diff --git a/.github/workflows/postgres-lifecycle.yml b/.github/workflows/postgres-lifecycle.yml index 781fe2469..0aacbfff9 100644 --- a/.github/workflows/postgres-lifecycle.yml +++ b/.github/workflows/postgres-lifecycle.yml @@ -26,17 +26,19 @@ jobs: with: toolchain: 1.97.1 - name: Start TLS PostgreSQL - run: docker compose -f product/stores/auths-stores/tests/postgres_tls/compose.yaml up -d --wait + run: | + mkdir -p target/test-support/auths-stores/postgres-tls + docker compose -f product/stores/auths-stores/tests/postgres_tls/compose.yaml up -d --wait - name: Run multi-host lifecycle evidence env: AUTHS_POSTGRES_URL: host=localhost port=55438 dbname=auths_lifecycle user=auths password=local-fixture-password sslmode=require - AUTHS_POSTGRES_CA_PEM: ${{ github.workspace }}/product/stores/auths-stores/tests/postgres_tls/generated/ca.crt + AUTHS_POSTGRES_CA_PEM: ${{ github.workspace }}/target/test-support/auths-stores/postgres-tls/ca.crt AUTHS_POSTGRES_SERVER_NAME: localhost run: cargo test -p auths-stores --test postgres_lifecycle -- --ignored - name: Run gateway attempt-store conformance and hostile suites env: AUTHS_POSTGRES_URL: host=localhost port=55438 dbname=auths_lifecycle user=auths password=local-fixture-password sslmode=require - AUTHS_POSTGRES_CA_PEM: ${{ github.workspace }}/product/stores/auths-stores/tests/postgres_tls/generated/ca.crt + AUTHS_POSTGRES_CA_PEM: ${{ github.workspace }}/target/test-support/auths-stores/postgres-tls/ca.crt AUTHS_POSTGRES_SERVER_NAME: localhost run: | cargo test -p auths-gateway --lib -- --ignored postgres diff --git a/.gitleaksignore b/.gitleaksignore index ef57bf711..30b30a557 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -82,3 +82,9 @@ d92064d919b7c2498ce62588ff48a82284f0bcd7:formal/proof-coverage-v1.json:generic-a # Ordinary progress prose triggered the generic key rule. The current prose # avoids the ambiguous wording; no credential occurred in the historical line. 3e9704b5d4d12bc654fc48de9b03ab6adb9fcb41:docs/PROGRAM_BOARD.md:generic-api-key:477 + +# Public upstream function/type identifiers in the immutable Aeneas template: +# ed25519_dalek::VerifyingKey::verify_strict and its typed arguments, no key +# bytes or credential. This template is inventoried but never compiled; the +# separate explicit implementation interface has no global crypto axiom. +92606918fdb9b6e5163f2e59d210a852004c1e30:formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean:generic-api-key:61 diff --git a/Cargo.lock b/Cargo.lock index aca959af0..9d89ceb91 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5530,9 +5530,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "log", diff --git a/Cargo.toml b/Cargo.toml index 2ad2eec94..b034233be 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -261,7 +261,7 @@ reqwest = { version = "0.13.4", default-features = false, features = ["blocking" postgres = { version = "0.19.12", default-features = false } r2d2 = "0.8.10" r2d2_postgres = "0.18.2" -rustls = { version = "0.23.45", default-features = false, features = ["ring", "std", "tls12"] } +rustls = { version = "0.23.46", default-features = false, features = ["ring", "std", "tls12"] } rustix = { version = "1.1.4", default-features = false, features = ["fs", "net", "process"] } seccompiler = "0.5.0" zeroize = { version = "1.9.0", features = ["derive"] } diff --git a/README.md b/README.md index 6fcd11ac1..45f98f606 100644 --- a/README.md +++ b/README.md @@ -71,15 +71,15 @@ own test key. verifiers agree on a shared corpus of test vectors. - **Proof coverage, measured.** - 110 of 1,031 decision-scope functions (10.7%) and 1,289 of 11,353 code lines - (11.4%) are translated to Lean and reached from audited theorem statements, - and 15 of 82 kernel check sites map only to such functions. The rest of the - decision path, including the staged verifier control flow, the composition - evaluator, the registry handlers, the codec, and the signature suites, is - tested, not proved. For K-of-N approval the proofs cover the approval count - and per-approver verdict functions and the requirement attenuation law, not - the verifier step that classifies each approval (binding, window, signature, - status). Figures, method, and what they do not mean: + 134 of 1,047 decision-scope functions (12.8%) and 1,833 of 11,563 code lines + (15.9%) are translated to Lean and reached from audited theorem statements, + and 23 of 82 kernel check sites map only to such functions. The rest of the + decision path, including the staged verifier control flow, the registry + handlers, and the codec, is tested, not proved. For K-of-N approval the proofs + cover the approval count and per-approver verdict functions and the + requirement attenuation law, not the verifier step that classifies each + approval (binding, window, signature, status). Figures, method, and what they + do not mean: [`docs/assurance/PROOF_COVERAGE.md`](docs/assurance/PROOF_COVERAGE.md). diff --git a/architecture/dependency-graph.json b/architecture/dependency-graph.json index 6ee389cb2..027a004ce 100644 --- a/architecture/dependency-graph.json +++ b/architecture/dependency-graph.json @@ -1786,7 +1786,7 @@ "target": "minicbor", "target_layer": null, "scope": "external", - "kind": "normal", + "kind": "dev", "target_condition": null, "optional": false, "default_features": false, diff --git a/bindings/fixtures/qualification/schema-vectors.json b/bindings/fixtures/qualification/schema-vectors.json index f8db5468e..4f9b614e4 100644 --- a/bindings/fixtures/qualification/schema-vectors.json +++ b/bindings/fixtures/qualification/schema-vectors.json @@ -23,9 +23,9 @@ "trust_root": "{\"public_key_b64\":\"0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc\",\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-trust-root/1\",\"signature_suite\":\"ed25519-v1\"}", "signer_certificate": "{\"root_signature_b64\":\"obGs_sPHvOXfTu8emdHu3odSbdq3PEW0XwoKhrOSb1LQTgq9LOvFPrRcuhE6Tis01Ac9ndvtGQiey6UWh0MmBg\",\"statement\":{\"issued_at\":1789913600,\"not_after\":1805465600,\"not_before\":1789913600,\"permitted_artifact_kinds\":[\"qualification-release-index\",\"recipe-qualification-attestation\"],\"public_key_b64\":\"oJql9HpnWYAv-VX43C0qFKXJnSO-l_hkEn_5ODRVpPA\",\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-signer-certificate/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\",\"signer_kind\":\"protected-software-release-key-v1\"}}", "revocation_list": "{\"root_signature_b64\":\"nVaEVMHFGD_kiB0SIdz3uK3Xh0YlYrUJY-PRkV7_sCAc6mGs39yQxxGsiShFyuVrE_NxGHNnX40Lg6mi_w_hAw\",\"statement\":{\"issued_at\":1789996400,\"next_update\":1790255600,\"revoked_qualifications\":[],\"revoked_signers\":[],\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-revocation-list/1\",\"sequence\":7}}", - "release_index": "{\"signature_b64\":\"qLnnKRCjNPMQ4E4htzwihMF_RcLGUtZ-QpmUc0xvAf9So4UwLqsqnQ8iE7KQDBPiDDEaT2tXMdXo8UJx7BKoCw\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", - "record": "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}", - "attestation": "{\"signature_b64\":\"RNvz-GVoozTJulLOMogzaDjwNMmNJIciII7dGyYiqv7CLXqD7OeqqnmO4COD_-YI7CtUTuT50ARNLDOYx6HOAw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "release_index": "{\"signature_b64\":\"F7krnKivn9TcWHofcVVSdWU9Z2aOnXMk6el8gB2gzYNCTICqwWJR264PBZ1AHlb5H89iS_SCG5BXDy4voHKtDA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "record": "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}", + "attestation": "{\"signature_b64\":\"WpEYcoyaUemj_FqmxTAi3TcdOE6gYEzBn4SF5UAT9cRxGvjngon9UxxryrSY8_9Y2KKosaERfQynLeTKGiprCw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", "provider_contract": "{\"api_release\":\"2026-09-01.fixture\",\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"declarations\":{\"idempotency_sha256\":\"d6ee51b4b1b7adbf404892f9326dd33a8d42047c0d7592aa8366ad4fcf99a300\",\"observation_sha256\":\"41eecb260924ac4b305313888b59325a24161b0c9d60ecda92ab26bc10e3fbf5\",\"recovery_sha256\":\"871f9dded4942ff0262f147ca7fd4992b38da2741bac401abf3cd8dc43d4d2d3\",\"retention_sha256\":\"5e783fc5c0cf8950b44fd3095ff0679df34660600d0e7a59cedb2084e850aec7\"},\"environment_class\":\"provider-test-mode\",\"manual_assumptions\":[\"a refund of a refunded payment is rejected, not repeated\",\"the idempotency key is honored for at least 24 hours\"],\"openapi_slice_sha256\":\"b11c8865e81ede17d33a255a677549fa87ba045c67077495b8749fc5455c0b2f\",\"oracle_version\":\"oracle-1\",\"provider\":\"example-payments\",\"schema\":\"auths.provider-contract/1\"}" }, "provider_contract_id": "f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d", @@ -511,21 +511,21 @@ "artifact": "record", "class": "non-canonical", "reason": "non-canonical", - "text": "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}\n" + "text": "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}\n" }, { "id": "record-exponent-time", "artifact": "record", "class": "non-canonical", "reason": "malformed", - "text": "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1.7899928e9,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}" + "text": "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1.7899928e9,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}" }, { "id": "record-repeated-member", "artifact": "record", "class": "non-canonical", "reason": "malformed", - "text": "{\"schema\":\"auths.recipe-qualification/1\",\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}" + "text": "{\"schema\":\"auths.recipe-qualification/1\",\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}" }, { "id": "certificate-hardware-signer-kind", @@ -833,14 +833,14 @@ "pointer": "/statement/entries", "value": [ { - "attestation_sha256": "00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82", + "attestation_sha256": "8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b", "qualification_id": "qlf_01010101010101010101010101010101", - "record_sha256": "e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a" + "record_sha256": "3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd" }, { - "attestation_sha256": "00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82", + "attestation_sha256": "8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b", "qualification_id": "qlf_01010101010101010101010101010101", - "record_sha256": "e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a" + "record_sha256": "3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd" } ] } @@ -858,9 +858,9 @@ "count": 257, "width": 32, "template": { - "attestation_sha256": "00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82", + "attestation_sha256": "8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b", "qualification_id": "qlf_{}", - "record_sha256": "e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a" + "record_sha256": "3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd" } } ] diff --git a/bindings/fixtures/qualification/verification-vectors.json b/bindings/fixtures/qualification/verification-vectors.json index 62d5ad446..fd62da145 100644 --- a/bindings/fixtures/qualification/verification-vectors.json +++ b/bindings/fixtures/qualification/verification-vectors.json @@ -50,12 +50,12 @@ "trust_root": "{\"public_key_b64\":\"0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc\",\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-trust-root/1\",\"signature_suite\":\"ed25519-v1\"}", "signer_certificate": "{\"root_signature_b64\":\"obGs_sPHvOXfTu8emdHu3odSbdq3PEW0XwoKhrOSb1LQTgq9LOvFPrRcuhE6Tis01Ac9ndvtGQiey6UWh0MmBg\",\"statement\":{\"issued_at\":1789913600,\"not_after\":1805465600,\"not_before\":1789913600,\"permitted_artifact_kinds\":[\"qualification-release-index\",\"recipe-qualification-attestation\"],\"public_key_b64\":\"oJql9HpnWYAv-VX43C0qFKXJnSO-l_hkEn_5ODRVpPA\",\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-signer-certificate/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\",\"signer_kind\":\"protected-software-release-key-v1\"}}", "revocation_list": "{\"root_signature_b64\":\"nVaEVMHFGD_kiB0SIdz3uK3Xh0YlYrUJY-PRkV7_sCAc6mGs39yQxxGsiShFyuVrE_NxGHNnX40Lg6mi_w_hAw\",\"statement\":{\"issued_at\":1789996400,\"next_update\":1790255600,\"revoked_qualifications\":[],\"revoked_signers\":[],\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-revocation-list/1\",\"sequence\":7}}", - "release_index": "{\"signature_b64\":\"qLnnKRCjNPMQ4E4htzwihMF_RcLGUtZ-QpmUc0xvAf9So4UwLqsqnQ8iE7KQDBPiDDEaT2tXMdXo8UJx7BKoCw\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "release_index": "{\"signature_b64\":\"F7krnKivn9TcWHofcVVSdWU9Z2aOnXMk6el8gB2gzYNCTICqwWJR264PBZ1AHlb5H89iS_SCG5BXDy4voHKtDA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", "records": [ - "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}" + "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}" ], "attestations": [ - "{\"signature_b64\":\"RNvz-GVoozTJulLOMogzaDjwNMmNJIciII7dGyYiqv7CLXqD7OeqqnmO4COD_-YI7CtUTuT50ARNLDOYx6HOAw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"WpEYcoyaUemj_FqmxTAi3TcdOE6gYEzBn4SF5UAT9cRxGvjngon9UxxryrSY8_9Y2KKosaERfQynLeTKGiprCw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], "deployment": { "recipe_family": "example-refund-v1", @@ -70,7 +70,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -91,14 +91,14 @@ "class": "valid", "replace": { "records": [ - "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}", - "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_02020202020202020202020202020202\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"aarch64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}" + "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}", + "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1797768800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_02020202020202020202020202020202\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"aarch64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}" ], "attestations": [ - "{\"signature_b64\":\"RNvz-GVoozTJulLOMogzaDjwNMmNJIciII7dGyYiqv7CLXqD7OeqqnmO4COD_-YI7CtUTuT50ARNLDOYx6HOAw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", - "{\"signature_b64\":\"1Hd7wDEt6bzoXwrcguCBXtcDy32fmhJRgKZVIG5iyFw-vVzLFAE06rP-p786NrT5nTepTF9DXwURduAeTvHSBQ\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_02020202020202020202020202020202\",\"record_sha256\":\"f4eee7e4a2af6f48d64102f768a9e056cf340d9be38cafde6808d8455785b7b7\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"WpEYcoyaUemj_FqmxTAi3TcdOE6gYEzBn4SF5UAT9cRxGvjngon9UxxryrSY8_9Y2KKosaERfQynLeTKGiprCw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "{\"signature_b64\":\"_E6upIbPHumyWVjZBeAs3wF_pwjiokZy0gMFD8PkPzJypu_4mbEdMlBlO2fhQ5vpOEh_JrgBQUKmSWrERb08Aw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_02020202020202020202020202020202\",\"record_sha256\":\"154c748f1fda0e7d97cc79bb64ce126daa879c33993b0afa67f88af382682e3b\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"rrIlocaWjnu0yGZqBctFItRCwBdsQACIBWypqxI4-DaRasCgyU0x354oFpqZT0HTcDQyh1cds1BrtMoslrhnDg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"},{\"attestation_sha256\":\"07660bc891d054fb560be8027aa9d74f489f74a347ede9818f826df7d42711a2\",\"qualification_id\":\"qlf_02020202020202020202020202020202\",\"record_sha256\":\"f4eee7e4a2af6f48d64102f768a9e056cf340d9be38cafde6808d8455785b7b7\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "release_index": "{\"signature_b64\":\"PpwJSY7n732459aPXuQE0nhAEoE831x4ObEy3UJYc91PISSJkno4S2dK9Sc2mSKnAj_ZIcqDMV48pwAa0hFUDQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"},{\"attestation_sha256\":\"0347ca6cfd561c9e1cf190937b658e3db4391e4dec0594362b5665e0d3c48415\",\"qualification_id\":\"qlf_02020202020202020202020202020202\",\"record_sha256\":\"154c748f1fda0e7d97cc79bb64ce126daa879c33993b0afa67f88af382682e3b\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", "deployment": { "recipe_family": "example-refund-v1", "compiled_recipe_sha256": "262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef", @@ -112,7 +112,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -154,9 +154,9 @@ "class": "forged", "replace": { "attestations": [ - "{\"signature_b64\":\"Rdvz-GVoozTJulLOMogzaDjwNMmNJIciII7dGyYiqv7CLXqD7OeqqnmO4COD_-YI7CtUTuT50ARNLDOYx6HOAw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"W5EYcoyaUemj_FqmxTAi3TcdOE6gYEzBn4SF5UAT9cRxGvjngon9UxxryrSY8_9Y2KKosaERfQynLeTKGiprCw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"CA6xsrEbfeBdNhtmWqR01vTD8Rh4tqH9xiKORfNaFa-URL_hS5mF3RqUA-6imag1YMvDcUEU2QLfqsmmu3dpBg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"53e358591892ff3a4733a7c685b5fcc5f36df1073c9813059f217ff28191fe18\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"gstQKaN_329H-IM1AIC81bbINma6jddesBZu3KBjyOmIZuGj9fHYl9ngobgj1YUYLPJMK2x6arDLnTRH8VhUCA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"f58b5ce0a7a3c471535e557d7d6bd5cc4adf97dc307dc4a0ed7f9a181f50dac4\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "candidate", @@ -169,7 +169,7 @@ "class": "forged", "replace": { "attestations": [ - "{\"signature_b64\":\"Byp9otAfoNdjUbZD0Fa0L3phBk8rgRCuRd4OwQdt0ja_anYDYlGYW9tBXAXCv6IX5uRWK_m5qh4RbJKQeHDaDA\",\"statement\":{\"issued_at\":1789992801,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"lgFGj1nFFiSRkZu2Jq5bHK9WVYsO-GZ4ba2IVU0R02XE9qn3LkAOKLFOeH9Ra41I7myx082uZ239YxauJFQVBw\",\"statement\":{\"issued_at\":1789992801,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ] }, "expect": { @@ -183,9 +183,9 @@ "class": "forged", "replace": { "attestations": [ - "{\"signature_b64\":\"xrJ1DFsrecZJ1w6RIfbOj1yQ9l-ZcrDRqHPZYP_Cqo1kj9G1Rc2FTRB6O05b_znhal3O9knMDlDpey-_hC4vBg\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"GUWYceUqDw8p20stIwTOXc_wuGgxT29imAD4Sco_t5IUFceKorukRSdPv4MQVKW-vGJtnsXLUyM1aU5PFw1NBQ\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"_5fxI4CUWG1x39gELCP_b6Tgh0TH_Slt2K9dd6PdCt8Hp7rMB9GLSmqIBCbVYxrZP2wE5RbXaIrZPmzmrt0OAg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8a24fea63afbe047524b68b394f957b8530a6fbbc78ad4defec2d39dd2a4de80\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"gMWeTFL0z6YX4Ewwzu1OQ-kE93EmeqkygiwI7vMDZ1HB-hIXW-EwZbU1rfjMpQciv8ArxonRF9nDUDxhPTiKAQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"9a266282eafd7311de55ee73c3a9d61d97686eaee3d365dd092e94ce5a6f8ac7\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "candidate", @@ -197,7 +197,7 @@ "id": "index-signature-forged", "class": "forged", "replace": { - "release_index": "{\"signature_b64\":\"qbnnKRCjNPMQ4E4htzwihMF_RcLGUtZ-QpmUc0xvAf9So4UwLqsqnQ8iE7KQDBPiDDEaT2tXMdXo8UJx7BKoCw\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"FrkrnKivn9TcWHofcVVSdWU9Z2aOnXMk6el8gB2gzYNCTICqwWJR264PBZ1AHlb5H89iS_SCG5BXDy4voHKtDA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "unqualified", @@ -209,7 +209,7 @@ "id": "index-signed-by-outsider", "class": "forged", "replace": { - "release_index": "{\"signature_b64\":\"1keFTCfs9mQxuQntTNOv_W9vqciC-oCRxxlVQrP2XpM23XoFBpxPEVPX25YGxZxGfByqeTTjvrzqEt8x5M0HCQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"pXqrlE-c_QkMVuKxDEFkaZ5xPkXCgNH2GCN5afzIeejtOcBP4vMNdyBwdMLsr3zUV1QnSJvsrrSeH_Lk3WxABA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "unqualified", @@ -294,9 +294,9 @@ "class": "forged", "replace": { "attestations": [ - "{\"signature_b64\":\"In_Pz4oSQhgTnbrScTBPACd3JNgcw7VDY4468cZMWvsjA-pzYcdCC_SGJHjaHn_LZ4FjVxd4Vv_8EOL41c4hDw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"another-signer\"}}" + "{\"signature_b64\":\"Rv7jMneOVEPB2DC5PsuJh9-UAID4nFlI1Y3S705lWuOVdHPG8ZKyvbcAobd-e53HWRvrQroy4eYYYvT7yr_SAg\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"another-signer\"}}" ], - "release_index": "{\"signature_b64\":\"PU3HBBhvW9glWplV0oZMyXhF56jPQagnXK9dXP_9IPNHLkNerKW02skNwEVq-YYiq5XZJb8wqsRYw5d32EBmCg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"b845e328d0333fefb98b407f35e2e7e0f23ad4cdcd2855f60ba858dc16c93b13\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"ksefSEsRRKU8M6176xy8cZm6gtLbTD0ShjT-wG_Tegm0PTxkcRG02YmW6wlbjSNf98BuLnQoCv9K22gmKodoDg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"7080a1a1cff7aa99fb84757ce9083e66f6e5947220e1890ded8c43a06b87da14\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "candidate", @@ -311,7 +311,7 @@ "attestations": [ "{\"signature_b64\":\"dU8UPdRvQ6Xr6xCtRvpnj5HT5oD_oPcTI1sc3fnHTzNL-eenyjjdJOq0-0wBZicAH4uVvsJV2LmcnPmcRaXXBQ\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"1bc3a22a5bba0537b35bcb4db6ec7a29fafb9deae8f5f964919628c38654c42d\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"C_W4OzY5dDjLR_EZAJYZqTKSJVJgs233eInKoc-aMIEPgO202P8lpu5echZJ7Yboh-_xZOegNojFccXqf2d-AQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"b349ee3d88adb475afa1ffabc89b76c010c1d890cc3ccf8ebe282f0e7cdece3f\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"SvgpIJYiHz8-HdRFw4Cy0ETIbiQt4R_T4Orc_BYB_D0qnvMMn4WnmVqHc30HfalrVaHuUlEdUC4VvHwI6zBbAA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"b349ee3d88adb475afa1ffabc89b76c010c1d890cc3ccf8ebe282f0e7cdece3f\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "candidate", @@ -324,12 +324,12 @@ "class": "widened-time-bound", "replace": { "records": [ - "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1795176800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/6\"}}}" + "{\"capabilities\":[{\"capability\":\"credential-guard\",\"result\":\"exercised\"},{\"capability\":\"version-pin\",\"result\":\"exercised\"},{\"capability\":\"account-binding\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"},{\"capability\":\"denied-reads\",\"result\":\"exercised\"},{\"capability\":\"ceiling\",\"result\":\"exercised\"},{\"capability\":\"budget\",\"result\":\"exercised\"},{\"capability\":\"idempotency\",\"result\":\"exercised\"},{\"capability\":\"response-locator\",\"result\":\"exercised\"},{\"capability\":\"echo\",\"result\":\"exercised\"},{\"capability\":\"observation\",\"result\":\"exercised\"},{\"capability\":\"recovery\",\"result\":\"exercised\"},{\"capability\":\"observer-rotation\",\"reason\":\"the qualified recipe and target declare none\",\"result\":\"not-applicable\"}],\"corpus_manifest_sha256\":\"d6c1cad9a6b0fe0fc27d1f8107c2381e8b9ab1bbfc04a47aa8234140de74a23f\",\"custody_descriptor\":\"aws-secrets-manager-v1 with workload identity\",\"evidence\":[{\"cases\":12,\"evidence_sha256\":\"c3a2a799eb04b1ee53a22495e0d95171a9f42f2ad557b639f3fe5440bbed90e7\",\"member\":\"conformance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"dfd5b5dccc73cae91abec7a76c332dae145eb37eddb18f56dca2e68f2dbc81ab\",\"member\":\"differential\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"a05d5182b4f20eb67c0d95622a70f1e4ac87d1d1b8b7fab219a2276b6da41256\",\"member\":\"hostile\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"00beb3d9e44f8d20d5da8861818ecd7b430714f959a6613dbd2d870997eb90f8\",\"member\":\"live\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"3a4e01d7b8d11480e334d0d2fffc2efeeaf2363d21f9107094c3cfc3c063b362\",\"member\":\"recovery\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"6b428d653e06c75268e2e33f234f30f9cc24616c42faf551699f7a7ac2376011\",\"member\":\"rotation\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"e8713a54bfb187836d4db2f34f181129f2e03f7221bc2d3247134470adcacee8\",\"member\":\"restart\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8824a7669543ecf652b651fa2d370c548e09b73c1babac841cd689389a1fdcbe\",\"member\":\"multi-instance\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"f31f29dc30a4e8ccd3aea69c012656c2811ac194881147b2cced5dd7dc1a7d9b\",\"member\":\"redaction\",\"result\":\"passed\",\"unauthorized_provider_entries\":0},{\"cases\":12,\"evidence_sha256\":\"8e91fde286bdbb80e6d6245e7ab9dab68f92e790922170195fc80aab2eeb227b\",\"member\":\"installed-consumer\",\"result\":\"passed\",\"unauthorized_provider_entries\":0}],\"excluded_claims\":[\"the provider performed or settled the business effect\"],\"generated_artifacts_sha256\":\"fff3ece48e4f5271825e80b355a1243a4c30619329bbbc70bc4e5c1b242973e2\",\"installed_packages\":[{\"name\":\"auths-gateway\",\"sha256\":\"8a58d99c69c098e53c2197df2c6a6a16b131c69798f728db134c978f77e95360\",\"version\":\"1.0.0-rc.1\"},{\"name\":\"auths-python\",\"sha256\":\"59b028e3e66e681bfa195fb6afee775b91f30fc418f05f86353bc71cd021d2f9\",\"version\":\"1.0.0rc1\"}],\"live_effects\":{\"confirmed_by_read_back\":4,\"entered\":4},\"not_after\":1795176800,\"not_before\":1789992800,\"provenance\":{\"commit\":\"0123456789abcdef0123456789abcdef01234567\",\"environment\":\"recipe-qualification\",\"repository\":\"github.com/auths-dev/auths-proof\",\"workflow\":\".github/workflows/recipe-qualification.yml\"},\"provider_kind\":\"example-payments\",\"provider_resources\":[\"refund:fixture-0001\",\"refund:fixture-0002\"],\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"recipe_decision_record_sha256\":\"0c2328dfcdc21fcd917fd242dd16f9adf1354395a472e589e2778dee99527081\",\"residual_assumptions\":[\"the provider keeps its test mode separate from live data\"],\"schema\":\"auths.recipe-qualification/1\",\"source_closure_sha256\":\"00023b3a6fbf90b531085365646cda2ffcac182f6eaedf453eb680b63ae33106\",\"store_descriptor\":\"postgresql 16 with TLS\",\"tuple\":{\"compiled_recipe_sha256\":\"262f5ef11b349645f2421c533220fc6bbfd70c4a5395f5d65c601406eba7d4ef\",\"gateway_semantic_closure_sha256\":\"01ec13346b098e4f5e1c64a995a50ce15ef339dc1f304966a45c94e80638203b\",\"profile_lock_sha256\":\"4dd8982feedb83403f985de3e1a952a90060e44035ab797e5313ff93957a22d5\",\"provider_contract_id\":\"f15f154a38de58de1b27c70c61a6b20fe532746e2e4462576dbd3d27d76cce3d\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.lifecycle.postgresql/7\"}}}" ], "attestations": [ - "{\"signature_b64\":\"llV5lBszVwmOYM3A6diwpACMWJ5B9H9sFvFfnthdn43G-Vv3jlMPEW1L6opboExmUFvpLvVrX85k5sh-y7mWDw\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"10cc5b9573f799fbe2edb24ca401950b782e399001276c2a6b010040154499dc\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"AwFLFc3BWQwkgabGaOOZ_Pl1I7kK2Vt0Fir3ngrKO-j3N_UnX61XoP7lxm26zdHuZVyUdH-CwTkQcFST2TZjBg\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"8c6d91168743e4833127e8121752d634bc99a5b50917c4fd91e14a751e2b1ab0\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"02dWO040SWUrdjFYAEGatWBeF4ISg4xINKvFWUG-q1lY2nN-pHRhyC4-qEib7YaWeSLuvfOFFr5CXuiyCkg8DQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"10dfac2b1176c1a877f5f2cba5ced11a6f2e38f1d634c3d7f764e1651997d568\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"10cc5b9573f799fbe2edb24ca401950b782e399001276c2a6b010040154499dc\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"AkvZARmRLyWHdBZDfe9h4C_RM6zKMy6Y_7ZAylwtfN7-WR6iNn_nwRmx4hn1AL8hJPueq1uLmCsFxjkgVcS6CQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"dccc035572444236f079312739837944911c39180153f2bbae76c009c4423e0e\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"8c6d91168743e4833127e8121752d634bc99a5b50917c4fd91e14a751e2b1ab0\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "candidate", @@ -342,9 +342,9 @@ "class": "not-yet-valid", "replace": { "attestations": [ - "{\"signature_b64\":\"xhMqiwUs1yCbR0ebhIO4hWPvROOx8HJVvQiAco5fKOF54wRuuJGH6hGsiNdbNPB4PdzsVE4CP8Ufv57b5fl8AQ\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1792595600,\"not_before\":1790003600,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"kdf21QMMuwNrnjH5blOc06QCr2mywsSLpic0dOcTbvOM0FBFG4L8wy55-VjRTJceoY36e1vXY-Meu-g-40SgBg\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1792595600,\"not_before\":1790003600,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"Ue5Ra0u17IlVF3otp4TbGtiJgnHSeHUx-RMC-EtR__PKqKA0Gtli-OFtmufJCwiPlK2MNgUGU1gh2KbbTLthBg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"0ec2dfd894f7b1809e61d1e9c86a67ad61e83cea5bc7924d12d1dcfc7693f15b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"FuutnsAO-NZvt8t4WXhw7E1U5QR-Ipp2QhxmIx64hcKBT5JEEugRnhCmuYMstSJeXKqD1chrsqImeSxx16hwCw\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"57fa5d84840f2c5e1b2de90041e2af75b10e234d2862d8802ee9cac9f680eb62\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "candidate", @@ -368,7 +368,7 @@ "id": "unusable-index-before-revocation", "class": "precedence", "replace": { - "release_index": "{\"signature_b64\":\"qbnnKRCjNPMQ4E4htzwihMF_RcLGUtZ-QpmUc0xvAf9So4UwLqsqnQ8iE7KQDBPiDDEaT2tXMdXo8UJx7BKoCw\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "release_index": "{\"signature_b64\":\"FrkrnKivn9TcWHofcVVSdWU9Z2aOnXMk6el8gB2gzYNCTICqwWJR264PBZ1AHlb5H89iS_SCG5BXDy4voHKtDA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", "revocation_list": "{\"root_signature_b64\":\"Oe8aY9Lt91XEvAJ86JGwNpAUwVl5WGvXfP3xvBIraeDWf8B0m0OPMVVmAp5WqglK8RDodbQ9g8CfDgAJI3coBg\",\"statement\":{\"issued_at\":1789996400,\"next_update\":1790255600,\"revoked_qualifications\":[\"qlf_01010101010101010101010101010101\"],\"revoked_signers\":[],\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-revocation-list/1\",\"sequence\":7}}" }, "expect": { @@ -426,9 +426,9 @@ "class": "precedence", "replace": { "attestations": [ - "{\"signature_b64\":\"xrJ1DFsrecZJ1w6RIfbOj1yQ9l-ZcrDRqHPZYP_Cqo1kj9G1Rc2FTRB6O05b_znhal3O9knMDlDpey-_hC4vBg\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"GUWYceUqDw8p20stIwTOXc_wuGgxT29imAD4Sco_t5IUFceKorukRSdPv4MQVKW-vGJtnsXLUyM1aU5PFw1NBQ\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"_5fxI4CUWG1x39gELCP_b6Tgh0TH_Slt2K9dd6PdCt8Hp7rMB9GLSmqIBCbVYxrZP2wE5RbXaIrZPmzmrt0OAg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8a24fea63afbe047524b68b394f957b8530a6fbbc78ad4defec2d39dd2a4de80\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "release_index": "{\"signature_b64\":\"gMWeTFL0z6YX4Ewwzu1OQ-kE93EmeqkygiwI7vMDZ1HB-hIXW-EwZbU1rfjMpQciv8ArxonRF9nDUDxhPTiKAQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"9a266282eafd7311de55ee73c3a9d61d97686eaee3d365dd092e94ce5a6f8ac7\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", "now": 1790255601 }, "expect": { @@ -442,9 +442,9 @@ "class": "precedence", "replace": { "attestations": [ - "{\"signature_b64\":\"xrJ1DFsrecZJ1w6RIfbOj1yQ9l-ZcrDRqHPZYP_Cqo1kj9G1Rc2FTRB6O05b_znhal3O9knMDlDpey-_hC4vBg\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"GUWYceUqDw8p20stIwTOXc_wuGgxT29imAD4Sco_t5IUFceKorukRSdPv4MQVKW-vGJtnsXLUyM1aU5PFw1NBQ\",\"statement\":{\"issued_at\":1789992800,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"_5fxI4CUWG1x39gELCP_b6Tgh0TH_Slt2K9dd6PdCt8Hp7rMB9GLSmqIBCbVYxrZP2wE5RbXaIrZPmzmrt0OAg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8a24fea63afbe047524b68b394f957b8530a6fbbc78ad4defec2d39dd2a4de80\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", + "release_index": "{\"signature_b64\":\"gMWeTFL0z6YX4Ewwzu1OQ-kE93EmeqkygiwI7vMDZ1HB-hIXW-EwZbU1rfjMpQciv8ArxonRF9nDUDxhPTiKAQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"9a266282eafd7311de55ee73c3a9d61d97686eaee3d365dd092e94ce5a6f8ac7\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}", "signer_certificate": "{\"root_signature_b64\":\"AzUQnJwFYUZzLtBZTs8b0R2kt6nvkhJoBbMttBXnyAP7dSk7rVfe7sZQxD4Laerbyc7jgH4yzz1dUWdEOfscDA\",\"statement\":{\"issued_at\":1787408000,\"not_after\":1789999999,\"not_before\":1787408000,\"permitted_artifact_kinds\":[\"qualification-release-index\",\"recipe-qualification-attestation\"],\"public_key_b64\":\"oJql9HpnWYAv-VX43C0qFKXJnSO-l_hkEn_5ODRVpPA\",\"root_id\":\"auths-qualification-root-1\",\"schema\":\"auths.qualification-signer-certificate/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\",\"signer_kind\":\"protected-software-release-key-v1\"}}" }, "expect": { @@ -472,7 +472,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -548,7 +548,7 @@ "id": "index-issued-ahead", "class": "future-issued-at", "replace": { - "release_index": "{\"signature_b64\":\"5taLptZFLigql-wheq4jrzJOZz6psUgXhzyzXzAgIuvuHx7bSgLdWS3PCFCMgooFSKE4-Z-IFgUbVISrNZngCA\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"00449fd858186bb6711b8697f6ea376b5c6a99ef79e0443c6ccc23a1a36e8c82\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1790000060,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"1uq26boBL0UHQZSn9lBnT3R61ZIfpbQ2RQ-nrtC5HM0PBbIkKbrkIcZzDll6OTRI9vjfV_apf8PoWD7hOCW0Ag\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"8f6949c5cdd736620e884c1d61939231657355fa170f25d835d0cb325fd6066b\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1790000060,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "stale", @@ -561,9 +561,9 @@ "class": "future-issued-at", "replace": { "attestations": [ - "{\"signature_b64\":\"1OYEnrP0APZgNIc9VFzQmKyYK-ltQO7ZjTduSVOzkNeQ0S8e2Ek4xFw2O3CyVfsajqVeHgDUPmDFsvWDBg-5Bw\",\"statement\":{\"issued_at\":1790000060,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "{\"signature_b64\":\"K_tNB3s_ibY38Q26cK8RIoG7SrYv58vSesGEZfDntKb7YvO7CI9M7QT5RJnQDbZ8cFsw4D9V5ohkxhCQsKJLDA\",\"statement\":{\"issued_at\":1790000060,\"not_after\":1797768800,\"not_before\":1789992800,\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\",\"schema\":\"auths.recipe-qualification-attestation/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" ], - "release_index": "{\"signature_b64\":\"QMiLn3BFlwLUUJctksJ9mbmwNJ8IEF5A1D-yy13oE2yuxvABWwZT-4Vw_N4onw1SrMY86a650H6xCqSUy9QNBQ\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"9d6bfaadd23e3be7ce7320fa6ad7779384a3187c7713856b5b12aa5728e86c32\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"e5495a2c95356229a778d6781860eed872090ac5f4b6ac447953d353a3592f7a\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" + "release_index": "{\"signature_b64\":\"JV3P-5Gtwgl_ldQ4NZ_VpNIh2U38g4zLpuc2GcA42pbFiE7-Fwo2sNzRzOLX9ljtPoQZCz7pAiL0cQfSU1mdBg\",\"statement\":{\"entries\":[{\"attestation_sha256\":\"495d11bbb7b5ee3bc7d795db990df7828ec06dfb337031dd66e68232fbd42bb3\",\"qualification_id\":\"qlf_01010101010101010101010101010101\",\"record_sha256\":\"3f787335aae239aa07f8d799d8e2ff83758a1d299f1dd3a92308dd73ebafc5fd\"}],\"issued_at\":1789996400,\"schema\":\"auths.qualification-release-index/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"release-signer-2026-10\"}}" }, "expect": { "state": "stale", @@ -637,7 +637,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } }, @@ -740,7 +740,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -768,7 +768,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -796,7 +796,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -824,7 +824,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -852,7 +852,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -880,7 +880,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -908,7 +908,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -936,7 +936,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -964,7 +964,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "245f158f0e08031548685ae415e98194feb1831db12f4563ecd7ab15b2630651", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -992,7 +992,7 @@ "gateway_version": "1.0.0-rc.2", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -1020,7 +1020,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "shared-file-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "aws-secrets-manager-v1" } } @@ -1076,7 +1076,7 @@ "gateway_version": "1.0.0-rc.1", "gateway_build_sha256": "42194bc83fbd821aaede008519091b4516baf914f8c2e27f3f2ac7a25f7485c3", "store_kind": "postgresql-v1", - "store_schema": "auths.lifecycle.postgresql/6", + "store_schema": "auths.lifecycle.postgresql/7", "credential_store_kind": "local-file-v1" } } diff --git a/bindings/independent/go/auths/adapters.go b/bindings/independent/go/auths/adapters.go index d79a2a7e8..224eb87cc 100644 --- a/bindings/independent/go/auths/adapters.go +++ b/bindings/independent/go/auths/adapters.go @@ -337,6 +337,9 @@ func decodeMultikey(encoded string) ([]byte, string, error) { } switch { case decoded[0] == 0xed && decoded[1] == 0x01 && len(decoded) == 34: + if !canonicalEd25519Encoding(decoded[2:]) { + return nil, "", errors.New("invalid Ed25519 multikey") + } return decoded[2:], "ed25519-v1", nil case decoded[0] == 0x80 && decoded[1] == 0x24 && len(decoded) == 35: if _, ok := p256PublicKey(decoded[2:]); !ok { diff --git a/bindings/independent/go/auths/ed25519_encoding.go b/bindings/independent/go/auths/ed25519_encoding.go new file mode 100644 index 000000000..6a7edd2f4 --- /dev/null +++ b/bindings/independent/go/auths/ed25519_encoding.go @@ -0,0 +1,50 @@ +package auths + +import "math/big" + +// canonicalEd25519Encoding implements RFC 8032 section 5.1.3's field/sign +// form. It does not replace curve-point or signature verification. +func canonicalEd25519Encoding(raw []byte) bool { + if len(raw) != 32 { + return false + } + encoded := make([]byte, 32) + for i := range raw { + encoded[31-i] = raw[i] + } + negative := encoded[0]&0x80 != 0 + encoded[0] &= 0x7f + ordinate := new(big.Int).SetBytes(encoded) + prime := new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(19)) + orderTwo := new(big.Int).Sub(new(big.Int).Set(prime), big.NewInt(1)) + return ordinate.Cmp(prime) < 0 && (!negative || (ordinate.Cmp(big.NewInt(1)) != 0 && ordinate.Cmp(orderTwo) != 0)) +} + +// For a valid point, y=0 or ±1 has order dividing four; [2]P has y=0 +// exactly when d*y^4+2*y^2-1=0. Substituting RFC 8032's d=-121665/121666 +// gives the remaining order-eight cases, without decoding an x-coordinate. +// Point recovery and signature verification remain the crypto primitive. +func strictEd25519PointEncoding(raw []byte) bool { + if !canonicalEd25519Encoding(raw) { + return false + } + encoded := make([]byte, 32) + for i := range raw { + encoded[31-i] = raw[i] + } + encoded[0] &= 0x7f + y := new(big.Int).SetBytes(encoded) + prime := new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(19)) + orderTwo := new(big.Int).Sub(new(big.Int).Set(prime), big.NewInt(1)) + if y.Sign() == 0 || y.Cmp(big.NewInt(1)) == 0 || y.Cmp(orderTwo) == 0 { + return false + } + square := new(big.Int).Mul(y, y) + square.Mod(square, prime) + fourth := new(big.Int).Mul(square, square) + polynomial := new(big.Int).Mul(fourth, big.NewInt(121665)) + polynomial.Sub(polynomial, new(big.Int).Mul(square, big.NewInt(243332))) + polynomial.Add(polynomial, big.NewInt(121666)) + polynomial.Mod(polynomial, prime) + return polynomial.Sign() != 0 +} diff --git a/bindings/independent/go/auths/ed25519_encoding_test.go b/bindings/independent/go/auths/ed25519_encoding_test.go new file mode 100644 index 000000000..ba65f4331 --- /dev/null +++ b/bindings/independent/go/auths/ed25519_encoding_test.go @@ -0,0 +1,82 @@ +package auths + +import ( + "math/big" + "testing" +) + +func coordinateEncoding(value *big.Int, negative bool) []byte { + encoded := make([]byte, 32) + value.FillBytes(encoded) + for left, right := 0, 31; left < right; left, right = left+1, right-1 { + encoded[left], encoded[right] = encoded[right], encoded[left] + } + if negative { + encoded[31] |= 128 + } + return encoded +} + +func TestEd25519CanonicalEncodingBoundaries(t *testing.T) { + prime := new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(19)) + for offset := int64(0); offset < 19; offset++ { + value := new(big.Int).Add(prime, big.NewInt(offset)) + for _, negative := range []bool{false, true} { + if canonicalEd25519Encoding(coordinateEncoding(value, negative)) { + t.Fatal("out-of-field coordinate accepted") + } + } + } + for _, value := range []*big.Int{big.NewInt(1), new(big.Int).Sub(prime, big.NewInt(1))} { + if !canonicalEd25519Encoding(coordinateEncoding(value, false)) { + t.Fatal("canonical boundary refused") + } + if canonicalEd25519Encoding(coordinateEncoding(value, true)) { + t.Fatal("negative zero accepted") + } + } + if !canonicalEd25519Encoding(coordinateEncoding(big.NewInt(0), true)) { + t.Fatal("nonzero-x sign choice refused") + } + for _, length := range []int{0, 31, 33} { + if canonicalEd25519Encoding(make([]byte, length)) { + t.Fatal("incorrect width accepted") + } + } +} + +func TestEd25519StrictRejectsWeakSignature(t *testing.T) { + prime := new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(19)) + for _, value := range []*big.Int{big.NewInt(0), big.NewInt(1), new(big.Int).Sub(prime, big.NewInt(1))} { + for _, negative := range []bool{false, true} { + if strictEd25519PointEncoding(coordinateEncoding(value, negative)) { + t.Fatal("small-order point accepted") + } + } + } + identity := coordinateEncoding(big.NewInt(1), false) + signature := make([]byte, 64) + signature[0] = 1 + if verifySignature("ed25519-v1", identity, []byte("unrelated message"), signature) { + t.Fatal("a weak key and R must not authenticate an arbitrary message") + } +} + +func TestEd25519OrderEightPointsAreExcluded(t *testing.T) { + prime := new(big.Int).Sub(new(big.Int).Lsh(big.NewInt(1), 255), big.NewInt(19)) + y, ok := new(big.Int).SetString("55188659117513257062467267217118295137698188065244968500265048394206261417927", 10) + if !ok { + t.Fatal("public torsion coordinate") + } + for _, value := range []*big.Int{y, new(big.Int).Sub(prime, y)} { + for _, negative := range []bool{false, true} { + encoded := coordinateEncoding(value, negative) + if !canonicalEd25519Encoding(encoded) { + t.Fatal("canonical torsion form refused") + } + if strictEd25519PointEncoding(encoded) { + t.Fatal("order-eight point accepted") + } + } + } +} diff --git a/bindings/independent/go/auths/p256_corpus_test.go b/bindings/independent/go/auths/p256_corpus_test.go new file mode 100644 index 000000000..df91e9be6 --- /dev/null +++ b/bindings/independent/go/auths/p256_corpus_test.go @@ -0,0 +1,54 @@ +package auths + +import ( + "encoding/hex" + "os" + "strings" + "testing" +) + +func TestPublishedP256CorpusAndStrictAuthsDerivations(t *testing.T) { + corpus, err := os.ReadFile("../../../../core/fixtures/crypto/p256-sha256-v1.tsv") + if err != nil { + t.Fatal(err) + } + cases, accepted := 0, 0 + keys := make(map[string]bool) + for _, line := range strings.Split(strings.TrimSuffix(string(corpus), "\n"), "\n") { + if strings.HasPrefix(line, "#") || strings.HasPrefix(line, "id\t") { + continue + } + fields := strings.Split(line, "\t") + if len(fields) != 6 { + t.Fatal("fixture fields") + } + name, result := fields[0], fields[4] + switch result { + case "ok", "invalid-key", "invalid-signature-encoding", "verification-failed": + default: + t.Fatalf("unknown fixture result: %s", result) + } + decode := func(value string) []byte { + valueBytes, err := hex.DecodeString(value) + if err != nil { + t.Fatal(err) + } + return valueBytes + } + key, message, signature := decode(fields[1]), decode(fields[2]), decode(fields[3]) + if verifySignature("p256-sha256-v1", key, message, signature) != (result == "ok") { + t.Errorf("signature verdict differs: %s", name) + } + if _, valid := p256PublicKey(key); valid != (fields[5] == "true") { + t.Errorf("key verdict differs: %s", name) + } + cases++ + if result == "ok" { + accepted++ + keys[fields[1]] = true + } + } + if cases != 653 || accepted != 173 || len(keys) != 98 { + t.Fatalf("incomplete corpus: %d cases, %d accepted, %d keys", cases, accepted, len(keys)) + } +} diff --git a/bindings/independent/go/auths/semantic.go b/bindings/independent/go/auths/semantic.go index f0500aa69..21cf2091d 100644 --- a/bindings/independent/go/auths/semantic.go +++ b/bindings/independent/go/auths/semantic.go @@ -1261,8 +1261,9 @@ func evidenceContent(object *evidenceObject) []byte { func verifySignature(suite string, key, message, signature []byte) bool { switch suite { case "ed25519-v1": - return len(key) == ed25519.PublicKeySize && + return strictEd25519PointEncoding(key) && len(signature) == ed25519.SignatureSize && + strictEd25519PointEncoding(signature[:32]) && ed25519.Verify(ed25519.PublicKey(key), message, signature) case "p256-sha256-v1": if len(signature) != 64 { diff --git a/bindings/independent/typescript/ed25519-encoding.test.ts b/bindings/independent/typescript/ed25519-encoding.test.ts new file mode 100644 index 000000000..6a0b58ddb --- /dev/null +++ b/bindings/independent/typescript/ed25519-encoding.test.ts @@ -0,0 +1,62 @@ +import assert from "node:assert/strict"; +import test from "node:test"; +import { canonicalEd25519Encoding, strictEd25519PointEncoding } from "./ed25519-encoding.ts"; + +function coordinate(value: bigint, negative = false): Uint8Array { + const bytes = new Uint8Array(32); + for (let index = 0; index < 32; index += 1) { + bytes[index] = Number(value & 255n); + value >>= 8n; + } + if (negative) bytes[31] = bytes[31]! | 128; + return bytes; +} + +test("RFC 8032 field and negative-zero boundaries", () => { + const prime = (1n << 255n) - 19n; + for (let offset = 0n; offset < 19n; offset += 1n) { + for (const negative of [false, true]) { + assert.equal(canonicalEd25519Encoding(coordinate(prime + offset, negative)), false); + } + } + for (const value of [1n, prime - 1n]) { + assert.equal(canonicalEd25519Encoding(coordinate(value)), true); + assert.equal(canonicalEd25519Encoding(coordinate(value, true)), false); + } + assert.equal(canonicalEd25519Encoding(coordinate(0n, true)), true); + for (const length of [0, 31, 33]) assert.equal(canonicalEd25519Encoding(new Uint8Array(length)), false); + assert.equal(canonicalEd25519Encoding(new Uint8Array([ + 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, + 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07, 0x3a, + 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, + 0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07, 0x51, 0x1a, + ])), true); +}); + +test("Auths strict verification excludes canonical small-order points", () => { + const prime = (1n << 255n) - 19n; + for (const value of [0n, 1n, prime - 1n]) { + for (const negative of [false, true]) { + assert.equal(strictEd25519PointEncoding(coordinate(value, negative)), false); + } + } + const publicKey = Uint8Array.from([ + 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, + 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07, 0x3a, + 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, + 0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07, 0x51, 0x1a, + ]); + assert.equal(strictEd25519PointEncoding(publicKey), true); +}); + +test("order-eight points are excluded for both sign choices", () => { + const prime = (1n << 255n) - 19n; + // Public torsion coordinate of Edwards25519, defined by RFC 8032's curve + // parameters. The two ordinates and two signs give its four order-eight points. + const y = 55188659117513257062467267217118295137698188065244968500265048394206261417927n; + for (const value of [y, prime - y]) for (const negative of [false, true]) { + const encoded = coordinate(value, negative); + assert.equal(canonicalEd25519Encoding(encoded), true); + assert.equal(strictEd25519PointEncoding(encoded), false); + } +}); diff --git a/bindings/independent/typescript/ed25519-encoding.ts b/bindings/independent/typescript/ed25519-encoding.ts new file mode 100644 index 000000000..5b942f62b --- /dev/null +++ b/bindings/independent/typescript/ed25519-encoding.ts @@ -0,0 +1,27 @@ +// RFC 8032 §5.1.3 compressed-coordinate/sign form. Curve and signature +// verification remain the selected cryptographic primitive's responsibility. +export function canonicalEd25519Encoding(raw: Uint8Array): boolean { + if (raw.length !== 32) return false; + const bigEndian = Uint8Array.from(raw).reverse(); + const negative = (bigEndian[0]! & 0x80) !== 0; + bigEndian[0] = bigEndian[0]! & 0x7f; + const ordinate = BigInt(`0x${Buffer.from(bigEndian).toString("hex")}`); + const prime = (1n << 255n) - 19n; + return ordinate < prime && (!negative || (ordinate !== 1n && ordinate !== prime - 1n)); +} + +// For a valid Edwards25519 point, y = 0, ±1 has order dividing four. +// The y-coordinate of [2]P is zero precisely when d*y^4 + 2*y^2 - 1 = 0. +// With d = -121665/121666, the polynomial below therefore identifies the +// remaining order-eight points. Point recovery and the signature equation +// still belong to the crypto primitive; this enforces Auths' strict rule. +export function strictEd25519PointEncoding(raw: Uint8Array): boolean { + if (!canonicalEd25519Encoding(raw)) return false; + const bigEndian = Uint8Array.from(raw).reverse(); + bigEndian[0] = bigEndian[0]! & 0x7f; + const y = BigInt(`0x${Buffer.from(bigEndian).toString("hex")}`); + const prime = (1n << 255n) - 19n; + if (y === 0n || y === 1n || y === prime - 1n) return false; + const square = y * y % prime; + return (121665n * square * square - 243332n * square + 121666n) % prime !== 0n; +} diff --git a/bindings/independent/typescript/p256-corpus.test.ts b/bindings/independent/typescript/p256-corpus.test.ts new file mode 100644 index 000000000..31b873ea2 --- /dev/null +++ b/bindings/independent/typescript/p256-corpus.test.ts @@ -0,0 +1,29 @@ +import assert from "node:assert/strict"; +import { readFileSync } from "node:fs"; +import test from "node:test"; +import { verifySignature } from "./semantic-verifier.ts"; + +test("published P-256 vectors and strict Auths derivations", () => { + const corpus = readFileSync(new URL("../../../core/fixtures/crypto/p256-sha256-v1.tsv", import.meta.url), "utf8"); + let cases = 0; + let accepted = 0; + const keys = new Set(); + for (const line of corpus.trimEnd().split("\n")) { + if (line.startsWith("#") || line.startsWith("id\t")) continue; + const fields = line.split("\t"); + assert.equal(fields.length, 6, "fixture fields"); + const [name, keyHex, messageHex, signatureHex, result] = fields; + assert.ok(["ok", "invalid-key", "invalid-signature-encoding", "verification-failed"].includes(result!)); + const decode = (hex: string): Uint8Array => { + assert.match(hex, /^(?:[0-9a-f]{2})*$/, "fixture hex"); + return Buffer.from(hex, "hex"); + }; + assert.equal(verifySignature("p256-sha256-v1", decode(keyHex!), decode(messageHex!), decode(signatureHex!)), + result === "ok", name); + cases += 1; + if (result === "ok") { accepted += 1; keys.add(keyHex!); } + } + assert.equal(cases, 653); + assert.equal(accepted, 173); + assert.ok(keys.size === 98, "positive coverage spans distinct keys"); +}); diff --git a/bindings/independent/typescript/semantic-verifier.ts b/bindings/independent/typescript/semantic-verifier.ts index 532245667..7555b1770 100644 --- a/bindings/independent/typescript/semantic-verifier.ts +++ b/bindings/independent/typescript/semantic-verifier.ts @@ -5,6 +5,7 @@ import { createPublicKey, verify as cryptoVerify, } from "node:crypto"; +import { canonicalEd25519Encoding, strictEd25519PointEncoding } from "./ed25519-encoding.ts"; import { readFileSync } from "node:fs"; import { dirname, join } from "node:path"; @@ -900,7 +901,9 @@ function multikey(encoded: string): { key: Uint8Array; suite: string } { if (!encoded.startsWith("z")) throw new Error("unsupported multibase"); const decoded = base58(encoded.slice(1)); if (decoded[0] === 0xed && decoded[1] === 0x01 && decoded.length === 34) { - return { key: decoded.slice(2), suite: "ed25519-v1" }; + const key = decoded.slice(2); + if (!canonicalEd25519Encoding(key)) throw new Error("invalid Ed25519 multikey"); + return { key, suite: "ed25519-v1" }; } if (decoded[0] === 0x80 && decoded[1] === 0x24 && decoded.length === 35) { const key = decoded.slice(2); @@ -1336,9 +1339,11 @@ function p256PublicKey(raw: Uint8Array): KeyObject | undefined { } } -function verifySignature(suite: string, key: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean { +export function verifySignature(suite: string, key: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean { if (suite === "ed25519-v1") { - return signature.length === 64 && cryptoVerify(null, message, ed25519PublicKey(key), signature); + return strictEd25519PointEncoding(key) && signature.length === 64 && + strictEd25519PointEncoding(signature.subarray(0, 32)) && + cryptoVerify(null, message, ed25519PublicKey(key), signature); } if (suite === "p256-sha256-v1") { if (signature.length !== 64) return false; diff --git a/compliance.toml b/compliance.toml index 20ab5a57e..71a176325 100644 --- a/compliance.toml +++ b/compliance.toml @@ -1600,7 +1600,7 @@ kind = "cargo" layer = "product" path = "product/runtime/auths-gateway" core_apis = ["auths-author", "auths-codec", "auths-did-keri", "auths-did-key", "auths-model", "auths-multikey", "auths-ports", "auths-raw-key", "auths-raw-key-core", "auths-registries", "auths-signature", "auths-verifier"] -protocol_versions = ["auths.gateway-execution-witness/1", "auths.gateway-commissioning-execution/1", "auths.gateway-commissioning-budget/1", "auths.qualification-commissioning-permit/2", "auths.qualification-commissioning-budget-key/1", "auths.qualification-commissioning-budget-binding/2", "auths.gateway-credential-journal/1", "auths.gateway-credential-collection/1", "auths.gateway-readiness/1", "auths.gateway-support-bundle/1", "auths.gateway-generation-floor/1", "auths.gateway-emergency-stop/1", "auths.gateway-installation/5", "auths.recipe-qualification/1", "auths.recipe-qualification-attestation/1", "auths.qualification-trust-root/1", "auths.qualification-signer-certificate/1", "auths.qualification-revocation-list/1", "auths.qualification-release-index/1", "auths.gateway-semantic-closure/1", "auths.qualification-verification-vectors/1", "auths.gateway-operator-attestation/1", "auths.gateway-admin-request/1", "auths.gateway-admin-response/1", "auths.gateway-connection/1", "auths.provider-connection/2", "auths.gateway-key-identity/1", "auths.lifecycle.transactional-store/4", "auths.gateway-recipe-source/2", "auths.gateway-compiled-recipe/2", "auths.gateway-recipe-review/2", "auths.gateway-recovery-capability/1", "auths.gateway-connection-descriptor/1", "auths.gateway-attempt/3", "auths.gateway-pre-entry/1", "auths.lifecycle.postgresql/6", "auths.gateway-echo/1", "auths.gateway-idempotency-key/1", "auths.gateway-observe/2", "auths.gateway-outcome/2", "auths.gateway-readback/1", "auths.self-hosted-profile-lock/1", "mcp-arguments-v1", "auths.gateway-audit-bundle/2", "auths.gateway-audit-report/3", "auths.gateway-counter-set/1", "auths.gateway-echo-verification/1", "auths.gateway-codes/1", "auths.gateway-production-codes/1", "auths.gateway-custody-vectors/1", "auths.gateway-outcome-vectors/1", "bounded-policy-commitment-v1", "auths.approval-response/1", "auths.gateway-bounded-count/2", "auths.gateway-bounded-sum/1", "auths.gateway.argument-ceiling-window-count/2", "auths.gateway.argument-ceiling-policy/2"] +protocol_versions = ["auths.gateway-execution-witness/1", "auths.gateway-commissioning-execution/1", "auths.gateway-commissioning-budget/1", "auths.qualification-commissioning-permit/2", "auths.qualification-commissioning-budget-key/1", "auths.qualification-commissioning-budget-binding/2", "auths.gateway-credential-journal/1", "auths.gateway-credential-collection/1", "auths.gateway-readiness/1", "auths.gateway-support-bundle/1", "auths.gateway-generation-floor/1", "auths.gateway-emergency-stop/1", "auths.gateway-installation/5", "auths.recipe-qualification/1", "auths.recipe-qualification-attestation/1", "auths.qualification-trust-root/1", "auths.qualification-signer-certificate/1", "auths.qualification-revocation-list/1", "auths.qualification-release-index/1", "auths.gateway-semantic-closure/1", "auths.qualification-verification-vectors/1", "auths.gateway-operator-attestation/1", "auths.gateway-admin-request/1", "auths.gateway-admin-response/1", "auths.gateway-connection/1", "auths.provider-connection/2", "auths.gateway-key-identity/1", "auths.lifecycle.transactional-store/5", "auths.gateway-recipe-source/2", "auths.gateway-compiled-recipe/2", "auths.gateway-recipe-review/2", "auths.gateway-recovery-capability/1", "auths.gateway-connection-descriptor/1", "auths.gateway-attempt/3", "auths.gateway-file-store/1", "auths.gateway-pre-entry/1", "auths.lifecycle.postgresql/7", "auths.gateway-echo/1", "auths.gateway-idempotency-key/1", "auths.gateway-observe/2", "auths.gateway-outcome/2", "auths.gateway-readback/1", "auths.self-hosted-profile-lock/1", "mcp-arguments-v1", "auths.gateway-audit-bundle/2", "auths.gateway-audit-report/3", "auths.gateway-counter-set/1", "auths.gateway-echo-verification/1", "auths.gateway-codes/1", "auths.gateway-production-codes/1", "auths.gateway-custody-vectors/1", "auths.gateway-outcome-vectors/1", "bounded-policy-commitment-v1", "auths.approval-response/1", "auths.gateway-bounded-count/2", "auths.gateway-bounded-sum/1", "auths.gateway.argument-ceiling-window-count/2", "auths.gateway.argument-ceiling-policy/2"] wire_objects = ["GatewayExecutionWitness", "CommissioningBudgetSnapshot", "CompiledRecipe", "ClosedProviderRequest", "ClosedCredentialReads", "RecipeReview", "RecoveryCapability", "GatewayAttemptSnapshot", "GatewayPreEntry", "GatewayRecordEntry", "GatewayConnectionDescriptor", "ConnectionRecord", "OperatorAttestation", "OperatorStatement", "GatewayAdminStatus", "GatewayEvidenceSummary", "GatewayObserveRequest", "GatewayObserveResult", "GatewayProviderEvidence", "GatewaySubmitResult", "SignedObservation", "ArgumentCeilingPolicy", "BoundedPolicyCommitment", "AuditReport", "ProviderResult", "AuditedPreEntry", "EchoVerification", "AdminRequestCommand", "ListedValues"] fixture_suites = ["bindings/fixtures/approval", "bindings/fixtures/gateway", "bindings/fixtures/qualification"] principal_families = ["raw-key-v1", "did-key-v1", "did-keri-v1"] @@ -1608,7 +1608,7 @@ signature_families = ["ed25519-v1", "p256-sha256-v1"] profiles = ["auths.mcp/2"] transports = ["bounded-https", "postgresql-tls", "loopback-http-development"] configuration_inputs = ["commissioning-witness-file", "commissioning-binding", "commissioning-permit", "retained-commissioning-budget-floor", "operator-approved-recipe", "profile-lock", "independently-provisioned-trust", "connection-binding", "observer-anchor", "observer-signing-key", "deployment-kind", "operator-attestation", "app-capacity", "development-shared-file-store", "postgresql-store-configuration", "audit-trust-and-observer-pins", "qualification-policy", "recipe-family", "provider-contract-id", "qualification-release-inputs", "deployment-clock"] -security_state = ["permanent-commissioning-consumption", "commissioning-revocation-and-time-floor", "durable-credential-cleanup-notes", "host-generation-floor", "recipe-digest", "logical-operation-claims", "credential-reference-generation", "shared-connection-record", "credential-generation", "in-flight-entry-count", "echo-bound-provider-evidence", "observer-signing-seed", "custody-held-observer-key", "principal-separation", "key-identity-separation", "pre-entry-evidence", "relative-ceiling-basis", "gateway-record-batches", "link-subject-count-and-sum-slots", "verified-qualification-index", "remembered-revocations", "accepted-revocation-sequence", "gateway-semantic-closure"] +security_state = ["permanent-commissioning-consumption", "commissioning-revocation-and-time-floor", "durable-credential-cleanup-notes", "host-generation-floor", "recipe-digest", "logical-operation-claims", "credential-reference-generation", "shared-connection-record", "credential-generation", "in-flight-entry-count", "echo-bound-provider-evidence", "observer-signing-seed", "custody-held-observer-key", "principal-separation", "key-identity-separation", "pre-entry-evidence", "relative-ceiling-basis", "gateway-record-batches", "shared-collection-cutoff", "link-subject-count-and-sum-slots", "verified-qualification-index", "remembered-revocations", "accepted-revocation-sequence", "gateway-semantic-closure"] [packages.auths-gateway.claims] operational-diagnostics = [ @@ -1803,6 +1803,7 @@ stateful-replay-budget-component = [ "product/runtime/auths-gateway/src/scenario_tests.rs#normal_write_reaches_observed_by_provider_with_secret_free_evidence", "product/runtime/auths-gateway/src/scenario_tests.rs#a_lost_claim_resends_the_same_idempotency_key", "product/runtime/auths-gateway/src/scenario_tests.rs#file_store_passes_attempt_store_conformance", + "product/runtime/auths-gateway/src/scenario_tests.rs#file_store_refuses_lost_or_invalid_collection_state", "product/runtime/auths-gateway/src/scenario_tests.rs#postgres_store_passes_attempt_store_conformance", "product/runtime/auths-gateway/src/scenario_tests.rs#postgres_record_scenarios_drive_the_counting_provider", "product/runtime/auths-gateway/src/scenario_tests.rs#a_file_batch_crashed_at_any_step_is_rolled_back", @@ -1936,7 +1937,7 @@ kind = "cargo" layer = "product" path = "product/stores/auths-stores" core_apis = ["auths-model"] -protocol_versions = ["auths-proof/v1", "auths.lifecycle.postgresql/6"] +protocol_versions = ["auths-proof/v1", "auths.lifecycle.transactional-store/5", "auths.lifecycle.postgresql/7"] wire_objects = ["AttestedDecisionReceipt", "AttestedExecutionReceipt", "LifecycleRecordV1", "GatewayRecordEntry"] fixture_suites = ["product/fixtures/v1/lifecycle"] principal_families = [] @@ -1944,7 +1945,7 @@ signature_families = [] profiles = [] transports = ["filesystem", "memory", "postgresql-tls"] configuration_inputs = ["budget-algebra", "capacity", "lifecycle-capacity-rule", "receipt-policy"] -security_state = ["budget-ledger", "gateway-attempt-records", "permanent-commissioning-budget-records", "lifecycle-records", "receipt-spool"] +security_state = ["budget-ledger", "shared-collection-cutoff", "gateway-attempt-records", "permanent-commissioning-budget-records", "lifecycle-records", "receipt-spool"] [packages.auths-stores.claims] receipt-producer-consumer = ["product/stores/auths-stores/src/lib.rs#local_spool_policy_persists_attested_receipt_on_primary_failure"] diff --git a/core/crates/auths-codec/Cargo.toml b/core/crates/auths-codec/Cargo.toml index 8906424af..fcd721201 100644 --- a/core/crates/auths-codec/Cargo.toml +++ b/core/crates/auths-codec/Cargo.toml @@ -14,10 +14,10 @@ std = ["auths-model/std"] [dependencies] auths-model.workspace = true -minicbor.workspace = true sha2.workspace = true [dev-dependencies] +minicbor.workspace = true proptest.workspace = true [lints] diff --git a/core/crates/auths-codec/src/approval.rs b/core/crates/auths-codec/src/approval.rs index 9425c58d1..b67b59e9a 100644 --- a/core/crates/auths-codec/src/approval.rs +++ b/core/crates/auths-codec/src/approval.rs @@ -1,6 +1,7 @@ //! Deterministic encoding of approval requirements, approver anchors, signed //! approvals, and reported approval satisfactions. +use crate::cbor::Decoder; use crate::{ CodecError, decode::{ @@ -22,7 +23,6 @@ use auths_model::{ MAX_SIGNED_APPROVAL_BYTES, MediaType, PrincipalId, PrincipalMethodId, ProtocolVersion, SignatureDescriptor, SignedApproval, Timestamp, ValidityWindow, VerifierLimits, }; -use minicbor::Decoder; fn timestamp(decoder: &mut V1Decoder<'_>) -> Result { Ok(Timestamp::new( @@ -241,7 +241,7 @@ pub(crate) fn encode_approval_statement_to( if let Some(attributes) = statement.attributes() { bytes(encoder, attributes.as_bytes())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } encode_key(encoder, 9)?; encode_text(encoder, statement.audience().as_str())?; diff --git a/core/crates/auths-codec/src/bounded_policy.rs b/core/crates/auths-codec/src/bounded_policy.rs index 4189b7763..ee9cdb5cd 100644 --- a/core/crates/auths-codec/src/bounded_policy.rs +++ b/core/crates/auths-codec/src/bounded_policy.rs @@ -1,5 +1,6 @@ //! Deterministic encoding of `bounded-policy-commitment-v1` extension bodies. +use crate::cbor::Decoder; use crate::{ CodecError, decode::{ @@ -17,7 +18,6 @@ use auths_model::{ MAX_BOUNDED_POLICY_BYTES, MAX_POLICY_CANONICALIZATION_BYTES, MAX_POLICY_IDENTIFIER_BYTES, PolicyCommitment, PolicyIdentifier, }; -use minicbor::Decoder; fn encode_commitment( encoder: &mut V1Encoder, @@ -80,7 +80,7 @@ pub fn encode_bounded_policy_commitment( if let Some(parent) = body.parent() { bytes(encoder, parent.as_bytes()) } else { - encoder.null().map_err(encode_error)?; + encoder.null(); Ok(()) } }) diff --git a/core/crates/auths-codec/src/cbor.rs b/core/crates/auths-codec/src/cbor.rs new file mode 100644 index 000000000..1ab938da8 --- /dev/null +++ b/core/crates/auths-codec/src/cbor.rs @@ -0,0 +1,442 @@ +//! The definite-length CBOR primitives used by the V1 codec. +//! +//! Object decoders still validate their schema and compare the final encoding +//! with the complete input. The primitive reader deliberately accepts wider +//! integer heads, as the previous tokenizer did: the enclosing canonical +//! comparison owns their stable `NonCanonical` result. + +use alloc::vec::Vec; + +/// A primitive failure; object codecs map it to their existing typed error. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) struct Error; + +fn malformed(_error: T) -> Error { + Error +} + +/// The wire categories inspected by the object decoder. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) enum Type { + U8, + U16, + U32, + U64, + Bytes, + String, + Null, + Other, +} + +/// One bounded CBOR head, without interpretation of its argument as a length. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) struct Head { + pub(crate) major: u8, + pub(crate) argument: u64, + pub(crate) next: usize, +} + +/// Reads at most eight argument bytes. Each byte is checked before use. +fn read_tail( + input: &[u8], + mut position: usize, + mut remaining: u8, + mut value: u64, +) -> Result<(u64, usize), Error> { + while remaining > 0 { + let byte = match input.get(position) { + Some(byte) => *byte, + None => return Err(Error), + }; + let Some(shifted) = value.checked_mul(256) else { + return Err(Error); + }; + value = match shifted.checked_add(u64::from(byte)) { + Some(value) => value, + None => return Err(Error), + }; + position += 1; + remaining -= 1; + } + Ok((value, position)) +} + +/// Decodes a definite CBOR head without allocating or reading a payload. +/// +/// On success `next` is at most `input.len()` and is one to nine bytes after +/// `position`. Reserved and indefinite heads are rejected. +pub(crate) fn read_head(input: &[u8], position: usize) -> Result { + let first = match input.get(position) { + Some(first) => *first, + None => return Err(Error), + }; + let additional = first % 32; + let start = position + 1; + let (argument, next) = if additional < 24 { + (u64::from(additional), start) + } else { + let width = match additional { + 24 => 1, + 25 => 2, + 26 => 4, + 27 => 8, + _ => return Err(Error), + }; + read_tail(input, start, width, 0)? + }; + Ok(Head { + major: first / 32, + argument, + next, + }) +} + +#[allow( + clippy::cast_possible_truncation, + reason = "Truncation deliberately selects the low eight bits of the shifted value" +)] +fn append_tail(mut output: Vec, value: u64, mut remaining: u8) -> Vec { + while remaining > 0 { + remaining -= 1; + output.push((value >> (u32::from(remaining) * 8)) as u8); + } + output +} + +/// Encodes the unique shortest head for one major type and unsigned argument. +#[allow( + clippy::cast_possible_truncation, + reason = "The inline branch proves the argument is at most 23 before narrowing it" +)] +pub(crate) fn encode_head(major: u8, argument: u64) -> Result, Error> { + if major > 7 { + return Err(Error); + } + let prefix = major * 32; + let mut output = Vec::with_capacity(9); + let width = if argument <= 23 { + output.push(prefix + argument as u8); + return Ok(output); + } else if argument <= 255 { + output.push(prefix + 24); + 1 + } else if argument <= 65_535 { + output.push(prefix + 25); + 2 + } else if argument <= 4_294_967_295 { + output.push(prefix + 26); + 4 + } else { + output.push(prefix + 27); + 8 + }; + Ok(append_tail(output, argument, width)) +} + +/// Borrowed, allocation-free cursor into one bounded object input. +pub(crate) struct Decoder<'a> { + input: &'a [u8], + position: usize, +} + +impl<'a> Decoder<'a> { + pub(crate) const fn new(input: &'a [u8]) -> Self { + Self { input, position: 0 } + } + + pub(crate) fn at(input: &'a [u8], position: usize) -> Result { + if position > input.len() { + return Err(Error); + } + Ok(Self { input, position }) + } + + pub(crate) const fn position(&self) -> usize { + self.position + } + + fn head(&mut self, major: u8) -> Result { + let head = read_head(self.input, self.position)?; + if head.major != major { + return Err(Error); + } + self.position = head.next; + Ok(head.argument) + } + + fn collection(&mut self, major: u8) -> Result, Error> { + if self.input.get(self.position) == Some(&((major << 5) | 31)) { + self.position += 1; + return Ok(None); + } + self.head(major).map(Some) + } + + pub(crate) fn map(&mut self) -> Result, Error> { + self.collection(5) + } + + pub(crate) fn array(&mut self) -> Result, Error> { + self.collection(4) + } + + pub(crate) fn u64(&mut self) -> Result { + self.head(0) + } + + pub(crate) fn u32(&mut self) -> Result { + self.u64()?.try_into().map_err(malformed) + } + + pub(crate) fn u16(&mut self) -> Result { + self.u64()?.try_into().map_err(malformed) + } + + pub(crate) fn u8(&mut self) -> Result { + self.u64()?.try_into().map_err(malformed) + } + + fn payload(&mut self, major: u8) -> Result<&'a [u8], Error> { + let length = usize::try_from(self.head(major)?).map_err(malformed)?; + let end = self.position.checked_add(length).ok_or(Error)?; + let bytes = self.input.get(self.position..end).ok_or(Error)?; + self.position = end; + Ok(bytes) + } + + pub(crate) fn bytes(&mut self) -> Result<&'a [u8], Error> { + self.payload(2) + } + + pub(crate) fn str(&mut self) -> Result<&'a str, Error> { + match core::str::from_utf8(self.payload(3)?) { + Ok(value) => Ok(value), + Err(_) => Err(Error), + } + } + + pub(crate) fn bool(&mut self) -> Result { + let value = match self.input.get(self.position) { + Some(244) => false, + Some(245) => true, + _ => return Err(Error), + }; + self.position += 1; + Ok(value) + } + + pub(crate) fn null(&mut self) -> Result<(), Error> { + if self.input.get(self.position) != Some(&246) { + return Err(Error); + } + self.position += 1; + Ok(()) + } + + pub(crate) fn datatype(&self) -> Result { + let first = self.input.get(self.position).ok_or(Error)?; + Ok(match *first { + 0..=24 => Type::U8, + 25 => Type::U16, + 26 => Type::U32, + 27 => Type::U64, + 64..=91 => Type::Bytes, + 96..=123 => Type::String, + 246 => Type::Null, + _ => Type::Other, + }) + } +} + +/// The V1 encoder writes only shortest, definite heads into its owned buffer. +pub(crate) struct Encoder { + output: Vec, +} + +impl Encoder { + pub(crate) const fn new(output: Vec) -> Self { + Self { output } + } + + pub(crate) fn into_writer(self) -> Vec { + self.output + } + + fn head(&mut self, major: u8, argument: u64) -> Result<(), Error> { + self.output + .extend_from_slice(&encode_head(major, argument)?); + Ok(()) + } + + pub(crate) fn map(&mut self, entries: u64) -> Result<(), Error> { + self.head(5, entries) + } + + pub(crate) fn array(&mut self, entries: u64) -> Result<(), Error> { + self.head(4, entries) + } + + pub(crate) fn u64(&mut self, value: u64) -> Result<(), Error> { + self.head(0, value) + } + + pub(crate) fn u32(&mut self, value: u32) -> Result<(), Error> { + self.u64(u64::from(value)) + } + + pub(crate) fn u16(&mut self, value: u16) -> Result<(), Error> { + self.u64(u64::from(value)) + } + + pub(crate) fn u8(&mut self, value: u8) -> Result<(), Error> { + self.u64(u64::from(value)) + } + + fn payload(&mut self, major: u8, bytes: &[u8]) -> Result<(), Error> { + self.head(major, u64::try_from(bytes.len()).map_err(malformed)?)?; + self.output.extend_from_slice(bytes); + Ok(()) + } + + pub(crate) fn bytes(&mut self, bytes: &[u8]) -> Result<(), Error> { + self.payload(2, bytes) + } + + pub(crate) fn str(&mut self, text: &str) -> Result<(), Error> { + self.payload(3, text.as_bytes()) + } + + pub(crate) fn bool(&mut self, value: bool) { + self.output.push(if value { 245 } else { 244 }); + } + + pub(crate) fn null(&mut self) { + self.output.push(246); + } +} + +#[cfg(test)] +mod tests { + use super::{Decoder, Encoder, encode_head, read_head}; + use alloc::{vec, vec::Vec}; + use proptest::prelude::*; + + proptest! { + #[test] + fn every_head_round_trips(major in 0_u8..=7, argument: u64) { + let bytes = encode_head(major, argument).unwrap(); + let head = read_head(&bytes, 0).unwrap(); + prop_assert_eq!(head.major, major); + prop_assert_eq!(head.argument, argument); + prop_assert_eq!(head.next, bytes.len()); + prop_assert!(bytes.len() <= 9); + let mut oracle = minicbor::Encoder::new(Vec::new()); + if major == 0 { + oracle.u64(argument).unwrap(); + prop_assert_eq!(&bytes, &oracle.into_writer()); + } + } + + #[test] + fn head_cursor_never_exceeds_input(input: Vec, position_seed: usize) { + let position = position_seed % (input.len() + 1); + if let Ok(head) = read_head(&input, position) { + prop_assert!(position < head.next); + prop_assert!(head.next <= input.len()); + prop_assert!(head.next - position <= 9); + } + } + + #[test] + fn byte_payload_matches_previous_codec(bytes: Vec) { + let mut encoder = Encoder::new(Vec::new()); + encoder.bytes(&bytes).unwrap(); + let wire = encoder.into_writer(); + let mut oracle = minicbor::Encoder::new(Vec::new()); + oracle.bytes(&bytes).unwrap(); + prop_assert_eq!(&wire, &oracle.into_writer()); + let mut decoder = Decoder::new(&wire); + prop_assert_eq!(decoder.bytes().unwrap(), bytes.as_slice()); + prop_assert_eq!(decoder.position(), wire.len()); + } + + #[test] + fn hostile_primitive_inputs_agree_with_previous_codec(input: Vec) { + prop_assert_eq!(Decoder::new(&input).u64().ok(), minicbor::Decoder::new(&input).u64().ok()); + prop_assert_eq!(Decoder::new(&input).u32().ok(), minicbor::Decoder::new(&input).u32().ok()); + prop_assert_eq!(Decoder::new(&input).u16().ok(), minicbor::Decoder::new(&input).u16().ok()); + prop_assert_eq!(Decoder::new(&input).u8().ok(), minicbor::Decoder::new(&input).u8().ok()); + prop_assert_eq!(Decoder::new(&input).map().ok(), minicbor::Decoder::new(&input).map().ok()); + prop_assert_eq!(Decoder::new(&input).array().ok(), minicbor::Decoder::new(&input).array().ok()); + prop_assert_eq!(Decoder::new(&input).bytes().ok(), minicbor::Decoder::new(&input).bytes().ok()); + prop_assert_eq!(Decoder::new(&input).str().ok(), minicbor::Decoder::new(&input).str().ok()); + prop_assert_eq!(Decoder::new(&input).bool().ok(), minicbor::Decoder::new(&input).bool().ok()); + prop_assert_eq!(Decoder::new(&input).null().ok(), minicbor::Decoder::new(&input).null().ok()); + } + } + + #[test] + fn every_integer_width_boundary_matches_previous_encoder() { + for value in [ + 0, + 23, + 24, + 255, + 256, + 65_535, + 65_536, + 4_294_967_295, + 4_294_967_296, + u64::MAX, + ] { + let encoded = encode_head(0, value).unwrap(); + let mut oracle = minicbor::Encoder::new(Vec::new()); + oracle.u64(value).unwrap(); + assert_eq!(encoded, oracle.into_writer()); + let head = read_head(&encoded, 0).unwrap(); + assert_eq!(head.argument, value); + assert_eq!(head.next, encoded.len()); + for length in 0..encoded.len() { + assert!(read_head(&encoded[..length], 0).is_err()); + } + } + assert!(read_head(&[0], usize::MAX).is_err()); + } + + #[test] + fn reserved_truncated_and_overflowing_inputs_fail() { + for additional in 28..=31 { + assert!(read_head(&[additional], 0).is_err()); + } + for (first, width) in [(24, 1), (25, 2), (26, 4), (27, 8)] { + for available in 0..width { + let mut bytes = vec![first]; + bytes.resize(available + 1, 0); + assert!(read_head(&bytes, 0).is_err()); + } + } + assert!( + Decoder::new(&[0x5b, 255, 255, 255, 255, 255, 255, 255, 255]) + .bytes() + .is_err() + ); + assert!(read_head(&[0], usize::MAX).is_err()); + } + + #[test] + fn primitive_reader_preserves_noncanonical_integer_detection_boundary() { + let mut decoder = Decoder::new(&[0x18, 0]); + assert_eq!(decoder.u8().unwrap(), 0); + assert_eq!(decoder.position(), 2); + assert_eq!(encode_head(0, 0).unwrap(), vec![0]); + } + + #[test] + fn text_and_simple_values_are_exact() { + assert!(Decoder::new(&[0x61, 0xff]).str().is_err()); + assert!(Decoder::new(&[0xf8, 20]).bool().is_err()); + assert!(!Decoder::new(&[0xf4]).bool().unwrap()); + assert!(Decoder::new(&[0xf5]).bool().unwrap()); + assert!(Decoder::new(&[0xf6]).null().is_ok()); + } +} diff --git a/core/crates/auths-codec/src/decode.rs b/core/crates/auths-codec/src/decode.rs index d63a2990b..34a398d77 100644 --- a/core/crates/auths-codec/src/decode.rs +++ b/core/crates/auths-codec/src/decode.rs @@ -1,5 +1,6 @@ //! Strict, bounded target V1 decoders. +use crate::cbor::{Decoder, Type}; use crate::{ CodecError, encode::{ @@ -33,10 +34,13 @@ use auths_model::{ VerificationMethod, VerificationResources, VerificationResultDigest, VerificationStage, VerifierConfigurationId, VerifierLimits, }; -use minicbor::{Decoder, data::Type}; pub(crate) type V1Decoder<'a> = Decoder<'a>; +fn decode_error(_error: T) -> CodecError { + CodecError::Malformed +} + pub(crate) fn map(decoder: &mut V1Decoder<'_>, expected: u64) -> Result<(), CodecError> { if decoder.map().unwrap_or(None) == Some(expected) { Ok(()) @@ -46,9 +50,9 @@ pub(crate) fn map(decoder: &mut V1Decoder<'_>, expected: u64) -> Result<(), Code } pub(crate) fn array(decoder: &mut V1Decoder<'_>, maximum: usize) -> Result { - let length = decoder.array().map_err(|_| CodecError::Malformed)?; + let length = decoder.array().map_err(decode_error)?; let length = length.ok_or(CodecError::Malformed)?; - let length = usize::try_from(length).map_err(|_| CodecError::LimitExceeded)?; + let length = usize::try_from(length).map_err(crate::error::limit_error)?; if length > maximum { return Err(CodecError::LimitExceeded); } @@ -56,7 +60,7 @@ pub(crate) fn array(decoder: &mut V1Decoder<'_>, maximum: usize) -> Result, expected: u64) -> Result<(), CodecError> { - if decoder.array().map_err(|_| CodecError::Malformed)? == Some(expected) { + if decoder.array().map_err(decode_error)? == Some(expected) { Ok(()) } else { Err(CodecError::Malformed) @@ -64,7 +68,7 @@ fn array_exact(decoder: &mut V1Decoder<'_>, expected: u64) -> Result<(), CodecEr } pub(crate) fn key(decoder: &mut V1Decoder<'_>, expected: u8) -> Result<(), CodecError> { - if decoder.u8().map_err(|_| CodecError::Malformed)? == expected { + if decoder.u8().map_err(decode_error)? == expected { Ok(()) } else { Err(CodecError::NonCanonical) @@ -72,7 +76,10 @@ pub(crate) fn key(decoder: &mut V1Decoder<'_>, expected: u8) -> Result<(), Codec } pub(crate) fn text<'a>(decoder: &mut V1Decoder<'a>) -> Result<&'a str, CodecError> { - decoder.str().map_err(|_| CodecError::Malformed) + match decoder.str() { + Ok(value) => Ok(value), + Err(_) => Err(CodecError::Malformed), + } } pub(crate) fn bounded_bytes( @@ -80,7 +87,9 @@ pub(crate) fn bounded_bytes( maximum: usize, non_empty: bool, ) -> Result, CodecError> { - let bytes = decoder.bytes().map_err(|_| CodecError::Malformed)?; + let Ok(bytes) = decoder.bytes() else { + return Err(CodecError::Malformed); + }; if bytes.len() > maximum || (non_empty && bytes.is_empty()) { return Err(CodecError::LimitExceeded); } @@ -88,19 +97,18 @@ pub(crate) fn bounded_bytes( } pub(crate) fn digest_bytes(decoder: &mut V1Decoder<'_>) -> Result<[u8; 32], CodecError> { - decoder - .bytes() - .map_err(|_| CodecError::Malformed)? - .try_into() - .map_err(|_| CodecError::Malformed) + let Ok(bytes) = decoder.bytes() else { + return Err(CodecError::Malformed); + }; + bytes.try_into().map_err(decode_error) } pub(crate) fn is_null(decoder: &V1Decoder<'_>) -> Result { - Ok(decoder.datatype().map_err(|_| CodecError::Malformed)? == Type::Null) + Ok(decoder.datatype().map_err(decode_error)? == Type::Null) } pub(crate) fn null(decoder: &mut V1Decoder<'_>) -> Result<(), CodecError> { - decoder.null().map_err(|_| CodecError::Malformed) + decoder.null().map_err(decode_error) } macro_rules! parse_text { @@ -120,7 +128,7 @@ fn profile_ref(decoder: &mut V1Decoder<'_>) -> Result { key(decoder, 0)?; let id = parse_text!(decoder, ProfileId)?; key(decoder, 1)?; - let version = decoder.u16().map_err(|_| CodecError::Malformed)?; + let version = decoder.u16().map_err(decode_error)?; ProfileRef::new(id, version).map_err(CodecError::from) } @@ -160,16 +168,16 @@ fn audiences( pub(crate) fn status_policy(decoder: &mut V1Decoder<'_>) -> Result { let entries = decoder .map() - .map_err(|_| CodecError::Malformed)? + .map_err(decode_error)? .ok_or(CodecError::Malformed)?; key(decoder, 0)?; - match decoder.u8().map_err(|_| CodecError::Malformed)? { + match decoder.u8().map_err(decode_error)? { 0 if entries == 1 => Ok(StatusPolicy::ExpiryOnly), 1 if entries == 3 => { key(decoder, 1)?; let method = parse_text!(decoder, StatusMethodId)?; key(decoder, 2)?; - let max_age = FreshnessLimit::new(decoder.u64().map_err(|_| CodecError::Malformed)?)?; + let max_age = FreshnessLimit::new(decoder.u64().map_err(decode_error)?)?; Ok(StatusPolicy::SnapshotRequired { method, max_age }) } _ => Err(CodecError::Malformed), @@ -181,7 +189,7 @@ fn budget(decoder: &mut V1Decoder<'_>) -> Result { key(decoder, 0)?; let algebra = parse_text!(decoder, BudgetAlgebraId)?; key(decoder, 1)?; - let value = decoder.u64().map_err(|_| CodecError::Malformed)?; + let value = decoder.u64().map_err(decode_error)?; Ok(BudgetCeiling::new(algebra, value)) } @@ -202,10 +210,10 @@ fn constraint( ) -> Result { let entries = decoder .map() - .map_err(|_| CodecError::Malformed)? + .map_err(decode_error)? .ok_or(CodecError::Malformed)?; key(decoder, 0)?; - match decoder.u8().map_err(|_| CodecError::Malformed)? { + match decoder.u8().map_err(decode_error)? { 0 if entries == 1 => Ok(ActionConstraint::AnyBody), 1 if entries == 2 => { key(decoder, 1)?; @@ -285,7 +293,7 @@ fn grant_statement( ) -> Result { map(decoder, 16)?; key(decoder, 0)?; - ProtocolVersion::new(decoder.u16().map_err(|_| CodecError::Malformed)?)?; + ProtocolVersion::new(decoder.u16().map_err(decode_error)?)?; key(decoder, 1)?; let issuer = parse_text!(decoder, PrincipalId)?; key(decoder, 2)?; @@ -293,16 +301,13 @@ fn grant_statement( key(decoder, 3)?; let profile_id = parse_text!(decoder, ProfileId)?; key(decoder, 4)?; - let profile = ProfileRef::new( - profile_id, - decoder.u16().map_err(|_| CodecError::Malformed)?, - )?; + let profile = ProfileRef::new(profile_id, decoder.u16().map_err(decode_error)?)?; key(decoder, 5)?; let permissions = permissions(decoder, limits)?; key(decoder, 6)?; - let not_before = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let not_before = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 7)?; - let expires_at = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let expires_at = Timestamp::new(decoder.u64().map_err(decode_error)?); let validity = ValidityWindow::new(not_before, expires_at)?; key(decoder, 8)?; let audiences = audiences(decoder, limits)?; @@ -311,7 +316,7 @@ fn grant_statement( key(decoder, 10)?; let budget_ceiling = optional_budget(decoder)?; key(decoder, 11)?; - let remaining_depth = decoder.u16().map_err(|_| CodecError::Malformed)?; + let remaining_depth = decoder.u16().map_err(decode_error)?; key(decoder, 12)?; let parent = if is_null(decoder)? { null(decoder)?; @@ -360,14 +365,11 @@ fn action_envelope( ) -> Result { map(decoder, 19)?; key(decoder, 0)?; - ProtocolVersion::new(decoder.u16().map_err(|_| CodecError::Malformed)?)?; + ProtocolVersion::new(decoder.u16().map_err(decode_error)?)?; key(decoder, 1)?; let profile_id = parse_text!(decoder, ProfileId)?; key(decoder, 2)?; - let profile = ProfileRef::new( - profile_id, - decoder.u16().map_err(|_| CodecError::Malformed)?, - )?; + let profile = ProfileRef::new(profile_id, decoder.u16().map_err(decode_error)?)?; key(decoder, 3)?; let body_media_type = parse_text!(decoder, MediaType)?; key(decoder, 4)?; @@ -384,9 +386,9 @@ fn action_envelope( key(decoder, 9)?; let challenge = Challenge::new(digest_bytes(decoder)?); key(decoder, 10)?; - let not_before = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let not_before = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 11)?; - let expires_at = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let expires_at = Timestamp::new(decoder.u64().map_err(decode_error)?); let validity = ValidityWindow::new(not_before, expires_at)?; key(decoder, 12)?; let actor = parse_text!(decoder, PrincipalId)?; @@ -452,10 +454,10 @@ fn authorization_plan( } let entries = decoder .map() - .map_err(|_| CodecError::Malformed)? + .map_err(decode_error)? .ok_or(CodecError::Malformed)?; key(decoder, 0)?; - match decoder.u8().map_err(|_| CodecError::Malformed)? { + match decoder.u8().map_err(decode_error)? { 0 if entries == 2 => { key(decoder, 1)?; Ok(AuthorizationPlan::proof(digest_id!(decoder, ProofRef)?)) @@ -475,7 +477,7 @@ fn authorization_plan( } 3 if entries == 3 => { key(decoder, 1)?; - let k = decoder.u16().map_err(|_| CodecError::Malformed)?; + let k = decoder.u16().map_err(decode_error)?; key(decoder, 2)?; let length = array(decoder, limits.get(LimitKind::PlanBranching))?; let mut members = Vec::with_capacity(length); @@ -511,7 +513,7 @@ pub(crate) fn evidence( fn statement_ref(decoder: &mut V1Decoder<'_>) -> Result { map(decoder, 2)?; key(decoder, 0)?; - let kind = decoder.u8().map_err(|_| CodecError::Malformed)?; + let kind = decoder.u8().map_err(decode_error)?; key(decoder, 1)?; match kind { 0 => Ok(StatementRef::Grant(digest_id!(decoder, GrantId)?)), @@ -550,24 +552,24 @@ fn principal_status_statement( ) -> Result { map(decoder, 9)?; key(decoder, 0)?; - ProtocolVersion::new(decoder.u16().map_err(|_| CodecError::Malformed)?)?; + ProtocolVersion::new(decoder.u16().map_err(decode_error)?)?; key(decoder, 1)?; let method = parse_text!(decoder, StatusMethodId)?; key(decoder, 2)?; let principal = parse_text!(decoder, PrincipalId)?; key(decoder, 3)?; - let state = match decoder.u8().map_err(|_| CodecError::Malformed)? { + let state = match decoder.u8().map_err(decode_error)? { 0 => PrincipalState::Active, 1 => PrincipalState::Revoked, 2 => PrincipalState::Superseded, _ => return Err(CodecError::Malformed), }; key(decoder, 4)?; - let sequence = decoder.u64().map_err(|_| CodecError::Malformed)?; + let sequence = decoder.u64().map_err(decode_error)?; key(decoder, 5)?; - let observed_at = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let observed_at = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 6)?; - let valid_until = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let valid_until = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 7)?; let issuer = parse_text!(decoder, PrincipalId)?; key(decoder, 8)?; @@ -603,24 +605,24 @@ fn grant_status_statement( ) -> Result { map(decoder, 9)?; key(decoder, 0)?; - ProtocolVersion::new(decoder.u16().map_err(|_| CodecError::Malformed)?)?; + ProtocolVersion::new(decoder.u16().map_err(decode_error)?)?; key(decoder, 1)?; let method = parse_text!(decoder, StatusMethodId)?; key(decoder, 2)?; let grant_id = digest_id!(decoder, GrantId)?; key(decoder, 3)?; - let state = match decoder.u8().map_err(|_| CodecError::Malformed)? { + let state = match decoder.u8().map_err(decode_error)? { 0 => GrantState::Active, 1 => GrantState::Revoked, 2 => GrantState::Superseded, _ => return Err(CodecError::Malformed), }; key(decoder, 4)?; - let sequence = decoder.u64().map_err(|_| CodecError::Malformed)?; + let sequence = decoder.u64().map_err(decode_error)?; key(decoder, 5)?; - let observed_at = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let observed_at = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 6)?; - let valid_until = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let valid_until = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 7)?; let issuer = parse_text!(decoder, PrincipalId)?; key(decoder, 8)?; @@ -657,15 +659,15 @@ fn attachment(decoder: &mut V1Decoder<'_>) -> Result) -> Result { - match decoder.u8().map_err(|_| CodecError::Malformed)? { + match decoder.u8().map_err(decode_error)? { 0 => Ok(auths_model::ParticipantRole::Root), 1 => Ok(auths_model::ParticipantRole::Intermediate), 2 => Ok(auths_model::ParticipantRole::Actor), @@ -854,19 +856,17 @@ fn assurance_policy( null(decoder)?; None } else { - Some(decoder.u16().map_err(|_| CodecError::Malformed)?) + Some(decoder.u16().map_err(decode_error)?) }; key(decoder, 6)?; let maximum_age = if is_null(decoder)? { null(decoder)?; None } else { - Some(FreshnessLimit::new( - decoder.u64().map_err(|_| CodecError::Malformed)?, - )?) + Some(FreshnessLimit::new(decoder.u64().map_err(decode_error)?)?) }; key(decoder, 7)?; - let quantifier = match decoder.u8().map_err(|_| CodecError::Malformed)? { + let quantifier = match decoder.u8().map_err(decode_error)? { 0 => AssuranceQuantifier::Any, 1 => AssuranceQuantifier::Every, _ => return Err(CodecError::Malformed), @@ -935,14 +935,14 @@ fn anchor(decoder: &mut V1Decoder<'_>, limits: &VerifierLimits) -> Result Result, CodecError> { let length = array(decoder, limits.get(LimitKind::RegistryEntries))?; let mut rules = Vec::with_capacity(length); - for _ in 0..length { - map(decoder, 4)?; - key(decoder, 0)?; - let method = parse_text!(decoder, StatusMethodId)?; - key(decoder, 1)?; - let issuer = parse_text!(decoder, PrincipalId)?; - key(decoder, 2)?; - let sequence_floor = decoder.u64().map_err(|_| CodecError::Malformed)?; - key(decoder, 3)?; - let scope = status_scope(decoder, limits)?; - rules.push(StatusTrustRule::new(method, issuer, sequence_floor, scope)); + let mut position = 0; + let mut failure = None; + while position < length && failure.is_none() { + match status_trust_rule(decoder, limits) { + Ok(rule) => rules.push(rule), + Err(error) => failure = Some(error), + } + position += 1; + } + match failure { + Some(error) => Err(error), + None => Ok(rules), } - Ok(rules) +} + +fn status_trust_rule( + decoder: &mut V1Decoder<'_>, + limits: &VerifierLimits, +) -> Result { + map(decoder, 4)?; + key(decoder, 0)?; + let method = parse_text!(decoder, StatusMethodId)?; + key(decoder, 1)?; + let issuer = parse_text!(decoder, PrincipalId)?; + key(decoder, 2)?; + let sequence_floor = decoder.u64().map_err(decode_error)?; + key(decoder, 3)?; + let scope = status_scope(decoder, limits)?; + Ok(StatusTrustRule::new(method, issuer, sequence_floor, scope)) } /// Reads `{0: 0}` (own), `{0: 1, 1: [ids]}` (listed anchors), or `{0: 2}` @@ -1059,29 +1075,42 @@ fn status_scope( ) -> Result { let entries = decoder .map() - .map_err(|_| CodecError::Malformed)? + .map_err(decode_error)? .ok_or(CodecError::Malformed)?; if !(1..=2).contains(&entries) { return Err(CodecError::Malformed); } key(decoder, 0)?; - let tag = decoder.u8().map_err(|_| CodecError::Malformed)?; + let tag = decoder.u8().map_err(decode_error)?; match (tag, entries) { (0, 1) => Ok(StatusScope::OwnAnchor), (1, 2) => { key(decoder, 1)?; let length = array(decoder, limits.get(LimitKind::TrustAnchors))?; let mut anchors = Vec::with_capacity(length); - for _ in 0..length { - anchors.push(parse_text!(decoder, TrustAnchorId)?); + let mut position = 0; + let mut failure = None; + while position < length && failure.is_none() { + match status_scope_anchor(decoder) { + Ok(anchor) => anchors.push(anchor), + Err(error) => failure = Some(error), + } + position += 1; + } + match failure { + Some(error) => Err(error), + None => Ok(StatusScope::Anchors(StatusScopeAnchors::new(anchors)?)), } - Ok(StatusScope::Anchors(StatusScopeAnchors::new(anchors)?)) } (2, 1) => Ok(StatusScope::AnyAnchor), _ => Err(CodecError::Malformed), } } +fn status_scope_anchor(decoder: &mut V1Decoder<'_>) -> Result { + parse_text!(decoder, TrustAnchorId) +} + fn principal_snapshot( decoder: &mut V1Decoder<'_>, limits: &VerifierLimits, @@ -1090,9 +1119,9 @@ fn principal_snapshot( key(decoder, 0)?; let id = digest_id!(decoder, StatusSnapshotId)?; key(decoder, 1)?; - let observed_at = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let observed_at = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 2)?; - let valid_until = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let valid_until = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 3)?; let length = array(decoder, limits.get(LimitKind::PrincipalStatusStatements))?; let mut statements = Vec::with_capacity(length); @@ -1122,9 +1151,9 @@ fn grant_snapshot( key(decoder, 0)?; let id = digest_id!(decoder, StatusSnapshotId)?; key(decoder, 1)?; - let observed_at = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let observed_at = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 2)?; - let valid_until = Timestamp::new(decoder.u64().map_err(|_| CodecError::Malformed)?); + let valid_until = Timestamp::new(decoder.u64().map_err(decode_error)?); key(decoder, 3)?; let length = array(decoder, limits.get(LimitKind::GrantStatusStatements))?; let mut statements = Vec::with_capacity(length); @@ -1174,14 +1203,14 @@ fn verifier_limits(decoder: &mut V1Decoder<'_>) -> Result) -> Result) -> Result) -> Result, + attachment_bytes: usize, + position: usize, +} + +fn attachment_batch_step( + input: &[u8], + limits: &VerifierLimits, + state: Result, +) -> Result { + let mut state = state?; + let Ok(mut decoder) = Decoder::at(input, state.position) else { + return Err(CodecError::Malformed); + }; + map(&mut decoder, 2)?; + key(&mut decoder, 0)?; + let digest = AttachmentDigest::new(digest_bytes(&mut decoder)?); + key(&mut decoder, 1)?; + let bytes = bounded_bytes(&mut decoder, limits.get(LimitKind::AttachmentBytes), true)?; + state.attachment_bytes = state + .attachment_bytes + .checked_add(bytes.len()) + .ok_or(CodecError::LimitExceeded)?; + if state.attachment_bytes > limits.get(LimitKind::AttachmentBytes) { + return Err(CodecError::LimitExceeded); + } + state + .attachments + .push(DetachedAttachment::new(digest, bytes)?); + + state.position = decoder.position(); + Ok(state) +} + +fn attachment_batch( + input: &[u8], + limits: &VerifierLimits, + position: usize, + mut remaining: usize, +) -> Result { + let mut state = Ok(AttachmentBatch { + attachments: Vec::with_capacity(remaining), + attachment_bytes: 0, + position, + }); + while remaining > 0 { + state = attachment_batch_step(input, limits, state); + remaining -= 1; + } + state +} + /// Decodes the complete portable canonical-action verifier input. /// /// # Errors @@ -1571,24 +1653,13 @@ pub fn decode_canonical_action( let requested_budget = optional_budget(&mut decoder)?; key(&mut decoder, 5)?; let count = array(&mut decoder, limits.get(LimitKind::Attachments))?; - let mut attachments = Vec::with_capacity(count); - let mut attachment_bytes = 0usize; - for _ in 0..count { - map(&mut decoder, 2)?; - key(&mut decoder, 0)?; - let digest = digest_id!(&mut decoder, AttachmentDigest)?; - key(&mut decoder, 1)?; - let bytes = bounded_bytes(&mut decoder, limits.get(LimitKind::AttachmentBytes), true)?; - attachment_bytes = attachment_bytes - .checked_add(bytes.len()) - .ok_or(CodecError::LimitExceeded)?; - if attachment_bytes > limits.get(LimitKind::AttachmentBytes) { - return Err(CodecError::LimitExceeded); - } - attachments.push(DetachedAttachment::new(digest, bytes)?); - } + let state = attachment_batch(input, limits, decoder.position(), count)?; + decoder = match Decoder::at(input, state.position) { + Ok(value) => value, + Err(_) => return Err(CodecError::Malformed), + }; let action = CanonicalAction::new(profile, media_type, body, permission, requested_budget)? - .with_detached_attachments(attachments)?; + .with_detached_attachments(state.attachments)?; ensure_complete(&decoder, input)?; if crate::encode::encode_canonical_action(&action)?.as_slice() != input { return Err(CodecError::NonCanonical); @@ -1615,9 +1686,7 @@ fn assurance_claim(decoder: &mut V1Decoder<'_>) -> Result) -> Result Result { map(decoder, 4)?; key(decoder, 0)?; - let requirement_index = decoder.u16().map_err(|_| CodecError::Malformed)?; + let requirement_index = decoder.u16().map_err(decode_error)?; key(decoder, 1)?; let principal = parse_text!(decoder, PrincipalId)?; key(decoder, 2)?; @@ -1693,9 +1762,9 @@ fn verification_resources( for (index, value) in values.iter_mut().enumerate() { key( decoder, - u8::try_from(index).map_err(|_| CodecError::LimitExceeded)?, + u8::try_from(index).map_err(crate::error::limit_error)?, )?; - *value = decoder.u64().map_err(|_| CodecError::Malformed)?; + *value = decoder.u64().map_err(decode_error)?; } Ok(VerificationResources::new( values[0], values[1], values[2], values[3], values[4], values[5], values[6], @@ -1716,14 +1785,14 @@ pub fn decode_verification_result(input: &[u8]) -> Result VerificationDecision::Authorized, 1 => VerificationDecision::Denied, 2 => VerificationDecision::Indeterminate, _ => return Err(CodecError::Malformed), }; key(&mut decoder, 1)?; - let stage = match decoder.u8().map_err(|_| CodecError::Malformed)? { + let stage = match decoder.u8().map_err(decode_error)? { 0 => VerificationStage::Decode, 1 => VerificationStage::Resolve, 2 => VerificationStage::PrincipalControl, @@ -1734,7 +1803,7 @@ pub fn decode_verification_result(input: &[u8]) -> Result Result Result { + limits.validate()?; + if input.len() > limits.get(LimitKind::ActionBytes) { + return Err(CodecError::LimitExceeded); + } + let mut decoder = Decoder::new(input); + map(&mut decoder, 6)?; + key(&mut decoder, 0)?; + let profile = profile_ref(&mut decoder)?; + key(&mut decoder, 1)?; + let media_type = parse_text!(&mut decoder, MediaType)?; + key(&mut decoder, 2)?; + let body = bounded_bytes( + &mut decoder, + limits.get(LimitKind::CanonicalBodyBytes), + true, + )?; + key(&mut decoder, 3)?; + let permission = permission(&mut decoder)?; + key(&mut decoder, 4)?; + let requested_budget = optional_budget(&mut decoder)?; + key(&mut decoder, 5)?; + let count = array(&mut decoder, limits.get(LimitKind::Attachments))?; + let mut attachments = Vec::with_capacity(count); + let mut attachment_bytes = 0usize; + for _ in 0..count { + map(&mut decoder, 2)?; + key(&mut decoder, 0)?; + let digest = digest_id!(&mut decoder, AttachmentDigest)?; + key(&mut decoder, 1)?; + let bytes = bounded_bytes(&mut decoder, limits.get(LimitKind::AttachmentBytes), true)?; + attachment_bytes = attachment_bytes + .checked_add(bytes.len()) + .ok_or(CodecError::LimitExceeded)?; + if attachment_bytes > limits.get(LimitKind::AttachmentBytes) { + return Err(CodecError::LimitExceeded); + } + attachments.push(DetachedAttachment::new(digest, bytes)?); + } + let action = CanonicalAction::new(profile, media_type, body, permission, requested_budget)? + .with_detached_attachments(attachments)?; + ensure_complete(&decoder, input)?; + if crate::encode::encode_canonical_action_reference(&action)?.as_slice() != input { + return Err(CodecError::NonCanonical); + } + Ok(action) + } + + #[test] + fn canonical_action_mutations_match_the_previous_codec() { + let action = minimal_canonical_action() + .with_detached_attachments(vec![ + DetachedAttachment::new(AttachmentDigest::new([2; 32]), vec![3, 4]).unwrap(), + DetachedAttachment::new(AttachmentDigest::new([1; 32]), vec![1, 2]).unwrap(), + ]) + .unwrap(); + let bytes = encode_canonical_action(&action).unwrap(); + assert_eq!( + bytes, + crate::encode::encode_canonical_action_reference(&action).unwrap() + ); + let limits = VerifierLimits::default(); + assert_eq!(decode_canonical_action(&bytes, &limits).unwrap(), action); + for length in 0..bytes.len() { + let truncated = &bytes[..length]; + assert_eq!( + decode_canonical_action(truncated, &limits), + decode_canonical_action_reference(truncated, &limits) + ); + } + for index in 0..bytes.len() { + for mask in [1, 128, 255] { + let mut mutated = bytes.clone(); + mutated[index] ^= mask; + assert_eq!( + decode_canonical_action(&mutated, &limits), + decode_canonical_action_reference(&mutated, &limits) + ); + } + } + } + + fn previous_attachment_checks( + mut attachments: Vec, + ) -> Result, auths_model::ModelError> { + attachments.sort_by_key(DetachedAttachment::digest); + if attachments.len() > auths_model::HARD_MAX_ATTACHMENTS + || attachments + .windows(2) + .any(|pair| pair[0].digest() == pair[1].digest()) + || attachments + .iter() + .try_fold(0usize, |total, attachment| { + total.checked_add(attachment.bytes().len()) + }) + .is_none_or(|total| total > auths_model::HARD_MAX_ATTACHMENT_BYTES) + { + return Err(auths_model::ModelError::InvalidAttachment); + } + Ok(attachments) + } + + #[test] + fn canonical_attachment_hard_limits_match_previous_checks() { + let action = minimal_canonical_action(); + let too_many = (0..=auths_model::HARD_MAX_ATTACHMENTS) + .map(|index| { + let mut key = [0; 32]; + key[..8].copy_from_slice(&u64::try_from(index).unwrap().to_be_bytes()); + DetachedAttachment::new(AttachmentDigest::new(key), vec![1]).unwrap() + }) + .collect::>(); + let too_large = vec![ + DetachedAttachment::new( + AttachmentDigest::new([1; 32]), + vec![1; auths_model::HARD_MAX_ATTACHMENT_BYTES / 2], + ) + .unwrap(), + DetachedAttachment::new( + AttachmentDigest::new([2; 32]), + vec![2; auths_model::HARD_MAX_ATTACHMENT_BYTES / 2 + 1], + ) + .unwrap(), + ]; + for input in [too_many, too_large] { + let expected = previous_attachment_checks(input.clone()); + let actual = action + .clone() + .with_detached_attachments(input) + .map(|action| action.detached_attachments().to_vec()); + assert_eq!(actual, expected); + assert_eq!(actual, Err(auths_model::ModelError::InvalidAttachment)); + } + } + proptest! { + #[test] + fn canonical_attachments_match_previous_checks( + raw in proptest::collection::vec((any::(), proptest::collection::vec(any::(), 1..=32)), 0..=80), + ) { + let input = raw.into_iter().map(|(key, data)| + DetachedAttachment::new(AttachmentDigest::new([key; 32]), data).unwrap() + ).collect::>(); + let expected = previous_attachment_checks(input.clone()); + let actual = minimal_canonical_action().with_detached_attachments(input) + .map(|action| action.detached_attachments().to_vec()); + prop_assert_eq!(actual, expected); + } + + #[test] + fn canonical_action_round_trips_match_the_previous_encoder( + body in proptest::collection::vec(any::(), 1..=128), + raw in proptest::collection::vec((any::(), proptest::collection::vec(any::(), 1..=32)), 0..=32), + budget in proptest::option::of(any::()), + ) { + let mut raw = raw; + raw.sort_by_key(|(key, _)| *key); + raw.dedup_by_key(|(key, _)| *key); + let base = minimal_canonical_action(); + let budget = budget.map(|amount| BudgetCeiling::new( + BudgetAlgebraId::parse("units").unwrap(), amount)); + let action = CanonicalAction::new(base.profile().clone(), base.media_type().clone(), + body, base.permission().clone(), budget).unwrap() + .with_detached_attachments(raw.into_iter().map(|(key, data)| + DetachedAttachment::new(AttachmentDigest::new([key; 32]), data).unwrap() + ).collect()).unwrap(); + let bytes = encode_canonical_action(&action).unwrap(); + prop_assert_eq!(&bytes, &crate::encode::encode_canonical_action_reference(&action).unwrap()); + let limits = VerifierLimits::default(); + prop_assert_eq!(decode_canonical_action(&bytes, &limits), + decode_canonical_action_reference(&bytes, &limits)); + prop_assert_eq!(decode_canonical_action(&bytes, &limits).unwrap(), action); + } + #[test] fn arbitrary_bytes_never_panic( bytes in proptest::collection::vec(any::(), 0..4096) ) { - let _ = decode_bundle(&bytes, &VerifierLimits::default()); + let limits = VerifierLimits::default(); + prop_assert_eq!(decode_canonical_action(&bytes, &limits), + decode_canonical_action_reference(&bytes, &limits)); + let _ = decode_bundle(&bytes, &limits); let _ = decode_verifier_context(&bytes); } } } + +#[cfg(test)] +#[path = "scope_decode_tests.rs"] +mod scope_decode_tests; diff --git a/core/crates/auths-codec/src/encode.rs b/core/crates/auths-codec/src/encode.rs index 90331c90c..9fc89924d 100644 --- a/core/crates/auths-codec/src/encode.rs +++ b/core/crates/auths-codec/src/encode.rs @@ -1,5 +1,6 @@ //! Deterministic target V1 encoders. +use crate::cbor::Encoder; use crate::{ CodecError, hash::{grant_id, grant_status_id, principal_status_id}, @@ -17,19 +18,18 @@ use auths_model::{ StatusPolicy, StatusScope, StatusTrustRule, TrustAnchor, TrustedContext, VerificationCode, VerificationDecision, VerificationResources, VerificationStage, VerifierLimits, }; -use minicbor::Encoder; -pub(crate) type V1Encoder = Encoder>; +pub(crate) type V1Encoder = Encoder; /// Shape version of the canonical portable verification result. pub const PORTABLE_RESULT_ABI_VERSION: u16 = 4; -pub(crate) fn encode_error(_error: minicbor::encode::Error) -> CodecError { +pub(crate) fn encode_error(_error: crate::cbor::Error) -> CodecError { CodecError::Malformed } pub(crate) fn length(value: usize) -> Result { - u64::try_from(value).map_err(|_| CodecError::LimitExceeded) + u64::try_from(value).map_err(crate::error::limit_error) } pub(crate) fn finish( @@ -133,7 +133,7 @@ pub(crate) fn encode_optional_budget( if let Some(budget) = budget { encode_budget(encoder, budget) } else { - encoder.null().map_err(encode_error)?; + encoder.null(); Ok(()) } } @@ -264,7 +264,7 @@ pub(crate) fn encode_grant_statement_to( if let Some(parent) = statement.parent() { bytes(encoder, parent.as_bytes())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 13)?; encode_status_policy(encoder, statement.status_policy())?; @@ -345,7 +345,7 @@ pub(crate) fn encode_action_envelope_to( if let Some(grant) = envelope.terminal_grant() { bytes(encoder, grant.as_bytes())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 14)?; bytes(encoder, envelope.authorization_plan().as_bytes())?; @@ -378,29 +378,38 @@ pub fn encode_action_envelope(envelope: &ActionEnvelope) -> Result, Code /// /// Returns [`CodecError`] if a length cannot be represented canonically. pub fn encode_canonical_action(action: &CanonicalAction) -> Result, CodecError> { - finish(|encoder| { - map(encoder, 6)?; - key(encoder, 0)?; - encode_profile_ref(encoder, action.profile())?; - key(encoder, 1)?; - text(encoder, action.media_type().as_str())?; - key(encoder, 2)?; - bytes(encoder, action.body())?; - key(encoder, 3)?; - encode_permission(encoder, action.permission())?; - key(encoder, 4)?; - encode_optional_budget(encoder, action.requested_budget())?; - key(encoder, 5)?; - array(encoder, action.detached_attachments().len())?; - for attachment in action.detached_attachments() { - map(encoder, 2)?; - key(encoder, 0)?; - bytes(encoder, attachment.digest().as_bytes())?; - key(encoder, 1)?; - bytes(encoder, attachment.bytes())?; - } - Ok(()) - }) + let mut encoder = Encoder::new(Vec::new()); + map(&mut encoder, 6)?; + key(&mut encoder, 0)?; + encode_profile_ref(&mut encoder, action.profile())?; + key(&mut encoder, 1)?; + text(&mut encoder, action.media_type().as_str())?; + key(&mut encoder, 2)?; + bytes(&mut encoder, action.body())?; + key(&mut encoder, 3)?; + encode_permission(&mut encoder, action.permission())?; + key(&mut encoder, 4)?; + encode_optional_budget(&mut encoder, action.requested_budget())?; + key(&mut encoder, 5)?; + array(&mut encoder, action.detached_attachments().len())?; + let mut state = Ok(encoder); + for attachment in action.detached_attachments() { + state = encode_canonical_attachment(state, attachment); + } + Ok(state?.into_writer()) +} + +fn encode_canonical_attachment( + state: Result, + attachment: &auths_model::DetachedAttachment, +) -> Result { + let mut encoder = state?; + map(&mut encoder, 2)?; + key(&mut encoder, 0)?; + bytes(&mut encoder, attachment.digest().as_bytes())?; + key(&mut encoder, 1)?; + bytes(&mut encoder, attachment.bytes())?; + Ok(encoder) } fn encode_assurance_claim( @@ -421,7 +430,7 @@ fn encode_assurance_claim( if let Some(observed_at) = claim.observed_at() { encoder.u64(observed_at.get()).map_err(encode_error)?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 3)?; text(encoder, claim.source().as_str())?; @@ -508,7 +517,7 @@ fn encode_verification_resources( { key( encoder, - u8::try_from(key_value).map_err(|_| CodecError::LimitExceeded)?, + u8::try_from(key_value).map_err(crate::error::limit_error)?, )?; encoder.u64(value).map_err(encode_error)?; } @@ -560,7 +569,7 @@ fn encode_verification_result_to( if let Some(plan_id) = result.plan_id() { bytes(encoder, plan_id.as_bytes())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 7)?; if include_result_digest { @@ -591,7 +600,7 @@ fn encode_verification_result_to( if let Some(configuration) = result.required_configuration() { bytes(encoder, configuration.as_bytes())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 14)?; bytes(encoder, result.local_configuration().as_bytes())?; @@ -944,26 +953,20 @@ fn encode_attachment( key(encoder, 3)?; text(encoder, attachment.disposition().as_str())?; key(encoder, 4)?; - encoder - .bool(matches!( - attachment.confidentiality(), - auths_model::Confidentiality::Encrypted - )) - .map_err(encode_error)?; + encoder.bool(matches!( + attachment.confidentiality(), + auths_model::Confidentiality::Encrypted + )); key(encoder, 5)?; - encoder - .bool(matches!( - attachment.presence(), - auths_model::Presence::Required - )) - .map_err(encode_error)?; + encoder.bool(matches!( + attachment.presence(), + auths_model::Presence::Required + )); key(encoder, 6)?; - encoder - .bool(matches!( - attachment.opacity(), - auths_model::Opacity::OpaqueAllowed - )) - .map_err(encode_error)?; + encoder.bool(matches!( + attachment.opacity(), + auths_model::Opacity::OpaqueAllowed + )); Ok(()) } @@ -1069,7 +1072,7 @@ fn encode_bundle_to(encoder: &mut V1Encoder, bundle: &ProofBundle) -> Result<(), if let Some(body) = bundle.canonical_body() { bytes(encoder, body)?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 10)?; @@ -1194,25 +1197,25 @@ fn encode_assurance_policy( if let Some(source) = requirement.source() { text(encoder, source.as_str())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 4)?; if let Some(adapter) = requirement.adapter() { text(encoder, adapter.as_str())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 5)?; if let Some(version) = requirement.adapter_version() { encoder.u16(version).map_err(encode_error)?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 6)?; if let Some(maximum_age) = requirement.maximum_age() { encoder.u64(maximum_age.get()).map_err(encode_error)?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 7)?; encoder @@ -1492,7 +1495,7 @@ fn encode_limits(encoder: &mut V1Encoder, limits: &VerifierLimits) -> Result<(), for (index, kind) in LIMITS.into_iter().enumerate() { key( encoder, - u8::try_from(index).map_err(|_| CodecError::LimitExceeded)?, + u8::try_from(index).map_err(crate::error::limit_error)?, )?; encoder .u64(length(limits.get(kind))?) @@ -1510,7 +1513,7 @@ fn encode_limits(encoder: &mut V1Encoder, limits: &VerifierLimits) -> Result<(), { key( encoder, - u8::try_from(27 + index).map_err(|_| CodecError::LimitExceeded)?, + u8::try_from(27 + index).map_err(crate::error::limit_error)?, )?; encoder .u64(length(limits.get(kind))?) @@ -1528,7 +1531,7 @@ fn encode_composition_requirement( if let Some(plan) = requirement.expected_plan() { bytes(encoder, plan.as_bytes())?; } else { - encoder.null().map_err(encode_error)?; + encoder.null(); } key(encoder, 1)?; encoder @@ -1600,3 +1603,33 @@ fn encode_verifier_context_to( pub fn encode_verifier_context(context: &TrustedContext) -> Result, CodecError> { finish(|encoder| encode_verifier_context_to(encoder, context)) } + +// The former implementation is retained only as a refactor-equivalence oracle. +#[cfg(test)] +pub(crate) fn encode_canonical_action_reference( + action: &CanonicalAction, +) -> Result, CodecError> { + finish(|encoder| { + map(encoder, 6)?; + key(encoder, 0)?; + encode_profile_ref(encoder, action.profile())?; + key(encoder, 1)?; + text(encoder, action.media_type().as_str())?; + key(encoder, 2)?; + bytes(encoder, action.body())?; + key(encoder, 3)?; + encode_permission(encoder, action.permission())?; + key(encoder, 4)?; + encode_optional_budget(encoder, action.requested_budget())?; + key(encoder, 5)?; + array(encoder, action.detached_attachments().len())?; + for attachment in action.detached_attachments() { + map(encoder, 2)?; + key(encoder, 0)?; + bytes(encoder, attachment.digest().as_bytes())?; + key(encoder, 1)?; + bytes(encoder, attachment.bytes())?; + } + Ok(()) + }) +} diff --git a/core/crates/auths-codec/src/error.rs b/core/crates/auths-codec/src/error.rs index 1fdba7a10..f85ca1b2d 100644 --- a/core/crates/auths-codec/src/error.rs +++ b/core/crates/auths-codec/src/error.rs @@ -20,9 +20,13 @@ pub enum CodecError { Model(ModelError), } +pub(crate) fn limit_error(_error: core::num::TryFromIntError) -> CodecError { + CodecError::LimitExceeded +} + impl From for CodecError { - fn from(error: ModelError) -> Self { - Self::Model(error) + fn from(model_error: ModelError) -> Self { + Self::Model(model_error) } } diff --git a/core/crates/auths-codec/src/hash.rs b/core/crates/auths-codec/src/hash.rs index 5b4fdba9e..0ad54f035 100644 --- a/core/crates/auths-codec/src/hash.rs +++ b/core/crates/auths-codec/src/hash.rs @@ -49,9 +49,7 @@ enum IdentifierType { } fn raw_sha256(value: &[u8]) -> Digest { - let mut hasher = Sha256::new(); - hasher.update(value); - Digest::new(hasher.finalize().into()) + Digest::new(Sha256::digest(value).into()) } /// Commits to already-canonical bytes under an explicit application domain. @@ -65,20 +63,38 @@ fn raw_sha256(value: &[u8]) -> Digest { /// /// Returns an error when the domain or payload exceeds protocol limits. pub fn domain_commitment(domain: &str, canonical: &[u8]) -> Result { + Ok(raw_sha256(&commitment_preimage(domain, canonical)?)) +} + +fn preimage_buffer(capacity: usize) -> Result, CodecError> { + // Vec's representable capacity is at most isize::MAX, even when the + // checked unsigned sum fits usize. Allocation failure remains the same + // standard-library/host boundary as the existing canonical encoders. + let _ = isize::try_from(capacity).map_err(crate::error::limit_error)?; + Ok(Vec::with_capacity(capacity)) +} + +fn commitment_preimage(domain: &str, canonical: &[u8]) -> Result, CodecError> { let domain_bytes = domain.as_bytes(); if domain_bytes.is_empty() || domain_bytes.len() > MAX_COMMITMENT_DOMAIN_BYTES { return Err(CodecError::LimitExceeded); } - let domain_length = u16::try_from(domain_bytes.len()).map_err(|_| CodecError::LimitExceeded)?; - let payload_length = u64::try_from(canonical.len()).map_err(|_| CodecError::LimitExceeded)?; - let mut hasher = Sha256::new(); - hasher.update(COMMITMENT_PREFIX); - hasher.update(PROTOCOL_V1.to_be_bytes()); - hasher.update(domain_length.to_be_bytes()); - hasher.update(domain_bytes); - hasher.update(payload_length.to_be_bytes()); - hasher.update(canonical); - Ok(Digest::new(hasher.finalize().into())) + let domain_length = u16::try_from(domain_bytes.len()).map_err(crate::error::limit_error)?; + let payload_length = u64::try_from(canonical.len()).map_err(crate::error::limit_error)?; + let capacity = COMMITMENT_PREFIX + .len() + .checked_add(2 + 2 + 8) + .and_then(|size| size.checked_add(domain_bytes.len())) + .and_then(|size| size.checked_add(canonical.len())) + .ok_or(CodecError::LimitExceeded)?; + let mut output = preimage_buffer(capacity)?; + output.extend_from_slice(COMMITMENT_PREFIX); + output.extend_from_slice(&PROTOCOL_V1.to_be_bytes()); + output.extend_from_slice(&domain_length.to_be_bytes()); + output.extend_from_slice(domain_bytes); + output.extend_from_slice(&payload_length.to_be_bytes()); + output.extend_from_slice(canonical); + Ok(output) } /// Returns the transaction binding for one external signing preimage. @@ -92,14 +108,29 @@ pub fn transaction_binding(signing_preimage: &[u8]) -> Digest { } fn domain_hash(identifier_type: IdentifierType, canonical: &[u8]) -> Result { - let canonical_length = u64::try_from(canonical.len()).map_err(|_| CodecError::LimitExceeded)?; - let mut hasher = Sha256::new(); - hasher.update(IDENTIFIER_PREFIX); - hasher.update(PROTOCOL_V1.to_be_bytes()); - hasher.update((identifier_type as u16).to_be_bytes()); - hasher.update(canonical_length.to_be_bytes()); - hasher.update(canonical); - Ok(Digest::new(hasher.finalize().into())) + Ok(raw_sha256(&identifier_preimage( + identifier_type, + canonical, + )?)) +} + +fn identifier_preimage( + identifier_type: IdentifierType, + canonical: &[u8], +) -> Result, CodecError> { + let canonical_length = u64::try_from(canonical.len()).map_err(crate::error::limit_error)?; + let capacity = IDENTIFIER_PREFIX + .len() + .checked_add(2 + 2 + 8) + .and_then(|size| size.checked_add(canonical.len())) + .ok_or(CodecError::LimitExceeded)?; + let mut output = preimage_buffer(capacity)?; + output.extend_from_slice(IDENTIFIER_PREFIX); + output.extend_from_slice(&PROTOCOL_V1.to_be_bytes()); + output.extend_from_slice(&(identifier_type as u16).to_be_bytes()); + output.extend_from_slice(&canonical_length.to_be_bytes()); + output.extend_from_slice(canonical); + Ok(output) } fn signing_preimage( @@ -108,16 +139,20 @@ fn signing_preimage( profile_version: u16, canonical_signing_object: &[u8], ) -> Result, CodecError> { - let profile_length = u16::try_from(profile_id.len()).map_err(|_| CodecError::LimitExceeded)?; + let profile_length = u16::try_from(profile_id.len()).map_err(crate::error::limit_error)?; let object_length = - u64::try_from(canonical_signing_object.len()).map_err(|_| CodecError::LimitExceeded)?; + u64::try_from(canonical_signing_object.len()).map_err(crate::error::limit_error)?; let capacity = SIGNING_PREFIX .len() .checked_add(2 + 2 + 2 + 2 + 8) - .and_then(|value| value.checked_add(profile_id.len())) - .and_then(|value| value.checked_add(canonical_signing_object.len())) .ok_or(CodecError::LimitExceeded)?; - let mut output = Vec::with_capacity(capacity); + let capacity = capacity + .checked_add(profile_id.len()) + .ok_or(CodecError::LimitExceeded)?; + let capacity = capacity + .checked_add(canonical_signing_object.len()) + .ok_or(CodecError::LimitExceeded)?; + let mut output = preimage_buffer(capacity)?; output.extend_from_slice(SIGNING_PREFIX); output.extend_from_slice(&PROTOCOL_V1.to_be_bytes()); output.extend_from_slice(&(object_type as u16).to_be_bytes()); @@ -397,3 +432,160 @@ pub fn approval_digest(approval: &SignedApproval) -> Result Result, CodecError> { + let profile_length = + u16::try_from(profile_id.len()).map_err(|_| CodecError::LimitExceeded)?; + let object_length = + u64::try_from(canonical_signing_object.len()).map_err(|_| CodecError::LimitExceeded)?; + let capacity = SIGNING_PREFIX + .len() + .checked_add(2 + 2 + 2 + 2 + 8) + .and_then(|value| value.checked_add(profile_id.len())) + .and_then(|value| value.checked_add(canonical_signing_object.len())) + .ok_or(CodecError::LimitExceeded)?; + let mut output = Vec::with_capacity(capacity); + output.extend_from_slice(SIGNING_PREFIX); + output.extend_from_slice(&PROTOCOL_V1.to_be_bytes()); + output.extend_from_slice(&(object_type as u16).to_be_bytes()); + output.extend_from_slice(&profile_length.to_be_bytes()); + output.extend_from_slice(profile_id.as_bytes()); + output.extend_from_slice(&profile_version.to_be_bytes()); + output.extend_from_slice(&object_length.to_be_bytes()); + output.extend_from_slice(canonical_signing_object); + Ok(output) + } + + fn object_types() -> [ObjectType; 6] { + [ + ObjectType::Grant, + ObjectType::Action, + ObjectType::PrincipalStatus, + ObjectType::GrantStatus, + ObjectType::Observation, + ObjectType::Approval, + ] + } + + fn identifier_types() -> [IdentifierType; 9] { + [ + IdentifierType::Grant, + IdentifierType::Action, + IdentifierType::Plan, + IdentifierType::Evidence, + IdentifierType::PrincipalStatus, + IdentifierType::GrantStatus, + IdentifierType::Context, + IdentifierType::ObservationRequirement, + IdentifierType::ApprovalRequirement, + ] + } + + proptest! { + #[test] + fn signing_frame_preserves_bytes_and_errors( + profile in any::(), version in any::(), + statement in proptest::collection::vec(any::(), 0..4096), + ) { + for kind in object_types() { + prop_assert_eq!(signing_preimage(kind, &profile, version, &statement), + signing_preimage_reference(kind, &profile, version, &statement)); + } + } + + #[test] + fn one_shot_hashes_preserve_independent_streaming_transcripts( + domain in any::(), + payload in proptest::collection::vec(any::(), 0..4096), + ) { + if domain.is_empty() || domain.len() > 128 { + prop_assert_eq!(domain_commitment(&domain, &payload), Err(CodecError::LimitExceeded)); + } else { + let mut reference = Sha256::new(); + reference.update(b"AUTHS-COMMITMENT"); + reference.update(1_u16.to_be_bytes()); + reference.update(u16::try_from(domain.len()).unwrap().to_be_bytes()); + reference.update(domain.as_bytes()); + reference.update(u64::try_from(payload.len()).unwrap().to_be_bytes()); + reference.update(&payload); + prop_assert_eq!(domain_commitment(&domain, &payload), + Ok(Digest::new(reference.finalize().into()))); + } + for kind in identifier_types() { + let mut reference = Sha256::new(); + reference.update(b"AUTHS-ID"); + reference.update(1_u16.to_be_bytes()); + reference.update((kind as u16).to_be_bytes()); + reference.update(u64::try_from(payload.len()).unwrap().to_be_bytes()); + reference.update(&payload); + prop_assert_eq!(domain_hash(kind, &payload), + Ok(Digest::new(reference.finalize().into()))); + } + } + } + + #[test] + fn commitment_domain_bound_counts_utf8_bytes() { + for (domain, accepted) in [ + (String::new(), false), + ("a".repeat(128), true), + ("a".repeat(129), false), + ("λ".repeat(64), true), + ("λ".repeat(64) + "a", false), + ] { + let actual = commitment_preimage(&domain, &[0, 255]); + if accepted { + assert_eq!(actual.as_ref().map(Vec::len), Ok(28 + domain.len() + 2)); + } else { + assert_eq!(actual, Err(CodecError::LimitExceeded)); + } + } + } + + #[test] + fn preimage_capacity_refuses_before_unrepresentable_allocation() { + let first_unrepresentable = usize::try_from(isize::MAX).unwrap() + 1; + assert_eq!( + preimage_buffer(first_unrepresentable), + Err(CodecError::LimitExceeded) + ); + assert_eq!(preimage_buffer(usize::MAX), Err(CodecError::LimitExceeded)); + assert_eq!(preimage_buffer(0), Ok(Vec::new())); + assert_eq!(preimage_buffer(32), Ok(Vec::new())); + } + + #[test] + fn signing_frame_profile_limit_counts_utf8_bytes_exactly() { + for profile in [ + String::new(), + "a".repeat(65535), + "a".repeat(65536), + "λ".repeat(32767) + "a", + "λ".repeat(32768), + ] { + for kind in object_types() { + let actual = signing_preimage(kind, &profile, u16::MAX, &[0, 255]); + assert_eq!( + actual, + signing_preimage_reference(kind, &profile, u16::MAX, &[0, 255]) + ); + if profile.len() > usize::from(u16::MAX) { + assert_eq!(actual, Err(CodecError::LimitExceeded)); + } else { + assert_eq!(actual.as_ref().map(Vec::len), Ok(21 + profile.len() + 2)); + } + } + } + } +} diff --git a/core/crates/auths-codec/src/lib.rs b/core/crates/auths-codec/src/lib.rs index 35126f81b..5595104d1 100644 --- a/core/crates/auths-codec/src/lib.rs +++ b/core/crates/auths-codec/src/lib.rs @@ -8,6 +8,7 @@ extern crate alloc; mod approval; mod bounded_policy; +mod cbor; mod decode; mod encode; mod error; diff --git a/core/crates/auths-codec/src/observation.rs b/core/crates/auths-codec/src/observation.rs index cc57e4693..68b672b1c 100644 --- a/core/crates/auths-codec/src/observation.rs +++ b/core/crates/auths-codec/src/observation.rs @@ -1,6 +1,7 @@ //! Deterministic encoding of signed observations, observation requirements, //! observer anchors, and reported observation satisfactions. +use crate::cbor::{Decoder, Type}; use crate::{ CodecError, decode::{ @@ -24,7 +25,6 @@ use auths_model::{ ObserverAnchorId, PrincipalId, PrincipalMethodId, ResourceId, SignatureDescriptor, SignedObservation, Timestamp, UintRange, ValidityWindow, VerifierLimits, }; -use minicbor::{Decoder, data::Type}; /// Upper bound on reported observation satisfactions in one result. pub(crate) const MAX_OBSERVATION_SATISFACTIONS: usize = 1_024; diff --git a/core/crates/auths-codec/src/scope_decode_tests.rs b/core/crates/auths-codec/src/scope_decode_tests.rs new file mode 100644 index 000000000..510e55b09 --- /dev/null +++ b/core/crates/auths-codec/src/scope_decode_tests.rs @@ -0,0 +1,270 @@ +//! Frozen pre-refactor decoder control flow. The model crate separately +//! compares constructor behavior with its frozen sorting/validation oracle. +use super::*; +use crate::cbor::Encoder; +use alloc::format; + +fn reference( + decoder: &mut V1Decoder<'_>, + limits: &VerifierLimits, +) -> Result { + let entries = decoder + .map() + .map_err(decode_error)? + .ok_or(CodecError::Malformed)?; + if !(1..=2).contains(&entries) { + return Err(CodecError::Malformed); + } + key(decoder, 0)?; + let tag = decoder.u8().map_err(decode_error)?; + match (tag, entries) { + (0, 1) => Ok(StatusScope::OwnAnchor), + (1, 2) => { + key(decoder, 1)?; + let length = array(decoder, limits.get(LimitKind::TrustAnchors))?; + let mut anchors = Vec::with_capacity(length); + for _ in 0..length { + anchors.push(parse_text!(decoder, TrustAnchorId)?); + } + Ok(StatusScope::Anchors(StatusScopeAnchors::new(anchors)?)) + } + (2, 1) => Ok(StatusScope::AnyAnchor), + _ => Err(CodecError::Malformed), + } +} + +fn check(bytes: &[u8], maximum: usize) { + let limits = VerifierLimits::default_deployment() + .with_limit(LimitKind::TrustAnchors, maximum) + .unwrap(); + let mut actual_decoder = V1Decoder::new(bytes); + let mut reference_decoder = V1Decoder::new(bytes); + let expected = reference(&mut reference_decoder, &limits); + let actual = status_scope(&mut actual_decoder, &limits); + assert_eq!(actual, expected, "bytes {bytes:?}, maximum {maximum}"); + assert_eq!(actual_decoder.position(), reference_decoder.position()); +} + +fn encode_scope(ids: &[&str]) -> Vec { + let mut encoder = Encoder::new(Vec::new()); + encoder.map(2).unwrap(); + encoder.u8(0).unwrap(); + encoder.u8(1).unwrap(); + encoder.u8(1).unwrap(); + encoder.array(u64::try_from(ids.len()).unwrap()).unwrap(); + for id in ids { + encoder.str(id).unwrap(); + } + encoder.into_writer() +} + +fn next_word(state: &mut u64) -> u64 { + *state ^= *state << 13; + *state ^= *state >> 7; + *state ^= *state << 17; + *state +} + +#[test] +fn scope_decoder_preserves_result_and_cursor_for_truncation_and_invalid_ids() { + let choices = [ + "anchor:a", + "anchor:b", + "anchor:c", + "anchor:é", + "anchor:δ", + "", + "two words", + "line\nbreak", + "anchor:\u{200b}", + ]; + let mut state = 42_u64; + for _ in 0..500 { + let length = usize::try_from(next_word(&mut state) % 9).unwrap(); + let ids: Vec<_> = (0..length) + .map(|_| { + let index = + usize::try_from(next_word(&mut state) % u64::try_from(choices.len()).unwrap()) + .unwrap(); + choices[index] + }) + .collect(); + let encoded = encode_scope(&ids); + for maximum in [1, 2, 8, auths_model::HARD_MAX_TRUST_ANCHORS] { + for end in 0..=encoded.len() { + check(&encoded[..end], maximum); + } + } + } +} + +#[test] +fn scope_decoder_preserves_all_header_tags_and_adversarial_bytes() { + for tag in 0..=u8::MAX { + let bytes = [0xa1, 0x00, tag]; + for maximum in [1, 2, 8, auths_model::HARD_MAX_TRUST_ANCHORS] { + check(&bytes, maximum); + } + } + let mut state = 17_u64; + for _ in 0..8_000 { + let length = usize::try_from(next_word(&mut state) % 64).unwrap(); + let bytes: Vec<_> = (0..length) + .map(|_| u8::try_from(next_word(&mut state) % 256).unwrap()) + .collect(); + for maximum in [1, 2, 8, auths_model::HARD_MAX_TRUST_ANCHORS] { + check(&bytes, maximum); + } + } +} + +#[test] +fn scope_decoder_preserves_own_any_sorted_and_limit_boundaries() { + let limits = VerifierLimits::default_deployment(); + for (bytes, expected) in [ + (&[0xa1, 0x00, 0x00][..], StatusScope::OwnAnchor), + (&[0xa1, 0x00, 0x02][..], StatusScope::AnyAnchor), + ] { + let mut decoder = V1Decoder::new(bytes); + assert_eq!(status_scope(&mut decoder, &limits), Ok(expected)); + check(bytes, auths_model::HARD_MAX_TRUST_ANCHORS); + } + let bytes = encode_scope(&["anchor:c", "anchor:a"]); + let mut decoder = V1Decoder::new(&bytes); + let StatusScope::Anchors(anchors) = status_scope(&mut decoder, &limits).unwrap() else { + panic!("listed scope"); + }; + assert_eq!( + anchors + .ids() + .iter() + .map(TrustAnchorId::as_str) + .collect::>(), + ["anchor:a", "anchor:c"] + ); + for length in [ + 0, + 1, + auths_model::HARD_MAX_TRUST_ANCHORS - 1, + auths_model::HARD_MAX_TRUST_ANCHORS, + auths_model::HARD_MAX_TRUST_ANCHORS + 1, + ] { + let ids: Vec<_> = (0..length) + .map(|index| format!("anchor:{index:04}")) + .collect(); + let borrowed: Vec<_> = ids.iter().map(String::as_str).collect(); + let encoded = encode_scope(&borrowed); + for maximum in [1, 2, 8, auths_model::HARD_MAX_TRUST_ANCHORS] { + check(&encoded, maximum); + } + } +} + +fn reference_trust( + decoder: &mut V1Decoder<'_>, + limits: &VerifierLimits, +) -> Result, CodecError> { + let length = array(decoder, limits.get(LimitKind::RegistryEntries))?; + let mut rules = Vec::with_capacity(length); + for _ in 0..length { + map(decoder, 4)?; + key(decoder, 0)?; + let method = parse_text!(decoder, StatusMethodId)?; + key(decoder, 1)?; + let issuer = parse_text!(decoder, PrincipalId)?; + key(decoder, 2)?; + let sequence_floor = decoder.u64().map_err(decode_error)?; + key(decoder, 3)?; + let scope = reference(decoder, limits)?; + rules.push(StatusTrustRule::new(method, issuer, sequence_floor, scope)); + } + Ok(rules) +} + +fn check_trust(bytes: &[u8], maximum: usize) { + let limits = VerifierLimits::default_deployment() + .with_limit(LimitKind::RegistryEntries, maximum) + .unwrap(); + let mut actual = V1Decoder::new(bytes); + let mut expected = V1Decoder::new(bytes); + assert_eq!( + status_trust(&mut actual, &limits), + reference_trust(&mut expected, &limits) + ); + assert_eq!(actual.position(), expected.position()); +} + +fn encode_trust(entries: &[(&str, &str, u64, &[&str])]) -> Vec { + let mut encoder = Encoder::new(Vec::new()); + encoder + .array(u64::try_from(entries.len()).unwrap()) + .unwrap(); + for (method, issuer, floor, ids) in entries { + encoder.map(4).unwrap(); + encoder.u8(0).unwrap(); + encoder.str(method).unwrap(); + encoder.u8(1).unwrap(); + encoder.str(issuer).unwrap(); + encoder.u8(2).unwrap(); + encoder.u64(*floor).unwrap(); + encoder.u8(3).unwrap(); + encoder.map(2).unwrap(); + encoder.u8(0).unwrap(); + encoder.u8(1).unwrap(); + encoder.u8(1).unwrap(); + encoder.array(u64::try_from(ids.len()).unwrap()).unwrap(); + for id in *ids { + encoder.str(id).unwrap(); + } + } + encoder.into_writer() +} + +#[test] +fn status_trust_preserves_values_first_error_and_cursor() { + let methods = ["exact", "", "two words", "méthod"]; + let issuers = [ + "raw:issuer", + "did:key:z", + "a+1-.:x", + "A:issuer", + "no-scheme", + "a:", + "a:é", + ]; + let mut state = 731_u64; + for _ in 0..400 { + let length = usize::try_from(next_word(&mut state) % 5).unwrap(); + let mut entries = Vec::new(); + for _ in 0..length { + let method = methods[usize::try_from( + next_word(&mut state) % u64::try_from(methods.len()).unwrap(), + ) + .unwrap()]; + let issuer = issuers[usize::try_from( + next_word(&mut state) % u64::try_from(issuers.len()).unwrap(), + ) + .unwrap()]; + let ids: &[&str] = match next_word(&mut state) % 4 { + 0 => &["a", "c"], + 1 => &["c", "a"], + 2 => &["a", "a"], + _ => &[], + }; + entries.push((method, issuer, next_word(&mut state), ids)); + } + let bytes = encode_trust(&entries); + for prefix in 0..=bytes.len() { + for maximum in [0, 1, 2, 8] { + check_trust(&bytes[..prefix], maximum); + } + } + } + for _ in 0..8000 { + let length = usize::try_from(next_word(&mut state) % 65).unwrap(); + let bytes: Vec = (0..length) + .map(|_| next_word(&mut state).to_le_bytes()[0]) + .collect(); + check_trust(&bytes, 8); + } +} diff --git a/core/crates/auths-codec/tests/formal_action_witness.rs b/core/crates/auths-codec/tests/formal_action_witness.rs new file mode 100644 index 000000000..d19208753 --- /dev/null +++ b/core/crates/auths-codec/tests/formal_action_witness.rs @@ -0,0 +1,100 @@ +//! Native parity for the complete-action witnesses in `Auths.Codec.Examples`. +//! These exercise codec acceptance, not authorization of an application profile. + +use auths_codec::{CodecError, decode_canonical_action, encode_canonical_action}; +use auths_model::{ + CanonicalAction, CapabilityId, LimitKind, MediaType, Permission, ProfileId, ProfileRef, + ResourceId, VerifierLimits, +}; + +const INPUT: [u8; 26] = [ + 166, 0, 162, 0, 97, 116, 1, 1, 1, 97, 109, 2, 65, 1, 3, 162, 0, 97, 114, 1, 97, 114, 4, 246, 5, + 128, +]; + +fn limits() -> Result { + let mut limits = VerifierLimits::default_deployment().with_work_units(1)?; + for kind in [ + LimitKind::BundleBytes, + LimitKind::ContextBytes, + LimitKind::Grants, + LimitKind::Actions, + LimitKind::PlanLeaves, + LimitKind::PlanDepth, + LimitKind::PlanBranching, + LimitKind::EvidenceObjects, + LimitKind::EvidenceBytes, + LimitKind::ControlBindings, + LimitKind::PrincipalStatusStatements, + LimitKind::GrantStatusStatements, + LimitKind::Attachments, + LimitKind::AttachmentBytes, + LimitKind::Signatures, + LimitKind::SignatureBytes, + LimitKind::Permissions, + LimitKind::Audiences, + LimitKind::CriticalExtensions, + LimitKind::CriticalExtensionBytes, + LimitKind::AllowedBodyDigests, + LimitKind::BindingEvidence, + LimitKind::CanonicalBodyBytes, + LimitKind::RegistryEntries, + LimitKind::TrustAnchors, + LimitKind::Approvals, + LimitKind::ApproverAnchors, + LimitKind::ApprovalRequirements, + ] { + limits = limits.with_limit(kind, 1)?; + } + limits.with_limit(LimitKind::ActionBytes, 128) +} + +#[test] +fn complete_action_matches_proved_acceptance_and_exact_byte_boundary() +-> Result<(), auths_model::ModelError> { + let limits = limits()?; + let expected = CanonicalAction::new( + ProfileRef::new(ProfileId::parse("t")?, 1)?, + MediaType::parse("m")?, + vec![1], + Permission::new(CapabilityId::parse("r")?, ResourceId::parse("r")?), + None, + )?; + assert_eq!( + decode_canonical_action(&INPUT, &limits), + Ok(expected.clone()) + ); + assert_eq!(encode_canonical_action(&expected), Ok(INPUT.to_vec())); + let exact = limits.clone().with_limit(LimitKind::ActionBytes, 26)?; + assert_eq!(decode_canonical_action(&INPUT, &exact), Ok(expected)); + let below = limits.with_limit(LimitKind::ActionBytes, 25)?; + assert_eq!( + decode_canonical_action(&INPUT, &below), + Err(CodecError::LimitExceeded) + ); + Ok(()) +} + +#[test] +fn complete_action_matches_proved_adversarial_refusals() -> Result<(), auths_model::ModelError> { + let limits = limits()?; + let mut duplicate_key = INPUT.to_vec(); + duplicate_key[6] = 0; + let mut nonminimal_integer = INPUT.to_vec(); + nonminimal_integer.insert(7, 24); + let mut invalid_utf8 = INPUT.to_vec(); + invalid_utf8[5] = 255; + let truncated = INPUT[..INPUT.len() - 1].to_vec(); + let mut trailing = INPUT.to_vec(); + trailing.push(0); + for (input, expected) in [ + (duplicate_key, CodecError::NonCanonical), + (nonminimal_integer, CodecError::NonCanonical), + (invalid_utf8, CodecError::Malformed), + (truncated, CodecError::Malformed), + (trailing, CodecError::Malformed), + ] { + assert_eq!(decode_canonical_action(&input, &limits), Err(expected)); + } + Ok(()) +} diff --git a/core/crates/auths-composition/src/lib.rs b/core/crates/auths-composition/src/lib.rs index e8660be5d..f47d0c683 100644 --- a/core/crates/auths-composition/src/lib.rs +++ b/core/crates/auths-composition/src/lib.rs @@ -5,11 +5,17 @@ extern crate alloc; +#[cfg(test)] use alloc::vec::Vec; + +#[cfg(test)] +mod oracle; +mod summary; pub use auths_algebra_kernel::Truth as ThresholdTruth; use auths_model::{ AuthorizationPlan, AuthorizationPlanRef, DenialReason, ProofRef, Requirement, VerifierLimits, }; +use summary::Summary; /// Result of evaluating one plan branch. #[derive(Clone, Copy, Debug, Eq, PartialEq)] @@ -96,11 +102,27 @@ pub fn evaluate_observed( branch: &mut impl FnMut(ProofRef) -> BranchOutcome, observer: &mut impl FnMut(EvaluationEvent), ) -> Result { - plan.validate(limits) - .map_err(|_| DenialReason::AuthorizationPlanInvalid)?; + match plan.validate(limits) { + Ok(_) => {} + Err(_) => return Err(DenialReason::AuthorizationPlanInvalid), + } Ok(evaluate_node(plan, branch, observer)) } +fn evaluate_members( + members: &[AuthorizationPlan], + branch: &mut impl FnMut(ProofRef) -> BranchOutcome, + observer: &mut impl FnMut(EvaluationEvent), +) -> Summary { + let mut state = Summary::default(); + let mut index = 0; + while index < members.len() { + summary::push(&mut state, evaluate_node(&members[index], branch, observer)); + index += 1; + } + state +} + fn evaluate_node( plan: &AuthorizationPlan, branch: &mut impl FnMut(ProofRef) -> BranchOutcome, @@ -113,96 +135,37 @@ fn evaluate_node( outcome } AuthorizationPlanRef::AllOf(members) => { - let child_count = members.len(); - let mut authorized = 0usize; - let mut denied = Vec::new(); - let mut indeterminate = Vec::new(); - for member in members { - match evaluate_node(member, branch, observer) { - BranchOutcome::Authorized => authorized += 1, - BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { - denied.push(reason); - } - BranchOutcome::Indeterminate(requirement) => indeterminate.push(requirement), - } - } - let outcome = canonical_denial(&denied).map_or_else( - || { - canonical_requirement(&indeterminate) - .map_or(BranchOutcome::Authorized, BranchOutcome::Indeterminate) - }, - BranchOutcome::Denied, - ); + let state = evaluate_members(members, branch, observer); observe_aggregate( observer, - child_count, - u16::try_from(child_count).unwrap_or(u16::MAX), - authorized, - indeterminate.len(), - outcome, + members.len(), + u16::try_from(members.len()).unwrap_or(u16::MAX), + state.authorized, + state.indeterminate, + summary::all(state), ) } AuthorizationPlanRef::AnyOf(members) => { - let child_count = members.len(); - let mut authorized = 0usize; - let mut denied = Vec::new(); - let mut indeterminate = Vec::new(); - for member in members { - match evaluate_node(member, branch, observer) { - BranchOutcome::Authorized => authorized += 1, - BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { - denied.push(reason); - } - BranchOutcome::Indeterminate(requirement) => indeterminate.push(requirement), - } - } - let outcome = if authorized > 0 { - BranchOutcome::Authorized - } else if let Some(requirement) = canonical_requirement(&indeterminate) { - BranchOutcome::Indeterminate(requirement) - } else { - BranchOutcome::Denied( - canonical_denial(&denied).unwrap_or(DenialReason::AuthorizationPlanInvalid), - ) - }; + let state = evaluate_members(members, branch, observer); observe_aggregate( observer, - child_count, + members.len(), 1, - authorized, - indeterminate.len(), - outcome, + state.authorized, + state.indeterminate, + summary::threshold(state, 1), ) } AuthorizationPlanRef::KOfN { k, members } => { - let child_count = members.len(); - let mut authorized = 0usize; - let mut indeterminate = 0usize; - let mut denied = Vec::new(); - let mut requirements = Vec::new(); - for member in members { - match evaluate_node(member, branch, observer) { - BranchOutcome::Authorized => authorized += 1, - BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { - denied.push(reason); - } - BranchOutcome::Indeterminate(requirement) => { - indeterminate += 1; - requirements.push(requirement); - } - } - } - let outcome = match evaluate_threshold_counts(k, authorized, indeterminate) { - ThresholdTruth::Authorized => BranchOutcome::Authorized, - ThresholdTruth::Indeterminate => BranchOutcome::Indeterminate( - canonical_requirement(&requirements) - .unwrap_or(Requirement::ExternalFactUnavailable), - ), - ThresholdTruth::Denied => BranchOutcome::Denied( - canonical_denial(&denied).unwrap_or(DenialReason::AuthorizationPlanInvalid), - ), - }; - observe_aggregate(observer, child_count, k, authorized, indeterminate, outcome) + let state = evaluate_members(members, branch, observer); + observe_aggregate( + observer, + members.len(), + k, + state.authorized, + state.indeterminate, + summary::threshold(state, k), + ) } } } @@ -225,17 +188,6 @@ fn observe_aggregate( outcome } -fn canonical_denial(reasons: &[DenialReason]) -> Option { - reasons.iter().copied().min_by_key(|reason| reason.code()) -} - -fn canonical_requirement(requirements: &[Requirement]) -> Option { - requirements - .iter() - .copied() - .min_by_key(|requirement| requirement.code()) -} - #[cfg(test)] mod tests { use super::*; @@ -249,7 +201,296 @@ mod tests { } } + #[test] + fn formal_summary_witnesses_match_shipping_operations() { + use BranchOutcome::{ + Authorized as A, Denied as D, Indeterminate as I, StructurallyInvalid as S, + }; + let cases = [ + (true, 2, vec![A, A], A), + ( + true, + 2, + vec![ + I(Requirement::StaleStatus), + D(DenialReason::InvalidSignature), + ], + D(DenialReason::InvalidSignature), + ), + ( + true, + 3, + vec![ + D(DenialReason::InvalidSignature), + S(DenialReason::ActionBodyMismatch), + D(DenialReason::MissingReference), + ], + D(DenialReason::ActionBodyMismatch), + ), + (false, 1, vec![S(DenialReason::MissingReference), A], A), + ( + false, + 1, + vec![ + D(DenialReason::InvalidSignature), + I(Requirement::StaleStatus), + ], + I(Requirement::StaleStatus), + ), + ( + false, + 1, + vec![ + I(Requirement::StaleStatus), + I(Requirement::ApprovalUnavailable), + ], + I(Requirement::ApprovalUnavailable), + ), + ( + false, + 1, + vec![ + A, + I(Requirement::StaleStatus), + D(DenialReason::InvalidSignature), + ], + A, + ), + ( + false, + 2, + vec![ + A, + I(Requirement::StaleStatus), + D(DenialReason::InvalidSignature), + ], + I(Requirement::StaleStatus), + ), + ( + false, + 3, + vec![ + A, + I(Requirement::StaleStatus), + D(DenialReason::InvalidSignature), + ], + D(DenialReason::InvalidSignature), + ), + ]; + for (all, required, children, expected) in cases { + let mut state = Summary::default(); + for child in children { + summary::push(&mut state, child); + } + let actual = if all { + summary::all(state) + } else { + summary::threshold(state, required) + }; + assert_eq!(actual, expected); + } + } + + #[test] + fn formal_plan_witnesses_preserve_every_callback_and_event() { + let reference = |tag| ProofRef::new([tag; 32]); + let members = || { + (1..=3) + .map(|tag| AuthorizationPlan::proof(reference(tag))) + .collect() + }; + let denied = BranchOutcome::Denied(DenialReason::PermissionNotGranted); + let missing = BranchOutcome::Indeterminate(Requirement::ExternalFactUnavailable); + let cases = [ + (AuthorizationPlan::all_of(members()).unwrap(), 3, denied), + ( + AuthorizationPlan::any_of(members()).unwrap(), + 1, + BranchOutcome::Authorized, + ), + (AuthorizationPlan::k_of_n(2, members()).unwrap(), 2, missing), + (AuthorizationPlan::k_of_n(3, members()).unwrap(), 3, denied), + ]; + for (plan, required, expected) in cases { + let mut count = 0; + let mut events = Vec::new(); + let actual = evaluate_observed( + &plan, + &VerifierLimits::hard(), + &mut |_| { + let result = match count { + 0 => denied, + 1 => BranchOutcome::Authorized, + _ => missing, + }; + count += 1; + result + }, + &mut |event| events.push(event), + ); + assert_eq!(actual, Ok(expected)); + assert_eq!(count, 3); + assert_eq!( + events, + vec![ + EvaluationEvent::Proof { + reference: reference(1), + outcome: denied + }, + EvaluationEvent::Proof { + reference: reference(2), + outcome: BranchOutcome::Authorized + }, + EvaluationEvent::Proof { + reference: reference(3), + outcome: missing + }, + EvaluationEvent::Aggregate { + child_count: 3, + required, + authorized: 1, + indeterminate: 1, + outcome: expected, + }, + ] + ); + } + } + + #[test] + fn maximum_depth_and_leaf_count_visit_the_complete_plan() { + let limits = VerifierLimits::hard(); + let max_depth = limits.get(auths_model::LimitKind::PlanDepth); + let max_leaves = limits.get(auths_model::LimitKind::PlanLeaves); + let members = (0..max_leaves) + .map(|index| { + let mut plan = AuthorizationPlan::proof(ProofRef::new( + [u8::try_from(index).expect("hard bound fits byte"); 32], + )); + for _ in 1..max_depth - 1 { + plan = AuthorizationPlan::all_of(vec![plan]).expect("single bounded child"); + } + plan + }) + .collect(); + let plan = AuthorizationPlan::all_of(members).expect("joint hard boundary"); + let shape = plan.validate(&limits).expect("hard-bound shape"); + assert_eq!(shape.leaves().len(), max_leaves); + assert_eq!(shape.maximum_depth(), max_depth); + let mut branches = 0; + let mut events = 0; + let actual = evaluate_observed( + &plan, + &limits, + &mut |_| { + branches += 1; + BranchOutcome::Authorized + }, + &mut |_| events += 1, + ); + assert_eq!(actual, Ok(BranchOutcome::Authorized)); + assert_eq!(branches, max_leaves); + assert_eq!(events, 1 + max_leaves * (max_depth - 1)); + assert!(events <= max_leaves * max_depth); + } + + #[test] + fn lower_deployment_limits_refuse_before_any_callback() { + let plan = AuthorizationPlan::all_of( + (1..=3) + .map(|tag| AuthorizationPlan::proof(ProofRef::new([tag; 32]))) + .collect(), + ) + .unwrap(); + let limits = VerifierLimits::hard() + .with_limit(auths_model::LimitKind::PlanBranching, 2) + .expect("lower deployment bound"); + let mut branches = 0; + let mut events = 0; + let result = evaluate_observed( + &plan, + &limits, + &mut |_| { + branches += 1; + BranchOutcome::Authorized + }, + &mut |_| events += 1, + ); + assert_eq!(result, Err(DenialReason::AuthorizationPlanInvalid)); + assert_eq!((branches, events), (0, 0)); + } + + fn nested_plan(seed: u64, leaves: &[u8]) -> AuthorizationPlan { + if leaves.len() == 1 { + return AuthorizationPlan::proof(ProofRef::new([leaves[0]; 32])); + } + let middle = leaves.len() / 2; + let children = vec![ + nested_plan(seed.rotate_left(7).wrapping_add(1), &leaves[..middle]), + nested_plan(seed.rotate_right(5).wrapping_add(3), &leaves[middle..]), + ]; + match seed % 3 { + 0 => AuthorizationPlan::all_of(children), + 1 => AuthorizationPlan::any_of(children), + _ => AuthorizationPlan::k_of_n(if seed & 8 == 0 { 1 } else { 2 }, children), + } + .expect("bounded distinct test leaves") + } + + fn diagnostic(tag: usize) -> BranchOutcome { + match tag % 8 { + 0 | 1 => BranchOutcome::Authorized, + 2 => BranchOutcome::Denied(DenialReason::InvalidSignature), + 3 => BranchOutcome::Denied(DenialReason::ActionBodyMismatch), + 4 => BranchOutcome::Indeterminate(Requirement::StaleStatus), + 5 => BranchOutcome::Indeterminate(Requirement::ApprovalUnavailable), + 6 => BranchOutcome::StructurallyInvalid(DenialReason::MissingReference), + _ => BranchOutcome::StructurallyInvalid(DenialReason::ActionConstraintMismatch), + } + } + + fn run_with_stateful_callbacks( + plan: &AuthorizationPlan, + tags: &[u8], + previous: bool, + ) -> (BranchOutcome, Vec, Vec, usize) { + let state = core::cell::Cell::new(0usize); + let mut visited = Vec::new(); + let mut events = Vec::new(); + let mut branch = |reference: ProofRef| { + state.set(state.get() + 11); + visited.push(reference); + diagnostic(usize::from(tags[usize::from(reference.as_bytes()[0]) - 1]) + state.get()) + }; + let mut observer = |event| { + state.set(state.get() + 17); + events.push(event); + }; + let outcome = if previous { + oracle::evaluate_node(plan, &mut branch, &mut observer) + } else { + evaluate_observed(plan, &VerifierLimits::hard(), &mut branch, &mut observer) + .expect("valid bounded plan") + }; + (outcome, visited, events, state.get()) + } + proptest! { + #[test] + fn streaming_summary_preserves_nested_results_and_callback_events( + tags in proptest::collection::vec(any::(), 1..33), + seed in any::(), + ) { + let leaves: Vec = (1..=tags.len()) + .map(|index| u8::try_from(index).expect("bounded test index")) + .collect(); + let plan = nested_plan(seed, &leaves); + prop_assert_eq!( + run_with_stateful_callbacks(&plan, &tags, false), + run_with_stateful_callbacks(&plan, &tags, true), + ); + } + #[test] fn threshold_matches_exact_counting( tags in proptest::collection::vec(0u8..3, 1..16), diff --git a/core/crates/auths-composition/src/oracle.rs b/core/crates/auths-composition/src/oracle.rs new file mode 100644 index 000000000..eb98f7f0e --- /dev/null +++ b/core/crates/auths-composition/src/oracle.rs @@ -0,0 +1,137 @@ +//! Previous production evaluator, retained only as a refactor oracle. +use super::*; + +pub(super) fn evaluate_node( + plan: &AuthorizationPlan, + branch: &mut impl FnMut(ProofRef) -> BranchOutcome, + observer: &mut impl FnMut(EvaluationEvent), +) -> BranchOutcome { + match plan.as_ref() { + AuthorizationPlanRef::Proof(reference) => { + let outcome = branch(reference); + observer(EvaluationEvent::Proof { reference, outcome }); + outcome + } + AuthorizationPlanRef::AllOf(members) => { + let child_count = members.len(); + let mut authorized = 0usize; + let mut denied = Vec::new(); + let mut indeterminate = Vec::new(); + for member in members { + match evaluate_node(member, branch, observer) { + BranchOutcome::Authorized => authorized += 1, + BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { + denied.push(reason); + } + BranchOutcome::Indeterminate(requirement) => indeterminate.push(requirement), + } + } + let outcome = canonical_denial(&denied).map_or_else( + || { + canonical_requirement(&indeterminate) + .map_or(BranchOutcome::Authorized, BranchOutcome::Indeterminate) + }, + BranchOutcome::Denied, + ); + observe_aggregate( + observer, + child_count, + u16::try_from(child_count).unwrap_or(u16::MAX), + authorized, + indeterminate.len(), + outcome, + ) + } + AuthorizationPlanRef::AnyOf(members) => { + let child_count = members.len(); + let mut authorized = 0usize; + let mut denied = Vec::new(); + let mut indeterminate = Vec::new(); + for member in members { + match evaluate_node(member, branch, observer) { + BranchOutcome::Authorized => authorized += 1, + BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { + denied.push(reason); + } + BranchOutcome::Indeterminate(requirement) => indeterminate.push(requirement), + } + } + let outcome = if authorized > 0 { + BranchOutcome::Authorized + } else if let Some(requirement) = canonical_requirement(&indeterminate) { + BranchOutcome::Indeterminate(requirement) + } else { + BranchOutcome::Denied( + canonical_denial(&denied).unwrap_or(DenialReason::AuthorizationPlanInvalid), + ) + }; + observe_aggregate( + observer, + child_count, + 1, + authorized, + indeterminate.len(), + outcome, + ) + } + AuthorizationPlanRef::KOfN { k, members } => { + let child_count = members.len(); + let mut authorized = 0usize; + let mut indeterminate = 0usize; + let mut denied = Vec::new(); + let mut requirements = Vec::new(); + for member in members { + match evaluate_node(member, branch, observer) { + BranchOutcome::Authorized => authorized += 1, + BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { + denied.push(reason); + } + BranchOutcome::Indeterminate(requirement) => { + indeterminate += 1; + requirements.push(requirement); + } + } + } + let outcome = match evaluate_threshold_counts(k, authorized, indeterminate) { + ThresholdTruth::Authorized => BranchOutcome::Authorized, + ThresholdTruth::Indeterminate => BranchOutcome::Indeterminate( + canonical_requirement(&requirements) + .unwrap_or(Requirement::ExternalFactUnavailable), + ), + ThresholdTruth::Denied => BranchOutcome::Denied( + canonical_denial(&denied).unwrap_or(DenialReason::AuthorizationPlanInvalid), + ), + }; + observe_aggregate(observer, child_count, k, authorized, indeterminate, outcome) + } + } +} + +fn observe_aggregate( + observer: &mut impl FnMut(EvaluationEvent), + child_count: usize, + required: u16, + authorized: usize, + indeterminate: usize, + outcome: BranchOutcome, +) -> BranchOutcome { + observer(EvaluationEvent::Aggregate { + child_count, + required, + authorized, + indeterminate, + outcome, + }); + outcome +} + +fn canonical_denial(reasons: &[DenialReason]) -> Option { + reasons.iter().copied().min_by_key(|reason| reason.code()) +} + +fn canonical_requirement(requirements: &[Requirement]) -> Option { + requirements + .iter() + .copied() + .min_by_key(|requirement| requirement.code()) +} diff --git a/core/crates/auths-composition/src/summary.rs b/core/crates/auths-composition/src/summary.rs new file mode 100644 index 000000000..c9494a90f --- /dev/null +++ b/core/crates/auths-composition/src/summary.rs @@ -0,0 +1,62 @@ +//! Constant-space state of the complete immediate-child outcome sequence. +use super::{BranchOutcome, ThresholdTruth, evaluate_threshold_counts}; +use auths_model::{DenialReason, Requirement}; + +#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] +pub(crate) struct Summary { + pub(crate) authorized: usize, + pub(crate) indeterminate: usize, + denial: Option, + requirement: Option, +} + +pub(crate) fn push(state: &mut Summary, outcome: BranchOutcome) { + match outcome { + BranchOutcome::Authorized => state.authorized += 1, + BranchOutcome::Denied(reason) | BranchOutcome::StructurallyInvalid(reason) => { + match state.denial { + None => state.denial = Some(reason), + Some(current) => { + if reason.code_precedes(current) { + state.denial = Some(reason); + } + } + } + } + BranchOutcome::Indeterminate(requirement) => { + state.indeterminate += 1; + match state.requirement { + None => state.requirement = Some(requirement), + Some(current) => { + if requirement.code_precedes(current) { + state.requirement = Some(requirement); + } + } + } + } + } +} + +pub(crate) fn all(state: Summary) -> BranchOutcome { + match state.denial { + Some(reason) => BranchOutcome::Denied(reason), + None => match state.requirement { + Some(requirement) => BranchOutcome::Indeterminate(requirement), + None => BranchOutcome::Authorized, + }, + } +} + +pub(crate) fn threshold(state: Summary, required: u16) -> BranchOutcome { + match evaluate_threshold_counts(required, state.authorized, state.indeterminate) { + ThresholdTruth::Authorized => BranchOutcome::Authorized, + ThresholdTruth::Indeterminate => match state.requirement { + Some(requirement) => BranchOutcome::Indeterminate(requirement), + None => BranchOutcome::Indeterminate(Requirement::ExternalFactUnavailable), + }, + ThresholdTruth::Denied => match state.denial { + Some(reason) => BranchOutcome::Denied(reason), + None => BranchOutcome::Denied(DenialReason::AuthorizationPlanInvalid), + }, + } +} diff --git a/core/crates/auths-model/src/identifier.rs b/core/crates/auths-model/src/identifier.rs new file mode 100644 index 000000000..488137033 --- /dev/null +++ b/core/crates/auths-model/src/identifier.rs @@ -0,0 +1,143 @@ +//! Fixed Unicode control and whitespace rules for protocol identifiers. +//! +//! Matching UTF-8 prefixes avoids an iterator callback and keeps the bounded +//! validation loop directly available to the qualified Rust-to-Lean translator. +//! Callers pass valid Rust strings; the byte scan itself is total on any slice. +//! The exclusion set agrees with the pinned Rust toolchain's `char::is_control` +//! and `char::is_whitespace`, as checked against every Unicode scalar in tests. + +fn forbidden_three_byte_prefix(first: u8, second: u8, third: u8) -> bool { + if first == 0xe1 { + second == 0x9a && third == 0x80 + } else if first == 0xe2 { + if second == 0x80 { + matches!(third, 0x80..=0x8a) || third == 0xa8 || third == 0xa9 || third == 0xaf + } else { + second == 0x81 && third == 0x9f + } + } else { + first == 0xe3 && second == 0x80 && third == 0x80 + } +} + +fn forbidden_identifier_at(input: &[u8], position: usize) -> bool { + let first = match input.get(position) { + Some(byte) => *byte, + None => return false, + }; + if first <= 0x20 || first == 0x7f { + return true; + } + if input.len() - position < 2 { + return false; + } + let second = input[position + 1]; + if first == 0xc2 { + return matches!(second, 0x80..=0xa0); + } + if input.len() - position < 3 { + return false; + } + forbidden_three_byte_prefix(first, second, input[position + 2]) +} + +fn contains_forbidden_identifier(input: &[u8]) -> bool { + let mut position = 0; + while position < input.len() { + if forbidden_identifier_at(input, position) { + return true; + } + position += 1; + } + false +} + +pub(crate) fn bounded_identifier_valid(value: &str, maximum: usize) -> bool { + !value.is_empty() && value.len() <= maximum && !contains_forbidden_identifier(value.as_bytes()) +} + +#[allow( + clippy::manual_range_contains, + reason = "The qualified classifier keeps ASCII ranges as transparent scalar comparisons." +)] +fn principal_scheme_byte_valid(byte: u8) -> bool { + (b'a' <= byte && byte <= b'z') + || (b'0' <= byte && byte <= b'9') + || byte == b'+' + || byte == b'-' + || byte == b'.' +} + +/// Recognizes the lowercase ASCII URI scheme and a nonempty remainder. +/// Callers separately enforce the identifier's byte bound and character rules. +pub(crate) fn principal_scheme_valid(value: &str) -> bool { + let bytes = value.as_bytes(); + if bytes.len() < 3 || !(b'a' <= bytes[0] && bytes[0] <= b'z') { + return false; + } + let mut position = 1; + let mut valid = true; + let mut found = false; + while position < bytes.len() && valid && !found { + let byte = bytes[position]; + if byte == b':' { + found = true; + } else { + valid = principal_scheme_byte_valid(byte); + } + position += 1; + } + valid && found && position < bytes.len() +} + +#[cfg(test)] +mod tests { + use super::{bounded_identifier_valid, contains_forbidden_identifier}; + use alloc::vec::Vec; + use proptest::prelude::*; + + #[test] + fn every_unicode_scalar_matches_the_character_oracle() { + let mut allowed = Vec::new(); + for scalar in 0..=0x0010_ffff { + let Some(character) = char::from_u32(scalar) else { + continue; + }; + let mut encoded = [0; 4]; + let text = character.encode_utf8(&mut encoded); + let expected = character.is_control() || character.is_whitespace(); + assert_eq!( + contains_forbidden_identifier(text.as_bytes()), + expected, + "standalone U+{scalar:04X}" + ); + let mut framed = [b'a'; 6]; + let end = 1 + text.len(); + framed[1..end].copy_from_slice(text.as_bytes()); + framed[end] = b'z'; + assert_eq!( + contains_forbidden_identifier(&framed[..=end]), + expected, + "framed U+{scalar:04X}" + ); + if !expected { + allowed.extend_from_slice(text.as_bytes()); + } + } + assert!( + !contains_forbidden_identifier(&allowed), + "adjacent allowed scalars cannot create a forbidden prefix" + ); + } + + proptest! { + #[test] + fn bounded_validation_matches_the_previous_character_rule( + text in "(?s).{0,1024}", maximum in 0usize..4096, + ) { + let expected = !text.is_empty() && text.len() <= maximum + && !text.chars().any(|c| c.is_control() || c.is_whitespace()); + prop_assert_eq!(bounded_identifier_valid(&text, maximum), expected); + } + } +} diff --git a/core/crates/auths-model/src/lib.rs b/core/crates/auths-model/src/lib.rs index dabf5a4fe..ed50517ad 100644 --- a/core/crates/auths-model/src/lib.rs +++ b/core/crates/auths-model/src/lib.rs @@ -7,12 +7,13 @@ extern crate alloc; mod bounded; +mod identifier; pub use bounded::{BoundError, BoundedBytes, BoundedSet}; use alloc::{ collections::{BTreeMap, BTreeSet}, - string::{String, ToString}, + string::String, vec::Vec, }; use core::fmt; @@ -109,18 +110,6 @@ impl ProtocolVersion { } } -fn parse_bounded(value: &str, maximum: usize, error: ModelError) -> Result { - if value.is_empty() - || value.len() > maximum - || value - .chars() - .any(|character| character.is_control() || character.is_whitespace()) - { - return Err(error); - } - Ok(value.to_string()) -} - fn byte_slices_equal(left: &[u8], right: &[u8]) -> bool { left == right } @@ -140,7 +129,10 @@ macro_rules! bounded_string { /// empty, exceeds its protocol bound, or contains whitespace or a /// control character. pub fn parse(value: &str) -> Result { - parse_bounded(value, $maximum, $error).map(Self) + if !$crate::identifier::bounded_identifier_valid(value, $maximum) { + return Err($error); + } + Ok(Self(String::from(value))) } #[must_use] @@ -170,22 +162,12 @@ impl PrincipalId { /// its byte bound, contains whitespace/control characters, lacks a URI /// scheme, or uses a non-canonical scheme. pub fn parse(value: &str) -> Result { - let parsed = parse_bounded(value, 512, ModelError::InvalidPrincipal)?; - let (scheme, remainder) = parsed.split_once(':').ok_or(ModelError::InvalidPrincipal)?; - let mut characters = scheme.chars(); - if remainder.is_empty() - || !characters - .next() - .is_some_and(|character| character.is_ascii_lowercase()) - || !characters.all(|character| { - character.is_ascii_lowercase() - || character.is_ascii_digit() - || matches!(character, '+' | '-' | '.') - }) + if !identifier::bounded_identifier_valid(value, 512) + || !identifier::principal_scheme_valid(value) { return Err(ModelError::InvalidPrincipal); } - Ok(Self(parsed)) + Ok(Self(String::from(value))) } /// Returns the canonical principal identifier. @@ -1637,6 +1619,25 @@ pub struct CanonicalAction { detached_attachments: Vec, } +fn canonical_attachments_valid(attachments: &[DetachedAttachment]) -> bool { + let mut index = 0; + let mut total = 0usize; + while index < attachments.len() { + if index > 0 && attachments[index - 1].digest() == attachments[index].digest() { + return false; + } + total = match total.checked_add(attachments[index].bytes().len()) { + Some(value) => value, + None => return false, + }; + if total > HARD_MAX_ATTACHMENT_BYTES { + return false; + } + index += 1; + } + true +} + impl CanonicalAction { /// Constructs a bounded profile-canonical action. /// @@ -1672,25 +1673,22 @@ impl CanonicalAction { /// protocol bounds, contains duplicate identifiers, or the accumulated /// detached bytes exceed the attachment-byte hard limit. pub fn with_detached_attachments( - mut self, + self, mut attachments: Vec, ) -> Result { - attachments.sort_by_key(DetachedAttachment::digest); - if attachments.len() > HARD_MAX_ATTACHMENTS - || attachments - .windows(2) - .any(|window| window[0].digest() == window[1].digest()) - || attachments - .iter() - .try_fold(0usize, |total, attachment| { - total.checked_add(attachment.bytes().len()) - }) - .is_none_or(|total| total > HARD_MAX_ATTACHMENT_BYTES) - { + if attachments.len() > HARD_MAX_ATTACHMENTS { return Err(ModelError::InvalidAttachment); } - self.detached_attachments = attachments; - Ok(self) + // A concrete stateless closure keeps the translated key computation explicit. + #[allow(clippy::redundant_closure_for_method_calls)] + attachments.sort_by_key(|attachment| attachment.digest()); + if !canonical_attachments_valid(&attachments) { + return Err(ModelError::InvalidAttachment); + } + Ok(Self { + detached_attachments: attachments, + ..self + }) } /// Returns the exact profile and semantic version. @@ -1834,9 +1832,24 @@ impl AuthorizationPlan { fn compound(mut node: AuthorizationPlanNode) -> Result { match &mut node { AuthorizationPlanNode::Proof(_) => {} - AuthorizationPlanNode::AllOf(members) - | AuthorizationPlanNode::AnyOf(members) - | AuthorizationPlanNode::KOfN { members, .. } => members.sort(), + AuthorizationPlanNode::AllOf(members) | AuthorizationPlanNode::AnyOf(members) => { + if members.is_empty() { + return Err(ModelError::InvalidPlan); + } + if members.len() > HARD_MAX_PLAN_BRANCHING { + return Err(ModelError::PlanLimitExceeded); + } + members.sort(); + } + AuthorizationPlanNode::KOfN { k, members } => { + if *k == 0 || usize::from(*k) > members.len() || members.is_empty() { + return Err(ModelError::InvalidPlan); + } + if members.len() > HARD_MAX_PLAN_BRANCHING { + return Err(ModelError::PlanLimitExceeded); + } + members.sort(); + } } let plan = Self(node); plan.validate(&VerifierLimits::hard())?; @@ -1864,6 +1877,19 @@ impl AuthorizationPlan { /// and [`ModelError::PlanLimitExceeded`] for excessive depth, excessive /// leaves, or repeated proof references. pub fn validate(&self, limits: &VerifierLimits) -> Result { + fn walk_members( + members: &[AuthorizationPlan], + depth: usize, + limits: &VerifierLimits, + refs: &mut BTreeSet, + maximum_depth: &mut usize, + ) -> Result<(), ModelError> { + for member in members { + walk(member, depth + 1, limits, refs, maximum_depth)?; + } + Ok(()) + } + fn walk( plan: &AuthorizationPlan, depth: usize, @@ -1888,9 +1914,7 @@ impl AuthorizationPlan { if members.len() > limits.plan_branching { return Err(ModelError::PlanLimitExceeded); } - for member in members { - walk(member, depth + 1, limits, refs, maximum_depth)?; - } + walk_members(members, depth, limits, refs, maximum_depth)?; } AuthorizationPlanNode::KOfN { k, members } => { if *k == 0 || usize::from(*k) > members.len() || members.is_empty() { @@ -1899,9 +1923,7 @@ impl AuthorizationPlan { if members.len() > limits.plan_branching { return Err(ModelError::PlanLimitExceeded); } - for member in members { - walk(member, depth + 1, limits, refs, maximum_depth)?; - } + walk_members(members, depth, limits, refs, maximum_depth)?; } } Ok(()) @@ -1910,8 +1932,14 @@ impl AuthorizationPlan { let mut refs = BTreeSet::new(); let mut maximum_depth = 0; walk(self, 1, limits, &mut refs, &mut maximum_depth)?; + // Keep collection visible to the pinned extractor instead of hiding + // it behind Iterator::collect's unsupported trait default. + let mut leaves = Vec::with_capacity(refs.len()); + for reference in refs { + leaves.push(reference); + } Ok(PlanShape { - leaves: refs.into_iter().collect(), + leaves, maximum_depth, }) } @@ -2290,14 +2318,21 @@ impl StatusScopeAnchors { /// Returns [`ModelError::InvalidStatusSnapshot`] for an empty list, a /// repeated identifier, or more than [`HARD_MAX_TRUST_ANCHORS`] entries. pub fn new(mut anchors: Vec) -> Result { - anchors.sort(); - if anchors.is_empty() - || anchors.len() > HARD_MAX_TRUST_ANCHORS - || anchors.windows(2).any(|window| window[0] == window[1]) - { + if anchors.is_empty() || anchors.len() > HARD_MAX_TRUST_ANCHORS { return Err(ModelError::InvalidStatusSnapshot); } - Ok(Self(anchors)) + anchors.sort(); + let mut position = 1; + let mut repeated = false; + while position < anchors.len() && !repeated { + repeated = anchors[position - 1] == anchors[position]; + position += 1; + } + if repeated { + Err(ModelError::InvalidStatusSnapshot) + } else { + Ok(Self(anchors)) + } } /// Returns the identifiers in ascending order. @@ -2355,10 +2390,16 @@ pub fn status_issuer_in_scope( issuer: &PrincipalId, anchor: &TrustAnchor, ) -> bool { - trust - .iter() - .filter(|rule| rule.issuer() == issuer) - .all(|rule| rule.scope().covers(issuer, anchor)) + let mut visible = true; + let mut position = 0; + while position < trust.len() && visible { + let rule = &trust[position]; + if rule.issuer() == issuer { + visible = rule.scope().covers(issuer, anchor); + } + position += 1; + } + visible } /// Whose status evaluation a snapshot statement may take part in. @@ -2383,10 +2424,18 @@ pub fn status_issuer_visible( ) -> bool { match view { StatusView::Anchor(anchor) => status_issuer_in_scope(trust, issuer, anchor), - StatusView::Approver => trust - .iter() - .filter(|rule| rule.issuer() == issuer) - .all(|rule| matches!(rule.scope(), StatusScope::AnyAnchor)), + StatusView::Approver => { + let mut visible = true; + let mut position = 0; + while position < trust.len() && visible { + let rule = &trust[position]; + if rule.issuer() == issuer { + visible = matches!(rule.scope(), StatusScope::AnyAnchor); + } + position += 1; + } + visible + } } } @@ -4925,58 +4974,83 @@ pub enum DenialReason { ApprovalThresholdNotMet, } -impl DenialReason { - /// Returns the stable language-neutral V1 reason code. - #[must_use] - pub const fn code(self) -> &'static str { - match self { - Self::MalformedProof => "malformed-proof", - Self::NonCanonicalProof => "non-canonical-proof", - Self::ResourceLimitExceeded => "resource-limit-exceeded", - Self::DigestMismatch => "digest-mismatch", - Self::DuplicateObject => "duplicate-object", - Self::MissingReference => "missing-reference", - Self::ReferenceCycle => "reference-cycle", - Self::AmbiguousTerminalGrant => "ambiguous-terminal-grant", - Self::UnusedCriticalEvidence => "unused-critical-evidence", - Self::InvalidSignature => "invalid-signature", - Self::PrincipalMethodMismatch => "principal-method-mismatch", - Self::VerificationMethodMismatch => "verification-method-mismatch", - Self::SignatureSuiteMismatch => "signature-suite-mismatch", - Self::UntrustedRoot => "untrusted-root", - Self::BrokenGrantChain => "broken-grant-chain", - Self::DelegationExpanded => "delegation-expanded", - Self::PermissionNotGranted => "permission-not-granted", - Self::ActionConstraintMismatch => "action-constraint-mismatch", - Self::BudgetCeilingExceeded => "budget-ceiling-exceeded", - Self::AuthorizationPlanInvalid => "authorization-plan-invalid", - Self::CompositionRequirementNotMet => "composition-requirement-not-met", - Self::PlanActionMismatch => "plan-action-mismatch", - Self::ActionBodyMismatch => "action-body-mismatch", - Self::AudienceMismatch => "audience-mismatch", - Self::ChallengeMismatch => "challenge-mismatch", - Self::ActionOutsideValidity => "action-outside-validity", - Self::PrincipalRevoked => "principal-revoked", - Self::GrantRevoked => "grant-revoked", - Self::StatusSequenceRollback => "status-sequence-rollback", - Self::StatusMethodMismatch => "status-method-mismatch", - Self::StatusIssuerUntrusted => "status-issuer-untrusted", - Self::RegistryManifestMismatch => "registry-manifest-mismatch", - Self::VerifierConfigurationMismatch => "verifier-configuration-mismatch", - Self::ResourceNamespaceMismatch => "resource-namespace-mismatch", - Self::CriticalExtensionUnknown => "critical-extension-unknown", - Self::AttachmentMissing => "attachment-missing", - Self::AttachmentDigestMismatch => "attachment-digest-mismatch", - Self::AttachmentLengthMismatch => "attachment-length-mismatch", - Self::DuplicateAttachment => "duplicate-attachment", - Self::UnusedCriticalAttachment => "unused-critical-attachment", - Self::OpaqueAttachmentNotAllowed => "opaque-attachment-not-allowed", - Self::LocalPolicyDenied => "local-policy-denied", - Self::ObservationConditionFalse => "observation-condition-false", - Self::ObserverInAuthorityChain => "observer-in-authority-chain", - Self::ObservationRequirementDropped => "observation-requirement-dropped", - Self::ApprovalThresholdNotMet => "approval-threshold-not-met", +// Each result-code string and its lexical selection rank share one catalog. +// Ranks are internal comparison data; they are never serialized. +macro_rules! ordered_result_codes { + ($($variant:ident => ($code:literal, $rank:literal)),+ $(,)?) => { + /// Returns the stable language-neutral V1 result code. + #[must_use] + pub const fn code(self) -> &'static str { + match self { $(Self::$variant => $code),+ } + } + + /// Tests strict lexical order of the stable V1 result codes. + /// + /// This is the same order as `self.code() < other.code()`, without + /// borrowing strings or allocating diagnostic collections. The + /// internal numeric ranks are not a protocol or persistence format. + #[must_use] + pub const fn code_precedes(self, other: Self) -> bool { + self.code_order() < other.code_order() } + + const fn code_order(self) -> u8 { + match self { $(Self::$variant => $rank),+ } + } + + #[cfg(test)] + const CODE_CATALOG: &'static [Self] = &[$(Self::$variant),+]; + }; +} + +impl DenialReason { + ordered_result_codes! { + ActionBodyMismatch => ("action-body-mismatch", 0), + ActionConstraintMismatch => ("action-constraint-mismatch", 1), + ActionOutsideValidity => ("action-outside-validity", 2), + AmbiguousTerminalGrant => ("ambiguous-terminal-grant", 3), + ApprovalThresholdNotMet => ("approval-threshold-not-met", 4), + AttachmentDigestMismatch => ("attachment-digest-mismatch", 5), + AttachmentLengthMismatch => ("attachment-length-mismatch", 6), + AttachmentMissing => ("attachment-missing", 7), + AudienceMismatch => ("audience-mismatch", 8), + AuthorizationPlanInvalid => ("authorization-plan-invalid", 9), + BrokenGrantChain => ("broken-grant-chain", 10), + BudgetCeilingExceeded => ("budget-ceiling-exceeded", 11), + ChallengeMismatch => ("challenge-mismatch", 12), + CompositionRequirementNotMet => ("composition-requirement-not-met", 13), + CriticalExtensionUnknown => ("critical-extension-unknown", 14), + DelegationExpanded => ("delegation-expanded", 15), + DigestMismatch => ("digest-mismatch", 16), + DuplicateAttachment => ("duplicate-attachment", 17), + DuplicateObject => ("duplicate-object", 18), + GrantRevoked => ("grant-revoked", 19), + InvalidSignature => ("invalid-signature", 20), + LocalPolicyDenied => ("local-policy-denied", 21), + MalformedProof => ("malformed-proof", 22), + MissingReference => ("missing-reference", 23), + NonCanonicalProof => ("non-canonical-proof", 24), + ObservationConditionFalse => ("observation-condition-false", 25), + ObservationRequirementDropped => ("observation-requirement-dropped", 26), + ObserverInAuthorityChain => ("observer-in-authority-chain", 27), + OpaqueAttachmentNotAllowed => ("opaque-attachment-not-allowed", 28), + PermissionNotGranted => ("permission-not-granted", 29), + PlanActionMismatch => ("plan-action-mismatch", 30), + PrincipalMethodMismatch => ("principal-method-mismatch", 31), + PrincipalRevoked => ("principal-revoked", 32), + ReferenceCycle => ("reference-cycle", 33), + RegistryManifestMismatch => ("registry-manifest-mismatch", 34), + ResourceLimitExceeded => ("resource-limit-exceeded", 35), + ResourceNamespaceMismatch => ("resource-namespace-mismatch", 36), + SignatureSuiteMismatch => ("signature-suite-mismatch", 37), + StatusIssuerUntrusted => ("status-issuer-untrusted", 38), + StatusMethodMismatch => ("status-method-mismatch", 39), + StatusSequenceRollback => ("status-sequence-rollback", 40), + UntrustedRoot => ("untrusted-root", 41), + UnusedCriticalAttachment => ("unused-critical-attachment", 42), + UnusedCriticalEvidence => ("unused-critical-evidence", 43), + VerificationMethodMismatch => ("verification-method-mismatch", 44), + VerifierConfigurationMismatch => ("verifier-configuration-mismatch", 45), } /// Parses one exact stable V1 denial code. @@ -5061,32 +5135,28 @@ pub enum Requirement { } impl Requirement { - /// Returns the stable language-neutral V1 requirement code. - #[must_use] - pub const fn code(self) -> &'static str { - match self { - Self::UnsupportedProtocol => "unsupported-protocol", - Self::UnsupportedPrincipalMethod => "unsupported-principal-method", - Self::UnsupportedSignatureSuite => "unsupported-signature-suite", - Self::UnsupportedEvidenceType => "unsupported-evidence-type", - Self::UnsupportedStatusMethod => "unsupported-status-method", - Self::UnsupportedProfile => "unsupported-profile", - Self::UnsupportedProfilePolicy => "unsupported-profile-policy", - Self::UnsupportedResourceMatcher => "unsupported-resource-matcher", - Self::UnsupportedBudgetAlgebra => "unsupported-budget-algebra", - Self::UnsupportedCriticalExtension => "unsupported-critical-extension", - Self::UnsupportedAssuranceClaim => "unsupported-assurance-claim", - Self::MissingPrincipalEvidence => "missing-principal-evidence", - Self::MissingPrincipalStatus => "missing-principal-status", - Self::MissingGrantStatus => "missing-grant-status", - Self::StaleStatus => "stale-status", - Self::HistoricalStateUnavailable => "historical-state-unavailable", - Self::AssuranceRequirementNotMet => "assurance-requirement-not-met", - Self::ExternalFactUnavailable => "external-fact-unavailable", - Self::ObservationMissing => "observation-missing", - Self::ObservationActionFactUnavailable => "observation-action-fact-unavailable", - Self::ApprovalUnavailable => "approval-unavailable", - } + ordered_result_codes! { + ApprovalUnavailable => ("approval-unavailable", 0), + AssuranceRequirementNotMet => ("assurance-requirement-not-met", 1), + ExternalFactUnavailable => ("external-fact-unavailable", 2), + HistoricalStateUnavailable => ("historical-state-unavailable", 3), + MissingGrantStatus => ("missing-grant-status", 4), + MissingPrincipalEvidence => ("missing-principal-evidence", 5), + MissingPrincipalStatus => ("missing-principal-status", 6), + ObservationActionFactUnavailable => ("observation-action-fact-unavailable", 7), + ObservationMissing => ("observation-missing", 8), + StaleStatus => ("stale-status", 9), + UnsupportedAssuranceClaim => ("unsupported-assurance-claim", 10), + UnsupportedBudgetAlgebra => ("unsupported-budget-algebra", 11), + UnsupportedCriticalExtension => ("unsupported-critical-extension", 12), + UnsupportedEvidenceType => ("unsupported-evidence-type", 13), + UnsupportedPrincipalMethod => ("unsupported-principal-method", 14), + UnsupportedProfile => ("unsupported-profile", 15), + UnsupportedProfilePolicy => ("unsupported-profile-policy", 16), + UnsupportedProtocol => ("unsupported-protocol", 17), + UnsupportedResourceMatcher => ("unsupported-resource-matcher", 18), + UnsupportedSignatureSuite => ("unsupported-signature-suite", 19), + UnsupportedStatusMethod => ("unsupported-status-method", 20), } /// Parses one exact stable V1 indeterminate requirement code. @@ -5276,6 +5346,22 @@ mod kani_harnesses { #[cfg(test)] mod tests { + + #[test] + fn code_selection_matches_every_published_diagnostic_pair() { + for &left in DenialReason::CODE_CATALOG { + assert_eq!(DenialReason::from_code(left.code()), Some(left)); + for &right in DenialReason::CODE_CATALOG { + assert_eq!(left.code_precedes(right), left.code() < right.code()); + } + } + for &left in Requirement::CODE_CATALOG { + assert_eq!(Requirement::from_code(left.code()), Some(left)); + for &right in Requirement::CODE_CATALOG { + assert_eq!(left.code_precedes(right), left.code() < right.code()); + } + } + } use super::*; const IDENTITY_IDENTIFIER_VECTOR_V1: &str = r#"{"schema":"auths-identity-identifier-conformance/v1","maximum_utf8_bytes":128,"valid":["a","raw-key-v2","p256-sha256-v1","xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"],"invalid":["","contains space","contains\ttab","contains\nnewline","contains\u00a0space","contains\u0007control","xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"]}"#; @@ -5418,6 +5504,81 @@ mod tests { assert!(!set.attenuates(&exact)); } + #[test] + fn plan_constructors_enforce_branching_bound_and_error_precedence() { + let members = |count| { + (0..count) + .map(|index| { + let mut bytes = [0; 32]; + bytes[..8].copy_from_slice(&u64::try_from(index).unwrap().to_be_bytes()); + AuthorizationPlan::proof(ProofRef::new(bytes)) + }) + .collect::>() + }; + let count = HARD_MAX_PLAN_BRANCHING; + let required = u16::try_from(count).unwrap(); + for plan in [ + AuthorizationPlan::all_of(members(count)), + AuthorizationPlan::any_of(members(count)), + AuthorizationPlan::k_of_n(required, members(count)), + ] { + let shape = plan.unwrap().validate(&VerifierLimits::hard()).unwrap(); + assert_eq!(shape.leaves.len(), count); + assert_eq!(shape.maximum_depth, 2); + } + for count in [count + 1, count * 8] { + assert_eq!( + AuthorizationPlan::all_of(members(count)), + Err(ModelError::PlanLimitExceeded) + ); + assert_eq!( + AuthorizationPlan::any_of(members(count)), + Err(ModelError::PlanLimitExceeded) + ); + assert_eq!( + AuthorizationPlan::k_of_n(1, members(count)), + Err(ModelError::PlanLimitExceeded) + ); + assert_eq!( + AuthorizationPlan::k_of_n(0, members(count)), + Err(ModelError::InvalidPlan) + ); + } + assert_eq!( + AuthorizationPlan::all_of(Vec::new()), + Err(ModelError::InvalidPlan) + ); + assert_eq!( + AuthorizationPlan::any_of(Vec::new()), + Err(ModelError::InvalidPlan) + ); + assert_eq!( + AuthorizationPlan::k_of_n(1, Vec::new()), + Err(ModelError::InvalidPlan) + ); + assert_eq!( + AuthorizationPlan::k_of_n(2, members(1)), + Err(ModelError::InvalidPlan) + ); + } + + #[test] + fn plan_shape_preserves_sorted_leaf_values_and_depth() { + let reference = |tag| ProofRef::new([tag; 32]); + let plan = AuthorizationPlan::all_of(vec![ + AuthorizationPlan::proof(reference(3)), + AuthorizationPlan::any_of(vec![ + AuthorizationPlan::proof(reference(2)), + AuthorizationPlan::proof(reference(1)), + ]) + .unwrap(), + ]) + .unwrap(); + let shape = plan.validate(&VerifierLimits::hard()).unwrap(); + assert_eq!(shape.leaves(), [reference(1), reference(2), reference(3)]); + assert_eq!(shape.maximum_depth(), 3); + } + #[test] fn plan_rejects_duplicate_leaf() { let leaf = AuthorizationPlan::proof(digest(1).into()); @@ -6143,3 +6304,11 @@ mod tests { ); } } + +#[cfg(test)] +#[path = "scope_constructor_tests.rs"] +mod scope_constructor_tests; + +#[cfg(test)] +#[path = "principal_scheme_tests.rs"] +mod principal_scheme_tests; diff --git a/core/crates/auths-model/src/observation.rs b/core/crates/auths-model/src/observation.rs index a6d11780b..d57efc3de 100644 --- a/core/crates/auths-model/src/observation.rs +++ b/core/crates/auths-model/src/observation.rs @@ -15,7 +15,7 @@ use crate::{ EvidenceObject, HARD_MAX_PERMISSIONS, HARD_MAX_REGISTRY_ENTRIES, ModelError, PrincipalId, PrincipalMethodId, ProtocolVersion, ResourceId, SignatureEnvelope, Timestamp, ValidityWindow, - byte_slices_equal, parse_bounded, + byte_slices_equal, }; use alloc::{string::String, vec::Vec}; use core::fmt; diff --git a/core/crates/auths-model/src/principal_scheme_tests.rs b/core/crates/auths-model/src/principal_scheme_tests.rs new file mode 100644 index 000000000..da3889e8c --- /dev/null +++ b/core/crates/auths-model/src/principal_scheme_tests.rs @@ -0,0 +1,79 @@ +//! Independent character-based oracle for the principal byte-loop cutover. +use super::*; +use alloc::{format, string::String}; + +fn reference(value: &str) -> Result { + if value.is_empty() + || value.len() > 512 + || value + .chars() + .any(|character| character.is_control() || character.is_whitespace()) + { + return Err(ModelError::InvalidPrincipal); + } + let parsed = String::from(value); + let (scheme, remainder) = parsed.split_once(':').ok_or(ModelError::InvalidPrincipal)?; + let mut characters = scheme.chars(); + if remainder.is_empty() + || !characters + .next() + .is_some_and(|character| character.is_ascii_lowercase()) + || !characters.all(|character| { + character.is_ascii_lowercase() + || character.is_ascii_digit() + || matches!(character, '+' | '-' | '.') + }) + { + return Err(ModelError::InvalidPrincipal); + } + Ok(parsed) +} + +fn check(value: &str) { + let actual = PrincipalId::parse(value).map(|id| String::from(id.as_str())); + assert_eq!(actual, reference(value), "principal {value:?}"); +} + +#[test] +fn principal_parser_matches_each_unicode_scalar_in_scheme_and_remainder() { + for scalar in 0..=0x0010_ffff { + let Some(character) = char::from_u32(scalar) else { + continue; + }; + check(&format!("{character}:x")); + check(&format!("a{character}:x")); + check(&format!("a:{character}")); + } +} + +#[test] +fn principal_parser_matches_adversarial_schemes_and_byte_boundaries() { + for first in 0_u8..=127 { + for second in 0_u8..=127 { + check(&format!("{}{}:x", char::from(first), char::from(second))); + } + } + for size in [0, 1, 2, 3, 510, 511, 512, 513, 1024] { + check(&"a".repeat(size)); + check(&format!("a:{}", "x".repeat(size))); + check(&format!("{}:x", "a".repeat(size))); + check(&format!("a:{}", "é".repeat(size))); + } + for value in [ + "a:x", + "raw:key", + "did:key:z", + "a+1-.:x", + "a:", + "a", + ":x", + "A:x", + "1:x", + "+a:x", + "a:x:y", + "a:é", + "a:🙂", + ] { + check(value); + } +} diff --git a/core/crates/auths-model/src/scope_constructor_tests.rs b/core/crates/auths-model/src/scope_constructor_tests.rs new file mode 100644 index 000000000..95023499e --- /dev/null +++ b/core/crates/auths-model/src/scope_constructor_tests.rs @@ -0,0 +1,67 @@ +//! Independent pre-refactor sorting/validation oracle; test-only. +use super::*; +use alloc::format; + +fn reference(mut anchors: Vec) -> Result, ModelError> { + anchors.sort(); + if anchors.is_empty() + || anchors.len() > HARD_MAX_TRUST_ANCHORS + || anchors.windows(2).any(|window| window[0] == window[1]) + { + return Err(ModelError::InvalidStatusSnapshot); + } + Ok(anchors) +} + +fn next_word(state: &mut u64) -> u64 { + *state ^= *state << 13; + *state ^= *state >> 7; + *state ^= *state << 17; + *state +} + +#[test] +fn scope_constructor_matches_reference_for_validated_ids() { + let mut admitted = 0; + let mut refused = 0; + for seed in [1_u64, 17, 42, 0x1234_5678] { + let mut state = seed; + for case in 0..1_500 { + let length = match case % 149 { + 0 => HARD_MAX_TRUST_ANCHORS - 1, + 1 => HARD_MAX_TRUST_ANCHORS, + 2 => HARD_MAX_TRUST_ANCHORS + 1, + 3 => HARD_MAX_TRUST_ANCHORS * 2, + _ => usize::try_from(next_word(&mut state) % 65).unwrap(), + }; + let mut anchors: Vec<_> = (0..length) + .map(|index| TrustAnchorId::parse(&format!("anchor:{index:04}")).unwrap()) + .collect(); + for index in (1..length).rev() { + let selected = + usize::try_from(next_word(&mut state) % u64::try_from(index + 1).unwrap()) + .unwrap(); + anchors.swap(index, selected); + } + if case % 4 == 0 && length > 1 { + anchors[length - 1] = anchors[0].clone(); + } + let expected = reference(anchors.clone()); + let actual = StatusScopeAnchors::new(anchors).map(|value| value.ids().to_vec()); + assert_eq!( + actual, expected, + "seed {seed}, case {case}, length {length}" + ); + match actual { + Ok(ids) => { + admitted += 1; + assert!(!ids.is_empty() && ids.len() <= HARD_MAX_TRUST_ANCHORS); + assert!(ids.windows(2).all(|pair| pair[0] < pair[1])); + } + Err(ModelError::InvalidStatusSnapshot) => refused += 1, + Err(other) => panic!("unexpected constructor result: {other:?}"), + } + } + } + assert!(admitted > 3_000 && refused > 1_000); +} diff --git a/core/crates/auths-ports/src/lib.rs b/core/crates/auths-ports/src/lib.rs index c16c0dd06..bb5efed57 100644 --- a/core/crates/auths-ports/src/lib.rs +++ b/core/crates/auths-ports/src/lib.rs @@ -447,6 +447,40 @@ pub enum StatusDecision { WrongMethod, } +/// One exact status decision and the last inclusive time for which its +/// selected snapshot and statements remain fresh. This is a property of the +/// supplied immutable evidence, not a promise that no later revocation exists. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct StatusEvaluation { + decision: StatusDecision, + valid_through: Timestamp, +} + +impl StatusEvaluation { + /// Constructs a method's temporal witness. An authorizing decision must + /// cover the evaluation time and every time through `valid_through` under + /// the same evidence and policy. Expiry-only policy has no status bound. + #[must_use] + pub const fn new(decision: StatusDecision, valid_through: Timestamp) -> Self { + Self { + decision, + valid_through, + } + } + + /// The evaluated status decision. + #[must_use] + pub const fn decision(self) -> StatusDecision { + self.decision + } + + /// Inclusive freshness horizon of the evidence actually selected. + #[must_use] + pub const fn valid_through(self) -> Timestamp { + self.valid_through + } +} + /// Pure exact status-method implementation shared by principal and grant status. pub trait StatusMethod { /// Returns the exact status-method identifier. @@ -472,7 +506,7 @@ pub trait StatusMethod { principal: &PrincipalId, view: StatusView<'_>, evaluation_time: Timestamp, - ) -> Result; + ) -> Result; /// Evaluates grant status for a branch under a trust anchor, with the same /// visibility and selection rules. /// @@ -486,7 +520,7 @@ pub trait StatusMethod { grant: GrantId, view: StatusView<'_>, evaluation_time: Timestamp, - ) -> Result; + ) -> Result; } /// Pure exact assurance-claim validation rule. diff --git a/core/crates/auths-registries/src/lib.rs b/core/crates/auths-registries/src/lib.rs index 84bc007d0..bdff84cc2 100644 --- a/core/crates/auths-registries/src/lib.rs +++ b/core/crates/auths-registries/src/lib.rs @@ -21,7 +21,7 @@ use auths_model::{ use auths_ports::{ AssuranceClaimRule, AssuranceImplication, BudgetAlgebra, CriticalExtensionHandler, PrincipalMethod, ProfileDecision, ProfilePolicy, RegistryOperationError, ResourceMatcher, - SignatureSuite, StatusDecision, StatusMethod, + SignatureSuite, StatusDecision, StatusEvaluation, StatusMethod, }; use core::fmt; @@ -490,26 +490,15 @@ impl StatusMethod for ExactStatusMethod { principal: &PrincipalId, view: StatusView<'_>, evaluation_time: Timestamp, - ) -> Result { - let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(StatusDecision::Active); - }; - if method != &self.id { - return Ok(StatusDecision::WrongMethod); - } - if snapshot.observed_at() > evaluation_time || snapshot.valid_until() < evaluation_time { - return Ok(StatusDecision::Stale); - } - let candidates: Vec<_> = snapshot - .statements() - .iter() - .map(auths_model::SignedPrincipalStatus::statement) - .filter(|statement| { - statement.principal() == principal - && status_issuer_visible(snapshot.trust(), statement.issuer(), view) - }) - .collect(); - select_principal(policy, snapshot, &candidates, evaluation_time) + ) -> Result { + Ok(select_principal_from_snapshot( + &self.id, + policy, + snapshot, + principal, + view, + evaluation_time, + )) } fn grant( @@ -519,167 +508,234 @@ impl StatusMethod for ExactStatusMethod { grant: GrantId, view: StatusView<'_>, evaluation_time: Timestamp, - ) -> Result { - let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(StatusDecision::Active); - }; - if method != &self.id { - return Ok(StatusDecision::WrongMethod); - } - if snapshot.observed_at() > evaluation_time || snapshot.valid_until() < evaluation_time { - return Ok(StatusDecision::Stale); + ) -> Result { + Ok(select_grant_from_snapshot( + &self.id, + policy, + snapshot, + grant, + view, + evaluation_time, + )) + } +} + +// Only the first exact method/issuer rule supplies the sequence floor. +fn status_sequence_floor( + rules: &[auths_model::StatusTrustRule], + method: &StatusMethodId, + issuer: &PrincipalId, +) -> Option { + let mut found = None; + let mut position = 0; + while position < rules.len() && found.is_none() { + let rule = &rules[position]; + if rule.method() == method && rule.issuer() == issuer { + found = Some(rule.sequence_floor()); } - let candidates: Vec<_> = snapshot - .statements() - .iter() - .map(auths_model::SignedGrantStatus::statement) - .filter(|statement| { - statement.grant_id() == grant - && status_issuer_visible(snapshot.trust(), statement.issuer(), view) - }) - .collect(); - select_grant(policy, snapshot, &candidates, evaluation_time) + position += 1; } + found } -fn select_principal( +fn select_principal_from_snapshot( + id: &StatusMethodId, policy: &StatusPolicy, snapshot: &PrincipalStatusSnapshot, - candidates: &[&auths_model::PrincipalStatusStatement], + principal: &PrincipalId, + view: StatusView<'_>, evaluation_time: Timestamp, -) -> Result { - let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(StatusDecision::Active); +) -> StatusEvaluation { + let StatusPolicy::SnapshotRequired { method, max_age } = policy else { + return StatusEvaluation::new(StatusDecision::Active, Timestamp::new(u64::MAX)); }; - if candidates.is_empty() { - return Ok(StatusDecision::Missing); - } - if candidates - .iter() - .all(|statement| statement.method() != method) - { - return Ok(StatusDecision::WrongMethod); - } - let mut trusted = Vec::new(); - for statement in candidates - .iter() - .copied() - .filter(|statement| statement.method() == method) - { - let Some(rule) = snapshot - .trust() - .iter() - .find(|rule| rule.method() == method && rule.issuer() == statement.issuer()) - else { - continue; - }; - if statement.sequence() < rule.sequence_floor() { - return Ok(StatusDecision::Rollback); - } - trusted.push(statement); - } - if trusted.is_empty() { - return Ok(StatusDecision::UntrustedIssuer); - } - let maximum = trusted - .iter() - .map(|statement| statement.sequence()) - .max() - .ok_or(RegistryOperationError::InvalidInput)?; - let latest: Vec<_> = trusted - .into_iter() - .filter(|statement| statement.sequence() == maximum) - .collect(); - if latest.iter().any(|statement| { - ExactStatusMethod::freshness( - policy, - statement.observed_at(), - statement.valid_until(), - evaluation_time, - ) == StatusDecision::Stale - }) { - return Ok(StatusDecision::Stale); - } - Ok( - if latest - .iter() - .any(|statement| statement.state() != PrincipalState::Active) + if method != id { + return StatusEvaluation::new(StatusDecision::WrongMethod, evaluation_time); + } + if snapshot.observed_at() > evaluation_time || snapshot.valid_until() < evaluation_time { + return StatusEvaluation::new(StatusDecision::Stale, evaluation_time); + } + let statements = snapshot.statements(); + let rules = snapshot.trust(); + let mut candidate_seen = false; + let mut method_seen = false; + let mut rollback = false; + let mut maximum = None; + let mut stale = false; + let mut revoked = false; + let mut valid_through = snapshot.valid_until(); + let mut position = 0; + while position < statements.len() && !rollback { + let statement = statements[position].statement(); + if statement.principal() == principal + && status_issuer_visible(rules, statement.issuer(), view) { - StatusDecision::Revoked - } else { - StatusDecision::Active - }, - ) + candidate_seen = true; + if statement.method() == method { + method_seen = true; + if let Some(floor) = status_sequence_floor(rules, method, statement.issuer()) { + let sequence = statement.sequence(); + if sequence < floor { + rollback = true; + } else { + // A newer sequence discards all older status and freshness + // contributions. Equal latest sequences combine conservatively. + let newer = match maximum { + None => true, + Some(previous) => sequence > previous, + }; + let equal = match maximum { + None => false, + Some(previous) => sequence == previous, + }; + if newer { + maximum = Some(sequence); + stale = false; + revoked = false; + valid_through = snapshot.valid_until(); + } + if newer || equal { + stale = stale + || ExactStatusMethod::freshness( + policy, + statement.observed_at(), + statement.valid_until(), + evaluation_time, + ) == StatusDecision::Stale; + revoked = revoked || statement.state() != PrincipalState::Active; + valid_through = + valid_through + .min(statement.valid_until()) + .min(Timestamp::new( + statement.observed_at().get().saturating_add(max_age.get()), + )); + } + } + } + } + } + position += 1; + } + let decision = if rollback { + StatusDecision::Rollback + } else if !candidate_seen { + StatusDecision::Missing + } else if !method_seen { + StatusDecision::WrongMethod + } else if maximum.is_none() { + StatusDecision::UntrustedIssuer + } else if stale { + StatusDecision::Stale + } else if revoked { + StatusDecision::Revoked + } else { + StatusDecision::Active + }; + let through = match decision { + StatusDecision::Missing => snapshot.valid_until(), + StatusDecision::Active | StatusDecision::Revoked => valid_through, + _ => evaluation_time, + }; + StatusEvaluation::new(decision, through) } -fn select_grant( +fn select_grant_from_snapshot( + id: &StatusMethodId, policy: &StatusPolicy, snapshot: &GrantStatusSnapshot, - candidates: &[&auths_model::GrantStatusStatement], + grant: GrantId, + view: StatusView<'_>, evaluation_time: Timestamp, -) -> Result { - let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(StatusDecision::Active); +) -> StatusEvaluation { + let StatusPolicy::SnapshotRequired { method, max_age } = policy else { + return StatusEvaluation::new(StatusDecision::Active, Timestamp::new(u64::MAX)); }; - if candidates.is_empty() { - return Ok(StatusDecision::Missing); - } - if candidates - .iter() - .all(|statement| statement.method() != method) - { - return Ok(StatusDecision::WrongMethod); - } - let mut trusted = Vec::new(); - for statement in candidates - .iter() - .copied() - .filter(|statement| statement.method() == method) - { - let Some(rule) = snapshot - .trust() - .iter() - .find(|rule| rule.method() == method && rule.issuer() == statement.issuer()) - else { - continue; - }; - if statement.sequence() < rule.sequence_floor() { - return Ok(StatusDecision::Rollback); + if method != id { + return StatusEvaluation::new(StatusDecision::WrongMethod, evaluation_time); + } + if snapshot.observed_at() > evaluation_time || snapshot.valid_until() < evaluation_time { + return StatusEvaluation::new(StatusDecision::Stale, evaluation_time); + } + let statements = snapshot.statements(); + let rules = snapshot.trust(); + let mut candidate_seen = false; + let mut method_seen = false; + let mut rollback = false; + let mut maximum = None; + let mut stale = false; + let mut revoked = false; + let mut valid_through = snapshot.valid_until(); + let mut position = 0; + while position < statements.len() && !rollback { + let statement = statements[position].statement(); + if statement.grant_id() == grant && status_issuer_visible(rules, statement.issuer(), view) { + candidate_seen = true; + if statement.method() == method { + method_seen = true; + if let Some(floor) = status_sequence_floor(rules, method, statement.issuer()) { + let sequence = statement.sequence(); + if sequence < floor { + rollback = true; + } else { + // A newer sequence discards all older status and freshness + // contributions. Equal latest sequences combine conservatively. + let newer = match maximum { + None => true, + Some(previous) => sequence > previous, + }; + let equal = match maximum { + None => false, + Some(previous) => sequence == previous, + }; + if newer { + maximum = Some(sequence); + stale = false; + revoked = false; + valid_through = snapshot.valid_until(); + } + if newer || equal { + stale = stale + || ExactStatusMethod::freshness( + policy, + statement.observed_at(), + statement.valid_until(), + evaluation_time, + ) == StatusDecision::Stale; + revoked = revoked || statement.state() != GrantState::Active; + valid_through = + valid_through + .min(statement.valid_until()) + .min(Timestamp::new( + statement.observed_at().get().saturating_add(max_age.get()), + )); + } + } + } + } } - trusted.push(statement); - } - if trusted.is_empty() { - return Ok(StatusDecision::UntrustedIssuer); - } - let maximum = trusted - .iter() - .map(|statement| statement.sequence()) - .max() - .ok_or(RegistryOperationError::InvalidInput)?; - let latest: Vec<_> = trusted - .into_iter() - .filter(|statement| statement.sequence() == maximum) - .collect(); - if latest.iter().any(|statement| { - ExactStatusMethod::freshness( - policy, - statement.observed_at(), - statement.valid_until(), - evaluation_time, - ) == StatusDecision::Stale - }) { - return Ok(StatusDecision::Stale); - } - Ok( - if latest - .iter() - .any(|statement| statement.state() != GrantState::Active) - { - StatusDecision::Revoked - } else { - StatusDecision::Active - }, - ) + position += 1; + } + let decision = if rollback { + StatusDecision::Rollback + } else if !candidate_seen { + StatusDecision::Missing + } else if !method_seen { + StatusDecision::WrongMethod + } else if maximum.is_none() { + StatusDecision::UntrustedIssuer + } else if stale { + StatusDecision::Stale + } else if revoked { + StatusDecision::Revoked + } else { + StatusDecision::Active + }; + let through = match decision { + StatusDecision::Missing => snapshot.valid_until(), + StatusDecision::Active | StatusDecision::Revoked => valid_through, + _ => evaluation_time, + }; + StatusEvaluation::new(decision, through) } /// Additional pure implementations supplied by downstream profile packages. @@ -1714,9 +1770,64 @@ mod tests { .expect("evaluation") }; // Visible, the statement forces a method mismatch. - assert_eq!(under(&partner_anchor), StatusDecision::WrongMethod); + assert_eq!( + under(&partner_anchor).decision(), + StatusDecision::WrongMethod + ); // Out of scope, it is absent, whatever its method. - assert_eq!(under(&verifier_anchor), StatusDecision::Missing); + assert_eq!(under(&verifier_anchor).decision(), StatusDecision::Missing); + } + + #[test] + fn selected_status_horizon_preserves_max_age_and_missing_list_semantics() { + let anchor = status_anchor("anchor-v", "raw:v-root"); + let snapshot = PrincipalStatusSnapshot::with_trust( + auths_model::StatusSnapshotId::new([0x61; 32]), + Timestamp::new(40), + Timestamp::new(100), + vec![principal_statement( + PRIMARY_STATUS, + "raw:v-actor", + PrincipalState::Active, + 1, + "raw:v-root", + )], + Vec::new(), + vec![rule( + PRIMARY_STATUS, + "raw:v-root", + 1, + StatusScope::AnyAnchor, + )], + ) + .expect("snapshot"); + let policy = StatusPolicy::SnapshotRequired { + method: method(PRIMARY_STATUS), + max_age: auths_model::FreshnessLimit::new(10).expect("age"), + }; + let evaluate = |subject, now| { + exact() + .principal( + &policy, + &snapshot, + &principal(subject), + StatusView::Anchor(&anchor), + Timestamp::new(now), + ) + .expect("evaluation") + }; + let selected = evaluate("raw:v-actor", 50); + assert_eq!(selected.decision(), StatusDecision::Active); + assert_eq!(selected.valid_through(), Timestamp::new(50)); + assert_eq!( + evaluate("raw:v-actor", 51).decision(), + StatusDecision::Stale + ); + // Absence on a revocation list is bounded by the snapshot's window; + // the native method applies max_age to selected statements only. + let missing = evaluate("raw:unlisted", 60); + assert_eq!(missing.decision(), StatusDecision::Missing); + assert_eq!(missing.valid_through(), Timestamp::new(100)); } /// For every snapshot, anchor, and subject, the status result equals the @@ -1872,3 +1983,6 @@ mod tests { assert!(checked > 4_000, "too few valid cases: {checked}"); } } + +#[cfg(test)] +mod status_selection_tests; diff --git a/core/crates/auths-registries/src/status_selection_tests.rs b/core/crates/auths-registries/src/status_selection_tests.rs new file mode 100644 index 000000000..7a8d98446 --- /dev/null +++ b/core/crates/auths-registries/src/status_selection_tests.rs @@ -0,0 +1,856 @@ +//! Frozen pre-refactor selector and visibility algorithms used only as differential oracles. +//! The production selector has no path to this module. +use super::*; +use auths_model::{StatusScope, StatusTrustRule, TrustAnchor}; + +struct ReferenceStatusMethod { + id: StatusMethodId, +} +impl ReferenceStatusMethod { + fn freshness( + policy: &StatusPolicy, + observed_at: Timestamp, + valid_until: Timestamp, + evaluation_time: Timestamp, + ) -> StatusDecision { + let StatusPolicy::SnapshotRequired { max_age, .. } = policy else { + return StatusDecision::Active; + }; + if observed_at > evaluation_time + || valid_until < evaluation_time + || evaluation_time.get().saturating_sub(observed_at.get()) > max_age.get() + { + StatusDecision::Stale + } else { + StatusDecision::Active + } + } + fn principal( + &self, + policy: &StatusPolicy, + snapshot: &PrincipalStatusSnapshot, + principal: &PrincipalId, + view: StatusView<'_>, + evaluation_time: Timestamp, + ) -> Result { + let StatusPolicy::SnapshotRequired { method, .. } = policy else { + return Ok(StatusEvaluation::new( + StatusDecision::Active, + Timestamp::new(u64::MAX), + )); + }; + if method != &self.id { + return Ok(StatusEvaluation::new( + StatusDecision::WrongMethod, + evaluation_time, + )); + } + if snapshot.observed_at() > evaluation_time || snapshot.valid_until() < evaluation_time { + return Ok(StatusEvaluation::new( + StatusDecision::Stale, + evaluation_time, + )); + } + let candidates: Vec<_> = snapshot + .statements() + .iter() + .map(auths_model::SignedPrincipalStatus::statement) + .filter(|statement| { + statement.principal() == principal + && status_issuer_visible(snapshot.trust(), statement.issuer(), view) + }) + .collect(); + select_principal(policy, snapshot, &candidates, evaluation_time) + } + + fn grant( + &self, + policy: &StatusPolicy, + snapshot: &GrantStatusSnapshot, + grant: GrantId, + view: StatusView<'_>, + evaluation_time: Timestamp, + ) -> Result { + let StatusPolicy::SnapshotRequired { method, .. } = policy else { + return Ok(StatusEvaluation::new( + StatusDecision::Active, + Timestamp::new(u64::MAX), + )); + }; + if method != &self.id { + return Ok(StatusEvaluation::new( + StatusDecision::WrongMethod, + evaluation_time, + )); + } + if snapshot.observed_at() > evaluation_time || snapshot.valid_until() < evaluation_time { + return Ok(StatusEvaluation::new( + StatusDecision::Stale, + evaluation_time, + )); + } + let candidates: Vec<_> = snapshot + .statements() + .iter() + .map(auths_model::SignedGrantStatus::statement) + .filter(|statement| { + statement.grant_id() == grant + && status_issuer_visible(snapshot.trust(), statement.issuer(), view) + }) + .collect(); + select_grant(policy, snapshot, &candidates, evaluation_time) + } +} +fn select_principal( + policy: &StatusPolicy, + snapshot: &PrincipalStatusSnapshot, + candidates: &[&auths_model::PrincipalStatusStatement], + evaluation_time: Timestamp, +) -> Result { + let StatusPolicy::SnapshotRequired { + method, max_age, .. + } = policy + else { + return Ok(StatusEvaluation::new( + StatusDecision::Active, + Timestamp::new(u64::MAX), + )); + }; + if candidates.is_empty() { + return Ok(StatusEvaluation::new( + StatusDecision::Missing, + snapshot.valid_until(), + )); + } + if candidates + .iter() + .all(|statement| statement.method() != method) + { + return Ok(StatusEvaluation::new( + StatusDecision::WrongMethod, + evaluation_time, + )); + } + let mut trusted = Vec::new(); + for statement in candidates + .iter() + .copied() + .filter(|statement| statement.method() == method) + { + let Some(rule) = snapshot + .trust() + .iter() + .find(|rule| rule.method() == method && rule.issuer() == statement.issuer()) + else { + continue; + }; + if statement.sequence() < rule.sequence_floor() { + return Ok(StatusEvaluation::new( + StatusDecision::Rollback, + evaluation_time, + )); + } + trusted.push(statement); + } + if trusted.is_empty() { + return Ok(StatusEvaluation::new( + StatusDecision::UntrustedIssuer, + evaluation_time, + )); + } + let maximum = trusted + .iter() + .map(|statement| statement.sequence()) + .max() + .ok_or(RegistryOperationError::InvalidInput)?; + let latest: Vec<_> = trusted + .into_iter() + .filter(|statement| statement.sequence() == maximum) + .collect(); + if latest.iter().any(|statement| { + ReferenceStatusMethod::freshness( + policy, + statement.observed_at(), + statement.valid_until(), + evaluation_time, + ) == StatusDecision::Stale + }) { + return Ok(StatusEvaluation::new( + StatusDecision::Stale, + evaluation_time, + )); + } + let valid_through = latest + .iter() + .fold(snapshot.valid_until(), |through, statement| { + through.min(statement.valid_until()).min(Timestamp::new( + statement.observed_at().get().saturating_add(max_age.get()), + )) + }); + let decision = if latest + .iter() + .any(|statement| statement.state() != PrincipalState::Active) + { + StatusDecision::Revoked + } else { + StatusDecision::Active + }; + Ok(StatusEvaluation::new(decision, valid_through)) +} + +fn select_grant( + policy: &StatusPolicy, + snapshot: &GrantStatusSnapshot, + candidates: &[&auths_model::GrantStatusStatement], + evaluation_time: Timestamp, +) -> Result { + let StatusPolicy::SnapshotRequired { + method, max_age, .. + } = policy + else { + return Ok(StatusEvaluation::new( + StatusDecision::Active, + Timestamp::new(u64::MAX), + )); + }; + if candidates.is_empty() { + return Ok(StatusEvaluation::new( + StatusDecision::Missing, + snapshot.valid_until(), + )); + } + if candidates + .iter() + .all(|statement| statement.method() != method) + { + return Ok(StatusEvaluation::new( + StatusDecision::WrongMethod, + evaluation_time, + )); + } + let mut trusted = Vec::new(); + for statement in candidates + .iter() + .copied() + .filter(|statement| statement.method() == method) + { + let Some(rule) = snapshot + .trust() + .iter() + .find(|rule| rule.method() == method && rule.issuer() == statement.issuer()) + else { + continue; + }; + if statement.sequence() < rule.sequence_floor() { + return Ok(StatusEvaluation::new( + StatusDecision::Rollback, + evaluation_time, + )); + } + trusted.push(statement); + } + if trusted.is_empty() { + return Ok(StatusEvaluation::new( + StatusDecision::UntrustedIssuer, + evaluation_time, + )); + } + let maximum = trusted + .iter() + .map(|statement| statement.sequence()) + .max() + .ok_or(RegistryOperationError::InvalidInput)?; + let latest: Vec<_> = trusted + .into_iter() + .filter(|statement| statement.sequence() == maximum) + .collect(); + if latest.iter().any(|statement| { + ReferenceStatusMethod::freshness( + policy, + statement.observed_at(), + statement.valid_until(), + evaluation_time, + ) == StatusDecision::Stale + }) { + return Ok(StatusEvaluation::new( + StatusDecision::Stale, + evaluation_time, + )); + } + let valid_through = latest + .iter() + .fold(snapshot.valid_until(), |through, statement| { + through.min(statement.valid_until()).min(Timestamp::new( + statement.observed_at().get().saturating_add(max_age.get()), + )) + }); + let decision = if latest + .iter() + .any(|statement| statement.state() != GrantState::Active) + { + StatusDecision::Revoked + } else { + StatusDecision::Active + }; + Ok(StatusEvaluation::new(decision, valid_through)) +} +fn status_issuer_visible( + trust: &[StatusTrustRule], + issuer: &PrincipalId, + view: StatusView<'_>, +) -> bool { + match view { + StatusView::Anchor(anchor) => { + trust + .iter() + .filter(|rule| rule.issuer() == issuer) + .all(|rule| match rule.scope() { + StatusScope::OwnAnchor => anchor.principal() == issuer, + StatusScope::Anchors(anchors) => { + anchors.ids().binary_search(anchor.id()).is_ok() + } + StatusScope::AnyAnchor => true, + }) + } + StatusView::Approver => trust + .iter() + .filter(|rule| rule.issuer() == issuer) + .all(|rule| matches!(rule.scope(), StatusScope::AnyAnchor)), + } +} + +fn principal(value: &str) -> PrincipalId { + PrincipalId::parse(value).expect("principal") +} + +fn method(value: &str) -> StatusMethodId { + StatusMethodId::parse(value).expect("status method") +} + +fn status_anchor(id: &str, root: &str) -> TrustAnchor { + TrustAnchor::new( + auths_model::TrustAnchorId::parse(id).expect("anchor ID"), + principal(root), + vec![PrincipalMethodId::parse("raw-key-v1").expect("method")], + vec![ + auths_model::ProfileRef::new( + auths_model::ProfileId::parse("auths.mcp").expect("profile"), + 1, + ) + .expect("profile"), + ], + auths_model::PermissionSet::new(vec![auths_model::Permission::new( + auths_model::CapabilityId::parse("tools/call").expect("capability"), + ResourceId::parse("mcp://reports/read").expect("resource"), + )]) + .expect("permissions"), + Vec::new(), + auths_model::AudienceSet::new(vec![ + auths_model::Audience::parse("audience://verifier").expect("audience"), + ]) + .expect("audiences"), + auths_model::ValidityWindow::new(Timestamp::new(0), Timestamp::new(100)).expect("validity"), + None, + 1, + auths_model::AssurancePolicyId::parse("policy").expect("policy"), + StatusPolicy::ExpiryOnly, + ) + .expect("anchor") +} + +fn envelope() -> auths_model::SignatureEnvelope { + auths_model::SignatureEnvelope::new( + auths_model::SignatureDescriptor::new( + PrincipalMethodId::parse("raw-key-v1").expect("method"), + auths_model::VerificationMethod::parse("raw:issuer#key-1").expect("key"), + SignatureSuiteId::parse("ed25519-v1").expect("suite"), + ), + auths_model::SignatureBytes::new(vec![1; 64]).expect("signature"), + ) +} + +fn rule(status_method: &str, issuer: &str, floor: u64, scope: StatusScope) -> StatusTrustRule { + StatusTrustRule::new(method(status_method), principal(issuer), floor, scope) +} + +/// Seeded boundary/property generator, matching the crate's dependency-free +/// property-test convention. Every snapshot passes the actual constructors. +struct Cases(u64); +impl Cases { + fn below(&mut self, bound: usize) -> usize { + self.0 ^= self.0 >> 12; + self.0 ^= self.0 << 25; + self.0 ^= self.0 >> 27; + let value = self.0.wrapping_mul(0x2545_f491_4f6c_dd1d); + usize::try_from(value % u64::try_from(bound).expect("small bound")).expect("small value") + } + fn pick(&mut self, values: &[T]) -> T { + values[self.below(values.len())] + } +} + +fn outcome_index(decision: StatusDecision) -> usize { + match decision { + StatusDecision::Active => 0, + StatusDecision::Revoked => 1, + StatusDecision::Missing => 2, + StatusDecision::Stale => 3, + StatusDecision::Rollback => 4, + StatusDecision::UntrustedIssuer => 5, + StatusDecision::WrongMethod => 6, + } +} + +const METHODS: [&str; 2] = ["auths-principal-status-v1", "other-principal-status-v1"]; +const ISSUERS: [&str; 4] = ["raw:v-root", "raw:f-root", "raw:other", "raw:unknown"]; +const SUBJECTS: [&str; 3] = ["raw:actor", "raw:other-actor", "raw:third-actor"]; + +fn generated_trust(cases: &mut Cases, anchors: &[TrustAnchor; 2]) -> Vec { + use auths_model::StatusScopeAnchors; + let methods = METHODS; + let issuers = ISSUERS; + let mut trust = Vec::new(); + for status_method in methods { + for issuer in &issuers[..3] { + if cases.below(2) == 0 { + let scope = match cases.below(4) { + 0 => StatusScope::OwnAnchor, + 1 => StatusScope::Anchors( + StatusScopeAnchors::new(vec![anchors[cases.below(2)].id().clone()]) + .expect("scope"), + ), + _ => StatusScope::AnyAnchor, + }; + trust.push(rule( + status_method, + issuer, + cases.pick(&[0, 1, 3, u64::MAX]), + scope, + )); + } + } + } + trust +} + +fn generated_snapshots( + cases: &mut Cases, + anchors: &[TrustAnchor; 2], +) -> Option<(PrincipalStatusSnapshot, GrantStatusSnapshot)> { + use auths_model::{ + CriticalExtensions, GrantStatusStatement, PrincipalStatusStatement, SignedGrantStatus, + SignedPrincipalStatus, StatusSnapshotId, + }; + let methods = METHODS; + let issuers = ISSUERS; + let subjects = SUBJECTS; + let trust = generated_trust(cases, anchors); + let mut principals = Vec::new(); + let mut grants = Vec::new(); + for _ in 0..cases.below(13) { + let subject = cases.below(3); + let status_method = method(cases.pick(&methods)); + let issuer = principal(cases.pick(&issuers)); + let sequence = cases.pick(&[0, 1, 2, 3, u64::MAX]); + let observed = Timestamp::new(cases.pick(&[0, 20, 40])); + let until = Timestamp::new(cases.pick(&[100, 120, u64::MAX])); + let state = cases.below(3); + let principal_state = [ + PrincipalState::Active, + PrincipalState::Revoked, + PrincipalState::Superseded, + ][state]; + let grant_state = [ + GrantState::Active, + GrantState::Revoked, + GrantState::Superseded, + ][state]; + principals.push(SignedPrincipalStatus::new( + PrincipalStatusStatement::new( + status_method.clone(), + principal(subjects[subject]), + principal_state, + sequence, + observed, + until, + issuer.clone(), + CriticalExtensions::empty(), + ) + .expect("principal statement"), + envelope(), + )); + grants.push(SignedGrantStatus::new( + GrantStatusStatement::new( + status_method, + GrantId::new([u8::try_from(subject).expect("small subject"); 32]), + grant_state, + sequence, + observed, + until, + issuer, + CriticalExtensions::empty(), + ) + .expect("grant statement"), + envelope(), + )); + } + let snapshots = ( + PrincipalStatusSnapshot::with_trust( + StatusSnapshotId::new([1; 32]), + Timestamp::new(40), + Timestamp::new(100), + principals, + Vec::new(), + trust.clone(), + ), + GrantStatusSnapshot::with_trust( + StatusSnapshotId::new([2; 32]), + Timestamp::new(40), + Timestamp::new(100), + grants, + Vec::new(), + trust, + ), + ); + let (Ok(principal), Ok(grant)) = snapshots else { + return None; + }; + Some((principal, grant)) +} + +#[test] +fn status_selection_matches_frozen_reference_on_validated_boundary_properties() { + use auths_model::FreshnessLimit; + let methods = METHODS; + let issuers = ISSUERS; + let subjects = SUBJECTS; + let anchors = [ + status_anchor("anchor-v", issuers[0]), + status_anchor("anchor-f", issuers[1]), + ]; + let views = [ + StatusView::Anchor(&anchors[0]), + StatusView::Anchor(&anchors[1]), + StatusView::Approver, + ]; + let mut principal_outcomes = [0_u64; 7]; + let mut grant_outcomes = [0_u64; 7]; + let mut horizons = alloc::collections::BTreeSet::new(); + let mut checked = 0; + for seed in [1, 0x5eed, 0x1234_5678_9abc_def0, u64::MAX] { + let mut cases = Cases(seed); + for _ in 0..5_000 { + // Duplicate generated statements are outside the constructor's domain. + let Some((principal_snapshot, grant_snapshot)) = + generated_snapshots(&mut cases, &anchors) + else { + continue; + }; + let id = method(cases.pick(&methods)); + let actual = ExactStatusMethod { id: id.clone() }; + let reference = ReferenceStatusMethod { id }; + let policy = if cases.below(8) == 0 { + StatusPolicy::ExpiryOnly + } else { + StatusPolicy::SnapshotRequired { + method: method(cases.pick(&methods)), + max_age: FreshnessLimit::new(cases.pick(&[1, 10, 20, 100, u64::MAX])) + .expect("age"), + } + }; + let now = Timestamp::new(cases.pick(&[0, 39, 40, 41, 49, 50, 60, 100, 101, u64::MAX])); + let subject_index = cases.below(4); + let subject = + principal([subjects[0], subjects[1], subjects[2], "raw:absent"][subject_index]); + let grant = GrantId::new([u8::try_from(subject_index).expect("small subject"); 32]); + for view in views { + for issuer in issuers { + assert_eq!( + auths_model::status_issuer_visible( + principal_snapshot.trust(), + &principal(issuer), + view + ), + status_issuer_visible(principal_snapshot.trust(), &principal(issuer), view), + "visibility seed {seed}" + ); + } + let principal_result = + actual.principal(&policy, &principal_snapshot, &subject, view, now); + let grant_result = actual.grant(&policy, &grant_snapshot, grant, view, now); + assert_eq!( + principal_result, + reference.principal(&policy, &principal_snapshot, &subject, view, now), + "principal seed {seed}; snapshot {principal_snapshot:?}; policy {policy:?}; now {now:?}; view {view:?}" + ); + assert_eq!( + grant_result, + reference.grant(&policy, &grant_snapshot, grant, view, now), + "grant seed {seed}; snapshot {grant_snapshot:?}; policy {policy:?}; now {now:?}; view {view:?}" + ); + let principal_evaluation = principal_result.expect("total status evaluation"); + let grant_evaluation = grant_result.expect("total status evaluation"); + principal_outcomes[outcome_index(principal_evaluation.decision())] += 1; + grant_outcomes[outcome_index(grant_evaluation.decision())] += 1; + horizons.insert(principal_evaluation.valid_through().get()); + horizons.insert(grant_evaluation.valid_through().get()); + } + checked += 1; + } + } + assert!(checked > 19_000, "valid cases: {checked}"); + assert!( + principal_outcomes.iter().all(|count| *count > 0), + "principal decisions: {principal_outcomes:?}" + ); + assert!( + grant_outcomes.iter().all(|count| *count > 0), + "grant decisions: {grant_outcomes:?}" + ); + assert!( + horizons.contains(&u64::MAX) && horizons.len() >= 10, + "horizon diversity: {horizons:?}" + ); +} + +#[test] +fn status_selection_keeps_latest_ties_rollback_and_stale_precedence() { + use auths_model::{ + CriticalExtensions, FreshnessLimit, PrincipalStatusStatement, SignedPrincipalStatus, + StatusSnapshotId, + }; + let id = method("auths-principal-status-v1"); + let implementation = ExactStatusMethod { id: id.clone() }; + let policy = StatusPolicy::SnapshotRequired { + method: id.clone(), + max_age: FreshnessLimit::new(20).expect("age"), + }; + let signed = |state, sequence, observed, issuer: &str| { + SignedPrincipalStatus::new( + PrincipalStatusStatement::new( + id.clone(), + principal("raw:actor"), + state, + sequence, + Timestamp::new(observed), + Timestamp::new(100), + principal(issuer), + CriticalExtensions::empty(), + ) + .expect("statement"), + envelope(), + ) + }; + let evaluate = |statements, floor| { + let snapshot = PrincipalStatusSnapshot::with_trust( + StatusSnapshotId::new([3; 32]), + Timestamp::new(40), + Timestamp::new(100), + statements, + Vec::new(), + vec![ + rule(id.as_str(), "raw:v-root", floor, StatusScope::AnyAnchor), + rule(id.as_str(), "raw:f-root", 0, StatusScope::AnyAnchor), + ], + ) + .expect("snapshot"); + implementation + .principal( + &policy, + &snapshot, + &principal("raw:actor"), + StatusView::Approver, + Timestamp::new(50), + ) + .expect("evaluation") + }; + assert_eq!( + evaluate( + vec![ + signed(PrincipalState::Revoked, 1, 0, "raw:v-root"), + signed(PrincipalState::Active, 2, 40, "raw:v-root") + ], + 0 + ), + StatusEvaluation::new(StatusDecision::Active, Timestamp::new(60)) + ); + assert_eq!( + evaluate( + vec![ + signed(PrincipalState::Active, 2, 40, "raw:v-root"), + signed(PrincipalState::Superseded, 2, 40, "raw:f-root") + ], + 0 + ), + StatusEvaluation::new(StatusDecision::Revoked, Timestamp::new(60)) + ); + assert_eq!( + evaluate( + vec![ + signed(PrincipalState::Active, 1, 40, "raw:v-root"), + signed(PrincipalState::Active, 2, 40, "raw:f-root") + ], + 2 + ), + StatusEvaluation::new(StatusDecision::Rollback, Timestamp::new(50)) + ); + assert_eq!( + evaluate( + vec![ + signed(PrincipalState::Revoked, 2, 40, "raw:v-root"), + signed(PrincipalState::Active, 2, 0, "raw:f-root") + ], + 0 + ), + StatusEvaluation::new(StatusDecision::Stale, Timestamp::new(50)) + ); +} + +struct WordLimitFixture { + implementation: ExactStatusMethod, + principal_snapshot: PrincipalStatusSnapshot, + grant_snapshot: GrantStatusSnapshot, + subject: PrincipalId, + grant: GrantId, +} + +fn word_limit_fixture() -> WordLimitFixture { + use auths_model::{ + CriticalExtensions, GrantStatusStatement, PrincipalStatusStatement, SignedGrantStatus, + SignedPrincipalStatus, StatusSnapshotId, + }; + let id = method(METHODS[0]); + let implementation = ExactStatusMethod { id: id.clone() }; + let observed = Timestamp::new(u64::MAX - 5); + let end = Timestamp::new(u64::MAX); + let issuer = principal(ISSUERS[0]); + let subject = principal(SUBJECTS[0]); + let grant = GrantId::new([7; 32]); + let trust = vec![rule( + METHODS[0], + ISSUERS[0], + u64::MAX, + StatusScope::AnyAnchor, + )]; + let principal_snapshot = PrincipalStatusSnapshot::with_trust( + StatusSnapshotId::new([3; 32]), + observed, + end, + vec![SignedPrincipalStatus::new( + PrincipalStatusStatement::new( + id.clone(), + subject.clone(), + PrincipalState::Active, + u64::MAX, + observed, + end, + issuer.clone(), + CriticalExtensions::empty(), + ) + .expect("statement"), + envelope(), + )], + Vec::new(), + trust.clone(), + ) + .expect("snapshot"); + let grant_snapshot = GrantStatusSnapshot::with_trust( + StatusSnapshotId::new([4; 32]), + observed, + end, + vec![SignedGrantStatus::new( + GrantStatusStatement::new( + id, + grant, + GrantState::Active, + u64::MAX, + observed, + end, + issuer, + CriticalExtensions::empty(), + ) + .expect("statement"), + envelope(), + )], + Vec::new(), + trust, + ) + .expect("snapshot"); + WordLimitFixture { + implementation, + principal_snapshot, + grant_snapshot, + subject, + grant, + } +} + +#[test] +fn status_selection_preserves_word_limits_and_header_precedence() { + use auths_model::FreshnessLimit; + let WordLimitFixture { + implementation, + principal_snapshot, + grant_snapshot, + subject, + grant, + } = word_limit_fixture(); + let cases = [ + ( + StatusPolicy::SnapshotRequired { + method: method(METHODS[0]), + max_age: FreshnessLimit::new(10).expect("age"), + }, + u64::MAX - 3, + StatusDecision::Active, + u64::MAX, + ), + ( + StatusPolicy::SnapshotRequired { + method: method(METHODS[0]), + max_age: FreshnessLimit::new(1).expect("age"), + }, + u64::MAX - 3, + StatusDecision::Stale, + u64::MAX - 3, + ), + ( + StatusPolicy::SnapshotRequired { + method: method(METHODS[1]), + max_age: FreshnessLimit::new(1).expect("age"), + }, + 0, + StatusDecision::WrongMethod, + 0, + ), + ( + StatusPolicy::ExpiryOnly, + 0, + StatusDecision::Active, + u64::MAX, + ), + ]; + for (policy, now, decision, through) in cases { + let expected = Ok(StatusEvaluation::new(decision, Timestamp::new(through))); + assert_eq!( + implementation.principal( + &policy, + &principal_snapshot, + &subject, + StatusView::Approver, + Timestamp::new(now) + ), + expected + ); + assert_eq!( + implementation.grant( + &policy, + &grant_snapshot, + grant, + StatusView::Approver, + Timestamp::new(now) + ), + expected + ); + } +} diff --git a/core/crates/auths-signature-core/src/lib.rs b/core/crates/auths-signature-core/src/lib.rs index 9b78b735b..850b8bbf1 100644 --- a/core/crates/auths-signature-core/src/lib.rs +++ b/core/crates/auths-signature-core/src/lib.rs @@ -13,6 +13,116 @@ pub const ED25519_V1: &str = "ed25519-v1"; pub const P256_SHA256_V1: &str = "p256-sha256-v1"; const P256_KEY_LEN: usize = 33; +/// RFC 8032 field and negative-zero encoding rules; point validity is separate. +fn ed25519_point_encoding_is_canonical(encoded: &[u8; 32]) -> bool { + let top = encoded[31] & 0x7f; + let mut all_max = top == 0x7f; + let mut all_zero = top == 0; + // The qualified scan uses this explicit fixed range; its refinement proves + // every array read in bounds. Keep the index representation shared with it. + #[expect( + clippy::needless_range_loop, + reason = "the source-linked bounded-scan proof uses this explicit index range" + )] + for index in 1..31 { + all_max &= encoded[index] == 0xff; + all_zero &= encoded[index] == 0; + } + if all_max && encoded[0] >= 0xed { + return false; + } + let sign = encoded[31] & 0x80 != 0; + if sign && ((all_zero && encoded[0] == 1) || (all_max && encoded[0] == 0xec)) { + return false; + } + true +} + +/// The Auths P-256 compressed SEC1 form; curve-point decoding is separate. +fn p256_key_encoding_is_canonical(encoded: &[u8]) -> bool { + if encoded.len() != P256_KEY_LEN { + return false; + } + encoded[0] == 0x02 || encoded[0] == 0x03 +} + +// SEC 2 secp256r1 subgroup order divided by two, in big-endian form. +const P256_HALF_ORDER: [u8; 32] = [ + 0x7f, 0xff, 0xff, 0xff, 0x80, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xde, 0x73, 0x7d, 0x56, 0xd3, 0x8b, 0xcf, 0x42, 0x79, 0xdc, 0xe5, 0x61, 0x7e, 0x31, 0x92, 0xa8, +]; + +fn p256_signature_is_low_s(encoded: &[u8; 64]) -> bool { + let mut index = 0; + while index < 32 { + let value = encoded[32 + index]; + let bound = P256_HALF_ORDER[index]; + if value < bound { + return true; + } + if value > bound { + return false; + } + index += 1; + } + true +} + +fn ed25519_same_coordinate(encoded: &[u8; 32], expected: &[u8; 32]) -> bool { + if encoded[31] & 0x7f != expected[31] & 0x7f { + return false; + } + let mut index = 0; + while index < 31 { + if encoded[index] != expected[index] { + return false; + } + index += 1; + } + true +} + +const ED25519_WEAK_ZERO: [u8; 32] = [ + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +]; + +const ED25519_WEAK_ONE: [u8; 32] = [ + 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, +]; + +const ED25519_WEAK_MINUS_ONE: [u8; 32] = [ + 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, +]; + +const ED25519_WEAK_ORDER_EIGHT_A: [u8; 32] = [ + 0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f, + 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a, +]; + +const ED25519_WEAK_ORDER_EIGHT_B: [u8; 32] = [ + 0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0, + 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05, +]; + +fn ed25519_has_small_order_coordinate(encoded: &[u8; 32]) -> bool { + ed25519_same_coordinate(encoded, &ED25519_WEAK_ZERO) + || ed25519_same_coordinate(encoded, &ED25519_WEAK_ONE) + || ed25519_same_coordinate(encoded, &ED25519_WEAK_MINUS_ONE) + || ed25519_same_coordinate(encoded, &ED25519_WEAK_ORDER_EIGHT_A) + || ed25519_same_coordinate(encoded, &ED25519_WEAK_ORDER_EIGHT_B) +} + +fn ed25519_signature_r_is_allowed(encoded: &[u8; 64]) -> bool { + let r: &[u8; 32] = match encoded[..32].try_into() { + Ok(r) => r, + Err(_) => return false, + }; + ed25519_point_encoding_is_canonical(r) && !ed25519_has_small_order_coordinate(r) +} + /// Failure classes shared by every Ed25519 protocol adapter. #[derive(Clone, Copy, Debug, Eq, PartialEq)] pub enum Ed25519Error { @@ -66,12 +176,74 @@ impl core::error::Error for P256Error {} /// /// Rejects malformed Ed25519 verification material. pub fn validate_ed25519_key(verification_key: &[u8]) -> Result<(), Ed25519Error> { - let key_bytes: &[u8; 32] = verification_key - .try_into() - .map_err(|_| Ed25519Error::InvalidKey)?; - VerifyingKey::from_bytes(key_bytes) - .map(|_| ()) - .map_err(|_| Ed25519Error::InvalidKey) + decode_ed25519_key(verification_key).map(|_| ()) +} + +fn ed25519_key_encoding(bytes: &[u8]) -> Result<&[u8; 32], Ed25519Error> { + let Ok(bytes) = bytes.try_into() else { + return Err(Ed25519Error::InvalidKey); + }; + if !ed25519_point_encoding_is_canonical(bytes) { + return Err(Ed25519Error::InvalidKey); + } + Ok(bytes) +} + +fn decode_ed25519_key_with(bytes: &[u8], decode: D) -> Result +where + D: FnOnce(&[u8; 32]) -> Option, +{ + let bytes = ed25519_key_encoding(bytes)?; + match decode(bytes) { + Some(key) => Ok(key), + None => Err(Ed25519Error::InvalidKey), + } +} + +fn decode_ed25519_point(bytes: &[u8; 32]) -> Option { + VerifyingKey::from_bytes(bytes).ok() +} + +#[expect( + clippy::redundant_closure, + reason = "explicit closure dictionaries are supported by the qualified Rust-to-Lean backend" +)] +fn decode_ed25519_key(bytes: &[u8]) -> Result { + decode_ed25519_key_with(bytes, |encoded| decode_ed25519_point(encoded)) +} + +fn verify_ed25519_with( + bytes: &[u8], + message: &[u8], + signature: &[u8], + decode: D, + verify: V, +) -> Result<(), Ed25519Error> +where + D: FnOnce(&[u8; 32]) -> Option, + V: FnOnce(&K, &[u8], &[u8; 64]) -> bool, +{ + let bytes = ed25519_key_encoding(bytes)?; + let Some(key) = decode(bytes) else { + return Err(Ed25519Error::InvalidKey); + }; + let signature: &[u8; 64] = match signature.try_into() { + Ok(signature) => signature, + Err(_) => return Err(Ed25519Error::InvalidSignatureEncoding), + }; + if ed25519_has_small_order_coordinate(bytes) || !ed25519_signature_r_is_allowed(signature) { + return Err(Ed25519Error::VerificationFailed); + } + if verify(&key, message, signature) { + Ok(()) + } else { + Err(Ed25519Error::VerificationFailed) + } +} + +fn verify_ed25519_equation(key: &VerifyingKey, message: &[u8], signature: &[u8; 64]) -> bool { + key.verify_strict(message, &Signature::from_bytes(signature)) + .is_ok() } /// Verifies an Ed25519 signature with the repository's one strict implementation. @@ -82,20 +254,22 @@ pub fn validate_ed25519_key(verification_key: &[u8]) -> Result<(), Ed25519Error> /// # Errors /// /// Distinguishes malformed keys, malformed signature encodings, and cryptographic failure. +#[expect( + clippy::redundant_closure, + reason = "explicit closure dictionaries are supported by the qualified Rust-to-Lean backend" +)] pub fn verify_ed25519( verification_key: &[u8], message: &[u8], signature: &[u8], ) -> Result<(), Ed25519Error> { - validate_ed25519_key(verification_key)?; - let key_bytes: &[u8; 32] = verification_key - .try_into() - .map_err(|_| Ed25519Error::InvalidKey)?; - let key = VerifyingKey::from_bytes(key_bytes).map_err(|_| Ed25519Error::InvalidKey)?; - let signature = - Signature::from_slice(signature).map_err(|_| Ed25519Error::InvalidSignatureEncoding)?; - key.verify_strict(message, &signature) - .map_err(|_| Ed25519Error::VerificationFailed) + verify_ed25519_with( + verification_key, + message, + signature, + |encoded| decode_ed25519_point(encoded), + |key, message, signature| verify_ed25519_equation(key, message, signature), + ) } /// Validates one P-256 verification key. @@ -110,19 +284,87 @@ pub fn verify_ed25519( /// Returns [`P256Error::InvalidKey`] for any other encoding, and for an x-coordinate that is not /// below the field modulus or has no point on the curve. pub fn validate_p256_key(verification_key: &[u8]) -> Result<(), P256Error> { - decode_p256_key(verification_key).map(|_| ()) + match decode_p256_key(verification_key) { + Ok(_) => Ok(()), + Err(reason) => Err(reason), + } } +// One explicit primitive interface keeps the suite's encoding, error ordering +// and low-S policy in the same production algorithm used by the native adapter. +trait P256Primitive { + type Key; + type Signature; + fn decode(bytes: &[u8]) -> Option; + fn parse(bytes: &[u8; 64]) -> Option; + fn verify(key: &Self::Key, message: &[u8], signature: &Self::Signature) -> bool; +} +struct NativeP256; +impl P256Primitive for NativeP256 { + type Key = P256Key; + type Signature = P256Signature; + fn decode(bytes: &[u8]) -> Option { + decode_p256_point(bytes) + } + fn parse(bytes: &[u8; 64]) -> Option { + parse_p256_signature(bytes) + } + fn verify(key: &P256Key, message: &[u8], signature: &P256Signature) -> bool { + verify_p256_equation(key, message, signature) + } +} /// Decodes the one key encoding [`validate_p256_key`] accepts. /// /// The tag and length are checked before point decoding because the SEC1 decoder also accepts /// the uncompressed and compact forms of the same point. -fn decode_p256_key(verification_key: &[u8]) -> Result { - match verification_key { - [0x02 | 0x03, ..] if verification_key.len() == P256_KEY_LEN => { - P256Key::from_sec1_bytes(verification_key).map_err(|_| P256Error::InvalidKey) - } - _ => Err(P256Error::InvalidKey), +fn decode_p256_key_with(bytes: &[u8]) -> Result { + if !p256_key_encoding_is_canonical(bytes) { + return Err(P256Error::InvalidKey); + } + match T::decode(bytes) { + Some(key) => Ok(key), + None => Err(P256Error::InvalidKey), + } +} + +fn decode_p256_point(bytes: &[u8]) -> Option { + P256Key::from_sec1_bytes(bytes).ok() +} + +fn decode_p256_key(bytes: &[u8]) -> Result { + decode_p256_key_with::(bytes) +} + +fn parse_p256_signature(bytes: &[u8; 64]) -> Option { + P256Signature::from_slice(bytes).ok() +} + +fn verify_p256_equation(key: &P256Key, message: &[u8], signature: &P256Signature) -> bool { + key.verify(message, signature).is_ok() +} + +fn verify_p256_sha256_with( + bytes: &[u8], + message: &[u8], + signature: &[u8], +) -> Result<(), P256Error> { + let key = decode_p256_key_with::(bytes)?; + // A fixed-size owned copy avoids region-erased borrowed array types in the + // monomorphic native-library extraction; the byte contract is unchanged. + let signature: [u8; 64] = match signature.try_into() { + Ok(signature) => signature, + Err(_) => return Err(P256Error::InvalidSignatureEncoding), + }; + let Some(parsed) = T::parse(&signature) else { + return Err(P256Error::InvalidSignatureEncoding); + }; + if !p256_signature_is_low_s(&signature) { + return Err(P256Error::VerificationFailed); + } + if T::verify(&key, message, &parsed) { + Ok(()) + } else { + Err(P256Error::VerificationFailed) } } @@ -141,14 +383,7 @@ pub fn verify_p256_sha256( message: &[u8], signature: &[u8], ) -> Result<(), P256Error> { - let key = decode_p256_key(verification_key)?; - let signature = - P256Signature::from_slice(signature).map_err(|_| P256Error::InvalidSignatureEncoding)?; - if signature.normalize_s().is_some() { - return Err(P256Error::VerificationFailed); - } - key.verify(message, &signature) - .map_err(|_| P256Error::VerificationFailed) + verify_p256_sha256_with::(verification_key, message, signature) } #[cfg(test)] @@ -184,6 +419,82 @@ mod tests { ); } + #[test] + fn ed25519_rejects_noncanonical_fields_before_signature_parsing() { + for offset in 0u8..19 { + let mut key = [0xff; 32]; + key[0] = 0xed + offset; + for sign in [0, 0x80] { + key[31] = 0x7f | sign; + assert!(!ed25519_point_encoding_is_canonical(&key)); + assert_eq!(validate_ed25519_key(&key), Err(Ed25519Error::InvalidKey)); + assert_eq!( + verify_ed25519(&key, b"message", &[]), + Err(Ed25519Error::InvalidKey) + ); + } + } + // A permissively decodable, non-weak point demonstrates why neither + // a length check nor the library's low-order check supplies this rule. + let mut noncanonical = [0xff; 32]; + noncanonical[0] = 0xf0; // p + 3 + noncanonical[31] = 0x7f; + let decoded = VerifyingKey::from_bytes(&noncanonical).unwrap(); + assert!(!decoded.is_weak()); + assert_eq!( + validate_ed25519_key(&noncanonical), + Err(Ed25519Error::InvalidKey) + ); + } + + #[test] + fn ed25519_rejects_negative_zero_and_preserves_canonical_boundaries() { + let mut identity = [0; 32]; + identity[0] = 1; + let mut order_two = [0xff; 32]; + order_two[0] = 0xec; + order_two[31] = 0x7f; + for canonical in [identity, order_two] { + assert!(ed25519_point_encoding_is_canonical(&canonical)); + assert_eq!(validate_ed25519_key(&canonical), Ok(())); + let mut negative_zero = canonical; + negative_zero[31] |= 0x80; + assert!(VerifyingKey::from_bytes(&negative_zero).is_ok()); + assert_eq!( + validate_ed25519_key(&negative_zero), + Err(Ed25519Error::InvalidKey) + ); + // Canonical small-order encodings remain subject to strict + // verification; an encoding check does not authenticate them. + assert_eq!( + verify_ed25519(&canonical, b"message", &[0; 64]), + Err(Ed25519Error::VerificationFailed) + ); + } + } + + #[test] + fn rfc8032_public_vector_one_verifies_the_exact_empty_message() { + let key = [ + 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, + 0x07, 0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68, + 0xf7, 0x07, 0x51, 0x1a, + ]; + let signature = [ + 0xe5, 0x56, 0x43, 0x00, 0xc3, 0x60, 0xac, 0x72, 0x90, 0x86, 0xe2, 0xcc, 0x80, 0x6e, + 0x82, 0x8a, 0x84, 0x87, 0x7f, 0x1e, 0xb8, 0xe5, 0xd9, 0x74, 0xd8, 0x73, 0xe0, 0x65, + 0x22, 0x49, 0x01, 0x55, 0x5f, 0xb8, 0x82, 0x15, 0x90, 0xa3, 0x3b, 0xac, 0xc6, 0x1e, + 0x39, 0x70, 0x1c, 0xf9, 0xb4, 0x6b, 0xd2, 0x5b, 0xf5, 0xf0, 0x59, 0x5b, 0xbe, 0x24, + 0x65, 0x51, 0x41, 0x43, 0x8e, 0x7a, 0x10, 0x0b, + ]; + assert_eq!(validate_ed25519_key(&key), Ok(())); + assert_eq!(verify_ed25519(&key, b"", &signature), Ok(())); + assert_eq!( + verify_ed25519(&key, b"changed", &signature), + Err(Ed25519Error::VerificationFailed) + ); + } + const P256_MESSAGE: &[u8] = b"canonical message"; /// A fixed P-256 key whose public point is the one its compact form `0x05 || x` decodes to. @@ -209,6 +520,204 @@ mod tests { encoded } + #[test] + fn ed25519_glue_refuses_weak_inputs_before_the_equation() { + use core::cell::Cell; + let good = [ + 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, + 0x07, 0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68, + 0xf7, 0x07, 0x51, 0x1a, + ]; + for coordinate in [ + ED25519_WEAK_ZERO, + ED25519_WEAK_ONE, + ED25519_WEAK_MINUS_ONE, + ED25519_WEAK_ORDER_EIGHT_A, + ED25519_WEAK_ORDER_EIGHT_B, + ] { + for sign in [0, 0x80] { + let mut weak = coordinate; + weak[31] |= sign; + if !ed25519_point_encoding_is_canonical(&weak) { + continue; + } + assert!(ed25519_has_small_order_coordinate(&weak)); + assert!(VerifyingKey::from_bytes(&weak).unwrap().is_weak()); + let calls = Cell::new(0); + let mut signature = [0; 64]; + signature[..32].copy_from_slice(&good); + let rejected = verify_ed25519_with( + &weak, + b"message", + &signature, + |_| Some(()), + |(), _, _| { + calls.set(calls.get() + 1); + true + }, + ); + assert_eq!(rejected, Err(Ed25519Error::VerificationFailed)); + assert_eq!(calls.get(), 0); + signature[..32].copy_from_slice(&weak); + let rejected = verify_ed25519_with( + &good, + b"message", + &signature, + |_| Some(()), + |(), _, _| { + calls.set(calls.get() + 1); + true + }, + ); + assert_eq!(rejected, Err(Ed25519Error::VerificationFailed)); + assert_eq!(calls.get(), 0); + } + } + // The real glue must still reach a supplied primitive on valid form, + // forwarding the exact key, message and signature. This mock does not + // claim that the zero scalar below authenticates a real signature. + let mut signature = [0; 64]; + signature[..32].copy_from_slice(&good); + assert_eq!( + verify_ed25519_with( + &good, + b"exact message", + &signature, + |bytes| { + assert_eq!(bytes, &good); + Some(17u8) + }, + |key, message, bytes| { + assert_eq!(*key, 17); + assert_eq!(message, b"exact message"); + assert_eq!(bytes, &signature); + true + } + ), + Ok(()) + ); + assert_eq!( + verify_ed25519_with( + &ED25519_WEAK_ONE, + b"message", + &signature[..63], + |_| Some(()), + |(), _, _| panic!("equation after bad width") + ), + Err(Ed25519Error::InvalidSignatureEncoding) + ); + } + + #[test] + fn p256_glue_preserves_parse_priority_and_blocks_high_s_before_equation() { + struct Guarded; + impl P256Primitive for Guarded { + type Key = (); + type Signature = (); + fn decode(_: &[u8]) -> Option<()> { + Some(()) + } + fn parse(_: &[u8; 64]) -> Option<()> { + PARSES.then_some(()) + } + fn verify((): &(), _: &[u8], (): &()) -> bool { + panic!("a refused scalar must not reach the equation") + } + } + struct ExactForward; + impl P256Primitive for ExactForward { + type Key = u8; + type Signature = u8; + fn decode(bytes: &[u8]) -> Option { + assert_eq!(bytes, &[2; 33]); + Some(23) + } + fn parse(bytes: &[u8; 64]) -> Option { + let mut expected = [0; 64]; + expected[31] = 1; + expected[32..].copy_from_slice(&P256_HALF_ORDER); + assert_eq!(bytes, &expected); + Some(17) + } + fn verify(point: &u8, message: &[u8], parsed: &u8) -> bool { + assert_eq!(*point, 23); + assert_eq!(message, b"exact message"); + assert_eq!(*parsed, 17); + true + } + } + let key = [2; 33]; + let mut signature = [0; 64]; + signature[31] = 1; + signature[32..].copy_from_slice(&P256_HALF_ORDER); + signature[63] += 1; + assert_eq!( + verify_p256_sha256_with::>(&key, b"message", &signature), + Err(P256Error::VerificationFailed) + ); + assert_eq!( + verify_p256_sha256_with::>(&key, b"message", &signature), + Err(P256Error::InvalidSignatureEncoding) + ); + signature[63] -= 1; + assert_eq!( + verify_p256_sha256_with::(&key, b"exact message", &signature), + Ok(()) + ); + } + + #[test] + fn p256_scalar_boundary_agrees_with_the_pinned_normalizer() { + let mut lower = P256_HALF_ORDER; + lower[31] -= 1; + let mut upper = P256_HALF_ORDER; + upper[31] += 1; + let mut one = [0; 32]; + one[31] = 1; + for (scalar, admitted) in [ + ([0; 32], true), + (one, true), + (lower, true), + (P256_HALF_ORDER, true), + (upper, false), + ([0xff; 32], false), + ] { + let mut encoded = [0; 64]; + encoded[31] = 1; // Public r = 1; no signing key is involved. + encoded[32..].copy_from_slice(&scalar); + assert_eq!(p256_signature_is_low_s(&encoded), admitted); + if let Ok(parsed) = P256Signature::from_slice(&encoded) { + assert_eq!( + p256_signature_is_low_s(&encoded), + parsed.normalize_s().is_none() + ); + } + // The protocol comparison depends only on the encoded s scalar. + encoded[..32].fill(0xff); + assert_eq!(p256_signature_is_low_s(&encoded), admitted); + } + } + + #[test] + fn p256_rejects_high_s_without_changing_the_signed_message() { + let key = compact_decodable_p256_key(); + let signature: P256Signature = key.sign(P256_MESSAGE); + let low = signature.normalize_s().unwrap_or(signature); + let (r, s) = low.split_scalars(); + let high = P256Signature::from_scalars(r.to_bytes(), (-s).to_bytes()).unwrap(); + let compressed = key.verifying_key().to_encoded_point(true); + assert!(high.normalize_s().is_some()); + assert!(key.verifying_key().verify(P256_MESSAGE, &high).is_ok()); + assert_eq!( + verify_p256_sha256(compressed.as_bytes(), P256_MESSAGE, &low.to_bytes()), + Ok(()) + ); + assert_eq!( + verify_p256_sha256(compressed.as_bytes(), P256_MESSAGE, &high.to_bytes()), + Err(P256Error::VerificationFailed) + ); + } + #[test] fn p256_accepts_only_the_compressed_encoding_of_a_point() { let key = compact_decodable_p256_key(); diff --git a/core/crates/auths-signature/tests/p256_corpus.rs b/core/crates/auths-signature/tests/p256_corpus.rs new file mode 100644 index 000000000..6a8e55549 --- /dev/null +++ b/core/crates/auths-signature/tests/p256_corpus.rs @@ -0,0 +1,94 @@ +//! Public P-256 vectors exercise the native primitive and the shipping port adapter. + +use auths_ports::{SignatureError, SignatureInput, SignatureSuite}; +use auths_signature::P256Sha256Suite; +use auths_signature_core::{P256Error, validate_p256_key, verify_p256_sha256}; + +fn bytes(value: &str) -> Vec { + assert!(value.len().is_multiple_of(2), "fixture hex width"); + value + .as_bytes() + .chunks_exact(2) + .map(|pair| { + let text = core::str::from_utf8(pair).expect("fixture ASCII"); + u8::from_str_radix(text, 16).expect("fixture hex") + }) + .collect() +} + +#[test] +fn published_p256_corpus_and_strict_auths_derivations() { + let suite = P256Sha256Suite::new().expect("mandatory suite ID"); + let mut cases = 0; + let mut accepted = 0; + let mut keys = std::collections::BTreeSet::new(); + for line in include_str!("../../../fixtures/crypto/p256-sha256-v1.tsv").lines() { + if line.starts_with('#') || line.starts_with("id\t") { + continue; + } + let fields: Vec<_> = line.split('\t').collect(); + assert_eq!(fields.len(), 6, "fixture fields"); + let [name, key_hex, message_hex, signature_hex, result, key_valid] = fields.as_slice() + else { + unreachable!("checked fixture width") + }; + let key = bytes(key_hex); + let message = bytes(message_hex); + let signature = bytes(signature_hex); + let (native, port) = match *result { + "ok" => (Ok(()), Ok(())), + "invalid-key" => (Err(P256Error::InvalidKey), Err(SignatureError::InvalidKey)), + "invalid-signature-encoding" => ( + Err(P256Error::InvalidSignatureEncoding), + Err(SignatureError::InvalidSignatureEncoding), + ), + "verification-failed" => ( + Err(P256Error::VerificationFailed), + Err(SignatureError::InvalidSignature), + ), + _ => panic!("unknown fixture result: {result}"), + }; + assert!( + matches!(*key_valid, "true" | "false"), + "fixture key verdict" + ); + assert_eq!( + validate_p256_key(&key).is_ok(), + *key_valid == "true", + "native key: {name}" + ); + assert_eq!( + suite.validate_key(&key).is_ok(), + *key_valid == "true", + "port key: {name}" + ); + assert_eq!( + verify_p256_sha256(&key, &message, &signature), + native, + "native: {name}" + ); + assert_eq!( + suite.verify(SignatureInput { + verification_key: &key, + signing_preimage: &message, + signature: &signature + }), + port, + "port: {name}" + ); + cases += 1; + if *result == "ok" { + accepted += 1; + keys.insert(key); + } + } + assert_eq!(cases, 653, "no source or derived cases may disappear"); + assert_eq!( + accepted, 173, + "every upstream valid tuple has one admitted low-S form" + ); + assert!( + keys.len() == 98, + "positive coverage must span distinct public keys" + ); +} diff --git a/core/crates/auths-verifier/src/approval.rs b/core/crates/auths-verifier/src/approval.rs index 86ac49a0c..25f8c6958 100644 --- a/core/crates/auths-verifier/src/approval.rs +++ b/core/crates/auths-verifier/src/approval.rs @@ -30,8 +30,8 @@ use auths_model::{ ApprovalSatisfaction, ApprovalStatement, ApprovalVerdict, ApproverAnchor, CanonicalAction, DenialReason, MAX_APPROVAL_REQUIREMENTS_PER_CHAIN, MAX_APPROVAL_REQUIREMENTS_PER_VERIFICATION, PrincipalId, ProofBundle, Requirement, SignedApproval, SignedGrant, StatementRef, StatusPolicy, - StatusView, TrustedContext, approval_counts, principal_id_equal, principal_ids_contain, - status_issuer_visible, + StatusView, Timestamp, TrustedContext, approval_counts, principal_id_equal, + principal_ids_contain, status_issuer_visible, }; use auths_ports::{ControlPurpose, StatusDecision}; use auths_registries::{APPROVAL_REQUIREMENT_EXTENSION_V1, ImmutableRegistries}; @@ -58,6 +58,7 @@ pub(crate) struct Evaluated { pub(crate) verdict: Verdict, pub(crate) counts: ApprovalCounts, pub(crate) threshold: u16, + valid_through: Timestamp, } /// The proof's approvals, the authority principals, and every requirement @@ -240,6 +241,19 @@ impl<'a> Approvals<'a> { satisfactions } + /// Horizon of only the requirements belonging to successful branches or + /// the context. Cached requirements from failed alternative branches do + /// not shorten the selected witness. + pub(crate) fn valid_through(&self, identifiers: &[ApprovalRequirementId]) -> Timestamp { + identifiers + .iter() + .filter_map(|identifier| self.get(*identifier)) + .filter(|evaluated| matches!(evaluated.verdict, Verdict::Authorized(_))) + .fold(Timestamp::new(u64::MAX), |through, evaluated| { + through.min(evaluated.valid_through) + }) + } + fn evaluate( &mut self, identifier: ApprovalRequirementId, @@ -258,6 +272,7 @@ impl<'a> Approvals<'a> { let evaluation_time = inputs.context.evaluation_time(); let mut outcomes: Vec = Vec::new(); let mut counted = Vec::new(); + let mut valid_through = Timestamp::new(u64::MAX); for (digest, approval) in &self.candidates { let statement = approval.statement(); let approver = statement.approver(); @@ -282,15 +297,19 @@ impl<'a> Approvals<'a> { { continue; } - let verdict = match signature_verdict(approval, inputs, meter)? { + let (verdict, status_not_after) = match signature_verdict(approval, inputs, meter)? { ApprovalVerdict::Counted => status_verdict(anchor, inputs, meter)?, - other => other, + other => (other, evaluation_time), }; if verdict == ApprovalVerdict::Ignored { continue; } if verdict == ApprovalVerdict::Counted { counted.push(*digest); + valid_through = valid_through + .min(statement.validity().expires_at()) + .min(anchor.validity().expires_at()) + .min(status_not_after); } outcomes.push(ApprovalOutcome::new(approver.clone(), verdict)); } @@ -312,6 +331,7 @@ impl<'a> Approvals<'a> { verdict, counts, threshold: requirement.threshold(), + valid_through, }; self.evaluated.push((identifier, evaluated.clone())); Ok(evaluated) @@ -368,10 +388,10 @@ fn status_verdict( anchor: &ApproverAnchor, inputs: &Inputs<'_, '_>, meter: &mut WorkMeter, -) -> Result { +) -> Result<(ApprovalVerdict, Timestamp), VerificationFailure> { let policy = anchor.status_policy(); let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(ApprovalVerdict::Counted); + return Ok((ApprovalVerdict::Counted, Timestamp::new(u64::MAX))); }; let context = inputs.context; let Some(implementation) = @@ -379,7 +399,7 @@ fn status_verdict( .registries .status_method(context.accepted_registries(), method, true) else { - return Ok(ApprovalVerdict::Pending); + return Ok((ApprovalVerdict::Pending, context.evaluation_time())); }; let principal = anchor.principal(); let snapshot = context.principal_status_snapshot(); @@ -395,10 +415,10 @@ fn status_verdict( if let Err(failure) = control_for(inputs.controlled, StatementRef::PrincipalStatus(identifier)) { - return classify(failure); + return classify(failure).map(|verdict| (verdict, context.evaluation_time())); } if let Err(failure) = check_status_extensions(status.statement().extensions(), context) { - return classify(failure); + return classify(failure).map(|verdict| (verdict, context.evaluation_time())); } } meter.reserve(implementation.maximum_work_units(snapshot.statements().len()))?; @@ -410,16 +430,27 @@ fn status_verdict( context.evaluation_time(), ) { Ok(decision) => decision, - Err(error) => return classify(registry_operation_failure(error)), + Err(error) => { + return classify(registry_operation_failure(error)) + .map(|verdict| (verdict, context.evaluation_time())); + } }; - Ok(match decision { - StatusDecision::Active => ApprovalVerdict::Counted, - StatusDecision::Missing | StatusDecision::Stale => ApprovalVerdict::Pending, - StatusDecision::Revoked - | StatusDecision::Rollback - | StatusDecision::UntrustedIssuer - | StatusDecision::WrongMethod => ApprovalVerdict::Ignored, - }) + if decision.decision() == StatusDecision::Active + && decision.valid_through() < context.evaluation_time() + { + return Ok((ApprovalVerdict::Pending, context.evaluation_time())); + } + Ok(( + match decision.decision() { + StatusDecision::Active => ApprovalVerdict::Counted, + StatusDecision::Missing | StatusDecision::Stale => ApprovalVerdict::Pending, + StatusDecision::Revoked + | StatusDecision::Rollback + | StatusDecision::UntrustedIssuer + | StatusDecision::WrongMethod => ApprovalVerdict::Ignored, + }, + decision.valid_through(), + )) } #[cfg(test)] diff --git a/core/crates/auths-verifier/src/lib.rs b/core/crates/auths-verifier/src/lib.rs index 3cc85e722..c0445a023 100644 --- a/core/crates/auths-verifier/src/lib.rs +++ b/core/crates/auths-verifier/src/lib.rs @@ -296,6 +296,7 @@ pub struct VerifiedAuthority { assurance_satisfactions: Vec, observation_satisfactions: Vec, approval_satisfactions: Vec, + authority_not_after: Timestamp, work_units: u64, } @@ -316,6 +317,7 @@ pub struct VerifiedAction { assurance_satisfactions: Vec, observation_satisfactions: Vec, approval_satisfactions: Vec, + authority_not_after: Timestamp, work_units: u64, } @@ -360,6 +362,17 @@ impl SealedVerificationResult { } impl VerifiedAction { + /// Inclusive last time allowed by the temporal evidence selected in this + /// verification: successful anchors, grants/actions, counted approvals, + /// selected observations/status, and selected assurance freshness. + /// It does not assert that the host clock is correct or that no newer + /// revocation exists. Downstream entry must also reject clock rollback + /// and impose its own shorter operational deadlines. + #[must_use] + pub const fn authority_not_after(&self) -> Timestamp { + self.authority_not_after + } + /// Returns exact profile-canonical bytes and derived meaning. #[must_use] pub const fn canonical_action(&self) -> &CanonicalAction { @@ -1248,8 +1261,8 @@ fn verify_portable_sealed( /// Unwraps the canonical encoding, or digest, of an already constructed model /// value. fn infallible_encoding(encoded: Result) -> T { - // INVARIANT: the V1 encoders write into a `Vec`, whose minicbor writer - // cannot fail, and frame only lengths that fit in `u64`, so no + // INVARIANT: the V1 encoders write valid major tags into a `Vec` and + // frame only lengths that fit in `u64`, so no // constructed model value makes them return `Err`. encoded.expect("canonical V1 encoding of a constructed model value cannot fail") } @@ -1641,6 +1654,7 @@ fn verify_authority_measured( let mut observation_satisfactions = Vec::new(); let mut approval_requirements = Vec::new(); let mut action_ids = Vec::new(); + let mut authority_not_after = Timestamp::new(u64::MAX); let bundle = controlled.resolved.decoded.bundle(); let mut approvals = approval::Approvals::new(bundle)?; let approval_inputs = approval::Inputs { @@ -1664,6 +1678,7 @@ fn verify_authority_measured( &approval_inputs, ) { Ok(branch) => { + authority_not_after = authority_not_after.min(branch.authority_not_after); authorized_branches.push(reference); action_ids.push(branch.action_id); assurance.extend(branch.assurance); @@ -1722,6 +1737,7 @@ fn verify_authority_measured( diagnostics, )?); let approval_satisfactions = approvals.satisfactions(&approval_requirements); + authority_not_after = authority_not_after.min(approvals.valid_through(&approval_requirements)); assurance.sort_by(|left, right| { left.role() .cmp(&right.role()) @@ -1748,6 +1764,7 @@ fn verify_authority_measured( assurance_satisfactions, observation_satisfactions, approval_satisfactions, + authority_not_after, work_units: meter.used, }) } @@ -1789,6 +1806,7 @@ pub(crate) fn bind_verified_action(authority: VerifiedAuthority) -> VerifiedActi assurance_satisfactions: authority.assurance_satisfactions, observation_satisfactions: authority.observation_satisfactions, approval_satisfactions: authority.approval_satisfactions, + authority_not_after: authority.authority_not_after, work_units: authority.work_units, } } @@ -2316,6 +2334,7 @@ fn same_shared_action( /// Authority established for one authorization-plan branch that authorized. struct BranchAuthority { action_id: ActionId, + authority_not_after: Timestamp, assurance: Vec, assurance_satisfactions: Vec, observation_satisfactions: Vec, @@ -2410,7 +2429,11 @@ fn verify_branch_from_anchor( { return Err(VerificationFailure::Denied(DenialReason::UntrustedRoot)); } - check_principal_status( + let mut authority_not_after = anchor + .validity() + .expires_at() + .min(action.envelope().validity().expires_at()); + authority_not_after = authority_not_after.min(check_principal_status( controlled, anchor.status_policy(), anchor.principal(), @@ -2419,13 +2442,14 @@ fn verify_branch_from_anchor( context, registries, meter, - )?; + )?); // Every grant subject is checked under the anchor's policy, not the // grant's own: by chain linkage the subjects are every issuer after the // root and the actor, and a grant's policy governs only that grant. for grant in chain { let id = grant_id(grant.statement()).map_err(codec_failure)?; - check_grant_status( + authority_not_after = authority_not_after.min(grant.statement().validity().expires_at()); + authority_not_after = authority_not_after.min(check_grant_status( controlled, grant.statement().status_policy(), id, @@ -2433,8 +2457,8 @@ fn verify_branch_from_anchor( context, registries, meter, - )?; - check_principal_status( + )?); + authority_not_after = authority_not_after.min(check_principal_status( controlled, anchor.status_policy(), grant.statement().subject(), @@ -2443,7 +2467,7 @@ fn verify_branch_from_anchor( context, registries, meter, - )?; + )?); } validate_resource_constraints(anchor, chain, action, context, registries, meter)?; validate_budget_constraints(anchor, chain, action, context, registries, meter)?; @@ -2463,7 +2487,9 @@ fn verify_branch_from_anchor( ParticipantRole::Actor, )?); let assurance_satisfactions = evaluate_branch_assurance(&reports, context, registries, meter)?; - let observation_satisfactions = observation::Stage { + authority_not_after = + authority_not_after.min(assurance_horizon(&assurance_satisfactions, context)?); + let (observation_satisfactions, observation_not_after) = observation::Stage { chain, root: anchor.principal(), action, @@ -2472,10 +2498,12 @@ fn verify_branch_from_anchor( registries, } .evaluate(meter)?; + authority_not_after = authority_not_after.min(observation_not_after); let approval_requirements = approval::chain_requirements(chain)?; approvals.evaluate_list(&approval_requirements, approval_inputs, meter)?; Ok(BranchAuthority { action_id, + authority_not_after, assurance: reports, assurance_satisfactions, observation_satisfactions, @@ -2557,6 +2585,35 @@ fn evaluate_branch_assurance( .map_err(VerificationFailure::Indeterminate) } +/// Reads only evidence already selected by the assurance evaluator. +fn assurance_horizon( + satisfactions: &[AssuranceSatisfaction], + context: &TrustedContext, +) -> Result { + let mut valid_through = Timestamp::new(u64::MAX); + for satisfaction in satisfactions { + let requirement = context + .assurance_policy() + .requirements() + .get(usize::from(satisfaction.requirement_index())) + .ok_or(VerificationFailure::Indeterminate( + Requirement::AssuranceRequirementNotMet, + ))?; + if let Some(age) = requirement.maximum_age() { + let observed = + satisfaction + .claim() + .observed_at() + .ok_or(VerificationFailure::Indeterminate( + Requirement::AssuranceRequirementNotMet, + ))?; + valid_through = + valid_through.min(Timestamp::new(observed.get().saturating_add(age.get()))); + } + } + Ok(valid_through) +} + fn action_or_first_method<'a>( action: &'a SignedAction, chain: &'a [&SignedGrant], @@ -2704,9 +2761,9 @@ fn check_principal_status( context: &TrustedContext, registries: &ImmutableRegistries<'_>, meter: &mut WorkMeter, -) -> Result<(), VerificationFailure> { +) -> Result { let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(()); + return Ok(Timestamp::new(u64::MAX)); }; let implementation = registries .status_method(context.accepted_registries(), method, true) @@ -2735,12 +2792,13 @@ fn check_principal_status( ) .map_err(registry_operation_failure)?; if matches!( - (listing, decision), + (listing, decision.decision()), (StatusListing::RevocationList, StatusDecision::Missing) ) { - return Ok(()); + return status_horizon(decision, context.evaluation_time()); } - status_decision(decision, true) + status_decision(decision.decision(), true)?; + status_horizon(decision, context.evaluation_time()) } /// Out-of-scope statements take no part, as for principal status. @@ -2752,9 +2810,9 @@ fn check_grant_status( context: &TrustedContext, registries: &ImmutableRegistries<'_>, meter: &mut WorkMeter, -) -> Result<(), VerificationFailure> { +) -> Result { let StatusPolicy::SnapshotRequired { method, .. } = policy else { - return Ok(()); + return Ok(Timestamp::new(u64::MAX)); }; let implementation = registries .status_method(context.accepted_registries(), method, false) @@ -2782,7 +2840,20 @@ fn check_grant_status( context.evaluation_time(), ) .map_err(registry_operation_failure)?; - status_decision(decision, false) + status_decision(decision.decision(), false)?; + status_horizon(decision, context.evaluation_time()) +} + +/// Refuses a registry's unusable temporal witness before sealing authority. +fn status_horizon( + evaluation: auths_ports::StatusEvaluation, + evaluation_time: Timestamp, +) -> Result { + if evaluation.valid_through() < evaluation_time { + Err(VerificationFailure::Indeterminate(Requirement::StaleStatus)) + } else { + Ok(evaluation.valid_through()) + } } fn status_decision(decision: StatusDecision, principal: bool) -> Result<(), VerificationFailure> { @@ -3629,6 +3700,11 @@ mod tests { &fixture.canonical ); + assert_eq!( + authorized.action().unwrap().authority_not_after(), + Timestamp::new(20) + ); + let denied = verify_v1_sealed(&fixture.bytes, b"invalid", &context_bytes, ®istries).unwrap(); assert_eq!(denied.portable().decision(), VerificationDecision::Denied); @@ -4129,3 +4205,6 @@ mod tests { ); } } + +#[cfg(test)] +mod temporal_tests; diff --git a/core/crates/auths-verifier/src/observation.rs b/core/crates/auths-verifier/src/observation.rs index b58c0988d..83c01d086 100644 --- a/core/crates/auths-verifier/src/observation.rs +++ b/core/crates/auths-verifier/src/observation.rs @@ -17,7 +17,7 @@ use auths_model::{ MAX_OBSERVATION_BYTES, MAX_OBSERVATION_REQUIREMENTS_PER_CHAIN, OBSERVATION_MEDIA_TYPE, ObservationRequirement, ObservationSatisfaction, ObservationSubject, ObserverAnchor, PrincipalId, Requirement, RequirementVerdict, ResourceId, SignedAction, SignedGrant, - SignedObservation, TrustedContext, observation_conditions_hold, observation_fresh, + SignedObservation, Timestamp, TrustedContext, observation_conditions_hold, observation_fresh, observation_schema_equal, observation_subject_equal, principal_id_equal, requirement_subject_equal, requirement_verdict, }; @@ -35,6 +35,12 @@ struct Candidate { authentic: Option, } +/// The exact selected observation and its inclusive freshness endpoint. +struct Satisfied { + record: ObservationSatisfaction, + valid_through: Timestamp, +} + /// Shared inputs of one branch's observation stage. pub(crate) struct Stage<'a, 'r> { pub(crate) chain: &'a [&'a SignedGrant], @@ -137,10 +143,10 @@ impl Stage<'_, '_> { pub(crate) fn evaluate( &self, meter: &mut WorkMeter, - ) -> Result, VerificationFailure> { + ) -> Result<(Vec, Timestamp), VerificationFailure> { let requirements = chain_requirements(self.chain)?; if requirements.is_empty() { - return Ok(Vec::new()); + return Ok((Vec::new(), Timestamp::new(u64::MAX))); } let mut anchors = Vec::with_capacity(requirements.len()); for requirement in &requirements { @@ -161,9 +167,13 @@ impl Stage<'_, '_> { let mut candidates = self.candidates()?; let mut satisfactions = Vec::with_capacity(requirements.len()); let mut unavailable = None; + let mut valid_through = Timestamp::new(u64::MAX); for (requirement, anchor) in requirements.iter().zip(anchors) { match self.requirement(requirement, anchor, &mut candidates, meter)? { - Ok(satisfaction) => satisfactions.push(satisfaction), + Ok(satisfied) => { + valid_through = valid_through.min(satisfied.valid_through); + satisfactions.push(satisfied.record); + } Err(VerificationFailure::Denied(reason)) => { return Err(VerificationFailure::Denied(reason)); } @@ -174,7 +184,7 @@ impl Stage<'_, '_> { } match unavailable { Some(failure) => Err(failure), - None => Ok(satisfactions), + None => Ok((satisfactions, valid_through)), } } @@ -221,7 +231,7 @@ impl Stage<'_, '_> { anchor: Option<&ObserverAnchor>, candidates: &mut [Candidate], meter: &mut WorkMeter, - ) -> Result, VerificationFailure> { + ) -> Result, VerificationFailure> { let Some(anchor) = anchor else { return Ok(Err(VerificationFailure::Indeterminate( Requirement::ObservationMissing, @@ -256,16 +266,26 @@ impl Stage<'_, '_> { &action_values, candidate.observation.statement().facts(), ) { - satisfying = Some(candidate.digest); + let statement = candidate.observation.statement(); + let valid_through = anchor.validity().expires_at().min(Timestamp::new( + statement + .observed_at() + .get() + .saturating_add(u64::from(requirement.max_age_seconds())), + )); + satisfying = Some((candidate.digest, valid_through)); break; } } let verdict = requirement_verdict(any_eligible, satisfying.is_some()); Ok(match (verdict, satisfying) { - (RequirementVerdict::Satisfied, Some(digest)) => { + (RequirementVerdict::Satisfied, Some((digest, valid_through))) => { let id = auths_codec::observation_requirement_id(requirement) .map_err(limit_or_malformed)?; - Ok(ObservationSatisfaction::new(id, digest)) + Ok(Satisfied { + record: ObservationSatisfaction::new(id, digest), + valid_through, + }) } (RequirementVerdict::ConditionFalse, _) => Err(VerificationFailure::Denied( DenialReason::ObservationConditionFalse, diff --git a/core/crates/auths-verifier/src/temporal_tests.rs b/core/crates/auths-verifier/src/temporal_tests.rs new file mode 100644 index 000000000..095a5638f --- /dev/null +++ b/core/crates/auths-verifier/src/temporal_tests.rs @@ -0,0 +1,151 @@ +//! Boundary witnesses for the actual temporal functions in the qualified slice. + +use super::{VerificationFailure, assurance_horizon, status_decision, status_horizon}; +use auths_model::{ + AssuranceClaim, AssurancePolicy, AssuranceRequirement, AssuranceSatisfaction, EvidenceId, + EvidenceSourceId, FreshnessLimit, Requirement, Timestamp, TrustedContext, +}; +use auths_ports::{StatusDecision, StatusEvaluation}; + +fn context(maximum_age: Option) -> TrustedContext { + let fixture = auths_testkit::raw_key_chain(); + let source = auths_codec::decode_verifier_context(fixture.context_bytes()).unwrap(); + let existing = source.assurance_policy().requirements().first().unwrap(); + let requirement = AssuranceRequirement::new( + existing.role(), + existing.quantifier(), + existing.claim_kind().clone(), + maximum_age.map(|age| FreshnessLimit::new(age).unwrap()), + ); + let policy = + AssurancePolicy::new(source.assurance_policy().id().clone(), vec![requirement]).unwrap(); + TrustedContext::new( + source.configuration(), + source.composition(), + source.trust_anchors().to_vec(), + source.accepted_registries().clone(), + source.expected_audience().clone(), + source.expected_challenge(), + source.evaluation_time(), + policy, + source.principal_status_snapshot().clone(), + source.grant_status_snapshot().clone(), + source.resource_matcher().clone(), + source.profile_policy().clone(), + source.channel_policy().clone(), + source.limits().clone(), + ) + .unwrap() +} + +fn witness( + context: &TrustedContext, + index: u16, + observed_at: Option, +) -> AssuranceSatisfaction { + let claim = AssuranceClaim::new( + context.assurance_policy().requirements()[0] + .claim_kind() + .clone(), + Vec::new(), + observed_at.map(Timestamp::new), + EvidenceSourceId::parse("temporal-boundary-test").unwrap(), + ) + .unwrap(); + AssuranceSatisfaction::new( + index, + context.trust_anchors()[0].principal().clone(), + claim, + vec![EvidenceId::new([1; 32])], + ) +} + +#[test] +fn temporal_status_needs_active_and_an_inclusive_current_horizon() { + for decision in [ + StatusDecision::Active, + StatusDecision::Revoked, + StatusDecision::Missing, + StatusDecision::Stale, + StatusDecision::Rollback, + StatusDecision::UntrustedIssuer, + StatusDecision::WrongMethod, + ] { + for principal in [false, true] { + for now in [99, 100, 101] { + let evaluation = StatusEvaluation::new(decision, Timestamp::new(100)); + let admitted = status_decision(decision, principal).is_ok() + && status_horizon(evaluation, Timestamp::new(now)).is_ok(); + assert_eq!(admitted, decision == StatusDecision::Active && now <= 100); + } + } + } + assert_eq!( + status_horizon( + StatusEvaluation::new(StatusDecision::Active, Timestamp::new(100)), + Timestamp::new(101), + ), + Err(VerificationFailure::Indeterminate(Requirement::StaleStatus)) + ); +} + +#[test] +fn temporal_selected_assurance_expiry_is_the_minimum() { + let context = context(Some(20)); + let selected = [ + witness(&context, 0, Some(40)), + witness(&context, 0, Some(45)), + ]; + assert_eq!( + assurance_horizon(&selected, &context), + Ok(Timestamp::new(60)) + ); + assert_eq!( + assurance_horizon(&selected[1..], &context), + Ok(Timestamp::new(65)) + ); +} + +#[test] +fn temporal_missing_selected_metadata_fails_closed() { + let context = context(Some(20)); + let refused = Err(VerificationFailure::Indeterminate( + Requirement::AssuranceRequirementNotMet, + )); + assert_eq!( + assurance_horizon(&[witness(&context, 1, Some(100))], &context), + refused + ); + assert_eq!( + assurance_horizon(&[witness(&context, 0, None)], &context), + refused + ); +} + +#[test] +fn temporal_unbounded_rule_does_not_require_an_observation_time() { + let context = context(None); + assert_eq!( + assurance_horizon(&[witness(&context, 0, None)], &context), + Ok(Timestamp::new(u64::MAX)) + ); + assert_eq!( + assurance_horizon(&[], &context), + Ok(Timestamp::new(u64::MAX)) + ); +} + +#[test] +fn temporal_expiry_overflow_saturates_without_reopening_an_earlier_bound() { + let context = context(Some(20)); + let overflow = witness(&context, 0, Some(u64::MAX)); + assert_eq!( + assurance_horizon(core::slice::from_ref(&overflow), &context), + Ok(Timestamp::new(u64::MAX)) + ); + let selected = [overflow, witness(&context, 0, Some(40))]; + assert_eq!( + assurance_horizon(&selected, &context), + Ok(Timestamp::new(60)) + ); +} diff --git a/core/fixtures/crypto/README.md b/core/fixtures/crypto/README.md new file mode 100644 index 000000000..364be764d --- /dev/null +++ b/core/fixtures/crypto/README.md @@ -0,0 +1,51 @@ +# Strict signature-suite corpus + +`p256-sha256-v1.tsv` is shared by the native Rust implementation and the +independent Go and TypeScript verifiers. It contains 653 cases: 173 admitted +signatures over 98 distinct public keys, 369 equation/low-S refusals, 85 +signature-encoding refusals, and 26 invalid-key/error-priority refusals. +The complete corpus spans 111 valid curve points. + +The input is Project Wycheproof's complete 262-case P-256/SHA-256 IEEE P1363 +verification corpus at commit +[`878e5366008753df2064d40c49f8e2f50f9c6af7`](https://github.com/C2SP/wycheproof/blob/878e5366008753df2064d40c49f8e2f50f9c6af7/testvectors_v1/ecdsa_secp256r1_sha256_p1363_test.json). +The exact source bytes have SHA-256 +`c60de693930e386c3a5472d08081623ef8504decc54b38ac01ec6b2a2575c986`. +The source is Apache-2.0 licensed; see the upstream +[license](https://github.com/C2SP/wycheproof/blob/878e5366008753df2064d40c49f8e2f50f9c6af7/LICENSE) +and this repository's [Apache license text](../../../LICENSE-APACHE). +Project Wycheproof's authors retain their attribution. No upstream private +key material is included. + +The adapter retains every original signature and message; the vendored JSON +preserves the upstream classifications. It converts the published uncompressed point to the unique corresponding compressed SEC1 +encoding; other SEC1 forms are independently refused by Auths. General ECDSA +accepts high-S signatures, while the registered Auths suite requires low-S. +Consequently each original valid high-S tuple is recorded as an Auths refusal +and receives its mathematically equivalent `n-s` low-S positive case. Each +original low-S tuple receives its reflected high-S refusal. Every valid tuple +also has a changed-message refusal. These transformations are explicit and do +not modify an upstream invalid verdict into an acceptance. + +Additional cases cover exact widths, zero/out-of-range scalars, half-order +boundaries, uncompressed/compact/hybrid/infinity encodings, out-of-field and +non-curve coordinates, altered domain/profile/descriptor bytes, and invalid-key +precedence over a malformed signature. These altered-message examples exercise +exact-byte signature binding; they do not replace the separate caller-framing +and canonical-object proofs. + +`import_p256_wycheproof.py` regenerates the TSV from a local copy of the exact +upstream JSON and refuses a changed source hash. Pass the source and output +paths, with `--write` to regenerate; omitting it checks byte equality. The +exact upstream JSON is vendored under `upstream/`, and qualification checks +byte-for-byte reproduction without network access. Normal test runs consume +the committed TSV. + +Rust checks the native primitive and shipping `SignatureSuite` adapter, their +key validators, and the complete stable result/error mapping. Go and TypeScript +check the same boolean signature verdicts using their independent libraries; +Go also checks the key verdict. Tests pin the complete case, positive, and +distinct-positive-key counts. Hosted bindings conformance includes both +independent runners, and core-layer tests include the Rust integration test. +These are conformance results, not proofs of cryptographic arithmetic or +security, and do not discharge the explicit primitive premises in Lean. diff --git a/core/fixtures/crypto/import_p256_wycheproof.py b/core/fixtures/crypto/import_p256_wycheproof.py new file mode 100644 index 000000000..0b974e22f --- /dev/null +++ b/core/fixtures/crypto/import_p256_wycheproof.py @@ -0,0 +1,131 @@ +#!/usr/bin/env python3 +"""Reproduce the strict Auths P-256 corpus from the pinned public upstream file.""" +import argparse +import hashlib +import json +from pathlib import Path + +COMMIT = "878e5366008753df2064d40c49f8e2f50f9c6af7" +SOURCE = f"https://raw.githubusercontent.com/C2SP/wycheproof/{COMMIT}/testvectors_v1/ecdsa_secp256r1_sha256_p1363_test.json" +SOURCE_SHA256 = "c60de693930e386c3a5472d08081623ef8504decc54b38ac01ec6b2a2575c986" +ORDER = int("ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", 16) +FIELD = int("ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", 16) +CURVE_B = int("5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b", 16) + + +def render(source: bytes) -> str: + if hashlib.sha256(source).hexdigest() != SOURCE_SHA256: + raise ValueError("upstream vector bytes differ from the reviewed revision") + data = json.loads(source) + if data["algorithm"] != "ECDSA" or data["numberOfTests"] != 262: + raise ValueError("unexpected upstream corpus") + rows = [] + + def add(name, key, message, signature, error, key_valid=True): + rows.append((name, key.hex(), message.hex(), signature.hex(), error, + "true" if key_valid else "false")) + + def refusal(signature): + if len(signature) != 64: + return "invalid-signature-encoding" + r, s = int.from_bytes(signature[:32], "big"), int.from_bytes(signature[32:], "big") + if not (0 < r < ORDER and 0 < s < ORDER): + return "invalid-signature-encoding" + return "verification-failed" + + first = None + source_cases = 0 + for group in data["testGroups"]: + if group["sha"] != "SHA-256" or group["publicKey"]["curve"] != "secp256r1": + raise ValueError("unexpected upstream algorithm") + uncompressed = bytes.fromhex(group["publicKey"]["uncompressed"]) + if len(uncompressed) != 65 or uncompressed[0] != 4: + raise ValueError("unexpected upstream public-key representation") + key = bytes([2 | (uncompressed[-1] & 1)]) + uncompressed[1:33] + for case in group["tests"]: + source_cases += 1 + name = f"wycheproof-{case['tcId']}" + message, signature = bytes.fromhex(case["msg"]), bytes.fromhex(case["sig"]) + if case["result"] == "invalid": + add(name, key, message, signature, refusal(signature)) + continue + if case["result"] != "valid" or len(signature) != 64: + raise ValueError("unexpected upstream result") + s = int.from_bytes(signature[32:], "big") + if not 0 < s < ORDER: + raise ValueError("invalid scalar in a valid upstream signature") + add(name, key, message, signature, + "ok" if s <= ORDER // 2 else "verification-failed") + low = signature[:32] + min(s, ORDER - s).to_bytes(32, "big") + high = signature[:32] + max(s, ORDER - s).to_bytes(32, "big") + if s > ORDER // 2: + add(name + "-low-s", key, message, low, "ok") + else: + add(name + "-high-s", key, message, high, "verification-failed") + add(name + "-changed-message", key, message + b"\x00", low, "verification-failed") + if first is None: + first = key, message, low, uncompressed + if source_cases != 262 or first is None: + raise ValueError("incomplete source corpus") + key, message, low, uncompressed = first + for size in (0, 1, 31, 32, 63, 65, 66, 128): + signature = (low + bytes(128))[:size] + add(f"auths-signature-width-{size}", key, message, signature, + "invalid-signature-encoding") + for component, offset in (("r", 0), ("s", 32)): + for label, value in (("zero", 0), ("order", ORDER), ("maximum", (1 << 256) - 1)): + signature = bytearray(low) + signature[offset:offset+32] = value.to_bytes(32, "big") + add(f"auths-{component}-{label}", key, message, bytes(signature), + "invalid-signature-encoding") + for label, scalar in (("half-order", ORDER // 2), ("half-order-plus-one", ORDER // 2 + 1)): + add(f"auths-s-{label}", key, message, low[:32] + scalar.to_bytes(32, "big"), "verification-failed") + invalid_x = next(x for x in range(100) if pow((x**3 - 3*x + CURVE_B) % FIELD, + (FIELD - 1) // 2, FIELD) == FIELD - 1) + invalid_keys = { + "empty": b"", "infinity": b"\x00", "x-only": key[1:], + "uncompressed": uncompressed, "compact": b"\x05" + key[1:], + "hybrid-even": b"\x06" + uncompressed[1:], + "hybrid-odd": b"\x07" + uncompressed[1:], + "truncated": key[:-1], "trailing": key + b"\x00", + "wrong-tag": b"\x01" + key[1:], + "out-of-field": b"\x02" + FIELD.to_bytes(32, "big"), + "non-point-even": b"\x02" + invalid_x.to_bytes(32, "big"), + "non-point-odd": b"\x03" + invalid_x.to_bytes(32, "big"), + } + for label, malformed_key in invalid_keys.items(): + add(f"auths-key-{label}", malformed_key, message, low, "invalid-key", False) + add(f"auths-key-{label}-before-signature", malformed_key, message, b"", "invalid-key", False) + for label, changed in (("domain", b"AUTHS-WRONG-DOMAIN" + message), + ("profile", b"wrong-profile\x00" + message), + ("descriptor", message + b"wrong-descriptor")): + add(f"auths-changed-{label}", key, changed, low, "verification-failed") + if len({row[0] for row in rows}) != len(rows): + raise ValueError("duplicate vector name") + header = ["# auths.p256-sha256-v1-corpus/1", f"# source: {SOURCE}", + f"# source-sha256: {SOURCE_SHA256}", + "# All 262 upstream cases retained; compressed keys preserve the published point.", + "# Valid high-S signatures remain refusals; n-s supplies the low-S equivalent.", + "# Derived message, scalar, encoding, and error-priority cases are explicit Auths checks.", + "id\tkey_hex\tmessage_hex\tsignature_hex\tresult\tkey_valid"] + return "\n".join(header + ["\t".join(row) for row in rows]) + "\n" + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("upstream", type=Path) + parser.add_argument("output", type=Path) + parser.add_argument("--write", action="store_true") + args = parser.parse_args() + rendered = render(args.upstream.resolve().read_bytes()) + output = args.output.resolve() + if args.write: + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(rendered) + elif output.read_text() != rendered: + raise SystemExit("P-256 corpus is stale") + print(f"P-256 corpus: {len(rendered.splitlines()) - 7} cases") + + +if __name__ == "__main__": + main() diff --git a/core/fixtures/crypto/p256-sha256-v1.tsv b/core/fixtures/crypto/p256-sha256-v1.tsv new file mode 100644 index 000000000..ed91d3d00 --- /dev/null +++ b/core/fixtures/crypto/p256-sha256-v1.tsv @@ -0,0 +1,660 @@ +# auths.p256-sha256-v1-corpus/1 +# source: https://raw.githubusercontent.com/C2SP/wycheproof/878e5366008753df2064d40c49f8e2f50f9c6af7/testvectors_v1/ecdsa_secp256r1_sha256_p1363_test.json +# source-sha256: c60de693930e386c3a5472d08081623ef8504decc54b38ac01ec6b2a2575c986 +# All 262 upstream cases retained; compressed keys preserve the published point. +# Valid high-S signatures remain refusals; n-s supplies the low-S equivalent. +# Derived message, scalar, encoding, and error-priority cases are explicit Auths checks. +id key_hex message_hex signature_hex result key_valid +wycheproof-1 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 ok true +wycheproof-1-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e18b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db verification-failed true +wycheproof-1-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31323334303000 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 verification-failed true +wycheproof-2 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 012ba3a8bd6b94d5ed80a6d9d1190a436ebccc0833490686deac8635bcb9bf536900b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-3 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 01002ba3a7be6b94d6ec80a6d9d1190a432be6dfbb2cb98d6d4d72972df620817f180000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-4 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 d45c5740946b2a147f59262ee6f5bc90bd01ed280528b62b3aed5fc93f06f739b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db verification-failed true +wycheproof-5 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 012ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e1800b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-6 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0100000000000000002ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e18000000000000000000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-7 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 01b329f478a2bbd0a6c384ee1493b1f518276e0e4a5375928d6fcd160c11cb6d2c00b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-8 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0100b329f379a2bbd1a5c384ee1493b1f4d55181c143c3fc78fc35de0e45788d98db0000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-9 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 01b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db00b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-10 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 010000000000000000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db000000000000000000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db invalid-signature-encoding true +wycheproof-11 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-12 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001 invalid-signature-encoding true +wycheproof-13 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-14 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 invalid-signature-encoding true +wycheproof-15 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-16 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000000ffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-17 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000000ffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-18 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-19 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001 verification-failed true +wycheproof-20 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000001ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-21 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000001ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 verification-failed true +wycheproof-22 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000001ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-23 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000001ffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-24 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 0000000000000000000000000000000000000000000000000000000000000001ffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-25 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325510000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-26 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325510000000000000000000000000000000000000000000000000000000000000001 invalid-signature-encoding true +wycheproof-27 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-28 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 invalid-signature-encoding true +wycheproof-29 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-30 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-31 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-32 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325500000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-33 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325500000000000000000000000000000000000000000000000000000000000000001 verification-failed true +wycheproof-34 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-35 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 verification-failed true +wycheproof-36 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-37 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-38 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-39 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325520000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-40 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325520000000000000000000000000000000000000000000000000000000000000001 invalid-signature-encoding true +wycheproof-41 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-42 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 invalid-signature-encoding true +wycheproof-43 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-44 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-45 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-46 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-47 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000001 invalid-signature-encoding true +wycheproof-48 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-49 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 invalid-signature-encoding true +wycheproof-50 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-51 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-52 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-53 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff000000010000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-54 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff000000010000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000001 invalid-signature-encoding true +wycheproof-55 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +wycheproof-56 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 invalid-signature-encoding true +wycheproof-57 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552 invalid-signature-encoding true +wycheproof-58 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000001000000000000000000000000ffffffffffffffffffffffff invalid-signature-encoding true +wycheproof-59 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000001000000000000000000000001000000000000000000000000 invalid-signature-encoding true +wycheproof-60 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3639383139 64a1aab5000d0e804f3e2fc02bdee9be8ff312334e2ba16d11547c97711c898e6af015971cc30be6d1a206d4e013e0997772a2f91d73286ffd683b9bb2cf4f1b ok true +wycheproof-60-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3639383139 64a1aab5000d0e804f3e2fc02bdee9be8ff312334e2ba16d11547c97711c898e950fea67e33cf41a2e5df92b1fec1f66457457b489a47614f6518f274993d636 verification-failed true +wycheproof-60-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 363938313900 64a1aab5000d0e804f3e2fc02bdee9be8ff312334e2ba16d11547c97711c898e6af015971cc30be6d1a206d4e013e0997772a2f91d73286ffd683b9bb2cf4f1b verification-failed true +wycheproof-61 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 343236343739373234 16aea964a2f6506d6f78c81c91fc7e8bded7d397738448de1e19a0ec580bf266252cd762130c6667cfe8b7bc47d27d78391e8e80c578d1cd38c3ff033be928e9 ok true +wycheproof-61-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 343236343739373234 16aea964a2f6506d6f78c81c91fc7e8bded7d397738448de1e19a0ec580bf266dad3289cecf3999930174843b82d828783c86c2ce19eccb7baf5cbbfc079fc68 verification-failed true +wycheproof-61-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34323634373937323400 16aea964a2f6506d6f78c81c91fc7e8bded7d397738448de1e19a0ec580bf266252cd762130c6667cfe8b7bc47d27d78391e8e80c578d1cd38c3ff033be928e9 verification-failed true +wycheproof-62 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 37313338363834383931 9cc98be2347d469bf476dfc26b9b733df2d26d6ef524af917c665baccb23c882093496459effe2d8d70727b82462f61d0ec1b7847929d10ea631dacb16b56c32 ok true +wycheproof-62-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 37313338363834383931 9cc98be2347d469bf476dfc26b9b733df2d26d6ef524af917c665baccb23c882f6cb69b961001d2828f8d847db9d09e2ae2543292dedcd764d87eff7e5adb91f verification-failed true +wycheproof-62-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3731333836383438393100 9cc98be2347d469bf476dfc26b9b733df2d26d6ef524af917c665baccb23c882093496459effe2d8d70727b82462f61d0ec1b7847929d10ea631dacb16b56c32 verification-failed true +wycheproof-63 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130333539333331363638 73b3c90ecd390028058164524dde892703dce3dea0d53fa8093999f07ab8aa432f67b0b8e20636695bb7d8bf0a651c802ed25a395387b5f4188c0c4075c88634 ok true +wycheproof-63-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130333539333331363638 73b3c90ecd390028058164524dde892703dce3dea0d53fa8093999f07ab8aa43d0984f461df9c997a4482740f59ae37f8e14a074538fe890db2dbe82869a9f1d verification-failed true +wycheproof-63-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313033353933333136363800 73b3c90ecd390028058164524dde892703dce3dea0d53fa8093999f07ab8aa432f67b0b8e20636695bb7d8bf0a651c802ed25a395387b5f4188c0c4075c88634 verification-failed true +wycheproof-64 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33393439343031323135 bfab3098252847b328fadf2f89b95c851a7f0eb390763378f37e90119d5ba3ddbdd64e234e832b1067c2d058ccb44d978195ccebb65c2aaf1e2da9b8b4987e3b verification-failed true +wycheproof-64-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33393439343031323135 bfab3098252847b328fadf2f89b95c851a7f0eb390763378f37e90119d5ba3dd4229b1dbb17cd4f0983d2fa7334bb2683b512dc1f0bb73d5d58c210a47caa716 ok true +wycheproof-64-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3339343934303132313500 bfab3098252847b328fadf2f89b95c851a7f0eb390763378f37e90119d5ba3dd4229b1dbb17cd4f0983d2fa7334bb2683b512dc1f0bb73d5d58c210a47caa716 verification-failed true +wycheproof-65 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31333434323933303739 204a9784074b246d8bf8bf04a4ceb1c1f1c9aaab168b1596d17093c5cd21d2cd51cce41670636783dc06a759c8847868a406c2506fe17975582fe648d1d88b52 ok true +wycheproof-65-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31333434323933303739 204a9784074b246d8bf8bf04a4ceb1c1f1c9aaab168b1596d17093c5cd21d2cdae331be88f9c987d23f958a6377b879718e0385d3736250f9b89e47a2a8a99ff verification-failed true +wycheproof-65-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3133343432393330373900 204a9784074b246d8bf8bf04a4ceb1c1f1c9aaab168b1596d17093c5cd21d2cd51cce41670636783dc06a759c8847868a406c2506fe17975582fe648d1d88b52 verification-failed true +wycheproof-66 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33373036323131373132 ed66dc34f551ac82f63d4aa4f81fe2cb0031a91d1314f835027bca0f1ceeaa0399ca123aa09b13cd194a422e18d5fda167623c3f6e5d4d6abb8953d67c0c48c7 verification-failed true +wycheproof-66-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33373036323131373132 ed66dc34f551ac82f63d4aa4f81fe2cb0031a91d1314f835027bca0f1ceeaa036635edc45f64ec33e6b5bdd1e72a025e5584be6e38ba511a383076ec8056dc8a ok true +wycheproof-66-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3337303632313137313200 ed66dc34f551ac82f63d4aa4f81fe2cb0031a91d1314f835027bca0f1ceeaa036635edc45f64ec33e6b5bdd1e72a025e5584be6e38ba511a383076ec8056dc8a verification-failed true +wycheproof-67 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 333433363838373132 060b700bef665c68899d44f2356a578d126b062023ccc3c056bf0f60a237012b8d186c027832965f4fcc78a3366ca95dedbb410cbef3f26d6be5d581c11d3610 verification-failed true +wycheproof-67-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 333433363838373132 060b700bef665c68899d44f2356a578d126b062023ccc3c056bf0f60a237012b72e793fc87cd69a1b033875cc99356a1cf2bb9a0e823ac1787d3f5413b45ef41 ok true +wycheproof-67-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33343336383837313200 060b700bef665c68899d44f2356a578d126b062023ccc3c056bf0f60a237012b72e793fc87cd69a1b033875cc99356a1cf2bb9a0e823ac1787d3f5413b45ef41 verification-failed true +wycheproof-68 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31333531353330333730 9f6adfe8d5eb5b2c24d7aa7934b6cf29c93ea76cd313c9132bb0c8e38c96831db26a9c9e40e55ee0890c944cf271756c906a33e66b5bd15e051593883b5e9902 verification-failed true +wycheproof-68-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31333531353330333730 9f6adfe8d5eb5b2c24d7aa7934b6cf29c93ea76cd313c9132bb0c8e38c96831d4d956360bf1aa12076f36bb30d8e8a932c7cc6c73bbbcd26eea4373ac1048c4f ok true +wycheproof-68-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3133353135333033373000 9f6adfe8d5eb5b2c24d7aa7934b6cf29c93ea76cd313c9132bb0c8e38c96831d4d956360bf1aa12076f36bb30d8e8a932c7cc6c73bbbcd26eea4373ac1048c4f verification-failed true +wycheproof-69 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36353533323033313236 a1af03ca91677b673ad2f33615e56174a1abf6da168cebfa8868f4ba273f16b720aa73ffe48afa6435cd258b173d0c2377d69022e7d098d75caf24c8c5e06b1c ok true +wycheproof-69-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36353533323033313236 a1af03ca91677b673ad2f33615e56174a1abf6da168cebfa8868f4ba273f16b7df558bff1b75059cca32da74e8c2f3dc45106a8abf4705ad970aa5fa3682ba35 verification-failed true +wycheproof-69-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3635353332303331323600 a1af03ca91677b673ad2f33615e56174a1abf6da168cebfa8868f4ba273f16b720aa73ffe48afa6435cd258b173d0c2377d69022e7d098d75caf24c8c5e06b1c verification-failed true +wycheproof-70 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31353634333436363033 fdc70602766f8eed11a6c99a71c973d5659355507b843da6e327a28c11893db93df5349688a085b137b1eacf456a9e9e0f6d15ec0078ca60a7f83f2b10d21350 ok true +wycheproof-70-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31353634333436363033 fdc70602766f8eed11a6c99a71c973d5659355507b843da6e327a28c11893db9c20acb68775f7a4fc84e1530ba956161ad79e4c1a69ed4244bc18b97eb911201 verification-failed true +wycheproof-70-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3135363433343636303300 fdc70602766f8eed11a6c99a71c973d5659355507b843da6e327a28c11893db93df5349688a085b137b1eacf456a9e9e0f6d15ec0078ca60a7f83f2b10d21350 verification-failed true +wycheproof-71 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34343239353339313137 b516a314f2fce530d6537f6a6c49966c23456f63c643cf8e0dc738f7b876e675d39ffd033c92b6d717dd536fbc5efdf1967c4bd80954479ba66b0120cd16fff2 verification-failed true +wycheproof-71-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34343239353339313137 b516a314f2fce530d6537f6a6c49966c23456f63c643cf8e0dc738f7b876e6752c6002fbc36d4929e822ac9043a1020e266aaed59dc356e94d4ec9a22f4c255f ok true +wycheproof-71-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3434323935333931313700 b516a314f2fce530d6537f6a6c49966c23456f63c643cf8e0dc738f7b876e6752c6002fbc36d4929e822ac9043a1020e266aaed59dc356e94d4ec9a22f4c255f verification-failed true +wycheproof-72 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130393533323631333531 3b2cbf046eac45842ecb7984d475831582717bebb6492fd0a485c101e29ff0a84c9b7b47a98b0f82de512bc9313aaf51701099cac5f76e68c8595fc1c1d99258 ok true +wycheproof-72-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130393533323631333531 3b2cbf046eac45842ecb7984d475831582717bebb6492fd0a485c101e29ff0a8b36484b75674f07e21aed436cec550ae4cd660e2e120301c2b606b013a8992f9 verification-failed true +wycheproof-72-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313039353332363133353100 3b2cbf046eac45842ecb7984d475831582717bebb6492fd0a485c101e29ff0a84c9b7b47a98b0f82de512bc9313aaf51701099cac5f76e68c8595fc1c1d99258 verification-failed true +wycheproof-73 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35393837333530303431 30c87d35e636f540841f14af54e2f9edd79d0312cfa1ab656c3fb15bfde48dcf47c15a5a82d24b75c85a692bd6ecafeb71409ede23efd08e0db9abf6340677ed ok true +wycheproof-73-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35393837333530303431 30c87d35e636f540841f14af54e2f9edd79d0312cfa1ab656c3fb15bfde48dcfb83ea5a47d2db48b37a596d4291350144ba65bcf8327cdf6e6001eccc85cad64 verification-failed true +wycheproof-73-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3539383733353030343100 30c87d35e636f540841f14af54e2f9edd79d0312cfa1ab656c3fb15bfde48dcf47c15a5a82d24b75c85a692bd6ecafeb71409ede23efd08e0db9abf6340677ed verification-failed true +wycheproof-74 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33343633303036383738 38686ff0fda2cef6bc43b58cfe6647b9e2e8176d168dec3c68ff262113760f52067ec3b651f422669601662167fa8717e976e2db5e6a4cf7c2ddabb3fde9d67d ok true +wycheproof-74-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33343633303036383738 38686ff0fda2cef6bc43b58cfe6647b9e2e8176d168dec3c68ff262113760f52f9813c48ae0bdd9a69fe99de980578e7d37017d248ad518d30dc1f0efe794ed4 verification-failed true +wycheproof-74-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3334363330303638373800 38686ff0fda2cef6bc43b58cfe6647b9e2e8176d168dec3c68ff262113760f52067ec3b651f422669601662167fa8717e976e2db5e6a4cf7c2ddabb3fde9d67d verification-failed true +wycheproof-75 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 39383137333230323837 44a3e23bf314f2b344fc25c7f2de8b6af3e17d27f5ee844b225985ab6e2775cf2d48e223205e98041ddc87be532abed584f0411f5729500493c9cc3f4dd15e86 ok true +wycheproof-75-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 39383137333230323837 44a3e23bf314f2b344fc25c7f2de8b6af3e17d27f5ee844b225985ab6e2775cfd2b71ddbdfa167fce2237841acd5412a37f6b98e4fee4e805feffe83ae91c6cb verification-failed true +wycheproof-75-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3938313733323032383700 44a3e23bf314f2b344fc25c7f2de8b6af3e17d27f5ee844b225985ab6e2775cf2d48e223205e98041ddc87be532abed584f0411f5729500493c9cc3f4dd15e86 verification-failed true +wycheproof-76 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33323232303431303436 2ded5b7ec8e90e7bf11f967a3d95110c41b99db3b5aa8d330eb9d638781688e97d5792c53628155e1bfc46fb1a67e3088de049c328ae1f44ec69238a009808f9 ok true +wycheproof-76-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33323232303431303436 2ded5b7ec8e90e7bf11f967a3d95110c41b99db3b5aa8d330eb9d638781688e982a86d39c9d7eaa2e403b904e5981cf72f06b0ea7e697f400750a738fbcb1c58 verification-failed true +wycheproof-76-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3332323230343130343600 2ded5b7ec8e90e7bf11f967a3d95110c41b99db3b5aa8d330eb9d638781688e97d5792c53628155e1bfc46fb1a67e3088de049c328ae1f44ec69238a009808f9 verification-failed true +wycheproof-77 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36363636333037313034 bdae7bcb580bf335efd3bc3d31870f923eaccafcd40ec2f605976f15137d8b8ff6dfa12f19e525270b0106eecfe257499f373a4fb318994f24838122ce7ec3c7 verification-failed true +wycheproof-77-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36363636333037313034 bdae7bcb580bf335efd3bc3d31870f923eaccafcd40ec2f605976f15137d8b8f09205ecfe61adad9f4fef911301da8b61dafc05df3ff0535cf3649a02de4618a ok true +wycheproof-77-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3636363633303731303400 bdae7bcb580bf335efd3bc3d31870f923eaccafcd40ec2f605976f15137d8b8f09205ecfe61adad9f4fef911301da8b61dafc05df3ff0535cf3649a02de4618a verification-failed true +wycheproof-78 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31303335393531383938 50f9c4f0cd6940e162720957ffff513799209b78596956d21ece251c2401f1c6d7033a0a787d338e889defaaabb106b95a4355e411a59c32aa5167dfab244726 verification-failed true +wycheproof-78-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31303335393531383938 50f9c4f0cd6940e162720957ffff513799209b78596956d21ece251c2401f1c628fcc5f48782cc7277621055544ef94662a3a4c995720252496862e3513ede2b ok true +wycheproof-78-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130333539353138393800 50f9c4f0cd6940e162720957ffff513799209b78596956d21ece251c2401f1c628fcc5f48782cc7277621055544ef94662a3a4c995720252496862e3513ede2b verification-failed true +wycheproof-79 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31383436353937313935 f612820687604fa01906066a378d67540982e29575d019aabe90924ead5c860d3f9367702dd7dd4f75ea98afd20e328a1a99f4857b316525328230ce294b0fef ok true +wycheproof-79-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31383436353937313935 f612820687604fa01906066a378d67540982e29575d019aabe90924ead5c860dc06c988ed22822b18a1567502df1cd75a24d06282be6395fc13799f4d3181562 verification-failed true +wycheproof-79-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3138343635393731393500 f612820687604fa01906066a378d67540982e29575d019aabe90924ead5c860d3f9367702dd7dd4f75ea98afd20e328a1a99f4857b316525328230ce294b0fef verification-failed true +wycheproof-80 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33313336303436313839 9505e407657d6e8bc93db5da7aa6f5081f61980c1949f56b0f2f507da5782a7ac60d31904e3669738ffbeccab6c3656c08e0ed5cb92b3cfa5e7f71784f9c5021 verification-failed true +wycheproof-80-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33313336303436313839 9505e407657d6e8bc93db5da7aa6f5081f61980c1949f56b0f2f507da5782a7a39f2ce6eb1c9968d70041335493c9a93b4060d50edec618a953a594aacc6d530 ok true +wycheproof-80-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3331333630343631383900 9505e407657d6e8bc93db5da7aa6f5081f61980c1949f56b0f2f507da5782a7a39f2ce6eb1c9968d70041335493c9a93b4060d50edec618a953a594aacc6d530 verification-failed true +wycheproof-81 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 32363633373834323534 bbd16fbbb656b6d0d83e6a7787cd691b08735aed371732723e1c68a40404517d9d8e35dba96028b7787d91315be675877d2d097be5e8ee34560e3e7fd25c0f00 verification-failed true +wycheproof-81-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 32363633373834323534 bbd16fbbb656b6d0d83e6a7787cd691b08735aed371732723e1c68a40404517d6271ca23569fd74987826ecea4198a783fb9f131c12eb0509dab8c432a071651 ok true +wycheproof-81-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3236363337383432353400 bbd16fbbb656b6d0d83e6a7787cd691b08735aed371732723e1c68a40404517d6271ca23569fd74987826ecea4198a783fb9f131c12eb0509dab8c432a071651 verification-failed true +wycheproof-82 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31363532313030353234 2ec9760122db98fd06ea76848d35a6da442d2ceef7559a30cf57c61e92df327e7ab271da90859479701fccf86e462ee3393fb6814c27b760c4963625c0a19878 ok true +wycheproof-82-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31363532313030353234 2ec9760122db98fd06ea76848d35a6da442d2ceef7559a30cf57c61e92df327e854d8e246f7a6b878fe0330791b9d11c83a7442c5aefe7242f23949d3bc18cd9 verification-failed true +wycheproof-82-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3136353231303035323400 2ec9760122db98fd06ea76848d35a6da442d2ceef7559a30cf57c61e92df327e7ab271da90859479701fccf86e462ee3393fb6814c27b760c4963625c0a19878 verification-failed true +wycheproof-83 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35373438303831363936 54e76b7683b6650baa6a7fc49b1c51eed9ba9dd463221f7a4f1005a89fe00c592ea076886c773eb937ec1cc8374b7915cfd11b1c1ae1166152f2f7806a31c8fd ok true +wycheproof-83-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35373438303831363936 54e76b7683b6650baa6a7fc49b1c51eed9ba9dd463221f7a4f1005a89fe00c59d15f89769388c147c813e337c8b486e9ed15df918c368823a0c6d34292315c54 verification-failed true +wycheproof-83-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3537343830383136393600 54e76b7683b6650baa6a7fc49b1c51eed9ba9dd463221f7a4f1005a89fe00c592ea076886c773eb937ec1cc8374b7915cfd11b1c1ae1166152f2f7806a31c8fd verification-failed true +wycheproof-84 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36333433393133343638 5291deaf24659ffbbce6e3c26f6021097a74abdbb69be4fb10419c0c496c946665d6fcf336d27cc7cdb982bb4e4ecef5827f84742f29f10abf83469270a03dc3 ok true +wycheproof-84-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36333433393133343638 5291deaf24659ffbbce6e3c26f6021097a74abdbb69be4fb10419c0c496c94669a29030bc92d833932467d44b1b1310a3a67763977edad7a343684308bc2e78e verification-failed true +wycheproof-84-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3633343339313334363800 5291deaf24659ffbbce6e3c26f6021097a74abdbb69be4fb10419c0c496c946665d6fcf336d27cc7cdb982bb4e4ecef5827f84742f29f10abf83469270a03dc3 verification-failed true +wycheproof-85 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31353431313033353938 207a3241812d75d947419dc58efb05e8003b33fc17eb50f9d15166a88479f107cdee749f2e492b213ce80b32d0574f62f1c5d70793cf55e382d5caadf7592767 verification-failed true +wycheproof-85-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31353431313033353938 207a3241812d75d947419dc58efb05e8003b33fc17eb50f9d15166a88479f10732118b5fd1b6d4dfc317f4cd2fa8b09ccb2123a6134848a170e400150509fdea ok true +wycheproof-85-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3135343131303335393800 207a3241812d75d947419dc58efb05e8003b33fc17eb50f9d15166a88479f10732118b5fd1b6d4dfc317f4cd2fa8b09ccb2123a6134848a170e400150509fdea verification-failed true +wycheproof-86 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130343738353830313238 6554e49f82a855204328ac94913bf01bbe84437a355a0a37c0dee3cf81aa7728aea00de2507ddaf5c94e1e126980d3df16250a2eaebc8be486effe7f22b4f929 verification-failed true +wycheproof-86-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130343738353830313238 6554e49f82a855204328ac94913bf01bbe84437a355a0a37c0dee3cf81aa7728515ff21caf82250b36b1e1ed967f2c20a6c1f07ef85b12a06cc9cc43d9ae2c28 ok true +wycheproof-86-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313034373835383031323800 6554e49f82a855204328ac94913bf01bbe84437a355a0a37c0dee3cf81aa7728515ff21caf82250b36b1e1ed967f2c20a6c1f07ef85b12a06cc9cc43d9ae2c28 verification-failed true +wycheproof-87 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130353336323835353638 a54c5062648339d2bff06f71c88216c26c6e19b4d80a8c602990ac82707efdfce99bbe7fcfafae3e69fd016777517aa01056317f467ad09aff09be73c9731b0d verification-failed true +wycheproof-87-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130353336323835353638 a54c5062648339d2bff06f71c88216c26c6e19b4d80a8c602990ac82707efdfc1664417f305051c29602fe9888ae855fac90c92e609ccde9f4b00c4f32f00a44 ok true +wycheproof-87-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313035333632383535363800 a54c5062648339d2bff06f71c88216c26c6e19b4d80a8c602990ac82707efdfc1664417f305051c29602fe9888ae855fac90c92e609ccde9f4b00c4f32f00a44 verification-failed true +wycheproof-88 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 393533393034313035 975bd7157a8d363b309f1f444012b1a1d23096593133e71b4ca8b059cff37eaf7faa7a28b1c822baa241793f2abc930bd4c69840fe090f2aacc46786bf919622 ok true +wycheproof-88-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 393533393034313035 975bd7157a8d363b309f1f444012b1a1d23096593133e71b4ca8b059cff37eaf805585d64e37dd465dbe86c0d5436cf3e820626ca90e8f5a46f5633c3cd18f2f verification-failed true +wycheproof-88-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 39353339303431303500 975bd7157a8d363b309f1f444012b1a1d23096593133e71b4ca8b059cff37eaf7faa7a28b1c822baa241793f2abc930bd4c69840fe090f2aacc46786bf919622 verification-failed true +wycheproof-89 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 393738383438303339 5694a6f84b8f875c276afd2ebcfe4d61de9ec90305afb1357b95b3e0da43885e0dffad9ffd0b757d8051dec02ebdf70d8ee2dc5c7870c0823b6ccc7c679cbaa4 ok true +wycheproof-89-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 393738383438303339 5694a6f84b8f875c276afd2ebcfe4d61de9ec90305afb1357b95b3e0da43885ef200525f02f48a837fae213fd14208f22e041e512ea6de02b84cfe4694c66aad verification-failed true +wycheproof-89-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 39373838343830333900 5694a6f84b8f875c276afd2ebcfe4d61de9ec90305afb1357b95b3e0da43885e0dffad9ffd0b757d8051dec02ebdf70d8ee2dc5c7870c0823b6ccc7c679cbaa4 verification-failed true +wycheproof-90 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33363130363732343432 a0c30e8026fdb2b4b4968a27d16a6d08f7098f1a98d21620d7454ba9790f1ba65e470453a8a399f15baf463f9deceb53acc5ca64459149688bd2760c65424339 ok true +wycheproof-90-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33363130363732343432 a0c30e8026fdb2b4b4968a27d16a6d08f7098f1a98d21620d7454ba9790f1ba6a1b8fbab575c660fa450b9c0621314ac102130496186551c67e754b69720e218 verification-failed true +wycheproof-90-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3336313036373234343200 a0c30e8026fdb2b4b4968a27d16a6d08f7098f1a98d21620d7454ba9790f1ba65e470453a8a399f15baf463f9deceb53acc5ca64459149688bd2760c65424339 verification-failed true +wycheproof-91 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31303534323430373035 614ea84acf736527dd73602cd4bb4eea1dfebebd5ad8aca52aa0228cf7b99a88737cc85f5f2d2f60d1b8183f3ed490e4de14368e96a9482c2a4dd193195c902f ok true +wycheproof-91-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31303534323430373035 614ea84acf736527dd73602cd4bb4eea1dfebebd5ad8aca52aa0228cf7b99a888c83379fa0d2d0a02e47e7c0c12b6f1aded2c41f106e5658c96bf92fe3069522 verification-failed true +wycheproof-91-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130353432343037303500 614ea84acf736527dd73602cd4bb4eea1dfebebd5ad8aca52aa0228cf7b99a88737cc85f5f2d2f60d1b8183f3ed490e4de14368e96a9482c2a4dd193195c902f verification-failed true +wycheproof-92 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35313734343438313937 bead6734ebe44b810d3fb2ea00b1732945377338febfd439a8d74dfbd0f942fa6bb18eae36616a7d3cad35919fd21a8af4bbe7a10f73b3e036a46b103ef56e2a ok true +wycheproof-92-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35313734343438313937 bead6734ebe44b810d3fb2ea00b1732945377338febfd439a8d74dfbd0f942fa944e7150c99e9583c352ca6e602de574c82b130c97a3eaa4bd155fb2bd6db727 verification-failed true +wycheproof-92-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3531373434343831393700 bead6734ebe44b810d3fb2ea00b1732945377338febfd439a8d74dfbd0f942fa6bb18eae36616a7d3cad35919fd21a8af4bbe7a10f73b3e036a46b103ef56e2a verification-failed true +wycheproof-93 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31393637353631323531 499625479e161dacd4db9d9ce64854c98d922cbf212703e9654fae182df9bad242c177cf37b8193a0131108d97819edd9439936028864ac195b64fca76d9d693 ok true +wycheproof-93-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31393637353631323531 499625479e161dacd4db9d9ce64854c98d922cbf212703e9654fae182df9bad2bd3e882fc847e6c6feceef72687e612228ad674d7e9153c35e037af885894ebe verification-failed true +wycheproof-93-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3139363735363132353100 499625479e161dacd4db9d9ce64854c98d922cbf212703e9654fae182df9bad242c177cf37b8193a0131108d97819edd9439936028864ac195b64fca76d9d693 verification-failed true +wycheproof-94 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33343437323533333433 08f16b8093a8fb4d66a2c8065b541b3d31e3bfe694f6b89c50fb1aaa6ff6c9b29d6455e2d5d1779748573b611cb95d4a21f967410399b39b535ba3e5af81ca2e verification-failed true +wycheproof-94-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33343437323533333433 08f16b8093a8fb4d66a2c8065b541b3d31e3bfe694f6b89c50fb1aaa6ff6c9b2629baa1c2a2e8869b7a8c49ee346a2b59aed936ca37deae9a05e26dd4ce15b23 ok true +wycheproof-94-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3334343732353333343300 08f16b8093a8fb4d66a2c8065b541b3d31e3bfe694f6b89c50fb1aaa6ff6c9b2629baa1c2a2e8869b7a8c49ee346a2b59aed936ca37deae9a05e26dd4ce15b23 verification-failed true +wycheproof-95 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 333638323634333138 be26231b6191658a19dd72ddb99ed8f8c579b6938d19bce8eed8dc2b338cb5f8e1d9a32ee56cffed37f0f22b2dcb57d5c943c14f79694a03b9c5e96952575c89 verification-failed true +wycheproof-95-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 333638323634333138 be26231b6191658a19dd72ddb99ed8f8c579b6938d19bce8eed8dc2b338cb5f81e265cd01a930013c80f0dd4d234a829f3a3395e2dae548139f3e159aa0bc8c8 ok true +wycheproof-95-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33363832363433313800 be26231b6191658a19dd72ddb99ed8f8c579b6938d19bce8eed8dc2b338cb5f81e265cd01a930013c80f0dd4d234a829f3a3395e2dae548139f3e159aa0bc8c8 verification-failed true +wycheproof-96 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33323631313938363038 15e76880898316b16204ac920a02d58045f36a229d4aa4f812638c455abe0443e74d357d3fcb5c8c5337bd6aba4178b455ca10e226e13f9638196506a1939123 verification-failed true +wycheproof-96-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33323631313938363038 15e76880898316b16204ac920a02d58045f36a229d4aa4f812638c455abe044318b2ca81c034a374acc8429545be874b671ce9cb80365eeebba065bc5acf942e ok true +wycheproof-96-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3332363131393836303800 15e76880898316b16204ac920a02d58045f36a229d4aa4f812638c455abe044318b2ca81c034a374acc8429545be874b671ce9cb80365eeebba065bc5acf942e verification-failed true +wycheproof-97 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 39363738373831303934 352ecb53f8df2c503a45f9846fc28d1d31e6307d3ddbffc1132315cc07f16dad1348dfa9c482c558e1d05c5242ca1c39436726ecd28258b1899792887dd0a3c6 ok true +wycheproof-97-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 39363738373831303934 352ecb53f8df2c503a45f9846fc28d1d31e6307d3ddbffc1132315cc07f16dadecb720553b7d3aa81e2fa3adbd35e3c6797fd3c0d49545d36a22383a7e92818b verification-failed true +wycheproof-97-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3936373837383130393400 352ecb53f8df2c503a45f9846fc28d1d31e6307d3ddbffc1132315cc07f16dad1348dfa9c482c558e1d05c5242ca1c39436726ecd28258b1899792887dd0a3c6 verification-failed true +wycheproof-98 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34393538383233383233 4a40801a7e606ba78a0da9882ab23c7677b8642349ed3d652c5bfa5f2a9558fb3a49b64848d682ef7f605f2832f7384bdc24ed2925825bf8ea77dc5981725782 ok true +wycheproof-98-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34393538383233383233 4a40801a7e606ba78a0da9882ab23c7677b8642349ed3d652c5bfa5f2a9558fbc5b649b6b7297d11809fa0d7cd08c7b3e0c20d848195428c0941ee697af0cdcf verification-failed true +wycheproof-98-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3439353838323338323300 4a40801a7e606ba78a0da9882ab23c7677b8642349ed3d652c5bfa5f2a9558fb3a49b64848d682ef7f605f2832f7384bdc24ed2925825bf8ea77dc5981725782 verification-failed true +wycheproof-99 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 383234363337383337 eacc5e1a8304a74d2be412b078924b3bb3511bac855c05c9e5e9e44df3d61e967451cd8e18d6ed1885dd827714847f96ec4bb0ed4c36ce9808db8f714204f6d1 ok true +wycheproof-99-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 383234363337383337 eacc5e1a8304a74d2be412b078924b3bb3511bac855c05c9e5e9e44df3d61e968bae3270e72912e87a227d88eb7b8068d09b49c05ae0cfeceade3b51ba5e2e80 verification-failed true +wycheproof-99-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 38323436333738333700 eacc5e1a8304a74d2be412b078924b3bb3511bac855c05c9e5e9e44df3d61e967451cd8e18d6ed1885dd827714847f96ec4bb0ed4c36ce9808db8f714204f6d1 verification-failed true +wycheproof-100 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3131303230383333373736 2f7a5e9e5771d424f30f67fdab61e8ce4f8cd1214882adb65f7de94c31577052ac4e69808345809b44acb0b2bd889175fb75dd050c5a449ab9528f8f78daa10c verification-failed true +wycheproof-100-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3131303230383333373736 2f7a5e9e5771d424f30f67fdab61e8ce4f8cd1214882adb65f7de94c3157705253b1967e7cba7f65bb534f4d42776e89c1711da89abd59ea3a673b3383888445 ok true +wycheproof-100-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313130323038333337373600 2f7a5e9e5771d424f30f67fdab61e8ce4f8cd1214882adb65f7de94c3157705253b1967e7cba7f65bb534f4d42776e89c1711da89abd59ea3a673b3383888445 verification-failed true +wycheproof-101 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313333383731363438 ffcda40f792ce4d93e7e0f0e95e1a2147dddd7f6487621c30a03d710b330021979938b55f8a17f7ed7ba9ade8f2065a1fa77618f0b67add8d58c422c2453a49a ok true +wycheproof-101-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313333383731363438 ffcda40f792ce4d93e7e0f0e95e1a2147dddd7f6487621c30a03d710b3300219866c74a9075e80822845652170df9a5dc26f991e9baff0ac1e2d8896d80f80b7 verification-failed true +wycheproof-101-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31333338373136343800 ffcda40f792ce4d93e7e0f0e95e1a2147dddd7f6487621c30a03d710b330021979938b55f8a17f7ed7ba9ade8f2065a1fa77618f0b67add8d58c422c2453a49a verification-failed true +wycheproof-102 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 333232313434313632 81f2359c4faba6b53d3e8c8c3fcc16a948350f7ab3a588b28c17603a431e39a8cd6f6a5cc3b55ead0ff695d06c6860b509e46d99fccefb9f7f9e101857f74300 verification-failed true +wycheproof-102-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 333232313434313632 81f2359c4faba6b53d3e8c8c3fcc16a948350f7ab3a588b28c17603a431e39a8329095a23c4aa153f0096a2f93979f4ab3028d13aa48a2e5741bbaaaa46be251 ok true +wycheproof-102-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33323231343431363200 81f2359c4faba6b53d3e8c8c3fcc16a948350f7ab3a588b28c17603a431e39a8329095a23c4aa153f0096a2f93979f4ab3028d13aa48a2e5741bbaaaa46be251 verification-failed true +wycheproof-103 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130363836363535353436 dfc8bf520445cbb8ee1596fb073ea283ea130251a6fdffa5c3f5f2aaf75ca808048e33efce147c9dd92823640e338e68bfd7d0dc7a4905b3a7ac711e577e90e7 ok true +wycheproof-103-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3130363836363535353436 dfc8bf520445cbb8ee1596fb073ea283ea130251a6fdffa5c3f5f2aaf75ca808fb71cc0f31eb836326d7dc9bf1cc7196fd0f29d12cce98d14c0d59a4a4e4946a verification-failed true +wycheproof-103-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313036383636353535343600 dfc8bf520445cbb8ee1596fb073ea283ea130251a6fdffa5c3f5f2aaf75ca808048e33efce147c9dd92823640e338e68bfd7d0dc7a4905b3a7ac711e577e90e7 verification-failed true +wycheproof-104 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3632313535323436 ad019f74c6941d20efda70b46c53db166503a0e393e932f688227688ba6a576293320eb7ca0710255346bdbb3102cdcf7964ef2e0988e712bc05efe16c199345 verification-failed true +wycheproof-104-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3632313535323436 ad019f74c6941d20efda70b46c53db166503a0e393e932f688227688ba6a57626ccdf14735f8efdbacb94244cefd323043820b7f9d8eb77237b3dae19049920c ok true +wycheproof-104-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 363231353532343600 ad019f74c6941d20efda70b46c53db166503a0e393e932f688227688ba6a57626ccdf14735f8efdbacb94244cefd323043820b7f9d8eb77237b3dae19049920c verification-failed true +wycheproof-105 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 37303330383138373734 ac8096842e8add68c34e78ce11dd71e4b54316bd3ebf7fffdeb7bd5a3ebc1883f5ca2f4f23d674502d4caf85d187215d36e3ce9f0ce219709f21a3aac003b7a8 verification-failed true +wycheproof-105-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 37303330383138373734 ac8096842e8add68c34e78ce11dd71e4b54316bd3ebf7fffdeb7bd5a3ebc18830a35d0afdc298bb0d2b3507a2e78dea286032c0e9a358514549827183c5f6da9 ok true +wycheproof-105-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3730333038313837373400 ac8096842e8add68c34e78ce11dd71e4b54316bd3ebf7fffdeb7bd5a3ebc18830a35d0afdc298bb0d2b3507a2e78dea286032c0e9a358514549827183c5f6da9 verification-failed true +wycheproof-106 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35393234353233373434 677b2d3a59b18a5ff939b70ea002250889ddcd7b7b9d776854b4943693fb92f76b4ba856ade7677bf30307b21f3ccda35d2f63aee81efd0bab6972cc0795db55 ok true +wycheproof-106-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 35393234353233373434 677b2d3a59b18a5ff939b70ea002250889ddcd7b7b9d776854b4943693fb92f794b457a8521898850cfcf84de0c3325c5fb796febef8a179485057f6f4cd49fc verification-failed true +wycheproof-106-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3539323435323337343400 677b2d3a59b18a5ff939b70ea002250889ddcd7b7b9d776854b4943693fb92f76b4ba856ade7677bf30307b21f3ccda35d2f63aee81efd0bab6972cc0795db55 verification-failed true +wycheproof-107 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31343935353836363231 479e1ded14bcaed0379ba8e1b73d3115d84d31d4b7c30e1f05e1fc0d5957cfb0918f79e35b3d89487cf634a4f05b2e0c30857ca879f97c771e877027355b2443 verification-failed true +wycheproof-107-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31343935353836363231 479e1ded14bcaed0379ba8e1b73d3115d84d31d4b7c30e1f05e1fc0d5957cfb06e70861ba4c276b88309cb5b0fa4d1f38c617e052d1e220dd5325a9bc708010e ok true +wycheproof-107-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3134393535383636323100 479e1ded14bcaed0379ba8e1b73d3115d84d31d4b7c30e1f05e1fc0d5957cfb06e70861ba4c276b88309cb5b0fa4d1f38c617e052d1e220dd5325a9bc708010e verification-failed true +wycheproof-108 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34303035333134343036 43dfccd0edb9e280d9a58f01164d55c3d711e14b12ac5cf3b64840ead512a0a31dbe33fa8ba84533cd5c4934365b3442ca1174899b78ef9a3199f49584389772 ok true +wycheproof-108-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34303035333134343036 43dfccd0edb9e280d9a58f01164d55c3d711e14b12ac5cf3b64840ead512a0a3e241cc047457bacd32a3b6cbc9a4cbbcf2d586240b9eaeeac21fd62d782a8ddf verification-failed true +wycheproof-108-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3430303533313434303600 43dfccd0edb9e280d9a58f01164d55c3d711e14b12ac5cf3b64840ead512a0a31dbe33fa8ba84533cd5c4934365b3442ca1174899b78ef9a3199f49584389772 verification-failed true +wycheproof-109 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33303936343537353132 5b09ab637bd4caf0f4c7c7e4bca592fea20e9087c259d26a38bb4085f0bbff1145b7eb467b6748af618e9d80d6fdcd6aa24964e5a13f885bca8101de08eb0d75 ok true +wycheproof-109-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 33303936343537353132 5b09ab637bd4caf0f4c7c7e4bca592fea20e9087c259d26a38bb4085f0bbff11ba4814b88498b7519e71627f290232951a9d95c805d816292938c8e4f37817dc verification-failed true +wycheproof-109-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3330393634353735313200 5b09ab637bd4caf0f4c7c7e4bca592fea20e9087c259d26a38bb4085f0bbff1145b7eb467b6748af618e9d80d6fdcd6aa24964e5a13f885bca8101de08eb0d75 verification-failed true +wycheproof-110 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 32373834303235363230 5e9b1c5a028070df5728c5c8af9b74e0667afa570a6cfa0114a5039ed15ee06fb1360907e2d9785ead362bb8d7bd661b6c29eeffd3c5037744edaeb9ad990c20 verification-failed true +wycheproof-110-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 32373834303235363230 5e9b1c5a028070df5728c5c8af9b74e0667afa570a6cfa0114a5039ed15ee06f4ec9f6f71d2687a252c9d447284299e450bd0badd3529b0daecc1c094eca1931 ok true +wycheproof-110-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3237383430323536323000 5e9b1c5a028070df5728c5c8af9b74e0667afa570a6cfa0114a5039ed15ee06f4ec9f6f71d2687a252c9d447284299e450bd0badd3529b0daecc1c094eca1931 verification-failed true +wycheproof-111 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 32363138373837343138 0671a0a85c2b72d54a2fb0990e34538b4890050f5a5712f6d1a7a5fb8578f32edb1846bab6b7361479ab9c3285ca41291808f27fd5bd4fdac720e5854713694c verification-failed true +wycheproof-111-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 32363138373837343138 0671a0a85c2b72d54a2fb0990e34538b4890050f5a5712f6d1a7a5fb8578f32e24e7b9444948c9ec865463cd7a35bed6a4de082dd15a4eaa2c98e53db54fbc05 ok true +wycheproof-111-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3236313837383734313800 0671a0a85c2b72d54a2fb0990e34538b4890050f5a5712f6d1a7a5fb8578f32e24e7b9444948c9ec865463cd7a35bed6a4de082dd15a4eaa2c98e53db54fbc05 verification-failed true +wycheproof-112 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31363432363235323632 7673f8526748446477dbbb0590a45492c5d7d69859d301abbaedb35b2095103a3dc70ddf9c6b524d886bed9e6af02e0e4dec0d417a414fed3807ef4422913d7c ok true +wycheproof-112-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31363432363235323632 7673f8526748446477dbbb0590a45492c5d7d69859d301abbaedb35b2095103ac238f21f6394adb377941261950fd1f16efaed6c2cd64e97bbb1db7ed9d1e7d5 verification-failed true +wycheproof-112-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3136343236323532363200 7673f8526748446477dbbb0590a45492c5d7d69859d301abbaedb35b2095103a3dc70ddf9c6b524d886bed9e6af02e0e4dec0d417a414fed3807ef4422913d7c verification-failed true +wycheproof-113 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36383234313839343336 7f085441070ecd2bb21285089ebb1aa6450d1a06c36d3ff39dfd657a796d12b5249712012029870a2459d18d47da9aa492a5e6cb4b2d8dafa9e4c5c54a2b9a8b ok true +wycheproof-113-high-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 36383234313839343336 7f085441070ecd2bb21285089ebb1aa6450d1a06c36d3ff39dfd657a796d12b5db68edfddfd678f6dba62e72b825655b2a4113e25bea10d549d504fdb2378ac6 verification-failed true +wycheproof-113-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 3638323431383934333600 7f085441070ecd2bb21285089ebb1aa6450d1a06c36d3ff39dfd657a796d12b5249712012029870a2459d18d47da9aa492a5e6cb4b2d8dafa9e4c5c54a2b9a8b verification-failed true +wycheproof-114 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 343834323435343235 914c67fb61dd1e27c867398ea7322d5ab76df04bc5aa6683a8e0f30a5d287348fa07474031481dda4953e3ac1959ee8cea7e66ec412b38d6c96d28f6d37304ea verification-failed true +wycheproof-114-low-s 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 343834323435343235 914c67fb61dd1e27c867398ea7322d5ab76df04bc5aa6683a8e0f30a5d28734805f8b8beceb7e226b6ac1c53e6a61172d26893c165ec65ae2a4ca1cc28f02067 ok true +wycheproof-114-changed-message 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 34383432343534323500 914c67fb61dd1e27c867398ea7322d5ab76df04bc5aa6683a8e0f30a5d28734805f8b8beceb7e226b6ac1c53e6a61172d26893c165ec65ae2a4ca1cc28f02067 verification-failed true +wycheproof-115 020ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103 313233343030 000000000000000000000000000000004319055358e8617b0c46353d039cdaabffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-115-low-s 020ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103 313233343030 000000000000000000000000000000004319055358e8617b0c46353d039cdaab0000000000000000000000000000000000000000000000000000000000000003 ok true +wycheproof-115-changed-message 020ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103 31323334303000 000000000000000000000000000000004319055358e8617b0c46353d039cdaab0000000000000000000000000000000000000000000000000000000000000003 verification-failed true +wycheproof-116 020ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103 313233343030 ffffffff00000001000000000000000000000000fffffffffffffffffffffffcffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e invalid-signature-encoding true +wycheproof-117 03ab05fd9d0de26b9ce6f4819652d9fc69193d0aa398f0fba8013e09c582204554 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-117-low-s 03ab05fd9d0de26b9ce6f4819652d9fc69193d0aa398f0fba8013e09c582204554 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254f0000000000000000000000000000000000000000000000000000000000000003 ok true +wycheproof-117-changed-message 03ab05fd9d0de26b9ce6f4819652d9fc69193d0aa398f0fba8013e09c582204554 31323334303000 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254f0000000000000000000000000000000000000000000000000000000000000003 verification-failed true +wycheproof-118 0380984f39a1ff38a86a68aa4201b6be5dfbfecf876219710b07badf6fdd4c6c56 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd909135bdb6799286170f5ead2de4f6511453fe50914f3df2de54a36383df8dd4 verification-failed true +wycheproof-118-low-s 0380984f39a1ff38a86a68aa4201b6be5dfbfecf876219710b07badf6fdd4c6c56 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd6f6eca4149866d7ae8f0a152d21b09aea892fc5d15c860921565275f7883977d ok true +wycheproof-118-changed-message 0380984f39a1ff38a86a68aa4201b6be5dfbfecf876219710b07badf6fdd4c6c56 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd6f6eca4149866d7ae8f0a152d21b09aea892fc5d15c860921565275f7883977d verification-failed true +wycheproof-119 024201b4272944201c3294f5baa9a3232b6dd687495fcc19a70a95bc602b4f7c05 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd27b4577ca009376f71303fd5dd227dcef5deb773ad5f5a84360644669ca249a5 ok true +wycheproof-119-high-s 024201b4272944201c3294f5baa9a3232b6dd687495fcc19a70a95bc602b4f7c05 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdd84ba8825ff6c8918ecfc02a22dd8230c7084339f9b84400bdb3865c5fc0dbac verification-failed true +wycheproof-119-changed-message 024201b4272944201c3294f5baa9a3232b6dd687495fcc19a70a95bc602b4f7c05 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd27b4577ca009376f71303fd5dd227dcef5deb773ad5f5a84360644669ca249a5 verification-failed true +wycheproof-120 03a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac957 313233343030 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000001 ok true +wycheproof-120-high-s 03a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac957 313233343030 0000000000000000000000000000000000000000000000000000000000000005ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 verification-failed true +wycheproof-120-changed-message 03a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac957 31323334303000 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000001 verification-failed true +wycheproof-121 03a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac957 313233343030 0501 invalid-signature-encoding true +wycheproof-122 036627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b1572 313233343030 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000003 ok true +wycheproof-122-high-s 036627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b1572 313233343030 0000000000000000000000000000000000000000000000000000000000000005ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-122-changed-message 036627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b1572 31323334303000 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000003 verification-failed true +wycheproof-123 036627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b1572 313233343030 0503 invalid-signature-encoding true +wycheproof-124 035a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bf 313233343030 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000005 ok true +wycheproof-124-high-s 035a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bf 313233343030 0000000000000000000000000000000000000000000000000000000000000005ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254c verification-failed true +wycheproof-124-changed-message 035a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bf 31323334303000 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000005 verification-failed true +wycheproof-125 035a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bf 313233343030 0505 invalid-signature-encoding true +wycheproof-126 03cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c737 313233343030 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006 ok true +wycheproof-126-high-s 03cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c737 313233343030 0000000000000000000000000000000000000000000000000000000000000005ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254b verification-failed true +wycheproof-126-changed-message 03cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c737 31323334303000 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006 verification-failed true +wycheproof-127 03cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c737 313233343030 0506 invalid-signature-encoding true +wycheproof-128 022ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2e 313233343030 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000001 ok true +wycheproof-128-high-s 022ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2e 313233343030 0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 verification-failed true +wycheproof-128-changed-message 022ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2e 31323334303000 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000001 verification-failed true +wycheproof-129 022ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2e 313233343030 0601 invalid-signature-encoding true +wycheproof-130 03931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf 313233343030 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000003 ok true +wycheproof-130-high-s 03931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf 313233343030 0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-130-changed-message 03931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf 31323334303000 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000003 verification-failed true +wycheproof-131 03931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf 313233343030 0603 invalid-signature-encoding true +wycheproof-132 03899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed 313233343030 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006 ok true +wycheproof-132-high-s 03899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed 313233343030 0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254b verification-failed true +wycheproof-132-changed-message 03899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed 31323334303000 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006 verification-failed true +wycheproof-133 03899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed 313233343030 0606 invalid-signature-encoding true +wycheproof-134 02d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c4 313233343030 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000007 ok true +wycheproof-134-high-s 02d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c4 313233343030 0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254a verification-failed true +wycheproof-134-changed-message 02d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c4 31323334303000 00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000007 verification-failed true +wycheproof-135 02d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c4 313233343030 0607 invalid-signature-encoding true +wycheproof-136 02d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c4 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325570000000000000000000000000000000000000000000000000000000000000007 invalid-signature-encoding true +wycheproof-137 023a72476291571193b4d109b2c37b59f2807e8fe9cffd804eacded903e77ca0da 313233343030 0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc75fbd8 invalid-signature-encoding true +wycheproof-138 03d0f73792203716afd4be4329faa48d269f15313ebbba379d7783c97bf3e890d9 313233343030 00000000000000000000000000000000000000000000000000000000000001008f1e3c7862c58b16bb76eddbb76eddbb516af4f63f2d74d76e0d28c9bb75ea88 verification-failed true +wycheproof-138-low-s 03d0f73792203716afd4be4329faa48d269f15313ebbba379d7783c97bf3e890d9 313233343030 000000000000000000000000000000000000000000000000000000000000010070e1c3869d3a74ea44891224489122446b7c05b767ea29ad85aca1f940ed3ac9 ok true +wycheproof-138-changed-message 03d0f73792203716afd4be4329faa48d269f15313ebbba379d7783c97bf3e890d9 31323334303000 000000000000000000000000000000000000000000000000000000000000010070e1c3869d3a74ea44891224489122446b7c05b767ea29ad85aca1f940ed3ac9 verification-failed true +wycheproof-139 034838b2be35a6276a80ef9e228140f9d9b96ce83b7a254f71ccdebbb8054ce05f 313233343030 000000000000000000000000000000000000000000000000002d9b4d347952d6ef3043e7329581dbb3974497710ab11505ee1c87ff907beebadd195a0ffe6d7a verification-failed true +wycheproof-139-low-s 034838b2be35a6276a80ef9e228140f9d9b96ce83b7a254f71ccdebbb8054ce05f 313233343030 000000000000000000000000000000000000000000000000002d9b4d347952d610cfbc17cd6a7e254c68bb688ef54eeab6f8de25a787229638dcb168ec64b7d7 ok true +wycheproof-139-changed-message 034838b2be35a6276a80ef9e228140f9d9b96ce83b7a254f71ccdebbb8054ce05f 31323334303000 000000000000000000000000000000000000000000000000002d9b4d347952d610cfbc17cd6a7e254c68bb688ef54eeab6f8de25a787229638dcb168ec64b7d7 verification-failed true +wycheproof-140 027393983ca30a520bbc4783dc9960746aab444ef520c0a8e771119aa4e74b0f64 313233343030 000000000000000000000000000000000000001033e67e37b32b445580bf4eff8b748b74000000008b748b748b748b7466e769ad4a16d3dcd87129b8e91d1b4d verification-failed true +wycheproof-140-low-s 027393983ca30a520bbc4783dc9960746aab444ef520c0a8e771119aa4e74b0f64 313233343030 000000000000000000000000000000000000001033e67e37b32b445580bf4eff748b748b00000000748b748b748b748b55ff91005d00caa81b48a10a13460a04 ok true +wycheproof-140-changed-message 027393983ca30a520bbc4783dc9960746aab444ef520c0a8e771119aa4e74b0f64 31323334303000 000000000000000000000000000000000000001033e67e37b32b445580bf4eff748b748b00000000748b748b748b748b55ff91005d00caa81b48a10a13460a04 verification-failed true +wycheproof-141 035ac331a1103fe966697379f356a937f350588a05477e308851b8a502d5dfcdc5 313233343030 0000000000000000000000000000000000000000000000000000000000000100ef9f6ba4d97c09d03178fa20b4aaad83be3cf9cb824a879fec3270fc4b81ef5b verification-failed true +wycheproof-141-low-s 035ac331a1103fe966697379f356a937f350588a05477e308851b8a502d5dfcdc5 313233343030 00000000000000000000000000000000000000000000000000000000000001001060945a2683f630ce8705df4b55527bfeaa00e224cd16e5078759c6b0e135f6 ok true +wycheproof-141-changed-message 035ac331a1103fe966697379f356a937f350588a05477e308851b8a502d5dfcdc5 31323334303000 00000000000000000000000000000000000000000000000000000000000001001060945a2683f630ce8705df4b55527bfeaa00e224cd16e5078759c6b0e135f6 verification-failed true +wycheproof-142 031d209be8de2de877095a399d3904c74cc458d926e27bb8e58e5eae5767c41509 313233343030 00000000000000000000000000000000000000062522bbd3ecbe7c39e93e7c25ef9f6ba4d97c09d03178fa20b4aaad83be3cf9cb824a879fec3270fc4b81ef5b verification-failed true +wycheproof-142-low-s 031d209be8de2de877095a399d3904c74cc458d926e27bb8e58e5eae5767c41509 313233343030 00000000000000000000000000000000000000062522bbd3ecbe7c39e93e7c251060945a2683f630ce8705df4b55527bfeaa00e224cd16e5078759c6b0e135f6 ok true +wycheproof-142-changed-message 031d209be8de2de877095a399d3904c74cc458d926e27bb8e58e5eae5767c41509 31323334303000 00000000000000000000000000000000000000062522bbd3ecbe7c39e93e7c251060945a2683f630ce8705df4b55527bfeaa00e224cd16e5078759c6b0e135f6 verification-failed true +wycheproof-143 02083539fbee44625e3acaafa2fcb41349392cef0633a1b8fabecee0c133b10e99 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6324d5555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 ok true +wycheproof-143-high-s 02083539fbee44625e3acaafa2fcb41349392cef0633a1b8fabecee0c133b10e99 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6324d5aaaaaaaa00000000aaaaaaaaaaaaaaaa7def51c91a0fbf034d26872ca84218e1 verification-failed true +wycheproof-143-changed-message 02083539fbee44625e3acaafa2fcb41349392cef0633a1b8fabecee0c133b10e99 31323334303000 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6324d5555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-144 02e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4 313233343030 0000000000000000000000000000000000000000000000009c44febf31c3594f000000000000000000000000000000000000000000000000839ed28247c2b06b ok true +wycheproof-144-high-s 02e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4 313233343030 0000000000000000000000000000000000000000000000009c44febf31c3594fffffffff00000000ffffffffffffffffbce6faada7179e84701af840b4a074e6 verification-failed true +wycheproof-144-changed-message 02e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4 31323334303000 0000000000000000000000000000000000000000000000009c44febf31c3594f000000000000000000000000000000000000000000000000839ed28247c2b06b verification-failed true +wycheproof-145 02e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4 313233343030 9c44febf31c3594f839ed28247c2b06b invalid-signature-encoding true +wycheproof-146 02cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8 313233343030 0000000000000000000000000000000000000009df8b682430beef6f5fd7c7cd000000000000000000000000000000000000000fd0a62e13778f4222a0d61c8a ok true +wycheproof-146-high-s 02cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8 313233343030 0000000000000000000000000000000000000009df8b682430beef6f5fd7c7cdffffffff00000000ffffffffffffffffbce6fa9dd67170717c2a88a05b8d08c7 verification-failed true +wycheproof-146-changed-message 02cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8 31323334303000 0000000000000000000000000000000000000009df8b682430beef6f5fd7c7cd000000000000000000000000000000000000000fd0a62e13778f4222a0d61c8a verification-failed true +wycheproof-147 02cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8 313233343030 09df8b682430beef6f5fd7c7cd0fd0a62e13778f4222a0d61c8a invalid-signature-encoding true +wycheproof-148 02b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549 313233343030 000000000000000000000000000000008a598e563a89f526c32ebec8de26367c0000000000000000000000000000000084f633e2042630e99dd0f1e16f7a04bf ok true +wycheproof-148-high-s 02b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549 313233343030 000000000000000000000000000000008a598e563a89f526c32ebec8de26367cffffffff00000000ffffffffffffffff37f0c6cba2f16d9b55e8d8e18ce92092 verification-failed true +wycheproof-148-changed-message 02b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549 31323334303000 000000000000000000000000000000008a598e563a89f526c32ebec8de26367c0000000000000000000000000000000084f633e2042630e99dd0f1e16f7a04bf verification-failed true +wycheproof-149 02b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549 313233343030 8a598e563a89f526c32ebec8de26367c84f633e2042630e99dd0f1e16f7a04bf invalid-signature-encoding true +wycheproof-150 0284536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b 313233343030 000000000000000000000000aa6eeb5823f7fa31b466bb473797f0d0314c0bdf000000000000000000000000e2977c479e6d25703cebbc6bd561938cc9d1bfb9 ok true +wycheproof-150-high-s 0284536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b 313233343030 000000000000000000000000aa6eeb5823f7fa31b466bb473797f0d0314c0bdfffffffff00000000ffffffff1d6883b81e79d53d6a2be2191e58373632916598 verification-failed true +wycheproof-150-changed-message 0284536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b 31323334303000 000000000000000000000000aa6eeb5823f7fa31b466bb473797f0d0314c0bdf000000000000000000000000e2977c479e6d25703cebbc6bd561938cc9d1bfb9 verification-failed true +wycheproof-151 0284536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b 313233343030 aa6eeb5823f7fa31b466bb473797f0d0314c0bdfe2977c479e6d25703cebbc6bd561938cc9d1bfb9 invalid-signature-encoding true +wycheproof-152 038aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e19373874 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c700000000000000000000000000000000000000000000000000000000000000001 ok true +wycheproof-152-high-s 038aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e19373874 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550 verification-failed true +wycheproof-152-changed-message 038aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e19373874 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c700000000000000000000000000000000000000000000000000000000000000001 verification-failed true +wycheproof-153 038aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e19373874 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c700000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +wycheproof-154 0261722eaba731c697c7a9ba4d0afdbb5713d8aa12b0eab601bb33dbaf792c5adc 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7002f676969f451a8ccafa4c4f09791810e6d632dbd60b1d5540f3284fbe1889b0 ok true +wycheproof-154-high-s 0261722eaba731c697c7a9ba4d0afdbb5713d8aa12b0eab601bb33dbaf792c5adc 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70fd09896860bae5743505b3b0f686e7eed610c7d1d10c812fb2c6a2733e4a9ba1 verification-failed true +wycheproof-154-changed-message 0261722eaba731c697c7a9ba4d0afdbb5713d8aa12b0eab601bb33dbaf792c5adc 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7002f676969f451a8ccafa4c4f09791810e6d632dbd60b1d5540f3284fbe1889b0 verification-failed true +wycheproof-155 03c4c91981e720e20d7e478ff19d09b95a98f58c0f469b72801a8ce844a3473165 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c704e260962e33362ef0046126d2d5a4edc6947ab20e19b8ec19cf79e5908b6e628 ok true +wycheproof-155-high-s 03c4c91981e720e20d7e478ff19d09b95a98f58c0f469b72801a8ce844a3473165 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70b1d9f69c1ccc9d11ffb9ed92d2a5b123539f4f8cc57c0fc356c22c69f3ac3f29 verification-failed true +wycheproof-155-changed-message 03c4c91981e720e20d7e478ff19d09b95a98f58c0f469b72801a8ce844a3473165 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c704e260962e33362ef0046126d2d5a4edc6947ab20e19b8ec19cf79e5908b6e628 verification-failed true +wycheproof-156 02d58d47bf49bc8f416641f6f760fcbca80aa52a814e56a5fa40bab44fd6f63172 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70077ed0d8f20f697d8fc591ac64dd5219c7932122b4f9b9ec6441e44a0092cf21 ok true +wycheproof-156-high-s 02d58d47bf49bc8f416641f6f760fcbca80aa52a814e56a5fa40bab44fd6f63172 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70f8812f260df09683703a6e539b22ade5f553d98af21de4988f77e678fbd05630 verification-failed true +wycheproof-156-changed-message 02d58d47bf49bc8f416641f6f760fcbca80aa52a814e56a5fa40bab44fd6f63172 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70077ed0d8f20f697d8fc591ac64dd5219c7932122b4f9b9ec6441e44a0092cf21 verification-failed true +wycheproof-157 0291e305822e5e44f3fdb616e2ef42cd98f241b86e9f68815bc4dba6a945e4eefb 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c703e0292a67e181c6c0105ee35e956e78e9bdd033c6e71ae57884039a245e4175f ok true +wycheproof-157-high-s 0291e305822e5e44f3fdb616e2ef42cd98f241b86e9f68815bc4dba6a945e4eefb 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70c1fd6d5881e7e394fefa11ca16a918712109f77138a5f02d6b799120b67f0df2 verification-failed true +wycheproof-157-changed-message 0291e305822e5e44f3fdb616e2ef42cd98f241b86e9f68815bc4dba6a945e4eefb 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c703e0292a67e181c6c0105ee35e956e78e9bdd033c6e71ae57884039a245e4175f verification-failed true +wycheproof-158 0324a0bc4d16dbbd40d2fd81a7c3f8d8ec741607d5bb406a0611cc60d0e683bd46 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7013d22b06d6b8f5d97e0c64962b4a3bae30f668ca6217ef5b35d799f159e23ebe ok true +wycheproof-158-high-s 0324a0bc4d16dbbd40d2fd81a7c3f8d8ec741607d5bb406a0611cc60d0e683bd46 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70ec2dd4f829470a2781f39b69d4b5c4518bf091e344ffaf29bde230d1a280e693 verification-failed true +wycheproof-158-changed-message 0324a0bc4d16dbbd40d2fd81a7c3f8d8ec741607d5bb406a0611cc60d0e683bd46 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7013d22b06d6b8f5d97e0c64962b4a3bae30f668ca6217ef5b35d799f159e23ebe verification-failed true +wycheproof-159 02d24dd06745cafb39186d22a92aa0e58169a79ab69488628a9da5ed3ef747269b 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c704523ce342e4994bb8968bf6613f60c06c86111f15a3a389309e72cd447d5dd99 ok true +wycheproof-159-high-s 02d24dd06745cafb39186d22a92aa0e58169a79ab69488628a9da5ed3ef747269b 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70badc31cad1b66b4576974099ec09f3f8f485e8bc4cdd65f1e9d29deeb48d47b8 verification-failed true +wycheproof-159-changed-message 02d24dd06745cafb39186d22a92aa0e58169a79ab69488628a9da5ed3ef747269b 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c704523ce342e4994bb8968bf6613f60c06c86111f15a3a389309e72cd447d5dd99 verification-failed true +wycheproof-160 038200f148e7eab1581bcd1e23946f8a9b8191d9641f9560341721f9d3fec3d63e 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7037d765be3c9c78189ad30edb5097a4db670de11686d01420e37039d4677f4809 ok true +wycheproof-160-high-s 038200f148e7eab1581bcd1e23946f8a9b8191d9641f9560341721f9d3fec3d63e 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70c8289a40c36387e8652cf124af685b2455d9199720478a64104990ee94e3dd48 verification-failed true +wycheproof-160-changed-message 038200f148e7eab1581bcd1e23946f8a9b8191d9641f9560341721f9d3fec3d63e 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7037d765be3c9c78189ad30edb5097a4db670de11686d01420e37039d4677f4809 verification-failed true +wycheproof-161 03a8a69c5ed33b150ce8d37ac197070ed894c05d47258a80c9041d92486622024d 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044237823b54e0c74c2bf5f759d9ac5f8cb897d537ffa92effd4f0bb6c9acd860 ok true +wycheproof-161-high-s 03a8a69c5ed33b150ce8d37ac197070ed894c05d47258a80c9041d92486622024d 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70bbdc87db4ab1f38c3d40a08a62653a06f15d7d5a271d0b94f66abf0c32b64cf1 verification-failed true +wycheproof-161-changed-message 03a8a69c5ed33b150ce8d37ac197070ed894c05d47258a80c9041d92486622024d 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044237823b54e0c74c2bf5f759d9ac5f8cb897d537ffa92effd4f0bb6c9acd860 verification-failed true +wycheproof-162 02ed0587e75b3b9a1dd0794f41d1729fcd432b2436cbf51c230d8bc72732731817 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70266d30a485385906054ca86d46f5f2b17e7f4646a3092092ad92877126538111 ok true +wycheproof-162-high-s 02ed0587e75b3b9a1dd0794f41d1729fcd432b2436cbf51c230d8bc72732731817 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70d992cf5a7ac7a6fafab35792b90a0d4e3e67b467040e7df246274351d60fa440 verification-failed true +wycheproof-162-changed-message 02ed0587e75b3b9a1dd0794f41d1729fcd432b2436cbf51c230d8bc72732731817 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70266d30a485385906054ca86d46f5f2b17e7f4646a3092092ad92877126538111 verification-failed true +wycheproof-163 02077091d99004a99ee08224e59a46a70495e6fba4eff681c3ce42127e588681ef 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70538c7b3798e84d0ce90340165806348971ed44db8f0c674f5f215968390f92ee ok true +wycheproof-163-high-s 02077091d99004a99ee08224e59a46a70495e6fba4eff681c3ce42127e588681ef 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70ac7384c76717b2f416fcbfe9a7f9cb764af9b5d2180b37359498715ac3539263 verification-failed true +wycheproof-163-changed-message 02077091d99004a99ee08224e59a46a70495e6fba4eff681c3ce42127e588681ef 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70538c7b3798e84d0ce90340165806348971ed44db8f0c674f5f215968390f92ee verification-failed true +wycheproof-164 02616a8b8e57d82c11678f5827911024cd23a16cb52a65f230fb554a7b110c35a5 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c706fef0ef15d1688e15e704c4e6bb8bb7f40d52d3af5c661bb78c4ed9b408699b3 ok true +wycheproof-164-high-s 02616a8b8e57d82c11678f5827911024cd23a16cb52a65f230fb554a7b110c35a5 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c709010f10da2e9771fa18fb3b1944744807c11cd72b1513cc97af4dd27bbdc8b9e verification-failed true +wycheproof-164-changed-message 02616a8b8e57d82c11678f5827911024cd23a16cb52a65f230fb554a7b110c35a5 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c706fef0ef15d1688e15e704c4e6bb8bb7f40d52d3af5c661bb78c4ed9b408699b3 verification-failed true +wycheproof-165 0271dc92b2b1baa7612c4a53427a0d2dfe548fa9cf829bb6b248f736a5eb30b513 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c706f44275e9aeb1331efcb8d58f35c0252791427e403ad84daad51d247cc2a64c6 ok true +wycheproof-165-high-s 0271dc92b2b1baa7612c4a53427a0d2dfe548fa9cf829bb6b248f736a5eb30b513 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7090bbd8a06514eccf103472a70ca3fdad43d2d2c9a36a19aa4667f87b3038c08b verification-failed true +wycheproof-165-changed-message 0271dc92b2b1baa7612c4a53427a0d2dfe548fa9cf829bb6b248f736a5eb30b513 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c706f44275e9aeb1331efcb8d58f35c0252791427e403ad84daad51d247cc2a64c6 verification-failed true +wycheproof-166 02662f43ae614bd9c90ff3fcded25cf0ef186b6967a47aa6aa7ae7f396594df931 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7021323755b103d2f9da6ab83eccab9ad8598bcf625652f10e7a3eeee3c3945fb3 ok true +wycheproof-166-high-s 02662f43ae614bd9c90ff3fcded25cf0ef186b6967a47aa6aa7ae7f396594df931 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70decdc8a94efc2d07259547c133546527635b2b4b50c4ad76797adbdf38cec59e verification-failed true +wycheproof-166-changed-message 02662f43ae614bd9c90ff3fcded25cf0ef186b6967a47aa6aa7ae7f396594df931 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7021323755b103d2f9da6ab83eccab9ad8598bcf625652f10e7a3eeee3c3945fb3 verification-failed true +wycheproof-167 02dff107959bd2f7386497a5624430a0ab35e552c1a4e4dc9c298caeb96353170d 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c706c50acfe76de1289e7a5edb240f1c2a7879db6873d5d931f3c6ac467a6eac171 ok true +wycheproof-167-high-s 02dff107959bd2f7386497a5624430a0ab35e552c1a4e4dc9c298caeb96353170d 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7093af53008921ed77185a124dbf0e3d583549442669ba0b65b74f065b557863e0 verification-failed true +wycheproof-167-changed-message 02dff107959bd2f7386497a5624430a0ab35e552c1a4e4dc9c298caeb96353170d 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c706c50acfe76de1289e7a5edb240f1c2a7879db6873d5d931f3c6ac467a6eac171 verification-failed true +wycheproof-168 03bd0862b0bfba85036922e06f5458754aafc3075b603a814b3ac75659bf24d752 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70755b7fffb0b17ad57dca50fcefb7fe297b029df25e5ccb5069e8e70c2742c2a6 ok true +wycheproof-168-high-s 03bd0862b0bfba85036922e06f5458754aafc3075b603a814b3ac75659bf24d752 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c708aa47fff4f4e852b8235af03104801d641e45cbb48bad33489d0e3b6d52062ab verification-failed true +wycheproof-168-changed-message 03bd0862b0bfba85036922e06f5458754aafc3075b603a814b3ac75659bf24d752 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70755b7fffb0b17ad57dca50fcefb7fe297b029df25e5ccb5069e8e70c2742c2a6 verification-failed true +wycheproof-169 03b533d4695dd5b8c5e07757e55e6e516f7e2c88fa0239e23f60e8ec07dd70f287 313233343030 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-170 03f50d371b91bfb1d7d14e1323523bc3aa8cbf2c57f9e284de628c8b4536787b86 313233343030 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8 ok true +wycheproof-170-high-s 03f50d371b91bfb1d7d14e1323523bc3aa8cbf2c57f9e284de628c8b4536787b86 313233343030 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a9 verification-failed true +wycheproof-170-changed-message 03f50d371b91bfb1d7d14e1323523bc3aa8cbf2c57f9e284de628c8b4536787b86 31323334303000 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8 verification-failed true +wycheproof-171 0268ec6e298eafe16539156ce57a14b04a7047c221bafc3a582eaeb0d857c4d946 313233343030 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a9 verification-failed true +wycheproof-171-low-s 0268ec6e298eafe16539156ce57a14b04a7047c221bafc3a582eaeb0d857c4d946 313233343030 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8 ok true +wycheproof-171-changed-message 0268ec6e298eafe16539156ce57a14b04a7047c221bafc3a582eaeb0d857c4d946 31323334303000 7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8 verification-failed true +wycheproof-172 0269da0364734d2e530fece94019265fefb781a0f1b08f6c8897bdf6557927c8b8 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023 verification-failed true +wycheproof-172-low-s 0269da0364734d2e530fece94019265fefb781a0f1b08f6c8897bdf6557927c8b8 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e ok true +wycheproof-172-changed-message 0269da0364734d2e530fece94019265fefb781a0f1b08f6c8897bdf6557927c8b8 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e verification-failed true +wycheproof-173 03d8adc00023a8edc02576e2b63e3e30621a471e2b2320620187bf067a1ac1ff32 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e ok true +wycheproof-173-high-s 03d8adc00023a8edc02576e2b63e3e30621a471e2b2320620187bf067a1ac1ff32 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023 verification-failed true +wycheproof-173-changed-message 03d8adc00023a8edc02576e2b63e3e30621a471e2b2320620187bf067a1ac1ff32 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e verification-failed true +wycheproof-174 023623ac973ced0a56fa6d882f03a7d5c7edca02cfc7b2401fab3690dbe75ab785 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 ok true +wycheproof-174-high-s 023623ac973ced0a56fa6d882f03a7d5c7edca02cfc7b2401fab3690dbe75ab785 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70aaaaaaaa00000000aaaaaaaaaaaaaaaa7def51c91a0fbf034d26872ca84218e1 verification-failed true +wycheproof-174-changed-message 023623ac973ced0a56fa6d882f03a7d5c7edca02cfc7b2401fab3690dbe75ab785 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-175 03cf04ea77e9622523d894b93ff52dc3027b31959503b6fa3890e5e04263f922f1 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70aaaaaaaa00000000aaaaaaaaaaaaaaaa7def51c91a0fbf034d26872ca84218e1 verification-failed true +wycheproof-175-low-s 03cf04ea77e9622523d894b93ff52dc3027b31959503b6fa3890e5e04263f922f1 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 ok true +wycheproof-175-changed-message 03cf04ea77e9622523d894b93ff52dc3027b31959503b6fa3890e5e04263f922f1 31323334303000 555555550000000055555555555555553ef7a8e48d07df81a693439654210c70555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-176 02db7a2c8a1ab573e5929dc24077b508d7e683d49227996bda3e9f78dbeff77350 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffde91e1ba60fdedb76a46bcb51dc0b8b4b7e019f0a28721885fa5d3a8196623397 verification-failed true +wycheproof-176-low-s 02db7a2c8a1ab573e5929dc24077b508d7e683d49227996bda3e9f78dbeff77350 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd16e1e458f021248a5b9434ae23f474b43ee55ba37ea585fef95c90416600f1ba ok true +wycheproof-176-changed-message 02db7a2c8a1ab573e5929dc24077b508d7e683d49227996bda3e9f78dbeff77350 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd16e1e458f021248a5b9434ae23f474b43ee55ba37ea585fef95c90416600f1ba verification-failed true +wycheproof-177 03dead11c7a5b396862f21974dc4752fadeff994efe9bbd05ab413765ea80b6e1f 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdfdea5843ffeb73af94313ba4831b53fe24f799e525b1e8e8c87b59b95b430ad9 verification-failed true +wycheproof-177-low-s 03dead11c7a5b396862f21974dc4752fadeff994efe9bbd05ab413765ea80b6e1f 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0215a7bb00148c516bcec45b7ce4ac0197ef60c88165b59c2b3e7109a1201a78 ok true +wycheproof-177-changed-message 03dead11c7a5b396862f21974dc4752fadeff994efe9bbd05ab413765ea80b6e1f 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0215a7bb00148c516bcec45b7ce4ac0197ef60c88165b59c2b3e7109a1201a78 verification-failed true +wycheproof-178 03d0bc472e0d7c81ebaed3a6ef96c18613bb1fea6f994326fbe80e00dfde67c7e9 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd03ffcabf2f1b4d2a65190db1680d62bb994e41c5251cd73b3c3dfc5e5bafc035 ok true +wycheproof-178-high-s 03d0bc472e0d7c81ebaed3a6ef96c18613bb1fea6f994326fbe80e00dfde67c7e9 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdfc00353fd0e4b2d69ae6f24e97f29d442398b8e881fac749b77bce64a0b3651c verification-failed true +wycheproof-178-changed-message 03d0bc472e0d7c81ebaed3a6ef96c18613bb1fea6f994326fbe80e00dfde67c7e9 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd03ffcabf2f1b4d2a65190db1680d62bb994e41c5251cd73b3c3dfc5e5bafc035 verification-failed true +wycheproof-179 03a0a44ca947d66a2acb736008b9c08d1ab2ad03776e02640f78495d458dd51c32 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd4dfbc401f971cd304b33dfdb17d0fed0fe4c1a88ae648e0d2847f74977534989 ok true +wycheproof-179-high-s 03a0a44ca947d66a2acb736008b9c08d1ab2ad03776e02640f78495d458dd51c32 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdb2043bfd068e32d0b4cc2024e82f012ebe9ae024f8b31077cb71d379850fdbc8 verification-failed true +wycheproof-179-changed-message 03a0a44ca947d66a2acb736008b9c08d1ab2ad03776e02640f78495d458dd51c32 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd4dfbc401f971cd304b33dfdb17d0fed0fe4c1a88ae648e0d2847f74977534989 verification-failed true +wycheproof-180 03c9c2115290d008b45fb65fad0f602389298c25420b775019d42b62c3ce8a96b7 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbc4024761cd2ffd43dfdb17d0fed112b988977055cd3a8e54971eba9cda5ca71 verification-failed true +wycheproof-180-low-s 03c9c2115290d008b45fb65fad0f602389298c25420b775019d42b62c3ce8a96b7 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd43bfdb88e32d002cc2024e82f012eed4245d83a84a43f59faa47df192ebd5ae0 ok true +wycheproof-180-changed-message 03c9c2115290d008b45fb65fad0f602389298c25420b775019d42b62c3ce8a96b7 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd43bfdb88e32d002cc2024e82f012eed4245d83a84a43f59faa47df192ebd5ae0 verification-failed true +wycheproof-181 035eca1ef4c287dddc66b8bccf1b88e8a24c0018962f3c5e7efa83bc1a5ff6033e 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd788048ed39a5ffa77bfb62fa1fda2257742bf35d128fb3459f2a0c909ee86f91 ok true +wycheproof-181-high-s 035eca1ef4c287dddc66b8bccf1b88e8a24c0018962f3c5e7efa83bc1a5ff6033e 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd877fb711c65a005984049d05e025dda848bb07509487eb3f548fbe325d7ab5c0 verification-failed true +wycheproof-181-changed-message 035eca1ef4c287dddc66b8bccf1b88e8a24c0018962f3c5e7efa83bc1a5ff6033e 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd788048ed39a5ffa77bfb62fa1fda2257742bf35d128fb3459f2a0c909ee86f91 verification-failed true +wycheproof-182 035caaa030e7fdf0e4936bc7ab5a96353e0a01e4130c3f8bf22d473e317029a47a 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd476d9131fd381bd917d0fed112bc9e0a5924b5ed5b11167edd8b23582b3cb15e ok true +wycheproof-182-high-s 035caaa030e7fdf0e4936bc7ab5a96353e0a01e4130c3f8bf22d473e317029a47a 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdb8926ecd02c7e427e82f012eed4361f563c244c04c068806162ea76ad12673f3 verification-failed true +wycheproof-182-changed-message 035caaa030e7fdf0e4936bc7ab5a96353e0a01e4130c3f8bf22d473e317029a47a 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd476d9131fd381bd917d0fed112bc9e0a5924b5ed5b11167edd8b23582b3cb15e verification-failed true +wycheproof-183 03c2fd20bac06e555bb8ac0ce69eb1ea20f83a1fc3501c8a66469b1a31f619b098 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd8374253e3e21bd154448d0a8f640fe46fafa8b19ce78d538f6cc0a19662d3601 verification-failed true +wycheproof-183-low-s 03c2fd20bac06e555bb8ac0ce69eb1ea20f83a1fc3501c8a66469b1a31f619b098 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7c8bdac0c1de42ebbbb72f5709bf01b8c1ec6f93d89ec94bfcedc0a99635ef50 ok true +wycheproof-183-changed-message 03c2fd20bac06e555bb8ac0ce69eb1ea20f83a1fc3501c8a66469b1a31f619b098 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7c8bdac0c1de42ebbbb72f5709bf01b8c1ec6f93d89ec94bfcedc0a99635ef50 verification-failed true +wycheproof-184 023fd6a1ca7f77fb3b0bbe726c372010068426e11ea6ae78ce17bedae4bba86ced 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd357cfd3be4d01d413c5b9ede36cba5452c11ee7fe14879e749ae6a2d897a52d6 ok true +wycheproof-184-high-s 023fd6a1ca7f77fb3b0bbe726c372010068426e11ea6ae78ce17bedae4bba86ced 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdca8302c31b2fe2bfc3a46121c9345aba90d50c2dc5cf249daa0b609572e8d27b verification-failed true +wycheproof-184-changed-message 023fd6a1ca7f77fb3b0bbe726c372010068426e11ea6ae78ce17bedae4bba86ced 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd357cfd3be4d01d413c5b9ede36cba5452c11ee7fe14879e749ae6a2d897a52d6 verification-failed true +wycheproof-185 029cb8e51e27a5ae3b624a60d6dc32734e4989db20e9bca3ede1edf7b086911114 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd29798c5c0ee287d4a5e8e6b799fd86b8df5225298e6ffc807cd2f2bc27a0a6d8 ok true +wycheproof-185-high-s 029cb8e51e27a5ae3b624a60d6dc32734e4989db20e9bca3ede1edf7b086911114 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdd68673a2f11d782c5a17194866027946dd94d58418a7a20476e6d806d4c27e79 verification-failed true +wycheproof-185-changed-message 029cb8e51e27a5ae3b624a60d6dc32734e4989db20e9bca3ede1edf7b086911114 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd29798c5c0ee287d4a5e8e6b799fd86b8df5225298e6ffc807cd2f2bc27a0a6d8 verification-failed true +wycheproof-186 03a3e52c156dcaf10502620b7955bc2b40bc78ef3d569e1223c262512d8f49602a 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0b70f22c781092452dca1a5711fa3a5a1f72add1bf52c2ff7cae4820b30078dd ok true +wycheproof-186-high-s 03a3e52c156dcaf10502620b7955bc2b40bc78ef3d569e1223c262512d8f49602a 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdf48f0dd287ef6dbbd235e5a8ee05c5a59d744cdbe7c4db85770b82a24962ac74 verification-failed true +wycheproof-186-changed-message 03a3e52c156dcaf10502620b7955bc2b40bc78ef3d569e1223c262512d8f49602a 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0b70f22c781092452dca1a5711fa3a5a1f72add1bf52c2ff7cae4820b30078dd verification-failed true +wycheproof-187 03f19b78928720d5bee8e670fb90010fb15c37bf91b58a5157c3f3c059b2655e88 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd16e1e458f021248a5b9434ae23f474b43ee55ba37ea585fef95c90416600f1ba ok true +wycheproof-187-high-s 03f19b78928720d5bee8e670fb90010fb15c37bf91b58a5157c3f3c059b2655e88 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffde91e1ba60fdedb76a46bcb51dc0b8b4b7e019f0a28721885fa5d3a8196623397 verification-failed true +wycheproof-187-changed-message 03f19b78928720d5bee8e670fb90010fb15c37bf91b58a5157c3f3c059b2655e88 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd16e1e458f021248a5b9434ae23f474b43ee55ba37ea585fef95c90416600f1ba verification-failed true +wycheproof-188 0283a744459ecdfb01a5cf52b27a05bb7337482d242f235d7b4cb89345545c90a8 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd2252d6856831b6cf895e4f0535eeaf0e5e5809753df848fe760ad86219016a97 ok true +wycheproof-188-high-s 0283a744459ecdfb01a5cf52b27a05bb7337482d242f235d7b4cb89345545c90a8 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdddad297997ce493176a1b0faca1150f15e8ef138691f55867daef260e361baba verification-failed true +wycheproof-188-changed-message 0283a744459ecdfb01a5cf52b27a05bb7337482d242f235d7b4cb89345545c90a8 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd2252d6856831b6cf895e4f0535eeaf0e5e5809753df848fe760ad86219016a97 verification-failed true +wycheproof-189 03dd13c6b34c56982ddae124f039dfd23f4b19bbe88cee8e528ae51e5d6f3a21d7 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd81ffe55f178da695b28c86d8b406b15dab1a9e39661a3ae017fbe390ac0972c3 verification-failed true +wycheproof-189-low-s 03dd13c6b34c56982ddae124f039dfd23f4b19bbe88cee8e528ae51e5d6f3a21d7 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7e001a9fe872596b4d7379274bf94ea211cc5c7440fd63a4dbbde7325059b28e ok true +wycheproof-189-changed-message 03dd13c6b34c56982ddae124f039dfd23f4b19bbe88cee8e528ae51e5d6f3a21d7 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7e001a9fe872596b4d7379274bf94ea211cc5c7440fd63a4dbbde7325059b28e verification-failed true +wycheproof-190 0267e6f659cdde869a2f65f094e94e5b4dfad636bbf95192feeed01b0f3deb7460 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffffaaaaaaaaffffffffffffffffe9a2538f37b28a2c513dee40fecbb71a verification-failed true +wycheproof-190-low-s 0267e6f659cdde869a2f65f094e94e5b4dfad636bbf95192feeed01b0f3deb7460 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffff55555555ffffffffffffffffd344a71e6f651458a27bdc81fd976e37 ok true +wycheproof-190-changed-message 0267e6f659cdde869a2f65f094e94e5b4dfad636bbf95192feeed01b0f3deb7460 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffff55555555ffffffffffffffffd344a71e6f651458a27bdc81fd976e37 verification-failed true +wycheproof-191 022eb6412505aec05c6545f029932087e490d05511e8ec1f599617bb367f9ecaaf 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdb62f26b5f2a2b26f6de86d42ad8a13da3ab3cccd0459b201de009e526adf21f2 verification-failed true +wycheproof-191-low-s 022eb6412505aec05c6545f029932087e490d05511e8ec1f599617bb367f9ecaaf 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd49d0d9490d5d4d91921792bd5275ec2582332de0a2bdec8315b92c709184035f ok true +wycheproof-191-changed-message 022eb6412505aec05c6545f029932087e490d05511e8ec1f599617bb367f9ecaaf 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd49d0d9490d5d4d91921792bd5275ec2582332de0a2bdec8315b92c709184035f verification-failed true +wycheproof-192 0284db645868eab35e3a9fd80e056e2e855435e3a6b68d75a50a854625fe0d7f35 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbb1d9ac949dd748cd02bbbe749bd351cd57b38bb61403d700686aa7b4c90851e verification-failed true +wycheproof-192-low-s 0284db645868eab35e3a9fd80e056e2e855435e3a6b68d75a50a854625fe0d7f35 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd44e26535b6228b742fd44418b642cae2e76bc1f245d76114ed332047afd2a033 ok true +wycheproof-192-changed-message 0284db645868eab35e3a9fd80e056e2e855435e3a6b68d75a50a854625fe0d7f35 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd44e26535b6228b742fd44418b642cae2e76bc1f245d76114ed332047afd2a033 verification-failed true +wycheproof-193 0391b9e47c56278662d75c0983b22ca8ea6aa5059b7a2ff7637eb2975e386ad663 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd66755a00638cdaec1c732513ca0234ece52545dac11f816e818f725b4f60aaf2 ok true +wycheproof-193-high-s 0391b9e47c56278662d75c0983b22ca8ea6aa5059b7a2ff7637eb2975e386ad663 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd998aa5fe9c732514e38cdaec35fdcb12d7c1b4d2e5f81d16722a5867ad027a5f verification-failed true +wycheproof-193-changed-message 0391b9e47c56278662d75c0983b22ca8ea6aa5059b7a2ff7637eb2975e386ad663 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd66755a00638cdaec1c732513ca0234ece52545dac11f816e818f725b4f60aaf2 verification-failed true +wycheproof-194 02f3ec2f13caf04d0192b47fb4c5311fb6d4dc6b0a9e802e5327f7ec5ee8e4834d 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd55a00c9fcdaebb6032513ca0234ecfffe98ebe492fdf02e48ca48e982beb3669 ok true +wycheproof-194-high-s 02f3ec2f13caf04d0192b47fb4c5311fb6d4dc6b0a9e802e5327f7ec5ee8e4834d 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdaa5ff35f325144a0cdaec35fdcb12fffd3583c6477389ba067153c2ad077eee8 verification-failed true +wycheproof-194-changed-message 02f3ec2f13caf04d0192b47fb4c5311fb6d4dc6b0a9e802e5327f7ec5ee8e4834d 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd55a00c9fcdaebb6032513ca0234ecfffe98ebe492fdf02e48ca48e982beb3669 verification-failed true +wycheproof-195 02d92b200aefcab6ac7dafd9acaf2fa10b3180235b8f46b4503e4693c670fccc88 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdab40193f9b5d76c064a27940469d9fffd31d7c925fbe05c919491d3057d66cd2 verification-failed true +wycheproof-195-low-s 02d92b200aefcab6ac7dafd9acaf2fa10b3180235b8f46b4503e4693c670fccc88 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd54bfe6bf64a289409b5d86bfb9625fffe9c97e1b475998bbda70ad92a48cb87f ok true +wycheproof-195-changed-message 02d92b200aefcab6ac7dafd9acaf2fa10b3180235b8f46b4503e4693c670fccc88 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd54bfe6bf64a289409b5d86bfb9625fffe9c97e1b475998bbda70ad92a48cb87f verification-failed true +wycheproof-196 030a88361eb92ecca2625b38e5f98bbabb96bf179b3d76fc48140a3bcd881523cd 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdca0234ebb5fdcb13ca0234ecffffffffcb0dadbbc7f549f8a26b4408d0dc8600 verification-failed true +wycheproof-196-low-s 030a88361eb92ecca2625b38e5f98bbabb96bf179b3d76fc48140a3bcd881523cd 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd35fdcb134a0234ed35fdcb12fffffffff1d94cf1df22548c514e86ba2b869f51 ok true +wycheproof-196-changed-message 030a88361eb92ecca2625b38e5f98bbabb96bf179b3d76fc48140a3bcd881523cd 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd35fdcb134a0234ed35fdcb12fffffffff1d94cf1df22548c514e86ba2b869f51 verification-failed true +wycheproof-197 03d0fb17ccd8fafe827e0c1afc5d8d80366e2b20e7f14a563a2ba50469d84375e8 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff3ea3677e082b9310572620ae19933a9e65b285598711c77298815ad3 verification-failed true +wycheproof-197-low-s 03d0fb17ccd8fafe827e0c1afc5d8d80366e2b20e7f14a563a2ba50469d84375e8 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffffc15c9882f7d46cefa8d9df51a353c00f4165192b6ca8035063e1ca7e ok true +wycheproof-197-changed-message 03d0fb17ccd8fafe827e0c1afc5d8d80366e2b20e7f14a563a2ba50469d84375e8 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffffc15c9882f7d46cefa8d9df51a353c00f4165192b6ca8035063e1ca7e verification-failed true +wycheproof-198 03836f33bbc1dc0d3d3abbcef0d91f11e2ac4181076c9af0a22b1e4309d3edb276 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd266666663bbbbbbbe6666666666666665b37902e023fab7c8f055d86e5cc41f4 ok true +wycheproof-198-high-s 03836f33bbc1dc0d3d3abbcef0d91f11e2ac4181076c9af0a22b1e4309d3edb276 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdd9999998c4444445199999999999999961af6a7fa4d7f30864b46d3c1696e35d verification-failed true +wycheproof-198-changed-message 03836f33bbc1dc0d3d3abbcef0d91f11e2ac4181076c9af0a22b1e4309d3edb276 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd266666663bbbbbbbe6666666666666665b37902e023fab7c8f055d86e5cc41f4 verification-failed true +wycheproof-199 0392f99fbe973ed4a299719baee4b432741237034dec8d72ba5103cb33e55feeb8 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff36db6db7a492492492492492146c573f4c6dfc8d08a443e258970b09 verification-failed true +wycheproof-199-low-s 0392f99fbe973ed4a299719baee4b432741237034dec8d72ba5103cb33e55feeb8 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffffc92492495b6db6db6db6db6da87aa36e5aa9a1f7eb1586e0a3cc1a48 ok true +wycheproof-199-changed-message 0392f99fbe973ed4a299719baee4b432741237034dec8d72ba5103cb33e55feeb8 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffffc92492495b6db6db6db6db6da87aa36e5aa9a1f7eb1586e0a3cc1a48 verification-failed true +wycheproof-200 02d35ba58da30197d378e618ec0fa7e2e2d12cffd73ebbb2049d130bba434af09e 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff2aaaaaab7fffffffffffffffc815d0e60b3e596ecb1ad3a27cfd49c4 verification-failed true +wycheproof-200-low-s 02d35ba58da30197d378e618ec0fa7e2e2d12cffd73ebbb2049d130bba434af09e 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffffd55555557ffffffffffffffff4d129c79bd94516289ef7207f65db8d ok true +wycheproof-200-changed-message 02d35ba58da30197d378e618ec0fa7e2e2d12cffd73ebbb2049d130bba434af09e 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffffd55555557ffffffffffffffff4d129c79bd94516289ef7207f65db8d verification-failed true +wycheproof-201 028651ce490f1b46d73f3ff475149be29136697334a519d7ddab0725c8d0793224 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffff55555555ffffffffffffffffd344a71e6f651458a27bdc81fd976e37 ok true +wycheproof-201-high-s 028651ce490f1b46d73f3ff475149be29136697334a519d7ddab0725c8d0793224 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffffaaaaaaaaffffffffffffffffe9a2538f37b28a2c513dee40fecbb71a verification-failed true +wycheproof-201-changed-message 028651ce490f1b46d73f3ff475149be29136697334a519d7ddab0725c8d0793224 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffff55555555ffffffffffffffffd344a71e6f651458a27bdc81fd976e37 verification-failed true +wycheproof-202 036d8e1b12c831a0da8795650ff95f101ed921d9e2f72b15b1cdaca9826b9cfc6d 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192aa ok true +wycheproof-202-high-s 036d8e1b12c831a0da8795650ff95f101ed921d9e2f72b15b1cdaca9826b9cfc6d 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a7 verification-failed true +wycheproof-202-changed-message 036d8e1b12c831a0da8795650ff95f101ed921d9e2f72b15b1cdaca9826b9cfc6d 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192aa verification-failed true +wycheproof-203 030ae580bae933b4ef2997cbdbb0922328ca9a410f627a0f7dff24cb4d920e1542 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd5d8ecd64a4eeba466815ddf3a4de9a8e6abd9c5db0a01eb80343553da648428f ok true +wycheproof-203-high-s 030ae580bae933b4ef2997cbdbb0922328ca9a410f627a0f7dff24cb4d920e1542 313233343030 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffda271329a5b1145ba97ea220c5b21657152295e4ff6777fccf0767585561ae2c2 verification-failed true +wycheproof-203-changed-message 030ae580bae933b4ef2997cbdbb0922328ca9a410f627a0f7dff24cb4d920e1542 31323334303000 7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd5d8ecd64a4eeba466815ddf3a4de9a8e6abd9c5db0a01eb80343553da648428f verification-failed true +wycheproof-204 035b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963 313233343030 6f2347cab7dd76858fe0555ac3bc99048c4aacafdfb6bcbe05ea6c42c4934569bb726660235793aa9957a61e76e00c2c435109cf9a15dd624d53f4301047856b verification-failed true +wycheproof-204-low-s 035b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963 313233343030 6f2347cab7dd76858fe0555ac3bc99048c4aacafdfb6bcbe05ea6c42c4934569448d999edca86c5666a859e1891ff3d37995f0de0d01c122a665d692ec1b9fe6 ok true +wycheproof-204-changed-message 035b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963 31323334303000 6f2347cab7dd76858fe0555ac3bc99048c4aacafdfb6bcbe05ea6c42c4934569448d999edca86c5666a859e1891ff3d37995f0de0d01c122a665d692ec1b9fe6 verification-failed true +wycheproof-205 025b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963 313233343030 6f2347cab7dd76858fe0555ac3bc99048c4aacafdfb6bcbe05ea6c42c4934569bb726660235793aa9957a61e76e00c2c435109cf9a15dd624d53f4301047856b verification-failed true +wycheproof-206 036adda82b90261b0f319faa0d878665a6b6da497f09c903176222c34acfef72a6 313233343030 0000000000000000000000000000000000000000000000000000000000000001555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-207 022fca0d0a47914de77ed56e7eccc3276a601120c6df0069c825c8f6a01c9f3820 313233343030 010000000000000000000000000000000000000000000000000000000000000000003333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aa9 invalid-signature-encoding true +wycheproof-208 03dd86d3b5f4a13e8511083b78002081c53ff467f11ebd98a51a633db76665d250 313233343030 555555550000000055555555555555553ef7a8e48d07df81a693439654210c703333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aa9 verification-failed true +wycheproof-209 024fea55b32cb32aca0c12c4cd0abfb4e64b0f5a516e578c016591a93f5a0fbcc5 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 ok true +wycheproof-209-high-s 024fea55b32cb32aca0c12c4cd0abfb4e64b0f5a516e578c016591a93f5a0fbcc5 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978aaaaaaaa00000000aaaaaaaaaaaaaaaa7def51c91a0fbf034d26872ca84218e1 verification-failed true +wycheproof-209-changed-message 024fea55b32cb32aca0c12c4cd0abfb4e64b0f5a516e578c016591a93f5a0fbcc5 31323334303000 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-210 02c6a771527024227792170a6f8eee735bf32b7f98af669ead299802e32d7c3107 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978b6db6db6249249254924924924924924625bd7a09bec4ca81bcdd9f8fd6b63cc verification-failed true +wycheproof-210-low-s 02c6a771527024227792170a6f8eee735bf32b7f98af669ead299802e32d7c3107 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997849249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 ok true +wycheproof-210-changed-message 02c6a771527024227792170a6f8eee735bf32b7f98af669ead299802e32d7c3107 31323334303000 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997849249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 verification-failed true +wycheproof-211 02851c2bbad08e54ec7a9af99f49f03644d6ec6d59b207fec98de85a7d15b956ef 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978cccccccc00000000cccccccccccccccc971f2ef152794b9d8fc7d568c9e8eaa7 verification-failed true +wycheproof-211-low-s 02851c2bbad08e54ec7a9af99f49f03644d6ec6d59b207fec98de85a7d15b956ef 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc476699783333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa ok true +wycheproof-211-changed-message 02851c2bbad08e54ec7a9af99f49f03644d6ec6d59b207fec98de85a7d15b956ef 31323334303000 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc476699783333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa verification-failed true +wycheproof-212 03f6417c8a670584e388676949e53da7fc55911ff68318d1bf3061205acb19c48f 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc476699783333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa ok true +wycheproof-212-high-s 03f6417c8a670584e388676949e53da7fc55911ff68318d1bf3061205acb19c48f 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978cccccccc00000000cccccccccccccccc971f2ef152794b9d8fc7d568c9e8eaa7 verification-failed true +wycheproof-212-changed-message 03f6417c8a670584e388676949e53da7fc55911ff68318d1bf3061205acb19c48f 31323334303000 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc476699783333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa verification-failed true +wycheproof-213 03501421277be45a5eefec6c639930d636032565af420cf3373f557faa7f8a0643 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997849249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 ok true +wycheproof-213-high-s 03501421277be45a5eefec6c639930d636032565af420cf3373f557faa7f8a0643 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978b6db6db6249249254924924924924924625bd7a09bec4ca81bcdd9f8fd6b63cc verification-failed true +wycheproof-213-changed-message 03501421277be45a5eefec6c639930d636032565af420cf3373f557faa7f8a0643 31323334303000 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997849249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 verification-failed true +wycheproof-214 030d935bf9ffc115a527735f729ca8a4ca23ee01a4894adf0e3415ac84e808bb34 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997816a4502e2781e11ac82cbc9d1edd8c981584d13e18411e2f6e0478c34416e3bb ok true +wycheproof-214-high-s 030d935bf9ffc115a527735f729ca8a4ca23ee01a4894adf0e3415ac84e808bb34 313233343030 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978e95bafd0d87e1ee637d34362e1227367a762296f8ed6805585b551ffb84c4196 verification-failed true +wycheproof-214-changed-message 030d935bf9ffc115a527735f729ca8a4ca23ee01a4894adf0e3415ac84e808bb34 31323334303000 7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997816a4502e2781e11ac82cbc9d1edd8c981584d13e18411e2f6e0478c34416e3bb verification-failed true +wycheproof-215 025e59f50708646be8a589355014308e60b668fb670196206c41e748e64e4dca21 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 ok true +wycheproof-215-high-s 025e59f50708646be8a589355014308e60b668fb670196206c41e748e64e4dca21 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296aaaaaaaa00000000aaaaaaaaaaaaaaaa7def51c91a0fbf034d26872ca84218e1 verification-failed true +wycheproof-215-changed-message 025e59f50708646be8a589355014308e60b668fb670196206c41e748e64e4dca21 31323334303000 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296555555550000000055555555555555553ef7a8e48d07df81a693439654210c70 verification-failed true +wycheproof-216 03169fb797325843faff2f7a5b5445da9e2fd6226f7ef90ef0bfe924104b02db8e 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296b6db6db6249249254924924924924924625bd7a09bec4ca81bcdd9f8fd6b63cc verification-failed true +wycheproof-216-low-s 03169fb797325843faff2f7a5b5445da9e2fd6226f7ef90ef0bfe924104b02db8e 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29649249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 ok true +wycheproof-216-changed-message 03169fb797325843faff2f7a5b5445da9e2fd6226f7ef90ef0bfe924104b02db8e 31323334303000 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29649249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 verification-failed true +wycheproof-217 03271cd89c000143096b62d4e9e4ca885aef2f7023d18affdaf8b7b54898148754 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296cccccccc00000000cccccccccccccccc971f2ef152794b9d8fc7d568c9e8eaa7 verification-failed true +wycheproof-217-low-s 03271cd89c000143096b62d4e9e4ca885aef2f7023d18affdaf8b7b54898148754 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2963333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa ok true +wycheproof-217-changed-message 03271cd89c000143096b62d4e9e4ca885aef2f7023d18affdaf8b7b54898148754 31323334303000 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2963333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa verification-failed true +wycheproof-218 033d0bc7ed8f09d2cb7ddb46ebc1ed799ab1563a9ab84bf524587a220afe499c12 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2963333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa ok true +wycheproof-218-high-s 033d0bc7ed8f09d2cb7ddb46ebc1ed799ab1563a9ab84bf524587a220afe499c12 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296cccccccc00000000cccccccccccccccc971f2ef152794b9d8fc7d568c9e8eaa7 verification-failed true +wycheproof-218-changed-message 033d0bc7ed8f09d2cb7ddb46ebc1ed799ab1563a9ab84bf524587a220afe499c12 31323334303000 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2963333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa verification-failed true +wycheproof-219 02a6c885ade1a4c566f9bb010d066974abb281797fa701288c721bcbd23663a9b7 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29649249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 ok true +wycheproof-219-high-s 02a6c885ade1a4c566f9bb010d066974abb281797fa701288c721bcbd23663a9b7 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296b6db6db6249249254924924924924924625bd7a09bec4ca81bcdd9f8fd6b63cc verification-failed true +wycheproof-219-changed-message 02a6c885ade1a4c566f9bb010d066974abb281797fa701288c721bcbd23663a9b7 31323334303000 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29649249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185 verification-failed true +wycheproof-220 038d3c2c2c3b765ba8289e6ac3812572a25bf75df62d87ab7330c3bdbad9ebfa5c 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29616a4502e2781e11ac82cbc9d1edd8c981584d13e18411e2f6e0478c34416e3bb ok true +wycheproof-220-high-s 038d3c2c2c3b765ba8289e6ac3812572a25bf75df62d87ab7330c3bdbad9ebfa5c 313233343030 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296e95bafd0d87e1ee637d34362e1227367a762296f8ed6805585b551ffb84c4196 verification-failed true +wycheproof-220-changed-message 038d3c2c2c3b765ba8289e6ac3812572a25bf75df62d87ab7330c3bdbad9ebfa5c 31323334303000 6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29616a4502e2781e11ac82cbc9d1edd8c981584d13e18411e2f6e0478c34416e3bb verification-failed true +wycheproof-221 036b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296 313233343030 bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2 verification-failed true +wycheproof-222 036b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296 313233343030 44a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2 verification-failed true +wycheproof-223 026b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296 313233343030 bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2 verification-failed true +wycheproof-224 026b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296 313233343030 44a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2 verification-failed true +wycheproof-225 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 b292a619339f6e567a305c951c0dcbcc42d16e47f219f9e98e76e09d8770b34a0177e60492c5a8242f76f07bfe3661bde59ec2a17ce5bd2dab2abebdf89a62e2 ok true +wycheproof-225-high-s 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 b292a619339f6e567a305c951c0dcbcc42d16e47f219f9e98e76e09d8770b34afe8819fa6d3a57dcd0890f8401c99e41d748380c2a31e157488f0c0503c8c26f verification-failed true +wycheproof-225-changed-message 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 00 b292a619339f6e567a305c951c0dcbcc42d16e47f219f9e98e76e09d8770b34a0177e60492c5a8242f76f07bfe3661bde59ec2a17ce5bd2dab2abebdf89a62e2 verification-failed true +wycheproof-226 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 4d7367 530bd6b0c9af2d69ba897f6b5fb59695cfbf33afe66dbadcf5b8d2a2a6538e23d85e489cb7a161fd55ededcedbf4cc0c0987e3e3f0f242cae934c72caa3f43e9 verification-failed true +wycheproof-226-low-s 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 4d7367 530bd6b0c9af2d69ba897f6b5fb59695cfbf33afe66dbadcf5b8d2a2a6538e2327a1b762485e9e03aa121231240b33f3b35f16c9b6255bba0a8503965223e168 ok true +wycheproof-226-changed-message 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 4d736700 530bd6b0c9af2d69ba897f6b5fb59695cfbf33afe66dbadcf5b8d2a2a6538e2327a1b762485e9e03aa121231240b33f3b35f16c9b6255bba0a8503965223e168 verification-failed true +wycheproof-227 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 313233343030 a8ea150cb80125d7381c4c1f1da8e9de2711f9917060406a73d7904519e51388f3ab9fa68bd47973a73b2d40480c2ba50c22c9d76ec217257288293285449b86 verification-failed true +wycheproof-227-low-s 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 313233343030 a8ea150cb80125d7381c4c1f1da8e9de2711f9917060406a73d7904519e513880c546058742b868d58c4d2bfb7f3d45ab0c430d63855875f8131a190771e89cb ok true +wycheproof-227-changed-message 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 31323334303000 a8ea150cb80125d7381c4c1f1da8e9de2711f9917060406a73d7904519e513880c546058742b868d58c4d2bfb7f3d45ab0c430d63855875f8131a190771e89cb verification-failed true +wycheproof-228 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 0000000000000000000000000000000000000000 986e65933ef2ed4ee5aada139f52b70539aaf63f00a91f29c69178490d57fb713dafedfb8da6189d372308cbf1489bbbdabf0c0217d1c0ff0f701aaa7a694b9c ok true +wycheproof-228-high-s 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 0000000000000000000000000000000000000000 986e65933ef2ed4ee5aada139f52b70539aaf63f00a91f29c69178490d57fb71c25012037259e763c8dcf7340eb76443e227eeab8f45dd85e449b01881f9d9b5 verification-failed true +wycheproof-228-changed-message 0304aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5 000000000000000000000000000000000000000000 986e65933ef2ed4ee5aada139f52b70539aaf63f00a91f29c69178490d57fb713dafedfb8da6189d372308cbf1489bbbdabf0c0217d1c0ff0f701aaa7a694b9c verification-failed true +wycheproof-229 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d657373616765 d434e262a49eab7781e353a3565e482550dd0fd5defa013c7f29745eff3569f19b0c0a93f267fb6052fd8077be769c2b98953195d7bc10de844218305c6ba17a verification-failed true +wycheproof-229-low-s 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d657373616765 d434e262a49eab7781e353a3565e482550dd0fd5defa013c7f29745eff3569f164f3f56b0d9804a0ad027f88418963d42451c917cf5b8da66f77b2929ff783d7 ok true +wycheproof-229-changed-message 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d65737361676500 d434e262a49eab7781e353a3565e482550dd0fd5defa013c7f29745eff3569f164f3f56b0d9804a0ad027f88418963d42451c917cf5b8da66f77b2929ff783d7 verification-failed true +wycheproof-230 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d657373616765 0fe774355c04d060f76d79fd7a772e421463489221bf0a33add0be9b1979110b500dcba1c69a8fbd43fa4f57f743ce124ca8b91a1f325f3fac6181175df55737 ok true +wycheproof-230-high-s 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d657373616765 0fe774355c04d060f76d79fd7a772e421463489221bf0a33add0be9b1979110baff2345d39657043bc05b0a808bc31ed703e419387e53f45475849ab9e6dce1a verification-failed true +wycheproof-230-changed-message 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d65737361676500 0fe774355c04d060f76d79fd7a772e421463489221bf0a33add0be9b1979110b500dcba1c69a8fbd43fa4f57f743ce124ca8b91a1f325f3fac6181175df55737 verification-failed true +wycheproof-231 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d657373616765 bb40bf217bed3fb3950c7d39f03d36dc8e3b2cd79693f125bfd06595ee1135e3541bf3532351ebb032710bdb6a1bf1bfc89a1e291ac692b3fa4780745bb55677 ok true +wycheproof-231-high-s 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d657373616765 bb40bf217bed3fb3950c7d39f03d36dc8e3b2cd79693f125bfd06595ee1135e3abe40cabdcae1450cd8ef42495e40e3ff44cdc848c510bd0f9724a4ea0adceda verification-failed true +wycheproof-231-changed-message 034f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000 4d65737361676500 bb40bf217bed3fb3950c7d39f03d36dc8e3b2cd79693f125bfd06595ee1135e3541bf3532351ebb032710bdb6a1bf1bfc89a1e291ac692b3fa4780745bb55677 verification-failed true +wycheproof-232 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 664eb7ee6db84a34df3c86ea31389a5405badd5ca99231ff556d3e75a233e73a59f3c752e52eca46137642490a51560ce0badc678754b8f72e51a2901426a1bd ok true +wycheproof-232-high-s 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 664eb7ee6db84a34df3c86ea31389a5405badd5ca99231ff556d3e75a233e73aa60c38ac1ad135baec89bdb6f5aea9f2dc2c1e461fc2e58dc5682832e83c8394 verification-failed true +wycheproof-232-changed-message 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d65737361676500 664eb7ee6db84a34df3c86ea31389a5405badd5ca99231ff556d3e75a233e73a59f3c752e52eca46137642490a51560ce0badc678754b8f72e51a2901426a1bd verification-failed true +wycheproof-233 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 4cd0429bbabd2827009d6fcd843d4ce39c3e42e2d1631fd001985a79d1fd8b439638bf12dd682f60be7ef1d0e0d98f08b7bca77a1a2b869ae466189d2acdabe3 verification-failed true +wycheproof-233-low-s 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 4cd0429bbabd2827009d6fcd843d4ce39c3e42e2d1631fd001985a79d1fd8b4369c740ec2297d0a041810e2f1f2670f7052a53338cec17ea0f53b225d195796e ok true +wycheproof-233-changed-message 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d65737361676500 4cd0429bbabd2827009d6fcd843d4ce39c3e42e2d1631fd001985a79d1fd8b4369c740ec2297d0a041810e2f1f2670f7052a53338cec17ea0f53b225d195796e verification-failed true +wycheproof-234 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 e56c6ea2d1b017091c44d8b6cb62b9f460e3ce9aed5e5fd41e8added97c56c04a308ec31f281e955be20b457e463440b4fcf2b80258078207fc1378180f89b55 verification-failed true +wycheproof-234-low-s 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 e56c6ea2d1b017091c44d8b6cb62b9f460e3ce9aed5e5fd41e8added97c56c045cf713cd0d7e16ab41df4ba81b9cbbf46d17cf2d8197266473f893417b6a89fc ok true +wycheproof-234-changed-message 023cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d65737361676500 e56c6ea2d1b017091c44d8b6cb62b9f460e3ce9aed5e5fd41e8added97c56c045cf713cd0d7e16ab41df4ba81b9cbbf46d17cf2d8197266473f893417b6a89fc verification-failed true +wycheproof-235 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 1158a08d291500b4cabed3346d891eee57c176356a2624fb011f8fbbf3466830228a8c486a736006e082325b85290c5bc91f378b75d487dda46798c18f285519 ok true +wycheproof-235-high-s 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 1158a08d291500b4cabed3346d891eee57c176356a2624fb011f8fbbf3466830dd7573b6958c9ffa1f7dcda47ad6f3a3f3c7c322314316a74f5232016d3ad038 verification-failed true +wycheproof-235-changed-message 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d65737361676500 1158a08d291500b4cabed3346d891eee57c176356a2624fb011f8fbbf3466830228a8c486a736006e082325b85290c5bc91f378b75d487dda46798c18f285519 verification-failed true +wycheproof-236 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 b1db9289649f59410ea36b0c0fc8d6aa2687b29176939dd23e0dde56d309fa9d3e1535e4280559015b0dbd987366dcf43a6d1af5c23c7d584e1c3f48a1251336 ok true +wycheproof-236-high-s 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 b1db9289649f59410ea36b0c0fc8d6aa2687b29176939dd23e0dde56d309fa9dc1eaca1ad7faa6ffa4f242678c99230b8279dfb7e4db212ca59d8b7a5b3e121b verification-failed true +wycheproof-236-changed-message 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d65737361676500 b1db9289649f59410ea36b0c0fc8d6aa2687b29176939dd23e0dde56d309fa9d3e1535e4280559015b0dbd987366dcf43a6d1af5c23c7d584e1c3f48a1251336 verification-failed true +wycheproof-237 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 b7b16e762286cb96446aa8d4e6e7578b0a341a79f2dd1a220ac6f0ca4e24ed86ddc60a700a139b04661c547d07bbb0721780146df799ccf55e55234ecb8f12bc verification-failed true +wycheproof-237-low-s 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d657373616765 b7b16e762286cb96446aa8d4e6e7578b0a341a79f2dd1a220ac6f0ca4e24ed862239f58ef5ec64fc99e3ab82f8444f8da566e63faf7dd18f9564a77430d41295 ok true +wycheproof-237-changed-message 033cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935 4d65737361676500 b7b16e762286cb96446aa8d4e6e7578b0a341a79f2dd1a220ac6f0ca4e24ed862239f58ef5ec64fc99e3ab82f8444f8da566e63faf7dd18f9564a77430d41295 verification-failed true +wycheproof-238 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d657373616765 d82a7c2717261187c8e00d8df963ff35d796edad36bc6e6bd1c91c670d9105b43dcabddaf8fcaa61f4603e7cbac0f3c0351ecd5988efb23f680d07debd139929 ok true +wycheproof-238-high-s 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d657373616765 d82a7c2717261187c8e00d8df963ff35d796edad36bc6e6bd1c91c670d9105b4c23542240703559f0b9fc183453f0c3f87c82d541e27ec458bacc2e43f4f8c28 verification-failed true +wycheproof-238-changed-message 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d65737361676500 d82a7c2717261187c8e00d8df963ff35d796edad36bc6e6bd1c91c670d9105b43dcabddaf8fcaa61f4603e7cbac0f3c0351ecd5988efb23f680d07debd139929 verification-failed true +wycheproof-239 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d657373616765 5eb9c8845de68eb13d5befe719f462d77787802baff30ce96a5cba063254af782c026ae9be2e2a5e7ca0ff9bbd92fb6e44972186228ee9a62b87ddbe2ef66fb5 ok true +wycheproof-239-high-s 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d657373616765 5eb9c8845de68eb13d5befe719f462d77787802baff30ce96a5cba063254af78d3fd951541d1d5a2835f0064426d0491784fd9278488b4dec831ed04cd6cb59c verification-failed true +wycheproof-239-changed-message 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d65737361676500 5eb9c8845de68eb13d5befe719f462d77787802baff30ce96a5cba063254af782c026ae9be2e2a5e7ca0ff9bbd92fb6e44972186228ee9a62b87ddbe2ef66fb5 verification-failed true +wycheproof-240 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d657373616765 96843dd03c22abd2f3b782b170239f90f277921becc117d0404a8e4e36230c28f2be378f526f74a543f67165976de9ed9a31214eb4d7e6db19e1ede123dd991d verification-failed true +wycheproof-240-low-s 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d657373616765 96843dd03c22abd2f3b782b170239f90f277921becc117d0404a8e4e36230c280d41c86fad908b5bbc098e9a6892161222b5d95ef23fb7a9d9d7dce1d8858c34 ok true +wycheproof-240-changed-message 022829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff 4d65737361676500 96843dd03c22abd2f3b782b170239f90f277921becc117d0404a8e4e36230c280d41c86fad908b5bbc098e9a6892161222b5d95ef23fb7a9d9d7dce1d8858c34 verification-failed true +wycheproof-241 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d657373616765 766456dce1857c906f9996af729339464d27e9d98edc2d0e3b760297067421f6402385ecadae0d8081dccaf5d19037ec4e55376eced699e93646bfbbf19d0b41 ok true +wycheproof-241-high-s 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d657373616765 766456dce1857c906f9996af729339464d27e9d98edc2d0e3b760297067421f6bfdc7a125251f2807e23350a2e6fc8136e91c33ed841049bbd730b070ac61a10 verification-failed true +wycheproof-241-changed-message 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d65737361676500 766456dce1857c906f9996af729339464d27e9d98edc2d0e3b760297067421f6402385ecadae0d8081dccaf5d19037ec4e55376eced699e93646bfbbf19d0b41 verification-failed true +wycheproof-242 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d657373616765 c605c4b2edeab20419e6518a11b2dbc2b97ed8b07cced0b19c34f777de7b9fd9edf0f612c5f46e03c719647bc8af1b29b2cde2eda700fb1cff5e159d47326dba verification-failed true +wycheproof-242-low-s 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d657373616765 c605c4b2edeab20419e6518a11b2dbc2b97ed8b07cced0b19c34f777de7b9fd9120f09ec3a0b91fd38e69b843750e4d60a1917c00016a367f45bb525b530b797 ok true +wycheproof-242-changed-message 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d65737361676500 c605c4b2edeab20419e6518a11b2dbc2b97ed8b07cced0b19c34f777de7b9fd9120f09ec3a0b91fd38e69b843750e4d60a1917c00016a367f45bb525b530b797 verification-failed true +wycheproof-243 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d657373616765 d48b68e6cabfe03cf6141c9ac54141f210e64485d9929ad7b732bfe3b7eb8a84feedae50c61bd00e19dc26f9b7e2265e4508c389109ad2f208f0772315b6c941 verification-failed true +wycheproof-243-low-s 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d657373616765 d48b68e6cabfe03cf6141c9ac54141f210e64485d9929ad7b732bfe3b7eb8a84011251ae39e42ff2e623d906481dd9a177de3724967ccb92eac9539fe6ac5c10 ok true +wycheproof-243-changed-message 03fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5 4d65737361676500 d48b68e6cabfe03cf6141c9ac54141f210e64485d9929ad7b732bfe3b7eb8a84011251ae39e42ff2e623d906481dd9a177de3724967ccb92eac9539fe6ac5c10 verification-failed true +wycheproof-244 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d657373616765 b7c81457d4aeb6aa65957098569f0479710ad7f6595d5874c35a93d12a5dd4c7b7961a0b652878c2d568069a432ca18a1a9199f2ca574dad4b9e3a05c0a1cdb3 verification-failed true +wycheproof-244-low-s 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d657373616765 b7c81457d4aeb6aa65957098569f0479710ad7f6595d5874c35a93d12a5dd4c74869e5f39ad7873e2a97f965bcd35e75a25560badcc050d7a81b90bd3bc1579e ok true +wycheproof-244-changed-message 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d65737361676500 b7c81457d4aeb6aa65957098569f0479710ad7f6595d5874c35a93d12a5dd4c74869e5f39ad7873e2a97f965bcd35e75a25560badcc050d7a81b90bd3bc1579e verification-failed true +wycheproof-245 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d657373616765 6b01332ddb6edfa9a30a1321d5858e1ee3cf97e263e669f8de5e9652e76ff3f75939545fced457309a6a04ace2bd0f70139c8f7d86b02cb1cc58f9e69e96cd5a ok true +wycheproof-245-high-s 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d657373616765 6b01332ddb6edfa9a30a1321d5858e1ee3cf97e263e669f8de5e9652e76ff3f7a6c6ab9f312ba8d06595fb531d42f08fa94a6b30206771d32760d0dc5dcc57f7 verification-failed true +wycheproof-245-changed-message 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d65737361676500 6b01332ddb6edfa9a30a1321d5858e1ee3cf97e263e669f8de5e9652e76ff3f75939545fced457309a6a04ace2bd0f70139c8f7d86b02cb1cc58f9e69e96cd5a verification-failed true +wycheproof-246 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d657373616765 efdb884720eaeadc349f9fc356b6c0344101cd2fd8436b7d0e6a4fb93f106361f24bee6ad5dc05f7613975473aadf3aacba9e77de7d69b6ce48cb60d8113385d verification-failed true +wycheproof-246-low-s 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d657373616765 efdb884720eaeadc349f9fc356b6c0344101cd2fd8436b7d0e6a4fb93f1063610db411942a23fa099ec68ab8c5520c54f13d132fbf4103180f2d14b57b4fecf4 ok true +wycheproof-246-changed-message 0300000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e 4d65737361676500 efdb884720eaeadc349f9fc356b6c0344101cd2fd8436b7d0e6a4fb93f1063610db411942a23fa099ec68ab8c5520c54f13d132fbf4103180f2d14b57b4fecf4 verification-failed true +wycheproof-247 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 31230428405560dcb88fb5a646836aea9b23a23dd973dcbe8014c87b8b20eb070f9344d6e812ce166646747694a41b0aaf97374e19f3c5fb8bd7ae3d9bd0beff ok true +wycheproof-247-high-s 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 31230428405560dcb88fb5a646836aea9b23a23dd973dcbe8014c87b8b20eb07f06cbb2817ed31ea99b98b896b5be4f50d4fc35f8d23d88967e21c8560926652 verification-failed true +wycheproof-247-changed-message 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d65737361676500 31230428405560dcb88fb5a646836aea9b23a23dd973dcbe8014c87b8b20eb070f9344d6e812ce166646747694a41b0aaf97374e19f3c5fb8bd7ae3d9bd0beff verification-failed true +wycheproof-248 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 caa797da65b320ab0d5c470cda0b36b294359c7db9841d679174db34c4855743cf543a62f23e212745391aaf7505f345123d2685ee3b941d3de6d9b36242e5a0 verification-failed true +wycheproof-248-low-s 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 caa797da65b320ab0d5c470cda0b36b294359c7db9841d679174db34c485574330abc59c0dc1ded9bac6e5508afa0cbaaaa9d427b8dc0a67b5d2f10f9a203fb1 ok true +wycheproof-248-changed-message 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d65737361676500 caa797da65b320ab0d5c470cda0b36b294359c7db9841d679174db34c485574330abc59c0dc1ded9bac6e5508afa0cbaaaa9d427b8dc0a67b5d2f10f9a203fb1 verification-failed true +wycheproof-249 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 7e5f0ab5d900d3d3d7867657e5d6d36519bc54084536e7d21c336ed8001859459450c07f201faec94b82dfb322e5ac676688294aad35aa72e727ff0b19b646aa verification-failed true +wycheproof-249-low-s 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 7e5f0ab5d900d3d3d7867657e5d6d36519bc54084536e7d21c336ed8001859456baf3f7fdfe05137b47d204cdd1a5398565ed162f9e1f4120c91cbb7e2acdea7 ok true +wycheproof-249-changed-message 02bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d65737361676500 7e5f0ab5d900d3d3d7867657e5d6d36519bc54084536e7d21c336ed8001859456baf3f7fdfe05137b47d204cdd1a5398565ed162f9e1f4120c91cbb7e2acdea7 verification-failed true +wycheproof-250 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 d7d70c581ae9e3f66dc6a480bf037ae23f8a1e4a2136fe4b03aa69f0ca25b35689c460f8a5a5c2bbba962c8a3ee833a413e85658e62a59e2af41d9127cc47224 verification-failed true +wycheproof-250-low-s 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 d7d70c581ae9e3f66dc6a480bf037ae23f8a1e4a2136fe4b03aa69f0ca25b356763b9f065a5a3d454569d375c117cc5ba8fea454c0ed44a24477f1b07f9eb32d ok true +wycheproof-250-changed-message 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d65737361676500 d7d70c581ae9e3f66dc6a480bf037ae23f8a1e4a2136fe4b03aa69f0ca25b356763b9f065a5a3d454569d375c117cc5ba8fea454c0ed44a24477f1b07f9eb32d verification-failed true +wycheproof-251 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 341c1b9ff3c83dd5e0dfa0bf68bcdf4bb7aa20c625975e5eeee34bb396266b3472b69f061b750fd5121b22b11366fad549c634e77765a017902a67099e0a4469 ok true +wycheproof-251-high-s 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 341c1b9ff3c83dd5e0dfa0bf68bcdf4bb7aa20c625975e5eeee34bb396266b348d4960f8e48af02bede4dd4eec99052a7320c5c62fb1fe6d638f63b95e58e0e8 verification-failed true +wycheproof-251-changed-message 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d65737361676500 341c1b9ff3c83dd5e0dfa0bf68bcdf4bb7aa20c625975e5eeee34bb396266b3472b69f061b750fd5121b22b11366fad549c634e77765a017902a67099e0a4469 verification-failed true +wycheproof-252 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 70bebe684cdcb5ca72a42f0d873879359bd1781a591809947628d313a3814f67aec03aca8f5587a4d535fa31027bbe9cc0e464b1c3577f4c2dcde6b2094798a9 verification-failed true +wycheproof-252-low-s 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d657373616765 70bebe684cdcb5ca72a42f0d873879359bd1781a591809947628d313a3814f67513fc53470aa785c2aca05cefd844162fc0295fbe3c01f38c5ebe410f31b8ca8 ok true +wycheproof-252-changed-message 03bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015 4d65737361676500 70bebe684cdcb5ca72a42f0d873879359bd1781a591809947628d313a3814f67513fc53470aa785c2aca05cefd844162fc0295fbe3c01f38c5ebe410f31b8ca8 verification-failed true +wycheproof-253 02264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9 68656c6c6f2c20776f726c64 0000000000000000000000000000000000000000000000000000000000000005ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-253-low-s 02264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9 68656c6c6f2c20776f726c64 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000003 ok true +wycheproof-253-changed-message 02264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9 68656c6c6f2c20776f726c6400 00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000003 verification-failed true +wycheproof-254 03add76677e54a92e79bbee36a70e1754838273ec4b39295e4018a587290a7fc73 68656c6c6f2c20776f726c64 0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-255 02264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9 68656c6c6f2c20776f726c64 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632556ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e invalid-signature-encoding true +wycheproof-256 02e7e49dd82812432744fefe723f7f69663214ad1b85c02b2650b4ca0354743a32 68656c6c6f2c20776f726c64 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254effffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-257 02ce24c99032d52ac6ead23c0ae3ec68ef41e51a281fd457808c83136d7dcce90e 68656c6c6f2c20776f726c64 0000000000000000000000000000000000000000000000000000000000000003ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-257-low-s 02ce24c99032d52ac6ead23c0ae3ec68ef41e51a281fd457808c83136d7dcce90e 68656c6c6f2c20776f726c64 00000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000003 ok true +wycheproof-257-changed-message 02ce24c99032d52ac6ead23c0ae3ec68ef41e51a281fd457808c83136d7dcce90e 68656c6c6f2c20776f726c6400 00000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000003 verification-failed true +wycheproof-258 02c981c75ddfd3910387eb147098fe5658c43aaaa34c681cd6d514b6ad5b6baa6d 68656c6c6f2c20776f726c64 0000000000000000000000000000000000000000000000000000000000000004ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-259 030ec505bc19b14a43e05678cccf07a443d3e871a2e19b68a4da91859a0650f324 68656c6c6f2c20776f726c64 000000000000000000000000000000004319055358e8617b0c46353d039cdab3ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-260 02d42ce21e730f3d2a84e949828574b4dceeb77d4f89556735f34fba03028ee3ed 68656c6c6f2c20776f726c64 00000000ffffffff00000000000000004319055258e8617b0c46353d039cdab4ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e verification-failed true +wycheproof-261 026955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa 68656c6c6f2c20776f726c64 5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c40000000000000000000000000000000100000000000000000000000000000000 ok true +wycheproof-261-high-s 026955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa 68656c6c6f2c20776f726c64 5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c4ffffffff00000000fffffffffffffffebce6faada7179e84f3b9cac2fc632551 verification-failed true +wycheproof-261-changed-message 026955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa 68656c6c6f2c20776f726c6400 5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c40000000000000000000000000000000100000000000000000000000000000000 verification-failed true +wycheproof-262 026955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa 68656c6c6f2c20776f726c64 5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c4ffffffff00000000fffffffffffffffebce6faada7179e84f3b9cac2fc632551 verification-failed true +wycheproof-262-low-s 026955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa 68656c6c6f2c20776f726c64 5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c40000000000000000000000000000000100000000000000000000000000000000 ok true +wycheproof-262-changed-message 026955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa 68656c6c6f2c20776f726c6400 5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c40000000000000000000000000000000100000000000000000000000000000000 verification-failed true +auths-signature-width-0 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 invalid-signature-encoding true +auths-signature-width-1 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2b invalid-signature-encoding true +auths-signature-width-31 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e invalid-signature-encoding true +auths-signature-width-32 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e18 invalid-signature-encoding true +auths-signature-width-63 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd invalid-signature-encoding true +auths-signature-width-65 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd7600 invalid-signature-encoding true +auths-signature-width-66 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd760000 invalid-signature-encoding true +auths-signature-width-128 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd7600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +auths-r-zero 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 00000000000000000000000000000000000000000000000000000000000000004cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-signature-encoding true +auths-r-order 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325514cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-signature-encoding true +auths-r-maximum 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff4cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-signature-encoding true +auths-s-zero 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e180000000000000000000000000000000000000000000000000000000000000000 invalid-signature-encoding true +auths-s-order 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e18ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 invalid-signature-encoding true +auths-s-maximum 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e18ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff invalid-signature-encoding true +auths-s-half-order 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e187fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8 verification-failed true +auths-s-half-order-plus-one 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e187fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a9 verification-failed true +auths-key-empty 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-empty-before-signature 313233343030 invalid-key false +auths-key-infinity 00 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-infinity-before-signature 00 313233343030 invalid-key false +auths-key-x-only 2927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-x-only-before-signature 2927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 invalid-key false +auths-key-uncompressed 042927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-uncompressed-before-signature 042927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e 313233343030 invalid-key false +auths-key-compact 052927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-compact-before-signature 052927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 invalid-key false +auths-key-hybrid-even 062927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-hybrid-even-before-signature 062927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e 313233343030 invalid-key false +auths-key-hybrid-odd 072927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-hybrid-odd-before-signature 072927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e 313233343030 invalid-key false +auths-key-truncated 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c7328 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-truncated-before-signature 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c7328 313233343030 invalid-key false +auths-key-trailing 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c73283800 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-trailing-before-signature 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c73283800 313233343030 invalid-key false +auths-key-wrong-tag 012927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-wrong-tag-before-signature 012927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 313233343030 invalid-key false +auths-key-out-of-field 02ffffffff00000001000000000000000000000000ffffffffffffffffffffffff 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-out-of-field-before-signature 02ffffffff00000001000000000000000000000000ffffffffffffffffffffffff 313233343030 invalid-key false +auths-key-non-point-even 020000000000000000000000000000000000000000000000000000000000000001 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-non-point-even-before-signature 020000000000000000000000000000000000000000000000000000000000000001 313233343030 invalid-key false +auths-key-non-point-odd 030000000000000000000000000000000000000000000000000000000000000001 313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 invalid-key false +auths-key-non-point-odd-before-signature 030000000000000000000000000000000000000000000000000000000000000001 313233343030 invalid-key false +auths-changed-domain 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 41555448532d57524f4e472d444f4d41494e313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 verification-failed true +auths-changed-profile 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 77726f6e672d70726f66696c6500313233343030 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 verification-failed true +auths-changed-descriptor 022927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838 31323334303077726f6e672d64657363726970746f72 2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76 verification-failed true diff --git a/core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json b/core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json new file mode 100644 index 000000000..d5c41c1d4 --- /dev/null +++ b/core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json @@ -0,0 +1,5714 @@ +{ + "algorithm": "ECDSA", + "schema": "ecdsa_p1363_verify_schema_v1.json", + "numberOfTests": 262, + "header": [ + "Test vectors of type EcdsaVerify are meant for the verification", + "of IEEE P1363 encoded ECDSA signatures." + ], + "notes": { + "ArithmeticError": { + "bugType": "EDGE_CASE", + "description": "Some implementations of ECDSA have arithmetic errors that occur when intermediate results have extreme values. This test vector has been constructed to test such occurrences.", + "cves": [ + "CVE-2017-18146" + ] + }, + "EdgeCasePublicKey": { + "bugType": "EDGE_CASE", + "description": "The test vector uses a special case public key. " + }, + "EdgeCaseShamirMultiplication": { + "bugType": "EDGE_CASE", + "description": "Shamir proposed a fast method for computing the sum of two scalar multiplications efficiently. This test vector has been constructed so that an intermediate result is the point at infinity if Shamir's method is used." + }, + "IntegerOverflow": { + "bugType": "CAN_OF_WORMS", + "description": "The test vector contains an r and s that has been modified, so that the original value is restored if the implementation ignores the most significant bits.", + "effect": "Without further analysis it is unclear if the modification can be used to forge signatures." + }, + "InvalidSignature": { + "bugType": "AUTH_BYPASS", + "description": "The signature contains special case values such as r=0 and s=0. Buggy implementations may accept such values, if the implementation does not check boundaries and computes s^(-1) == 0.", + "effect": "Accepting such signatures can have the effect that an adversary can forge signatures without even knowing the message to sign.", + "cves": [ + "CVE-2022-21449", + "CVE-2021-43572", + "CVE-2022-24884" + ] + }, + "ModifiedInteger": { + "bugType": "CAN_OF_WORMS", + "description": "The test vector contains an r and s that has been modified. The goal is to check for arithmetic errors.", + "effect": "Without further analysis it is unclear if the modification can be used to forge signatures." + }, + "ModularInverse": { + "bugType": "EDGE_CASE", + "description": "The test vectors contains a signature where computing the modular inverse of s hits an edge case.", + "effect": "While the signature in this test vector is constructed and similar cases are unlikely to occur, it is important to determine if the underlying arithmetic error can be used to forge signatures.", + "cves": [ + "CVE-2019-0865" + ] + }, + "PointDuplication": { + "bugType": "EDGE_CASE", + "description": "Some implementations of ECDSA do not handle duplication and points at infinity correctly. This is a test vector that has been specially crafted to check for such an omission.", + "cves": [ + "2020-12607", + "CVE-2015-2730" + ] + }, + "RangeCheck": { + "bugType": "CAN_OF_WORMS", + "description": "The test vector contains an r and s that has been modified. By adding or subtracting the order of the group (or other values) the test vector checks whether signature verification verifies the range of r and s.", + "effect": "Without further analysis it is unclear if the modification can be used to forge signatures." + }, + "SignatureSize": { + "bugType": "LEGACY", + "description": "This test vector contains valid values for r and s. But the values are encoded using a smaller number of bytes. The size of an IEEE P1363 encoded signature should always be twice the number of bytes of the size of the order. Some libraries accept signatures with less bytes. To our knowledge no standard (i.e., IEEE P1363 or RFC 7515) requires any explicit checks of the signature size during signature verification." + }, + "SmallRandS": { + "bugType": "EDGE_CASE", + "description": "The test vectors contains a signature where both r and s are small integers. Some libraries cannot verify such signatures.", + "effect": "While the signature in this test vector is constructed and similar cases are unlikely to occur, it is important to determine if the underlying arithmetic error can be used to forge signatures.", + "cves": [ + "2020-13895" + ] + }, + "SpecialCaseHash": { + "bugType": "EDGE_CASE", + "description": "The test vector contains a signature where the hash of the message is a special case, e.g., contains a long run of 0 or 1 bits." + }, + "ValidSignature": { + "bugType": "BASIC", + "description": "The test vector contains a valid signature that was generated pseudorandomly. Such signatures should not fail to verify unless some of the parameters (e.g. curve or hash function) are not supported." + } + }, + "testGroups": [ + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "042927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e", + "wx": "2927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838", + "wy": "00c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200042927b10512bae3eddcfe467828128bad2903269919f7086069c8c4df6c732838c7787964eaac00e5921fb1498a60f4606766b3d9685001558d1a974e7341513e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKSexBRK64+3c/kZ4KBKLrSkDJpkZ\n9whgacjE32xzKDjHeHlk6qwA5ZIfsUmKYPRgZ2az2WhQAVWNGpdOc0FRPg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 1, + "comment": "signature malleability", + "flags": [ + "ValidSignature" + ], + "msg": "313233343030", + "sig": "2ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e184cd60b855d442f5b3c7b11eb6c4e0ae7525fe710fab9aa7c77a67f79e6fadd76", + "result": "valid" + }, + { + "tcId": 2, + "comment": "replaced r by r + n", + "flags": [ + "RangeCheck" + ], + "msg": "313233343030", + "sig": "012ba3a8bd6b94d5ed80a6d9d1190a436ebccc0833490686deac8635bcb9bf536900b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 3, + "comment": "replaced r by r + 256 * n", + "flags": [ + "RangeCheck" + ], + "msg": "313233343030", + "sig": "01002ba3a7be6b94d6ec80a6d9d1190a432be6dfbb2cb98d6d4d72972df620817f180000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 4, + "comment": "replaced r by n - r", + "flags": [ + "ModifiedInteger" + ], + "msg": "313233343030", + "sig": "d45c5740946b2a147f59262ee6f5bc90bd01ed280528b62b3aed5fc93f06f739b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 5, + "comment": "replaced r by r + 2**256", + "flags": [ + "IntegerOverflow" + ], + "msg": "313233343030", + "sig": "012ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e1800b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 6, + "comment": "replaced r by r + 2**320", + "flags": [ + "IntegerOverflow" + ], + "msg": "313233343030", + "sig": "0100000000000000002ba3a8be6b94d5ec80a6d9d1190a436effe50d85a1eee859b8cc6af9bd5c2e18000000000000000000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 7, + "comment": "replaced s by s + n", + "flags": [ + "RangeCheck" + ], + "msg": "313233343030", + "sig": "01b329f478a2bbd0a6c384ee1493b1f518276e0e4a5375928d6fcd160c11cb6d2c00b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 8, + "comment": "replaced s by s + 256 * n", + "flags": [ + "RangeCheck" + ], + "msg": "313233343030", + "sig": "0100b329f379a2bbd1a5c384ee1493b1f4d55181c143c3fc78fc35de0e45788d98db0000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 9, + "comment": "replaced s by s + 2**256", + "flags": [ + "IntegerOverflow" + ], + "msg": "313233343030", + "sig": "01b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db00b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 10, + "comment": "replaced s by s + 2**320", + "flags": [ + "IntegerOverflow" + ], + "msg": "313233343030", + "sig": "010000000000000000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db000000000000000000b329f479a2bbd0a5c384ee1493b1f5186a87139cac5df4087c134b49156847db", + "result": "invalid" + }, + { + "tcId": 11, + "comment": "Signature with special case values r=0 and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 12, + "comment": "Signature with special case values r=0 and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 13, + "comment": "Signature with special case values r=0 and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 14, + "comment": "Signature with special case values r=0 and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 15, + "comment": "Signature with special case values r=0 and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 16, + "comment": "Signature with special case values r=0 and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000000ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 17, + "comment": "Signature with special case values r=0 and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000000ffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 18, + "comment": "Signature with special case values r=1 and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 19, + "comment": "Signature with special case values r=1 and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 20, + "comment": "Signature with special case values r=1 and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000001ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 21, + "comment": "Signature with special case values r=1 and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000001ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 22, + "comment": "Signature with special case values r=1 and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000001ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 23, + "comment": "Signature with special case values r=1 and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000001ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 24, + "comment": "Signature with special case values r=1 and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000001ffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 25, + "comment": "Signature with special case values r=n and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325510000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 26, + "comment": "Signature with special case values r=n and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325510000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 27, + "comment": "Signature with special case values r=n and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 28, + "comment": "Signature with special case values r=n and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 29, + "comment": "Signature with special case values r=n and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 30, + "comment": "Signature with special case values r=n and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 31, + "comment": "Signature with special case values r=n and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551ffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 32, + "comment": "Signature with special case values r=n - 1 and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325500000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 33, + "comment": "Signature with special case values r=n - 1 and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325500000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 34, + "comment": "Signature with special case values r=n - 1 and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 35, + "comment": "Signature with special case values r=n - 1 and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 36, + "comment": "Signature with special case values r=n - 1 and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 37, + "comment": "Signature with special case values r=n - 1 and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 38, + "comment": "Signature with special case values r=n - 1 and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550ffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 39, + "comment": "Signature with special case values r=n + 1 and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325520000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 40, + "comment": "Signature with special case values r=n + 1 and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325520000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 41, + "comment": "Signature with special case values r=n + 1 and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 42, + "comment": "Signature with special case values r=n + 1 and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 43, + "comment": "Signature with special case values r=n + 1 and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 44, + "comment": "Signature with special case values r=n + 1 and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 45, + "comment": "Signature with special case values r=n + 1 and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552ffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 46, + "comment": "Signature with special case values r=p and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 47, + "comment": "Signature with special case values r=p and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 48, + "comment": "Signature with special case values r=p and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 49, + "comment": "Signature with special case values r=p and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 50, + "comment": "Signature with special case values r=p and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 51, + "comment": "Signature with special case values r=p and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 52, + "comment": "Signature with special case values r=p and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000ffffffffffffffffffffffffffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 53, + "comment": "Signature with special case values r=p + 1 and s=0", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff000000010000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 54, + "comment": "Signature with special case values r=p + 1 and s=1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff000000010000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", + "result": "invalid" + }, + { + "tcId": 55, + "comment": "Signature with special case values r=p + 1 and s=n", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551", + "result": "invalid" + }, + { + "tcId": 56, + "comment": "Signature with special case values r=p + 1 and s=n - 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632550", + "result": "invalid" + }, + { + "tcId": 57, + "comment": "Signature with special case values r=p + 1 and s=n + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552", + "result": "invalid" + }, + { + "tcId": 58, + "comment": "Signature with special case values r=p + 1 and s=p", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000001000000000000000000000000ffffffffffffffffffffffff", + "result": "invalid" + }, + { + "tcId": 59, + "comment": "Signature with special case values r=p + 1 and s=p + 1", + "flags": [ + "InvalidSignature" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000001000000000000000000000000ffffffff00000001000000000000000000000001000000000000000000000000", + "result": "invalid" + }, + { + "tcId": 60, + "comment": "Edge case for Shamir multiplication", + "flags": [ + "EdgeCaseShamirMultiplication" + ], + "msg": "3639383139", + "sig": "64a1aab5000d0e804f3e2fc02bdee9be8ff312334e2ba16d11547c97711c898e6af015971cc30be6d1a206d4e013e0997772a2f91d73286ffd683b9bb2cf4f1b", + "result": "valid" + }, + { + "tcId": 61, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "343236343739373234", + "sig": "16aea964a2f6506d6f78c81c91fc7e8bded7d397738448de1e19a0ec580bf266252cd762130c6667cfe8b7bc47d27d78391e8e80c578d1cd38c3ff033be928e9", + "result": "valid" + }, + { + "tcId": 62, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "37313338363834383931", + "sig": "9cc98be2347d469bf476dfc26b9b733df2d26d6ef524af917c665baccb23c882093496459effe2d8d70727b82462f61d0ec1b7847929d10ea631dacb16b56c32", + "result": "valid" + }, + { + "tcId": 63, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3130333539333331363638", + "sig": "73b3c90ecd390028058164524dde892703dce3dea0d53fa8093999f07ab8aa432f67b0b8e20636695bb7d8bf0a651c802ed25a395387b5f4188c0c4075c88634", + "result": "valid" + }, + { + "tcId": 64, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33393439343031323135", + "sig": "bfab3098252847b328fadf2f89b95c851a7f0eb390763378f37e90119d5ba3ddbdd64e234e832b1067c2d058ccb44d978195ccebb65c2aaf1e2da9b8b4987e3b", + "result": "valid" + }, + { + "tcId": 65, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31333434323933303739", + "sig": "204a9784074b246d8bf8bf04a4ceb1c1f1c9aaab168b1596d17093c5cd21d2cd51cce41670636783dc06a759c8847868a406c2506fe17975582fe648d1d88b52", + "result": "valid" + }, + { + "tcId": 66, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33373036323131373132", + "sig": "ed66dc34f551ac82f63d4aa4f81fe2cb0031a91d1314f835027bca0f1ceeaa0399ca123aa09b13cd194a422e18d5fda167623c3f6e5d4d6abb8953d67c0c48c7", + "result": "valid" + }, + { + "tcId": 67, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "333433363838373132", + "sig": "060b700bef665c68899d44f2356a578d126b062023ccc3c056bf0f60a237012b8d186c027832965f4fcc78a3366ca95dedbb410cbef3f26d6be5d581c11d3610", + "result": "valid" + }, + { + "tcId": 68, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31333531353330333730", + "sig": "9f6adfe8d5eb5b2c24d7aa7934b6cf29c93ea76cd313c9132bb0c8e38c96831db26a9c9e40e55ee0890c944cf271756c906a33e66b5bd15e051593883b5e9902", + "result": "valid" + }, + { + "tcId": 69, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "36353533323033313236", + "sig": "a1af03ca91677b673ad2f33615e56174a1abf6da168cebfa8868f4ba273f16b720aa73ffe48afa6435cd258b173d0c2377d69022e7d098d75caf24c8c5e06b1c", + "result": "valid" + }, + { + "tcId": 70, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31353634333436363033", + "sig": "fdc70602766f8eed11a6c99a71c973d5659355507b843da6e327a28c11893db93df5349688a085b137b1eacf456a9e9e0f6d15ec0078ca60a7f83f2b10d21350", + "result": "valid" + }, + { + "tcId": 71, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "34343239353339313137", + "sig": "b516a314f2fce530d6537f6a6c49966c23456f63c643cf8e0dc738f7b876e675d39ffd033c92b6d717dd536fbc5efdf1967c4bd80954479ba66b0120cd16fff2", + "result": "valid" + }, + { + "tcId": 72, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3130393533323631333531", + "sig": "3b2cbf046eac45842ecb7984d475831582717bebb6492fd0a485c101e29ff0a84c9b7b47a98b0f82de512bc9313aaf51701099cac5f76e68c8595fc1c1d99258", + "result": "valid" + }, + { + "tcId": 73, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "35393837333530303431", + "sig": "30c87d35e636f540841f14af54e2f9edd79d0312cfa1ab656c3fb15bfde48dcf47c15a5a82d24b75c85a692bd6ecafeb71409ede23efd08e0db9abf6340677ed", + "result": "valid" + }, + { + "tcId": 74, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33343633303036383738", + "sig": "38686ff0fda2cef6bc43b58cfe6647b9e2e8176d168dec3c68ff262113760f52067ec3b651f422669601662167fa8717e976e2db5e6a4cf7c2ddabb3fde9d67d", + "result": "valid" + }, + { + "tcId": 75, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "39383137333230323837", + "sig": "44a3e23bf314f2b344fc25c7f2de8b6af3e17d27f5ee844b225985ab6e2775cf2d48e223205e98041ddc87be532abed584f0411f5729500493c9cc3f4dd15e86", + "result": "valid" + }, + { + "tcId": 76, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33323232303431303436", + "sig": "2ded5b7ec8e90e7bf11f967a3d95110c41b99db3b5aa8d330eb9d638781688e97d5792c53628155e1bfc46fb1a67e3088de049c328ae1f44ec69238a009808f9", + "result": "valid" + }, + { + "tcId": 77, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "36363636333037313034", + "sig": "bdae7bcb580bf335efd3bc3d31870f923eaccafcd40ec2f605976f15137d8b8ff6dfa12f19e525270b0106eecfe257499f373a4fb318994f24838122ce7ec3c7", + "result": "valid" + }, + { + "tcId": 78, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31303335393531383938", + "sig": "50f9c4f0cd6940e162720957ffff513799209b78596956d21ece251c2401f1c6d7033a0a787d338e889defaaabb106b95a4355e411a59c32aa5167dfab244726", + "result": "valid" + }, + { + "tcId": 79, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31383436353937313935", + "sig": "f612820687604fa01906066a378d67540982e29575d019aabe90924ead5c860d3f9367702dd7dd4f75ea98afd20e328a1a99f4857b316525328230ce294b0fef", + "result": "valid" + }, + { + "tcId": 80, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33313336303436313839", + "sig": "9505e407657d6e8bc93db5da7aa6f5081f61980c1949f56b0f2f507da5782a7ac60d31904e3669738ffbeccab6c3656c08e0ed5cb92b3cfa5e7f71784f9c5021", + "result": "valid" + }, + { + "tcId": 81, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "32363633373834323534", + "sig": "bbd16fbbb656b6d0d83e6a7787cd691b08735aed371732723e1c68a40404517d9d8e35dba96028b7787d91315be675877d2d097be5e8ee34560e3e7fd25c0f00", + "result": "valid" + }, + { + "tcId": 82, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31363532313030353234", + "sig": "2ec9760122db98fd06ea76848d35a6da442d2ceef7559a30cf57c61e92df327e7ab271da90859479701fccf86e462ee3393fb6814c27b760c4963625c0a19878", + "result": "valid" + }, + { + "tcId": 83, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "35373438303831363936", + "sig": "54e76b7683b6650baa6a7fc49b1c51eed9ba9dd463221f7a4f1005a89fe00c592ea076886c773eb937ec1cc8374b7915cfd11b1c1ae1166152f2f7806a31c8fd", + "result": "valid" + }, + { + "tcId": 84, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "36333433393133343638", + "sig": "5291deaf24659ffbbce6e3c26f6021097a74abdbb69be4fb10419c0c496c946665d6fcf336d27cc7cdb982bb4e4ecef5827f84742f29f10abf83469270a03dc3", + "result": "valid" + }, + { + "tcId": 85, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31353431313033353938", + "sig": "207a3241812d75d947419dc58efb05e8003b33fc17eb50f9d15166a88479f107cdee749f2e492b213ce80b32d0574f62f1c5d70793cf55e382d5caadf7592767", + "result": "valid" + }, + { + "tcId": 86, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3130343738353830313238", + "sig": "6554e49f82a855204328ac94913bf01bbe84437a355a0a37c0dee3cf81aa7728aea00de2507ddaf5c94e1e126980d3df16250a2eaebc8be486effe7f22b4f929", + "result": "valid" + }, + { + "tcId": 87, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3130353336323835353638", + "sig": "a54c5062648339d2bff06f71c88216c26c6e19b4d80a8c602990ac82707efdfce99bbe7fcfafae3e69fd016777517aa01056317f467ad09aff09be73c9731b0d", + "result": "valid" + }, + { + "tcId": 88, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "393533393034313035", + "sig": "975bd7157a8d363b309f1f444012b1a1d23096593133e71b4ca8b059cff37eaf7faa7a28b1c822baa241793f2abc930bd4c69840fe090f2aacc46786bf919622", + "result": "valid" + }, + { + "tcId": 89, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "393738383438303339", + "sig": "5694a6f84b8f875c276afd2ebcfe4d61de9ec90305afb1357b95b3e0da43885e0dffad9ffd0b757d8051dec02ebdf70d8ee2dc5c7870c0823b6ccc7c679cbaa4", + "result": "valid" + }, + { + "tcId": 90, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33363130363732343432", + "sig": "a0c30e8026fdb2b4b4968a27d16a6d08f7098f1a98d21620d7454ba9790f1ba65e470453a8a399f15baf463f9deceb53acc5ca64459149688bd2760c65424339", + "result": "valid" + }, + { + "tcId": 91, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31303534323430373035", + "sig": "614ea84acf736527dd73602cd4bb4eea1dfebebd5ad8aca52aa0228cf7b99a88737cc85f5f2d2f60d1b8183f3ed490e4de14368e96a9482c2a4dd193195c902f", + "result": "valid" + }, + { + "tcId": 92, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "35313734343438313937", + "sig": "bead6734ebe44b810d3fb2ea00b1732945377338febfd439a8d74dfbd0f942fa6bb18eae36616a7d3cad35919fd21a8af4bbe7a10f73b3e036a46b103ef56e2a", + "result": "valid" + }, + { + "tcId": 93, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31393637353631323531", + "sig": "499625479e161dacd4db9d9ce64854c98d922cbf212703e9654fae182df9bad242c177cf37b8193a0131108d97819edd9439936028864ac195b64fca76d9d693", + "result": "valid" + }, + { + "tcId": 94, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33343437323533333433", + "sig": "08f16b8093a8fb4d66a2c8065b541b3d31e3bfe694f6b89c50fb1aaa6ff6c9b29d6455e2d5d1779748573b611cb95d4a21f967410399b39b535ba3e5af81ca2e", + "result": "valid" + }, + { + "tcId": 95, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "333638323634333138", + "sig": "be26231b6191658a19dd72ddb99ed8f8c579b6938d19bce8eed8dc2b338cb5f8e1d9a32ee56cffed37f0f22b2dcb57d5c943c14f79694a03b9c5e96952575c89", + "result": "valid" + }, + { + "tcId": 96, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33323631313938363038", + "sig": "15e76880898316b16204ac920a02d58045f36a229d4aa4f812638c455abe0443e74d357d3fcb5c8c5337bd6aba4178b455ca10e226e13f9638196506a1939123", + "result": "valid" + }, + { + "tcId": 97, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "39363738373831303934", + "sig": "352ecb53f8df2c503a45f9846fc28d1d31e6307d3ddbffc1132315cc07f16dad1348dfa9c482c558e1d05c5242ca1c39436726ecd28258b1899792887dd0a3c6", + "result": "valid" + }, + { + "tcId": 98, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "34393538383233383233", + "sig": "4a40801a7e606ba78a0da9882ab23c7677b8642349ed3d652c5bfa5f2a9558fb3a49b64848d682ef7f605f2832f7384bdc24ed2925825bf8ea77dc5981725782", + "result": "valid" + }, + { + "tcId": 99, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "383234363337383337", + "sig": "eacc5e1a8304a74d2be412b078924b3bb3511bac855c05c9e5e9e44df3d61e967451cd8e18d6ed1885dd827714847f96ec4bb0ed4c36ce9808db8f714204f6d1", + "result": "valid" + }, + { + "tcId": 100, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3131303230383333373736", + "sig": "2f7a5e9e5771d424f30f67fdab61e8ce4f8cd1214882adb65f7de94c31577052ac4e69808345809b44acb0b2bd889175fb75dd050c5a449ab9528f8f78daa10c", + "result": "valid" + }, + { + "tcId": 101, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "313333383731363438", + "sig": "ffcda40f792ce4d93e7e0f0e95e1a2147dddd7f6487621c30a03d710b330021979938b55f8a17f7ed7ba9ade8f2065a1fa77618f0b67add8d58c422c2453a49a", + "result": "valid" + }, + { + "tcId": 102, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "333232313434313632", + "sig": "81f2359c4faba6b53d3e8c8c3fcc16a948350f7ab3a588b28c17603a431e39a8cd6f6a5cc3b55ead0ff695d06c6860b509e46d99fccefb9f7f9e101857f74300", + "result": "valid" + }, + { + "tcId": 103, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3130363836363535353436", + "sig": "dfc8bf520445cbb8ee1596fb073ea283ea130251a6fdffa5c3f5f2aaf75ca808048e33efce147c9dd92823640e338e68bfd7d0dc7a4905b3a7ac711e577e90e7", + "result": "valid" + }, + { + "tcId": 104, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "3632313535323436", + "sig": "ad019f74c6941d20efda70b46c53db166503a0e393e932f688227688ba6a576293320eb7ca0710255346bdbb3102cdcf7964ef2e0988e712bc05efe16c199345", + "result": "valid" + }, + { + "tcId": 105, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "37303330383138373734", + "sig": "ac8096842e8add68c34e78ce11dd71e4b54316bd3ebf7fffdeb7bd5a3ebc1883f5ca2f4f23d674502d4caf85d187215d36e3ce9f0ce219709f21a3aac003b7a8", + "result": "valid" + }, + { + "tcId": 106, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "35393234353233373434", + "sig": "677b2d3a59b18a5ff939b70ea002250889ddcd7b7b9d776854b4943693fb92f76b4ba856ade7677bf30307b21f3ccda35d2f63aee81efd0bab6972cc0795db55", + "result": "valid" + }, + { + "tcId": 107, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31343935353836363231", + "sig": "479e1ded14bcaed0379ba8e1b73d3115d84d31d4b7c30e1f05e1fc0d5957cfb0918f79e35b3d89487cf634a4f05b2e0c30857ca879f97c771e877027355b2443", + "result": "valid" + }, + { + "tcId": 108, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "34303035333134343036", + "sig": "43dfccd0edb9e280d9a58f01164d55c3d711e14b12ac5cf3b64840ead512a0a31dbe33fa8ba84533cd5c4934365b3442ca1174899b78ef9a3199f49584389772", + "result": "valid" + }, + { + "tcId": 109, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "33303936343537353132", + "sig": "5b09ab637bd4caf0f4c7c7e4bca592fea20e9087c259d26a38bb4085f0bbff1145b7eb467b6748af618e9d80d6fdcd6aa24964e5a13f885bca8101de08eb0d75", + "result": "valid" + }, + { + "tcId": 110, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "32373834303235363230", + "sig": "5e9b1c5a028070df5728c5c8af9b74e0667afa570a6cfa0114a5039ed15ee06fb1360907e2d9785ead362bb8d7bd661b6c29eeffd3c5037744edaeb9ad990c20", + "result": "valid" + }, + { + "tcId": 111, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "32363138373837343138", + "sig": "0671a0a85c2b72d54a2fb0990e34538b4890050f5a5712f6d1a7a5fb8578f32edb1846bab6b7361479ab9c3285ca41291808f27fd5bd4fdac720e5854713694c", + "result": "valid" + }, + { + "tcId": 112, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "31363432363235323632", + "sig": "7673f8526748446477dbbb0590a45492c5d7d69859d301abbaedb35b2095103a3dc70ddf9c6b524d886bed9e6af02e0e4dec0d417a414fed3807ef4422913d7c", + "result": "valid" + }, + { + "tcId": 113, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "36383234313839343336", + "sig": "7f085441070ecd2bb21285089ebb1aa6450d1a06c36d3ff39dfd657a796d12b5249712012029870a2459d18d47da9aa492a5e6cb4b2d8dafa9e4c5c54a2b9a8b", + "result": "valid" + }, + { + "tcId": 114, + "comment": "special case hash", + "flags": [ + "SpecialCaseHash" + ], + "msg": "343834323435343235", + "sig": "914c67fb61dd1e27c867398ea7322d5ab76df04bc5aa6683a8e0f30a5d287348fa07474031481dda4953e3ac1959ee8cea7e66ec412b38d6c96d28f6d37304ea", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "KSexBRK64-3c_kZ4KBKLrSkDJpkZ9whgacjE32xzKDg", + "y": "x3h5ZOqsAOWSH7FJimD0YGdms9loUAFVjRqXTnNBUT4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "040ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103c5011e6ef2c42dcd50d5d3d29f99ae6eba2c80c9244f4c5422f0979ff0c3ba5e", + "wx": "0ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103", + "wy": "00c5011e6ef2c42dcd50d5d3d29f99ae6eba2c80c9244f4c5422f0979ff0c3ba5e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200040ad99500288d466940031d72a9f5445a4d43784640855bf0a69874d2de5fe103c5011e6ef2c42dcd50d5d3d29f99ae6eba2c80c9244f4c5422f0979ff0c3ba5e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECtmVACiNRmlAAx1yqfVEWk1DeEZA\nhVvwpph00t5f4QPFAR5u8sQtzVDV09Kfma5uuiyAySRPTFQi8Jef8MO6Xg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 115, + "comment": "k*G has a large x-coordinate", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "000000000000000000000000000000004319055358e8617b0c46353d039cdaabffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "valid" + }, + { + "tcId": 116, + "comment": "r too large", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "ffffffff00000001000000000000000000000000fffffffffffffffffffffffcffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "CtmVACiNRmlAAx1yqfVEWk1DeEZAhVvwpph00t5f4QM", + "y": "xQEebvLELc1Q1dPSn5mubrosgMkkT0xUIvCXn_DDul4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04ab05fd9d0de26b9ce6f4819652d9fc69193d0aa398f0fba8013e09c58220455419235271228c786759095d12b75af0692dd4103f19f6a8c32f49435a1e9b8d45", + "wx": "00ab05fd9d0de26b9ce6f4819652d9fc69193d0aa398f0fba8013e09c582204554", + "wy": "19235271228c786759095d12b75af0692dd4103f19f6a8c32f49435a1e9b8d45" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004ab05fd9d0de26b9ce6f4819652d9fc69193d0aa398f0fba8013e09c58220455419235271228c786759095d12b75af0692dd4103f19f6a8c32f49435a1e9b8d45", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqwX9nQ3ia5zm9IGWUtn8aRk9CqOY\n8PuoAT4JxYIgRVQZI1JxIox4Z1kJXRK3WvBpLdQQPxn2qMMvSUNaHpuNRQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 117, + "comment": "r,s are large", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254fffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "qwX9nQ3ia5zm9IGWUtn8aRk9CqOY8PuoAT4JxYIgRVQ", + "y": "GSNScSKMeGdZCV0St1rwaS3UED8Z9qjDL0lDWh6bjUU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0480984f39a1ff38a86a68aa4201b6be5dfbfecf876219710b07badf6fdd4c6c5611feb97390d9826e7a06dfb41871c940d74415ed3cac2089f1445019bb55ed95", + "wx": "0080984f39a1ff38a86a68aa4201b6be5dfbfecf876219710b07badf6fdd4c6c56", + "wy": "11feb97390d9826e7a06dfb41871c940d74415ed3cac2089f1445019bb55ed95" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000480984f39a1ff38a86a68aa4201b6be5dfbfecf876219710b07badf6fdd4c6c5611feb97390d9826e7a06dfb41871c940d74415ed3cac2089f1445019bb55ed95", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgJhPOaH/OKhqaKpCAba+Xfv+z4di\nGXELB7rfb91MbFYR/rlzkNmCbnoG37QYcclA10QV7TysIInxRFAZu1XtlQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 118, + "comment": "r and s^-1 have a large Hamming weight", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd909135bdb6799286170f5ead2de4f6511453fe50914f3df2de54a36383df8dd4", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "gJhPOaH_OKhqaKpCAba-Xfv-z4diGXELB7rfb91MbFY", + "y": "Ef65c5DZgm56Bt-0GHHJQNdEFe08rCCJ8URQGbtV7ZU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "044201b4272944201c3294f5baa9a3232b6dd687495fcc19a70a95bc602b4f7c0595c37eba9ee8171c1bb5ac6feaf753bc36f463e3aef16629572c0c0a8fb0800e", + "wx": "4201b4272944201c3294f5baa9a3232b6dd687495fcc19a70a95bc602b4f7c05", + "wy": "0095c37eba9ee8171c1bb5ac6feaf753bc36f463e3aef16629572c0c0a8fb0800e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200044201b4272944201c3294f5baa9a3232b6dd687495fcc19a70a95bc602b4f7c0595c37eba9ee8171c1bb5ac6feaf753bc36f463e3aef16629572c0c0a8fb0800e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQgG0JylEIBwylPW6qaMjK23Wh0lf\nzBmnCpW8YCtPfAWVw366nugXHBu1rG/q91O8NvRj467xZilXLAwKj7CADg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 119, + "comment": "r and s^-1 have a large Hamming weight", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd27b4577ca009376f71303fd5dd227dcef5deb773ad5f5a84360644669ca249a5", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "QgG0JylEIBwylPW6qaMjK23Wh0lfzBmnCpW8YCtPfAU", + "y": "lcN-up7oFxwbtaxv6vdTvDb0Y-Ou8WYpVywMCo-wgA4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac9575d47723c8fbe580bb369fec9c2665d8e30a435b9932645482e7c9f11e872296b", + "wx": "00a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac957", + "wy": "5d47723c8fbe580bb369fec9c2665d8e30a435b9932645482e7c9f11e872296b" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004a71af64de5126a4a4e02b7922d66ce9415ce88a4c9d25514d91082c8725ac9575d47723c8fbe580bb369fec9c2665d8e30a435b9932645482e7c9f11e872296b", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpxr2TeUSakpOAreSLWbOlBXOiKTJ\n0lUU2RCCyHJayVddR3I8j75YC7Np/snCZl2OMKQ1uZMmRUgufJ8R6HIpaw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 120, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000001", + "result": "valid" + }, + { + "tcId": 121, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0501", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "pxr2TeUSakpOAreSLWbOlBXOiKTJ0lUU2RCCyHJayVc", + "y": "XUdyPI--WAuzaf7JwmZdjjCkNbmTJkVILnyfEehyKWs", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "046627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b15726170ed77d8d0a14fc5c9c3c4c9be7f0d3ee18f709bb275eaf2073e258fe694a5", + "wx": "6627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b1572", + "wy": "6170ed77d8d0a14fc5c9c3c4c9be7f0d3ee18f709bb275eaf2073e258fe694a5" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200046627cec4f0731ea23fc2931f90ebe5b7572f597d20df08fc2b31ee8ef16b15726170ed77d8d0a14fc5c9c3c4c9be7f0d3ee18f709bb275eaf2073e258fe694a5", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZifOxPBzHqI/wpMfkOvlt1cvWX0g\n3wj8KzHujvFrFXJhcO132NChT8XJw8TJvn8NPuGPcJuyderyBz4lj+aUpQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 122, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000003", + "result": "valid" + }, + { + "tcId": 123, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0503", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "ZifOxPBzHqI_wpMfkOvlt1cvWX0g3wj8KzHujvFrFXI", + "y": "YXDtd9jQoU_FycPEyb5_DT7hj3CbsnXq8gc-JY_mlKU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bfef6edf62a4497c1bd7b147fb6c3d22af3c39bfce95f30e13a16d3d7b2812f813", + "wx": "5a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bf", + "wy": "00ef6edf62a4497c1bd7b147fb6c3d22af3c39bfce95f30e13a16d3d7b2812f813" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045a7c8825e85691cce1f5e7544c54e73f14afc010cb731343262ca7ec5a77f5bfef6edf62a4497c1bd7b147fb6c3d22af3c39bfce95f30e13a16d3d7b2812f813", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWnyIJehWkczh9edUTFTnPxSvwBDL\ncxNDJiyn7Fp39b/vbt9ipEl8G9exR/tsPSKvPDm/zpXzDhOhbT17KBL4Ew==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 124, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000005", + "result": "valid" + }, + { + "tcId": 125, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0505", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "WnyIJehWkczh9edUTFTnPxSvwBDLcxNDJiyn7Fp39b8", + "y": "727fYqRJfBvXsUf7bD0irzw5v86V8w4ToW09eygS-BM", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c73770af6a8ce44cb41224b2603606f4c04d188e80bff7cc31ad5189d4ab0d70e8c1", + "wx": "00cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c737", + "wy": "70af6a8ce44cb41224b2603606f4c04d188e80bff7cc31ad5189d4ab0d70e8c1" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004cbe0c29132cd738364fedd603152990c048e5e2fff996d883fa6caca7978c73770af6a8ce44cb41224b2603606f4c04d188e80bff7cc31ad5189d4ab0d70e8c1", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEy+DCkTLNc4Nk/t1gMVKZDASOXi//\nmW2IP6bKynl4xzdwr2qM5Ey0EiSyYDYG9MBNGI6Av/fMMa1RidSrDXDowQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 126, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006", + "result": "valid" + }, + { + "tcId": 127, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0506", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "y-DCkTLNc4Nk_t1gMVKZDASOXi__mW2IP6bKynl4xzc", + "y": "cK9qjORMtBIksmA2BvTATRiOgL_3zDGtUYnUqw1w6ME", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "042ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2ea8fb2ea635b761baefc1c4ded2099281b844e13e044c328553bbbafa337d8a76", + "wx": "2ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2e", + "wy": "00a8fb2ea635b761baefc1c4ded2099281b844e13e044c328553bbbafa337d8a76" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200042ef747671c97d9c7f9cb2f6a30d678c3d84757ba241ef7183d51a29f52d87c2ea8fb2ea635b761baefc1c4ded2099281b844e13e044c328553bbbafa337d8a76", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELvdHZxyX2cf5yy9qMNZ4w9hHV7ok\nHvcYPVGin1LYfC6o+y6mNbdhuu/BxN7SCZKBuEThPgRMMoVTu7r6M32Kdg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 128, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000001", + "result": "valid" + }, + { + "tcId": 129, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0601", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "LvdHZxyX2cf5yy9qMNZ4w9hHV7okHvcYPVGin1LYfC4", + "y": "qPsupjW3YbrvwcTe0gmSgbhE4T4ETDKFU7u6-jN9inY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf058dc140abbba42fc1ddbf30dab8eb9b46ee7338b3f7ee96242bf45e1df5e995", + "wx": "00931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf", + "wy": "058dc140abbba42fc1ddbf30dab8eb9b46ee7338b3f7ee96242bf45e1df5e995" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004931cc49cda4d87d25b1601c56c3b83b4f45e44971998f2d3e7d3c55152214edf058dc140abbba42fc1ddbf30dab8eb9b46ee7338b3f7ee96242bf45e1df5e995", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkxzEnNpNh9JbFgHFbDuDtPReRJcZ\nmPLT59PFUVIhTt8FjcFAq7ukL8HdvzDauOubRu5zOLP37pYkK/ReHfXplQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 130, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000003", + "result": "valid" + }, + { + "tcId": 131, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0603", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "kxzEnNpNh9JbFgHFbDuDtPReRJcZmPLT59PFUVIhTt8", + "y": "BY3BQKu7pC_B3b8w2rjrm0bucziz9-6WJCv0Xh316ZU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed47ac000f9ea8a3034939bf48ad5d061a69fc8495ae4df2dbec7effa03a0062b3", + "wx": "00899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed", + "wy": "47ac000f9ea8a3034939bf48ad5d061a69fc8495ae4df2dbec7effa03a0062b3" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004899a4af61867e3f3c190dbb48f8bc9fc74b70a467a4a1f06477b3af2f39ab8ed47ac000f9ea8a3034939bf48ad5d061a69fc8495ae4df2dbec7effa03a0062b3", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiZpK9hhn4/PBkNu0j4vJ/HS3CkZ6\nSh8GR3s68vOauO1HrAAPnqijA0k5v0itXQYaafyEla5N8tvsfv+gOgBisw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 132, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006", + "result": "valid" + }, + { + "tcId": 133, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0606", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "iZpK9hhn4_PBkNu0j4vJ_HS3CkZ6Sh8GR3s68vOauO0", + "y": "R6wAD56oowNJOb9IrV0GGmn8hJWuTfLb7H7_oDoAYrM", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c46d5df3f45ac58fa334c6d102381b3120b7a2455600dcaff3d1a845514f12bf46", + "wx": "00d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c4", + "wy": "6d5df3f45ac58fa334c6d102381b3120b7a2455600dcaff3d1a845514f12bf46" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d03eb09913cc20c6a8d0070f0d8d2a7f63527fafa44117fce6bd1ef2aa4ae3c46d5df3f45ac58fa334c6d102381b3120b7a2455600dcaff3d1a845514f12bf46", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0D6wmRPMIMao0AcPDY0qf2NSf6+k\nQRf85r0e8qpK48RtXfP0WsWPozTG0QI4GzEgt6JFVgDcr/PRqEVRTxK/Rg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 134, + "comment": "small r and s", + "flags": [ + "SmallRandS", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000007", + "result": "valid" + }, + { + "tcId": 135, + "comment": "incorrect size of signature", + "flags": [ + "SmallRandS", + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "0607", + "result": "invalid" + }, + { + "tcId": 136, + "comment": "r is larger than n", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325570000000000000000000000000000000000000000000000000000000000000007", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "0D6wmRPMIMao0AcPDY0qf2NSf6-kQRf85r0e8qpK48Q", + "y": "bV3z9FrFj6M0xtECOBsxILeiRVYA3K_z0ahFUU8Sv0Y", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "043a72476291571193b4d109b2c37b59f2807e8fe9cffd804eacded903e77ca0da592dbc74fee0ca7508cc7bc282b0c51a143286ff53c60131668e7a0929e4ed04", + "wx": "3a72476291571193b4d109b2c37b59f2807e8fe9cffd804eacded903e77ca0da", + "wy": "592dbc74fee0ca7508cc7bc282b0c51a143286ff53c60131668e7a0929e4ed04" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200043a72476291571193b4d109b2c37b59f2807e8fe9cffd804eacded903e77ca0da592dbc74fee0ca7508cc7bc282b0c51a143286ff53c60131668e7a0929e4ed04", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOnJHYpFXEZO00Qmyw3tZ8oB+j+nP\n/YBOrN7ZA+d8oNpZLbx0/uDKdQjMe8KCsMUaFDKG/1PGATFmjnoJKeTtBA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 137, + "comment": "s is larger than n", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc75fbd8", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "OnJHYpFXEZO00Qmyw3tZ8oB-j-nP_YBOrN7ZA-d8oNo", + "y": "WS28dP7gynUIzHvCgrDFGhQyhv9TxgExZo56CSnk7QQ", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d0f73792203716afd4be4329faa48d269f15313ebbba379d7783c97bf3e890d9971f4a3206605bec21782bf5e275c714417e8f566549e6bc68690d2363c89cc1", + "wx": "00d0f73792203716afd4be4329faa48d269f15313ebbba379d7783c97bf3e890d9", + "wy": "00971f4a3206605bec21782bf5e275c714417e8f566549e6bc68690d2363c89cc1" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d0f73792203716afd4be4329faa48d269f15313ebbba379d7783c97bf3e890d9971f4a3206605bec21782bf5e275c714417e8f566549e6bc68690d2363c89cc1", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0Pc3kiA3Fq/UvkMp+qSNJp8VMT67\nujedd4PJe/PokNmXH0oyBmBb7CF4K/XidccUQX6PVmVJ5rxoaQ0jY8icwQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 138, + "comment": "small r and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000000000000000000000000001008f1e3c7862c58b16bb76eddbb76eddbb516af4f63f2d74d76e0d28c9bb75ea88", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "0Pc3kiA3Fq_UvkMp-qSNJp8VMT67ujedd4PJe_PokNk", + "y": "lx9KMgZgW-wheCv14nXHFEF-j1ZlSea8aGkNI2PInME", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "044838b2be35a6276a80ef9e228140f9d9b96ce83b7a254f71ccdebbb8054ce05ffa9cbc123c919b19e00238198d04069043bd660a828814051fcb8aac738a6c6b", + "wx": "4838b2be35a6276a80ef9e228140f9d9b96ce83b7a254f71ccdebbb8054ce05f", + "wy": "00fa9cbc123c919b19e00238198d04069043bd660a828814051fcb8aac738a6c6b" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200044838b2be35a6276a80ef9e228140f9d9b96ce83b7a254f71ccdebbb8054ce05ffa9cbc123c919b19e00238198d04069043bd660a828814051fcb8aac738a6c6b", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESDiyvjWmJ2qA754igUD52bls6Dt6\nJU9xzN67uAVM4F/6nLwSPJGbGeACOBmNBAaQQ71mCoKIFAUfy4qsc4psaw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 139, + "comment": "smallish r and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "000000000000000000000000000000000000000000000000002d9b4d347952d6ef3043e7329581dbb3974497710ab11505ee1c87ff907beebadd195a0ffe6d7a", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "SDiyvjWmJ2qA754igUD52bls6Dt6JU9xzN67uAVM4F8", + "y": "-py8EjyRmxngAjgZjQQGkEO9ZgqCiBQFH8uKrHOKbGs", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "047393983ca30a520bbc4783dc9960746aab444ef520c0a8e771119aa4e74b0f64e9d7be1ab01a0bf626e709863e6a486dbaf32793afccf774e2c6cd27b1857526", + "wx": "7393983ca30a520bbc4783dc9960746aab444ef520c0a8e771119aa4e74b0f64", + "wy": "00e9d7be1ab01a0bf626e709863e6a486dbaf32793afccf774e2c6cd27b1857526" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200047393983ca30a520bbc4783dc9960746aab444ef520c0a8e771119aa4e74b0f64e9d7be1ab01a0bf626e709863e6a486dbaf32793afccf774e2c6cd27b1857526", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEc5OYPKMKUgu8R4PcmWB0aqtETvUg\nwKjncRGapOdLD2Tp174asBoL9ibnCYY+akhtuvMnk6/M93Tixs0nsYV1Jg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 140, + "comment": "100-bit r and small s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "000000000000000000000000000000000000001033e67e37b32b445580bf4eff8b748b74000000008b748b748b748b7466e769ad4a16d3dcd87129b8e91d1b4d", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "c5OYPKMKUgu8R4PcmWB0aqtETvUgwKjncRGapOdLD2Q", + "y": "6de-GrAaC_Ym5wmGPmpIbbrzJ5OvzPd04sbNJ7GFdSY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045ac331a1103fe966697379f356a937f350588a05477e308851b8a502d5dfcdc5fe9993df4b57939b2b8da095bf6d794265204cfe03be995a02e65d408c871c0b", + "wx": "5ac331a1103fe966697379f356a937f350588a05477e308851b8a502d5dfcdc5", + "wy": "00fe9993df4b57939b2b8da095bf6d794265204cfe03be995a02e65d408c871c0b" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045ac331a1103fe966697379f356a937f350588a05477e308851b8a502d5dfcdc5fe9993df4b57939b2b8da095bf6d794265204cfe03be995a02e65d408c871c0b", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWsMxoRA/6WZpc3nzVqk381BYigVH\nfjCIUbilAtXfzcX+mZPfS1eTmyuNoJW/bXlCZSBM/gO+mVoC5l1AjIccCw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 141, + "comment": "small r and 100 bit s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000100ef9f6ba4d97c09d03178fa20b4aaad83be3cf9cb824a879fec3270fc4b81ef5b", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "WsMxoRA_6WZpc3nzVqk381BYigVHfjCIUbilAtXfzcU", + "y": "_pmT30tXk5srjaCVv215QmUgTP4DvplaAuZdQIyHHAs", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "041d209be8de2de877095a399d3904c74cc458d926e27bb8e58e5eae5767c41509dd59e04c214f7b18dce351fc2a549893a6860e80163f38cc60a4f2c9d040d8c9", + "wx": "1d209be8de2de877095a399d3904c74cc458d926e27bb8e58e5eae5767c41509", + "wy": "00dd59e04c214f7b18dce351fc2a549893a6860e80163f38cc60a4f2c9d040d8c9" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200041d209be8de2de877095a399d3904c74cc458d926e27bb8e58e5eae5767c41509dd59e04c214f7b18dce351fc2a549893a6860e80163f38cc60a4f2c9d040d8c9", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHSCb6N4t6HcJWjmdOQTHTMRY2Sbi\ne7jljl6uV2fEFQndWeBMIU97GNzjUfwqVJiTpoYOgBY/OMxgpPLJ0EDYyQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 142, + "comment": "100-bit r and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "00000000000000000000000000000000000000062522bbd3ecbe7c39e93e7c25ef9f6ba4d97c09d03178fa20b4aaad83be3cf9cb824a879fec3270fc4b81ef5b", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "HSCb6N4t6HcJWjmdOQTHTMRY2Sbie7jljl6uV2fEFQk", + "y": "3VngTCFPexjc41H8KlSYk6aGDoAWPzjMYKTyydBA2Mk", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04083539fbee44625e3acaafa2fcb41349392cef0633a1b8fabecee0c133b10e99915c1ebe7bf00df8535196770a58047ae2a402f26326bb7d41d4d7616337911e", + "wx": "083539fbee44625e3acaafa2fcb41349392cef0633a1b8fabecee0c133b10e99", + "wy": "00915c1ebe7bf00df8535196770a58047ae2a402f26326bb7d41d4d7616337911e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004083539fbee44625e3acaafa2fcb41349392cef0633a1b8fabecee0c133b10e99915c1ebe7bf00df8535196770a58047ae2a402f26326bb7d41d4d7616337911e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECDU5++5EYl46yq+i/LQTSTks7wYz\nobj6vs7gwTOxDpmRXB6+e/AN+FNRlncKWAR64qQC8mMmu31B1NdhYzeRHg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 143, + "comment": "r and s^-1 are close to n", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6324d5555555550000000055555555555555553ef7a8e48d07df81a693439654210c70", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "CDU5--5EYl46yq-i_LQTSTks7wYzobj6vs7gwTOxDpk", + "y": "kVwevnvwDfhTUZZ3ClgEeuKkAvJjJrt9QdTXYWM3kR4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4cc61760ac8b0680c1b644c03cc628ba9dc4a3c0561368489c692bd40f43aa3ca", + "wx": "00e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4", + "wy": "00cc61760ac8b0680c1b644c03cc628ba9dc4a3c0561368489c692bd40f43aa3ca" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004e075effd9607d08d5f34e3652f64cfa3bd6d20c58d0a232f058491260ab212a4cc61760ac8b0680c1b644c03cc628ba9dc4a3c0561368489c692bd40f43aa3ca", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4HXv/ZYH0I1fNONlL2TPo71tIMWN\nCiMvBYSRJgqyEqTMYXYKyLBoDBtkTAPMYoup3Eo8BWE2hInGkr1A9Dqjyg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 144, + "comment": "r and s are 64-bit integer", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000009c44febf31c3594f000000000000000000000000000000000000000000000000839ed28247c2b06b", + "result": "valid" + }, + { + "tcId": 145, + "comment": "incorrect size of signature", + "flags": [ + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "9c44febf31c3594f839ed28247c2b06b", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "4HXv_ZYH0I1fNONlL2TPo71tIMWNCiMvBYSRJgqyEqQ", + "y": "zGF2CsiwaAwbZEwDzGKLqdxKPAVhNoSJxpK9QPQ6o8o", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8dfdc6bebc894144c6d418ac5d97339726ad2ae925df868426e5628e9f4e62342", + "wx": "00cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8", + "wy": "00dfdc6bebc894144c6d418ac5d97339726ad2ae925df868426e5628e9f4e62342" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004cffb758c3073ea3c08efd9f7f17a85b6ae385c5a140c146ad5f1f5a826718bc8dfdc6bebc894144c6d418ac5d97339726ad2ae925df868426e5628e9f4e62342", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz/t1jDBz6jwI79n38XqFtq44XFoU\nDBRq1fH1qCZxi8jf3GvryJQUTG1BisXZczlyatKukl34aEJuVijp9OYjQg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 146, + "comment": "r and s are 100-bit integer", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000009df8b682430beef6f5fd7c7cd000000000000000000000000000000000000000fd0a62e13778f4222a0d61c8a", + "result": "valid" + }, + { + "tcId": 147, + "comment": "incorrect size of signature", + "flags": [ + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "09df8b682430beef6f5fd7c7cd0fd0a62e13778f4222a0d61c8a", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "z_t1jDBz6jwI79n38XqFtq44XFoUDBRq1fH1qCZxi8g", + "y": "39xr68iUFExtQYrF2XM5cmrSrpJd-GhCblYo6fTmI0I", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549c446e814138e4ebc82dbf86a390056d4595dcf45e381fef217a4597d7bd51498", + "wx": "00b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549", + "wy": "00c446e814138e4ebc82dbf86a390056d4595dcf45e381fef217a4597d7bd51498" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004b98740e69e61a325d5f772e3b5c4f67fb7150b16a9afeca9ddc4afcbb6fa0549c446e814138e4ebc82dbf86a390056d4595dcf45e381fef217a4597d7bd51498", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuYdA5p5hoyXV93LjtcT2f7cVCxap\nr+yp3cSvy7b6BUnERugUE45OvILb+Go5AFbUWV3PReOB/vIXpFl9e9UUmA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 148, + "comment": "r and s are 128-bit integer", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "000000000000000000000000000000008a598e563a89f526c32ebec8de26367c0000000000000000000000000000000084f633e2042630e99dd0f1e16f7a04bf", + "result": "valid" + }, + { + "tcId": 149, + "comment": "incorrect size of signature", + "flags": [ + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "8a598e563a89f526c32ebec8de26367c84f633e2042630e99dd0f1e16f7a04bf", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "uYdA5p5hoyXV93LjtcT2f7cVCxapr-yp3cSvy7b6BUk", + "y": "xEboFBOOTryC2_hqOQBW1Fldz0Xjgf7yF6RZfXvVFJg", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0484536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b1766398cdac2fc8000017b29a7ba15a58f196037f35f7008ed4286ddff00fd46", + "wx": "0084536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b", + "wy": "1766398cdac2fc8000017b29a7ba15a58f196037f35f7008ed4286ddff00fd46" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000484536a270c3932bb2084732adf2c768efc6d3977e5220229ea9a44888b8f9d7b1766398cdac2fc8000017b29a7ba15a58f196037f35f7008ed4286ddff00fd46", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhFNqJww5MrsghHMq3yx2jvxtOXfl\nIgIp6ppEiIuPnXsXZjmM2sL8gAABeymnuhWljxlgN/NfcAjtQobd/wD9Rg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 150, + "comment": "r and s are 160-bit integer", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "000000000000000000000000aa6eeb5823f7fa31b466bb473797f0d0314c0bdf000000000000000000000000e2977c479e6d25703cebbc6bd561938cc9d1bfb9", + "result": "valid" + }, + { + "tcId": 151, + "comment": "incorrect size of signature", + "flags": [ + "ArithmeticError", + "SignatureSize" + ], + "msg": "313233343030", + "sig": "aa6eeb5823f7fa31b466bb473797f0d0314c0bdfe2977c479e6d25703cebbc6bd561938cc9d1bfb9", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "hFNqJww5MrsghHMq3yx2jvxtOXflIgIp6ppEiIuPnXs", + "y": "F2Y5jNrC_IAAAXspp7oVpY8ZYDfzX3AI7UKG3f8A_UY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "048aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e1937387405bd13834715e1dbae9b875cf07bd55e1b6691c7f7536aef3b19bf7a4adf576d", + "wx": "008aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e19373874", + "wy": "05bd13834715e1dbae9b875cf07bd55e1b6691c7f7536aef3b19bf7a4adf576d" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200048aeb368a7027a4d64abdea37390c0c1d6a26f399e2d9734de1eb3d0e1937387405bd13834715e1dbae9b875cf07bd55e1b6691c7f7536aef3b19bf7a4adf576d", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEius2inAnpNZKveo3OQwMHWom85ni\n2XNN4es9Dhk3OHQFvRODRxXh266bh1zwe9VeG2aRx/dTau87Gb96St9XbQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 152, + "comment": "s == 1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c700000000000000000000000000000000000000000000000000000000000000001", + "result": "valid" + }, + { + "tcId": 153, + "comment": "s == 0", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c700000000000000000000000000000000000000000000000000000000000000000", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "ius2inAnpNZKveo3OQwMHWom85ni2XNN4es9Dhk3OHQ", + "y": "Bb0Tg0cV4duum4dc8HvVXhtmkcf3U2rvOxm_ekrfV20", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0461722eaba731c697c7a9ba4d0afdbb5713d8aa12b0eab601bb33dbaf792c5adc272cd993b2b663aba5b3a26c101182ff178684945e83879e71598b95fe647dfc", + "wx": "61722eaba731c697c7a9ba4d0afdbb5713d8aa12b0eab601bb33dbaf792c5adc", + "wy": "272cd993b2b663aba5b3a26c101182ff178684945e83879e71598b95fe647dfc" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000461722eaba731c697c7a9ba4d0afdbb5713d8aa12b0eab601bb33dbaf792c5adc272cd993b2b663aba5b3a26c101182ff178684945e83879e71598b95fe647dfc", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYXIuq6cxxpfHqbpNCv27VxPYqhKw\n6rYBuzPbr3ksWtwnLNmTsrZjq6WzomwQEYL/F4aElF6Dh55xWYuV/mR9/A==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 154, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c7002f676969f451a8ccafa4c4f09791810e6d632dbd60b1d5540f3284fbe1889b0", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "YXIuq6cxxpfHqbpNCv27VxPYqhKw6rYBuzPbr3ksWtw", + "y": "JyzZk7K2Y6uls6JsEBGC_xeGhJReg4eecVmLlf5kffw", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04c4c91981e720e20d7e478ff19d09b95a98f58c0f469b72801a8ce844a347316594afcd4188182e7779889b3258d0368ece1e66797fe7c648c6f0b9e26bd71871", + "wx": "00c4c91981e720e20d7e478ff19d09b95a98f58c0f469b72801a8ce844a3473165", + "wy": "0094afcd4188182e7779889b3258d0368ece1e66797fe7c648c6f0b9e26bd71871" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004c4c91981e720e20d7e478ff19d09b95a98f58c0f469b72801a8ce844a347316594afcd4188182e7779889b3258d0368ece1e66797fe7c648c6f0b9e26bd71871", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExMkZgecg4g1+R4/xnQm5Wpj1jA9G\nm3KAGozoRKNHMWWUr81BiBgud3mImzJY0DaOzh5meX/nxkjG8Lnia9cYcQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 155, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c704e260962e33362ef0046126d2d5a4edc6947ab20e19b8ec19cf79e5908b6e628", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "xMkZgecg4g1-R4_xnQm5Wpj1jA9Gm3KAGozoRKNHMWU", + "y": "lK_NQYgYLnd5iJsyWNA2js4eZnl_58ZIxvC54mvXGHE", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d58d47bf49bc8f416641f6f760fcbca80aa52a814e56a5fa40bab44fd6f6317216deaa84d45d8e0e29cc9ecf5653f8ee6444750813becae8deb42b04ba07a634", + "wx": "00d58d47bf49bc8f416641f6f760fcbca80aa52a814e56a5fa40bab44fd6f63172", + "wy": "16deaa84d45d8e0e29cc9ecf5653f8ee6444750813becae8deb42b04ba07a634" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d58d47bf49bc8f416641f6f760fcbca80aa52a814e56a5fa40bab44fd6f6317216deaa84d45d8e0e29cc9ecf5653f8ee6444750813becae8deb42b04ba07a634", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Y1Hv0m8j0FmQfb3YPy8qAqlKoFO\nVqX6QLq0T9b2MXIW3qqE1F2ODinMns9WU/juZER1CBO+yujetCsEugemNA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 156, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70077ed0d8f20f697d8fc591ac64dd5219c7932122b4f9b9ec6441e44a0092cf21", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "1Y1Hv0m8j0FmQfb3YPy8qAqlKoFOVqX6QLq0T9b2MXI", + "y": "Ft6qhNRdjg4pzJ7PVlP47mREdQgTvsro3rQrBLoHpjQ", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0491e305822e5e44f3fdb616e2ef42cd98f241b86e9f68815bc4dba6a945e4eefb3c5937e2ac1d9466f6d65e49b35fc8d75ffc22e1fe2f32af42f5fa3c26f9b4b0", + "wx": "0091e305822e5e44f3fdb616e2ef42cd98f241b86e9f68815bc4dba6a945e4eefb", + "wy": "3c5937e2ac1d9466f6d65e49b35fc8d75ffc22e1fe2f32af42f5fa3c26f9b4b0" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000491e305822e5e44f3fdb616e2ef42cd98f241b86e9f68815bc4dba6a945e4eefb3c5937e2ac1d9466f6d65e49b35fc8d75ffc22e1fe2f32af42f5fa3c26f9b4b0", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkeMFgi5eRPP9thbi70LNmPJBuG6f\naIFbxNumqUXk7vs8WTfirB2UZvbWXkmzX8jXX/wi4f4vMq9C9fo8Jvm0sA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 157, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c703e0292a67e181c6c0105ee35e956e78e9bdd033c6e71ae57884039a245e4175f", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "keMFgi5eRPP9thbi70LNmPJBuG6faIFbxNumqUXk7vs", + "y": "PFk34qwdlGb21l5Js1_I11_8IuH-LzKvQvX6PCb5tLA", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0424a0bc4d16dbbd40d2fd81a7c3f8d8ec741607d5bb406a0611cc60d0e683bd46b575cad039c15f7f3dffcfc007b4b0f743c871ecc76a504a32672fd84526d861", + "wx": "24a0bc4d16dbbd40d2fd81a7c3f8d8ec741607d5bb406a0611cc60d0e683bd46", + "wy": "00b575cad039c15f7f3dffcfc007b4b0f743c871ecc76a504a32672fd84526d861" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000424a0bc4d16dbbd40d2fd81a7c3f8d8ec741607d5bb406a0611cc60d0e683bd46b575cad039c15f7f3dffcfc007b4b0f743c871ecc76a504a32672fd84526d861", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJKC8TRbbvUDS/YGnw/jY7HQWB9W7\nQGoGEcxg0OaDvUa1dcrQOcFffz3/z8AHtLD3Q8hx7MdqUEoyZy/YRSbYYQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 158, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c7013d22b06d6b8f5d97e0c64962b4a3bae30f668ca6217ef5b35d799f159e23ebe", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "JKC8TRbbvUDS_YGnw_jY7HQWB9W7QGoGEcxg0OaDvUY", + "y": "tXXK0DnBX389_8_AB7Sw90PIcezHalBKMmcv2EUm2GE", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d24dd06745cafb39186d22a92aa0e58169a79ab69488628a9da5ed3ef747269b7e9209d98faeb95355948adae61d5291c6015d3ee9513486d886fb05cbd25c6a", + "wx": "00d24dd06745cafb39186d22a92aa0e58169a79ab69488628a9da5ed3ef747269b", + "wy": "7e9209d98faeb95355948adae61d5291c6015d3ee9513486d886fb05cbd25c6a" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d24dd06745cafb39186d22a92aa0e58169a79ab69488628a9da5ed3ef747269b7e9209d98faeb95355948adae61d5291c6015d3ee9513486d886fb05cbd25c6a", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0k3QZ0XK+zkYbSKpKqDlgWmnmraU\niGKKnaXtPvdHJpt+kgnZj665U1WUitrmHVKRxgFdPulRNIbYhvsFy9Jcag==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 159, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c704523ce342e4994bb8968bf6613f60c06c86111f15a3a389309e72cd447d5dd99", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "0k3QZ0XK-zkYbSKpKqDlgWmnmraUiGKKnaXtPvdHJps", + "y": "fpIJ2Y-uuVNVlIra5h1SkcYBXT7pUTSG2Ib7BcvSXGo", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "048200f148e7eab1581bcd1e23946f8a9b8191d9641f9560341721f9d3fec3d63ece795669e0481e035de8623d716a6984d0a4809d6c65519443ee55260f7f3dcb", + "wx": "008200f148e7eab1581bcd1e23946f8a9b8191d9641f9560341721f9d3fec3d63e", + "wy": "00ce795669e0481e035de8623d716a6984d0a4809d6c65519443ee55260f7f3dcb" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200048200f148e7eab1581bcd1e23946f8a9b8191d9641f9560341721f9d3fec3d63ece795669e0481e035de8623d716a6984d0a4809d6c65519443ee55260f7f3dcb", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEggDxSOfqsVgbzR4jlG+Km4GR2WQf\nlWA0FyH50/7D1j7OeVZp4EgeA13oYj1xammE0KSAnWxlUZRD7lUmD389yw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 160, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c7037d765be3c9c78189ad30edb5097a4db670de11686d01420e37039d4677f4809", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "ggDxSOfqsVgbzR4jlG-Km4GR2WQflWA0FyH50_7D1j4", + "y": "znlWaeBIHgNd6GI9cWpphNCkgJ1sZVGUQ-5VJg9_Pcs", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04a8a69c5ed33b150ce8d37ac197070ed894c05d47258a80c9041d92486622024de85997c9666b60a393568efede8f4ca0167c1e10f626e62fc1b8c8e9c6ba6ed7", + "wx": "00a8a69c5ed33b150ce8d37ac197070ed894c05d47258a80c9041d92486622024d", + "wy": "00e85997c9666b60a393568efede8f4ca0167c1e10f626e62fc1b8c8e9c6ba6ed7" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004a8a69c5ed33b150ce8d37ac197070ed894c05d47258a80c9041d92486622024de85997c9666b60a393568efede8f4ca0167c1e10f626e62fc1b8c8e9c6ba6ed7", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEqKacXtM7FQzo03rBlwcO2JTAXUcl\nioDJBB2SSGYiAk3oWZfJZmtgo5NWjv7ej0ygFnweEPYm5i/BuMjpxrpu1w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 161, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044237823b54e0c74c2bf5f759d9ac5f8cb897d537ffa92effd4f0bb6c9acd860", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "qKacXtM7FQzo03rBlwcO2JTAXUclioDJBB2SSGYiAk0", + "y": "6FmXyWZrYKOTVo7-3o9MoBZ8HhD2JuYvwbjI6ca6btc", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04ed0587e75b3b9a1dd0794f41d1729fcd432b2436cbf51c230d8bc7273273181735a57f09c7873d3964aa8102c9e25fa53070cd924cb7e3a459174740b8b71c34", + "wx": "00ed0587e75b3b9a1dd0794f41d1729fcd432b2436cbf51c230d8bc72732731817", + "wy": "35a57f09c7873d3964aa8102c9e25fa53070cd924cb7e3a459174740b8b71c34" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004ed0587e75b3b9a1dd0794f41d1729fcd432b2436cbf51c230d8bc7273273181735a57f09c7873d3964aa8102c9e25fa53070cd924cb7e3a459174740b8b71c34", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7QWH51s7mh3QeU9B0XKfzUMrJDbL\n9RwjDYvHJzJzGBc1pX8Jx4c9OWSqgQLJ4l+lMHDNkky346RZF0dAuLccNA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 162, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70266d30a485385906054ca86d46f5f2b17e7f4646a3092092ad92877126538111", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "7QWH51s7mh3QeU9B0XKfzUMrJDbL9RwjDYvHJzJzGBc", + "y": "NaV_CceHPTlkqoECyeJfpTBwzZJMt-OkWRdHQLi3HDQ", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04077091d99004a99ee08224e59a46a70495e6fba4eff681c3ce42127e588681ef4f1c16c77dfa440dde18245c9de76243d8f2fd9dea3f2782d6c04974d02f25dc", + "wx": "077091d99004a99ee08224e59a46a70495e6fba4eff681c3ce42127e588681ef", + "wy": "4f1c16c77dfa440dde18245c9de76243d8f2fd9dea3f2782d6c04974d02f25dc" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004077091d99004a99ee08224e59a46a70495e6fba4eff681c3ce42127e588681ef4f1c16c77dfa440dde18245c9de76243d8f2fd9dea3f2782d6c04974d02f25dc", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEB3CR2ZAEqZ7ggiTlmkanBJXm+6Tv\n9oHDzkISfliGge9PHBbHffpEDd4YJFyd52JD2PL9neo/J4LWwEl00C8l3A==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 163, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70538c7b3798e84d0ce90340165806348971ed44db8f0c674f5f215968390f92ee", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "B3CR2ZAEqZ7ggiTlmkanBJXm-6Tv9oHDzkISfliGge8", + "y": "TxwWx336RA3eGCRcnediQ9jy_Z3qPyeC1sBJdNAvJdw", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04616a8b8e57d82c11678f5827911024cd23a16cb52a65f230fb554a7b110c35a5bb466660be5cab3e4b587c12b45bd998bd56c7d66c2f94d03a1a6d2028d8a154", + "wx": "616a8b8e57d82c11678f5827911024cd23a16cb52a65f230fb554a7b110c35a5", + "wy": "00bb466660be5cab3e4b587c12b45bd998bd56c7d66c2f94d03a1a6d2028d8a154" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004616a8b8e57d82c11678f5827911024cd23a16cb52a65f230fb554a7b110c35a5bb466660be5cab3e4b587c12b45bd998bd56c7d66c2f94d03a1a6d2028d8a154", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYWqLjlfYLBFnj1gnkRAkzSOhbLUq\nZfIw+1VKexEMNaW7RmZgvlyrPktYfBK0W9mYvVbH1mwvlNA6Gm0gKNihVA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 164, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c706fef0ef15d1688e15e704c4e6bb8bb7f40d52d3af5c661bb78c4ed9b408699b3", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "YWqLjlfYLBFnj1gnkRAkzSOhbLUqZfIw-1VKexEMNaU", + "y": "u0ZmYL5cqz5LWHwStFvZmL1Wx9ZsL5TQOhptICjYoVQ", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0471dc92b2b1baa7612c4a53427a0d2dfe548fa9cf829bb6b248f736a5eb30b513f91c7dff1144cb36057c2b859f35bd666a7961833b06de0f45159fbae208e326", + "wx": "71dc92b2b1baa7612c4a53427a0d2dfe548fa9cf829bb6b248f736a5eb30b513", + "wy": "00f91c7dff1144cb36057c2b859f35bd666a7961833b06de0f45159fbae208e326" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000471dc92b2b1baa7612c4a53427a0d2dfe548fa9cf829bb6b248f736a5eb30b513f91c7dff1144cb36057c2b859f35bd666a7961833b06de0f45159fbae208e326", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcdySsrG6p2EsSlNCeg0t/lSPqc+C\nm7aySPc2peswtRP5HH3/EUTLNgV8K4WfNb1manlhgzsG3g9FFZ+64gjjJg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 165, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c706f44275e9aeb1331efcb8d58f35c0252791427e403ad84daad51d247cc2a64c6", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "cdySsrG6p2EsSlNCeg0t_lSPqc-Cm7aySPc2peswtRM", + "y": "-Rx9_xFEyzYFfCuFnzW9Zmp5YYM7Bt4PRRWfuuII4yY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04662f43ae614bd9c90ff3fcded25cf0ef186b6967a47aa6aa7ae7f396594df931f5f94a525edd50d3738f7a28d03d7a2a70095c8f89de9bb2c645fea8d8bac9e0", + "wx": "662f43ae614bd9c90ff3fcded25cf0ef186b6967a47aa6aa7ae7f396594df931", + "wy": "00f5f94a525edd50d3738f7a28d03d7a2a70095c8f89de9bb2c645fea8d8bac9e0" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004662f43ae614bd9c90ff3fcded25cf0ef186b6967a47aa6aa7ae7f396594df931f5f94a525edd50d3738f7a28d03d7a2a70095c8f89de9bb2c645fea8d8bac9e0", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZi9DrmFL2ckP8/ze0lzw7xhraWek\neqaqeufzlllN+TH1+UpSXt1Q03OPeijQPXoqcAlcj4nem7LGRf6o2LrJ4A==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 166, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c7021323755b103d2f9da6ab83eccab9ad8598bcf625652f10e7a3eeee3c3945fb3", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "Zi9DrmFL2ckP8_ze0lzw7xhraWekeqaqeufzlllN-TE", + "y": "9flKUl7dUNNzj3oo0D16KnAJXI-J3puyxkX-qNi6yeA", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04dff107959bd2f7386497a5624430a0ab35e552c1a4e4dc9c298caeb96353170dcb5065d7947a676c76287ca8e430324f8a534b0ba6f21200e033c4b88852a3cc", + "wx": "00dff107959bd2f7386497a5624430a0ab35e552c1a4e4dc9c298caeb96353170d", + "wy": "00cb5065d7947a676c76287ca8e430324f8a534b0ba6f21200e033c4b88852a3cc" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004dff107959bd2f7386497a5624430a0ab35e552c1a4e4dc9c298caeb96353170dcb5065d7947a676c76287ca8e430324f8a534b0ba6f21200e033c4b88852a3cc", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3/EHlZvS9zhkl6ViRDCgqzXlUsGk\n5NycKYyuuWNTFw3LUGXXlHpnbHYofKjkMDJPilNLC6byEgDgM8S4iFKjzA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 167, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c706c50acfe76de1289e7a5edb240f1c2a7879db6873d5d931f3c6ac467a6eac171", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "3_EHlZvS9zhkl6ViRDCgqzXlUsGk5NycKYyuuWNTFw0", + "y": "y1Bl15R6Z2x2KHyo5DAyT4pTSwum8hIA4DPEuIhSo8w", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04bd0862b0bfba85036922e06f5458754aafc3075b603a814b3ac75659bf24d7528258a607ffca2cfe05a300cb4c3c4e1963bbb1bc54d320e16969f85aad243385", + "wx": "00bd0862b0bfba85036922e06f5458754aafc3075b603a814b3ac75659bf24d752", + "wy": "008258a607ffca2cfe05a300cb4c3c4e1963bbb1bc54d320e16969f85aad243385" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004bd0862b0bfba85036922e06f5458754aafc3075b603a814b3ac75659bf24d7528258a607ffca2cfe05a300cb4c3c4e1963bbb1bc54d320e16969f85aad243385", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvQhisL+6hQNpIuBvVFh1Sq/DB1tg\nOoFLOsdWWb8k11KCWKYH/8os/gWjAMtMPE4ZY7uxvFTTIOFpafharSQzhQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 168, + "comment": "edge case modular inverse", + "flags": [ + "ModularInverse", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70755b7fffb0b17ad57dca50fcefb7fe297b029df25e5ccb5069e8e70c2742c2a6", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "vQhisL-6hQNpIuBvVFh1Sq_DB1tgOoFLOsdWWb8k11I", + "y": "glimB__KLP4FowDLTDxOGWO7sbxU0yDhaWn4Wq0kM4U", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04b533d4695dd5b8c5e07757e55e6e516f7e2c88fa0239e23f60e8ec07dd70f2871b134ee58cc583278456863f33c3a85d881f7d4a39850143e29d4eaf009afe47", + "wx": "00b533d4695dd5b8c5e07757e55e6e516f7e2c88fa0239e23f60e8ec07dd70f287", + "wy": "1b134ee58cc583278456863f33c3a85d881f7d4a39850143e29d4eaf009afe47" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004b533d4695dd5b8c5e07757e55e6e516f7e2c88fa0239e23f60e8ec07dd70f2871b134ee58cc583278456863f33c3a85d881f7d4a39850143e29d4eaf009afe47", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEtTPUaV3VuMXgd1flXm5Rb34siPoC\nOeI/YOjsB91w8ocbE07ljMWDJ4RWhj8zw6hdiB99SjmFAUPinU6vAJr+Rw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 169, + "comment": "point at infinity during verify", + "flags": [ + "PointDuplication", + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8555555550000000055555555555555553ef7a8e48d07df81a693439654210c70", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "tTPUaV3VuMXgd1flXm5Rb34siPoCOeI_YOjsB91w8oc", + "y": "GxNO5YzFgyeEVoY_M8OoXYgffUo5hQFD4p1OrwCa_kc", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04f50d371b91bfb1d7d14e1323523bc3aa8cbf2c57f9e284de628c8b4536787b86f94ad887ac94d527247cd2e7d0c8b1291c553c9730405380b14cbb209f5fa2dd", + "wx": "00f50d371b91bfb1d7d14e1323523bc3aa8cbf2c57f9e284de628c8b4536787b86", + "wy": "00f94ad887ac94d527247cd2e7d0c8b1291c553c9730405380b14cbb209f5fa2dd" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004f50d371b91bfb1d7d14e1323523bc3aa8cbf2c57f9e284de628c8b4536787b86f94ad887ac94d527247cd2e7d0c8b1291c553c9730405380b14cbb209f5fa2dd", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9Q03G5G/sdfRThMjUjvDqoy/LFf5\n4oTeYoyLRTZ4e4b5StiHrJTVJyR80ufQyLEpHFU8lzBAU4CxTLsgn1+i3Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 170, + "comment": "edge case for signature malleability", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "9Q03G5G_sdfRThMjUjvDqoy_LFf54oTeYoyLRTZ4e4Y", + "y": "-UrYh6yU1SckfNLn0MixKRxVPJcwQFOAsUy7IJ9fot0", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0468ec6e298eafe16539156ce57a14b04a7047c221bafc3a582eaeb0d857c4d94697bed1af17850117fdb39b2324f220a5698ed16c426a27335bb385ac8ca6fb30", + "wx": "68ec6e298eafe16539156ce57a14b04a7047c221bafc3a582eaeb0d857c4d946", + "wy": "0097bed1af17850117fdb39b2324f220a5698ed16c426a27335bb385ac8ca6fb30" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000468ec6e298eafe16539156ce57a14b04a7047c221bafc3a582eaeb0d857c4d94697bed1af17850117fdb39b2324f220a5698ed16c426a27335bb385ac8ca6fb30", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaOxuKY6v4WU5FWzlehSwSnBHwiG6\n/DpYLq6w2FfE2UaXvtGvF4UBF/2zmyMk8iClaY7RbEJqJzNbs4WsjKb7MA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 171, + "comment": "edge case for signature malleability", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a97fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a9", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "aOxuKY6v4WU5FWzlehSwSnBHwiG6_DpYLq6w2FfE2UY", + "y": "l77RrxeFARf9s5sjJPIgpWmO0WxCaiczW7OFrIym-zA", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0469da0364734d2e530fece94019265fefb781a0f1b08f6c8897bdf6557927c8b866d2d3c7dcd518b23d726960f069ad71a933d86ef8abbcce8b20f71e2a847002", + "wx": "69da0364734d2e530fece94019265fefb781a0f1b08f6c8897bdf6557927c8b8", + "wy": "66d2d3c7dcd518b23d726960f069ad71a933d86ef8abbcce8b20f71e2a847002" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000469da0364734d2e530fece94019265fefb781a0f1b08f6c8897bdf6557927c8b866d2d3c7dcd518b23d726960f069ad71a933d86ef8abbcce8b20f71e2a847002", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEadoDZHNNLlMP7OlAGSZf77eBoPGw\nj2yIl732VXknyLhm0tPH3NUYsj1yaWDwaa1xqTPYbvirvM6LIPceKoRwAg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 172, + "comment": "u1 == 1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "adoDZHNNLlMP7OlAGSZf77eBoPGwj2yIl732VXknyLg", + "y": "ZtLTx9zVGLI9cmlg8Gmtcakz2G74q7zOiyD3HiqEcAI", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d8adc00023a8edc02576e2b63e3e30621a471e2b2320620187bf067a1ac1ff3233e2b50ec09807accb36131fff95ed12a09a86b4ea9690aa32861576ba2362e1", + "wx": "00d8adc00023a8edc02576e2b63e3e30621a471e2b2320620187bf067a1ac1ff32", + "wy": "33e2b50ec09807accb36131fff95ed12a09a86b4ea9690aa32861576ba2362e1" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d8adc00023a8edc02576e2b63e3e30621a471e2b2320620187bf067a1ac1ff3233e2b50ec09807accb36131fff95ed12a09a86b4ea9690aa32861576ba2362e1", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2K3AACOo7cAlduK2Pj4wYhpHHisj\nIGIBh78GehrB/zIz4rUOwJgHrMs2Ex//le0SoJqGtOqWkKoyhhV2uiNi4Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 173, + "comment": "u1 == n - 1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c7044a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "2K3AACOo7cAlduK2Pj4wYhpHHisjIGIBh78GehrB_zI", + "y": "M-K1DsCYB6zLNhMf_5XtEqCahrTqlpCqMoYVdrojYuE", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "043623ac973ced0a56fa6d882f03a7d5c7edca02cfc7b2401fab3690dbe75ab7858db06908e64b28613da7257e737f39793da8e713ba0643b92e9bb3252be7f8fe", + "wx": "3623ac973ced0a56fa6d882f03a7d5c7edca02cfc7b2401fab3690dbe75ab785", + "wy": "008db06908e64b28613da7257e737f39793da8e713ba0643b92e9bb3252be7f8fe" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200043623ac973ced0a56fa6d882f03a7d5c7edca02cfc7b2401fab3690dbe75ab7858db06908e64b28613da7257e737f39793da8e713ba0643b92e9bb3252be7f8fe", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENiOslzztClb6bYgvA6fVx+3KAs/H\nskAfqzaQ2+dat4WNsGkI5ksoYT2nJX5zfzl5PajnE7oGQ7kum7MlK+f4/g==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 174, + "comment": "u2 == 1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70555555550000000055555555555555553ef7a8e48d07df81a693439654210c70", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "NiOslzztClb6bYgvA6fVx-3KAs_HskAfqzaQ2-dat4U", + "y": "jbBpCOZLKGE9pyV-c385eT2o5xO6BkO5LpuzJSvn-P4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04cf04ea77e9622523d894b93ff52dc3027b31959503b6fa3890e5e04263f922f1e8528fb7c006b3983c8b8400e57b4ed71740c2f3975438821199bedeaecab2e9", + "wx": "00cf04ea77e9622523d894b93ff52dc3027b31959503b6fa3890e5e04263f922f1", + "wy": "00e8528fb7c006b3983c8b8400e57b4ed71740c2f3975438821199bedeaecab2e9" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004cf04ea77e9622523d894b93ff52dc3027b31959503b6fa3890e5e04263f922f1e8528fb7c006b3983c8b8400e57b4ed71740c2f3975438821199bedeaecab2e9", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzwTqd+liJSPYlLk/9S3DAnsxlZUD\ntvo4kOXgQmP5IvHoUo+3wAazmDyLhADle07XF0DC85dUOIIRmb7ersqy6Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 175, + "comment": "u2 == n - 1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c70aaaaaaaa00000000aaaaaaaaaaaaaaaa7def51c91a0fbf034d26872ca84218e1", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "zwTqd-liJSPYlLk_9S3DAnsxlZUDtvo4kOXgQmP5IvE", + "y": "6FKPt8AGs5g8i4QA5XtO1xdAwvOXVDiCEZm-3q7Ksuk", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04db7a2c8a1ab573e5929dc24077b508d7e683d49227996bda3e9f78dbeff773504f417f3bc9a88075c2e0aadd5a13311730cf7cc76a82f11a36eaf08a6c99a206", + "wx": "00db7a2c8a1ab573e5929dc24077b508d7e683d49227996bda3e9f78dbeff77350", + "wy": "4f417f3bc9a88075c2e0aadd5a13311730cf7cc76a82f11a36eaf08a6c99a206" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004db7a2c8a1ab573e5929dc24077b508d7e683d49227996bda3e9f78dbeff773504f417f3bc9a88075c2e0aadd5a13311730cf7cc76a82f11a36eaf08a6c99a206", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE23osihq1c+WSncJAd7UI1+aD1JIn\nmWvaPp942+/3c1BPQX87yaiAdcLgqt1aEzEXMM98x2qC8Ro26vCKbJmiBg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 176, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffde91e1ba60fdedb76a46bcb51dc0b8b4b7e019f0a28721885fa5d3a8196623397", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "23osihq1c-WSncJAd7UI1-aD1JInmWvaPp942-_3c1A", + "y": "T0F_O8mogHXC4KrdWhMxFzDPfMdqgvEaNurwimyZogY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04dead11c7a5b396862f21974dc4752fadeff994efe9bbd05ab413765ea80b6e1f1de3f0640e8ac6edcf89cff53c40e265bb94078a343736df07aa0318fc7fe1ff", + "wx": "00dead11c7a5b396862f21974dc4752fadeff994efe9bbd05ab413765ea80b6e1f", + "wy": "1de3f0640e8ac6edcf89cff53c40e265bb94078a343736df07aa0318fc7fe1ff" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004dead11c7a5b396862f21974dc4752fadeff994efe9bbd05ab413765ea80b6e1f1de3f0640e8ac6edcf89cff53c40e265bb94078a343736df07aa0318fc7fe1ff", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3q0Rx6WzloYvIZdNxHUvre/5lO/p\nu9BatBN2XqgLbh8d4/BkDorG7c+Jz/U8QOJlu5QHijQ3Nt8HqgMY/H/h/w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 177, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdfdea5843ffeb73af94313ba4831b53fe24f799e525b1e8e8c87b59b95b430ad9", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "3q0Rx6WzloYvIZdNxHUvre_5lO_pu9BatBN2XqgLbh8", + "y": "HePwZA6Kxu3Pic_1PEDiZbuUB4o0NzbfB6oDGPx_4f8", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d0bc472e0d7c81ebaed3a6ef96c18613bb1fea6f994326fbe80e00dfde67c7e9986c723ea4843d48389b946f64ad56c83ad70ff17ba85335667d1bb9fa619efd", + "wx": "00d0bc472e0d7c81ebaed3a6ef96c18613bb1fea6f994326fbe80e00dfde67c7e9", + "wy": "00986c723ea4843d48389b946f64ad56c83ad70ff17ba85335667d1bb9fa619efd" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d0bc472e0d7c81ebaed3a6ef96c18613bb1fea6f994326fbe80e00dfde67c7e9986c723ea4843d48389b946f64ad56c83ad70ff17ba85335667d1bb9fa619efd", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0LxHLg18geuu06bvlsGGE7sf6m+Z\nQyb76A4A395nx+mYbHI+pIQ9SDiblG9krVbIOtcP8XuoUzVmfRu5+mGe/Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 178, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd03ffcabf2f1b4d2a65190db1680d62bb994e41c5251cd73b3c3dfc5e5bafc035", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "0LxHLg18geuu06bvlsGGE7sf6m-ZQyb76A4A395nx-k", + "y": "mGxyPqSEPUg4m5RvZK1WyDrXD_F7qFM1Zn0bufphnv0", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04a0a44ca947d66a2acb736008b9c08d1ab2ad03776e02640f78495d458dd51c326337fe5cf8c4604b1f1c409dc2d872d4294a4762420df43a30a2392e40426add", + "wx": "00a0a44ca947d66a2acb736008b9c08d1ab2ad03776e02640f78495d458dd51c32", + "wy": "6337fe5cf8c4604b1f1c409dc2d872d4294a4762420df43a30a2392e40426add" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004a0a44ca947d66a2acb736008b9c08d1ab2ad03776e02640f78495d458dd51c326337fe5cf8c4604b1f1c409dc2d872d4294a4762420df43a30a2392e40426add", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoKRMqUfWairLc2AIucCNGrKtA3du\nAmQPeEldRY3VHDJjN/5c+MRgSx8cQJ3C2HLUKUpHYkIN9DowojkuQEJq3Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 179, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd4dfbc401f971cd304b33dfdb17d0fed0fe4c1a88ae648e0d2847f74977534989", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "oKRMqUfWairLc2AIucCNGrKtA3duAmQPeEldRY3VHDI", + "y": "Yzf-XPjEYEsfHECdwthy1ClKR2JCDfQ6MKI5LkBCat0", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04c9c2115290d008b45fb65fad0f602389298c25420b775019d42b62c3ce8a96b73877d25a8080dc02d987ca730f0405c2c9dbefac46f9e601cc3f06e9713973fd", + "wx": "00c9c2115290d008b45fb65fad0f602389298c25420b775019d42b62c3ce8a96b7", + "wy": "3877d25a8080dc02d987ca730f0405c2c9dbefac46f9e601cc3f06e9713973fd" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004c9c2115290d008b45fb65fad0f602389298c25420b775019d42b62c3ce8a96b73877d25a8080dc02d987ca730f0405c2c9dbefac46f9e601cc3f06e9713973fd", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEycIRUpDQCLRftl+tD2AjiSmMJUIL\nd1AZ1Ctiw86Klrc4d9JagIDcAtmHynMPBAXCydvvrEb55gHMPwbpcTlz/Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 180, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbc4024761cd2ffd43dfdb17d0fed112b988977055cd3a8e54971eba9cda5ca71", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "ycIRUpDQCLRftl-tD2AjiSmMJUILd1AZ1Ctiw86Klrc", + "y": "OHfSWoCA3ALZh8pzDwQFwsnb76xG-eYBzD8G6XE5c_0", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045eca1ef4c287dddc66b8bccf1b88e8a24c0018962f3c5e7efa83bc1a5ff6033e5e79c4cb2c245b8c45abdce8a8e4da758d92a607c32cd407ecaef22f1c934a71", + "wx": "5eca1ef4c287dddc66b8bccf1b88e8a24c0018962f3c5e7efa83bc1a5ff6033e", + "wy": "5e79c4cb2c245b8c45abdce8a8e4da758d92a607c32cd407ecaef22f1c934a71" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045eca1ef4c287dddc66b8bccf1b88e8a24c0018962f3c5e7efa83bc1a5ff6033e5e79c4cb2c245b8c45abdce8a8e4da758d92a607c32cd407ecaef22f1c934a71", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXsoe9MKH3dxmuLzPG4jookwAGJYv\nPF5++oO8Gl/2Az5eecTLLCRbjEWr3Oio5Np1jZKmB8Ms1AfsrvIvHJNKcQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 181, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd788048ed39a5ffa77bfb62fa1fda2257742bf35d128fb3459f2a0c909ee86f91", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "Xsoe9MKH3dxmuLzPG4jookwAGJYvPF5--oO8Gl_2Az4", + "y": "XnnEyywkW4xFq9zoqOTadY2SpgfDLNQH7K7yLxyTSnE", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045caaa030e7fdf0e4936bc7ab5a96353e0a01e4130c3f8bf22d473e317029a47adeb6adc462f7058f2a20d371e9702254e9b201642005b3ceda926b42b178bef9", + "wx": "5caaa030e7fdf0e4936bc7ab5a96353e0a01e4130c3f8bf22d473e317029a47a", + "wy": "00deb6adc462f7058f2a20d371e9702254e9b201642005b3ceda926b42b178bef9" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045caaa030e7fdf0e4936bc7ab5a96353e0a01e4130c3f8bf22d473e317029a47adeb6adc462f7058f2a20d371e9702254e9b201642005b3ceda926b42b178bef9", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXKqgMOf98OSTa8erWpY1PgoB5BMM\nP4vyLUc+MXAppHretq3EYvcFjyog03HpcCJU6bIBZCAFs87akmtCsXi++Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 182, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd476d9131fd381bd917d0fed112bc9e0a5924b5ed5b11167edd8b23582b3cb15e", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "XKqgMOf98OSTa8erWpY1PgoB5BMMP4vyLUc-MXAppHo", + "y": "3ratxGL3BY8qINNx6XAiVOmyAWQgBbPO2pJrQrF4vvk", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04c2fd20bac06e555bb8ac0ce69eb1ea20f83a1fc3501c8a66469b1a31f619b0986237050779f52b615bd7b8d76a25fc95ca2ed32525c75f27ffc87ac397e6cbaf", + "wx": "00c2fd20bac06e555bb8ac0ce69eb1ea20f83a1fc3501c8a66469b1a31f619b098", + "wy": "6237050779f52b615bd7b8d76a25fc95ca2ed32525c75f27ffc87ac397e6cbaf" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004c2fd20bac06e555bb8ac0ce69eb1ea20f83a1fc3501c8a66469b1a31f619b0986237050779f52b615bd7b8d76a25fc95ca2ed32525c75f27ffc87ac397e6cbaf", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwv0gusBuVVu4rAzmnrHqIPg6H8NQ\nHIpmRpsaMfYZsJhiNwUHefUrYVvXuNdqJfyVyi7TJSXHXyf/yHrDl+bLrw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 183, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd8374253e3e21bd154448d0a8f640fe46fafa8b19ce78d538f6cc0a19662d3601", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "wv0gusBuVVu4rAzmnrHqIPg6H8NQHIpmRpsaMfYZsJg", + "y": "YjcFB3n1K2Fb17jXaiX8lcou0yUlx18n_8h6w5fmy68", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "043fd6a1ca7f77fb3b0bbe726c372010068426e11ea6ae78ce17bedae4bba86ced03ce5516406bf8cfaab8745eac1cd69018ad6f50b5461872ddfc56e0db3c8ff4", + "wx": "3fd6a1ca7f77fb3b0bbe726c372010068426e11ea6ae78ce17bedae4bba86ced", + "wy": "03ce5516406bf8cfaab8745eac1cd69018ad6f50b5461872ddfc56e0db3c8ff4" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200043fd6a1ca7f77fb3b0bbe726c372010068426e11ea6ae78ce17bedae4bba86ced03ce5516406bf8cfaab8745eac1cd69018ad6f50b5461872ddfc56e0db3c8ff4", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEP9ahyn93+zsLvnJsNyAQBoQm4R6m\nrnjOF77a5LuobO0DzlUWQGv4z6q4dF6sHNaQGK1vULVGGHLd/Fbg2zyP9A==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 184, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd357cfd3be4d01d413c5b9ede36cba5452c11ee7fe14879e749ae6a2d897a52d6", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "P9ahyn93-zsLvnJsNyAQBoQm4R6mrnjOF77a5LuobO0", + "y": "A85VFkBr-M-quHRerBzWkBitb1C1Rhhy3fxW4Ns8j_Q", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "049cb8e51e27a5ae3b624a60d6dc32734e4989db20e9bca3ede1edf7b086911114b4c104ab3c677e4b36d6556e8ad5f523410a19f2e277aa895fc57322b4427544", + "wx": "009cb8e51e27a5ae3b624a60d6dc32734e4989db20e9bca3ede1edf7b086911114", + "wy": "00b4c104ab3c677e4b36d6556e8ad5f523410a19f2e277aa895fc57322b4427544" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200049cb8e51e27a5ae3b624a60d6dc32734e4989db20e9bca3ede1edf7b086911114b4c104ab3c677e4b36d6556e8ad5f523410a19f2e277aa895fc57322b4427544", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnLjlHielrjtiSmDW3DJzTkmJ2yDp\nvKPt4e33sIaRERS0wQSrPGd+SzbWVW6K1fUjQQoZ8uJ3qolfxXMitEJ1RA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 185, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd29798c5c0ee287d4a5e8e6b799fd86b8df5225298e6ffc807cd2f2bc27a0a6d8", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "nLjlHielrjtiSmDW3DJzTkmJ2yDpvKPt4e33sIaRERQ", + "y": "tMEEqzxnfks21lVuitX1I0EKGfLid6qJX8VzIrRCdUQ", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04a3e52c156dcaf10502620b7955bc2b40bc78ef3d569e1223c262512d8f49602a4a2039f31c1097024ad3cc86e57321de032355463486164cf192944977df147f", + "wx": "00a3e52c156dcaf10502620b7955bc2b40bc78ef3d569e1223c262512d8f49602a", + "wy": "4a2039f31c1097024ad3cc86e57321de032355463486164cf192944977df147f" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004a3e52c156dcaf10502620b7955bc2b40bc78ef3d569e1223c262512d8f49602a4a2039f31c1097024ad3cc86e57321de032355463486164cf192944977df147f", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEo+UsFW3K8QUCYgt5VbwrQLx47z1W\nnhIjwmJRLY9JYCpKIDnzHBCXAkrTzIblcyHeAyNVRjSGFkzxkpRJd98Ufw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 186, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd0b70f22c781092452dca1a5711fa3a5a1f72add1bf52c2ff7cae4820b30078dd", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "o-UsFW3K8QUCYgt5VbwrQLx47z1WnhIjwmJRLY9JYCo", + "y": "SiA58xwQlwJK08yG5XMh3gMjVUY0hhZM8ZKUSXffFH8", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04f19b78928720d5bee8e670fb90010fb15c37bf91b58a5157c3f3c059b2655e88cf701ec962fb4a11dcf273f5dc357e58468560c7cfeb942d074abd4329260509", + "wx": "00f19b78928720d5bee8e670fb90010fb15c37bf91b58a5157c3f3c059b2655e88", + "wy": "00cf701ec962fb4a11dcf273f5dc357e58468560c7cfeb942d074abd4329260509" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004f19b78928720d5bee8e670fb90010fb15c37bf91b58a5157c3f3c059b2655e88cf701ec962fb4a11dcf273f5dc357e58468560c7cfeb942d074abd4329260509", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8Zt4kocg1b7o5nD7kAEPsVw3v5G1\nilFXw/PAWbJlXojPcB7JYvtKEdzyc/XcNX5YRoVgx8/rlC0HSr1DKSYFCQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 187, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd16e1e458f021248a5b9434ae23f474b43ee55ba37ea585fef95c90416600f1ba", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "8Zt4kocg1b7o5nD7kAEPsVw3v5G1ilFXw_PAWbJlXog", + "y": "z3AeyWL7ShHc8nP13DV-WEaFYMfP65QtB0q9QykmBQk", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0483a744459ecdfb01a5cf52b27a05bb7337482d242f235d7b4cb89345545c90a8c05d49337b9649813287de9ffe90355fd905df5f3c32945828121f37cc50de6e", + "wx": "0083a744459ecdfb01a5cf52b27a05bb7337482d242f235d7b4cb89345545c90a8", + "wy": "00c05d49337b9649813287de9ffe90355fd905df5f3c32945828121f37cc50de6e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000483a744459ecdfb01a5cf52b27a05bb7337482d242f235d7b4cb89345545c90a8c05d49337b9649813287de9ffe90355fd905df5f3c32945828121f37cc50de6e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEg6dERZ7N+wGlz1KyegW7czdILSQv\nI117TLiTRVRckKjAXUkze5ZJgTKH3p/+kDVf2QXfXzwylFgoEh83zFDebg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 188, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd2252d6856831b6cf895e4f0535eeaf0e5e5809753df848fe760ad86219016a97", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "g6dERZ7N-wGlz1KyegW7czdILSQvI117TLiTRVRckKg", + "y": "wF1JM3uWSYEyh96f_pA1X9kF3188MpRYKBIfN8xQ3m4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04dd13c6b34c56982ddae124f039dfd23f4b19bbe88cee8e528ae51e5d6f3a21d7bfad4c2e6f263fe5eb59ca974d039fc0e4c3345692fb5320bdae4bd3b42a45ff", + "wx": "00dd13c6b34c56982ddae124f039dfd23f4b19bbe88cee8e528ae51e5d6f3a21d7", + "wy": "00bfad4c2e6f263fe5eb59ca974d039fc0e4c3345692fb5320bdae4bd3b42a45ff" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004dd13c6b34c56982ddae124f039dfd23f4b19bbe88cee8e528ae51e5d6f3a21d7bfad4c2e6f263fe5eb59ca974d039fc0e4c3345692fb5320bdae4bd3b42a45ff", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3RPGs0xWmC3a4STwOd/SP0sZu+iM\n7o5SiuUeXW86Ide/rUwubyY/5etZypdNA5/A5MM0VpL7UyC9rkvTtCpF/w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 189, + "comment": "edge case for u1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd81ffe55f178da695b28c86d8b406b15dab1a9e39661a3ae017fbe390ac0972c3", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "3RPGs0xWmC3a4STwOd_SP0sZu-iM7o5SiuUeXW86Idc", + "y": "v61MLm8mP-XrWcqXTQOfwOTDNFaS-1Mgva5L07QqRf8", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0467e6f659cdde869a2f65f094e94e5b4dfad636bbf95192feeed01b0f3deb7460a37e0a51f258b7aeb51dfe592f5cfd5685bbe58712c8d9233c62886437c38ba0", + "wx": "67e6f659cdde869a2f65f094e94e5b4dfad636bbf95192feeed01b0f3deb7460", + "wy": "00a37e0a51f258b7aeb51dfe592f5cfd5685bbe58712c8d9233c62886437c38ba0" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000467e6f659cdde869a2f65f094e94e5b4dfad636bbf95192feeed01b0f3deb7460a37e0a51f258b7aeb51dfe592f5cfd5685bbe58712c8d9233c62886437c38ba0", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZ+b2Wc3ehpovZfCU6U5bTfrWNrv5\nUZL+7tAbDz3rdGCjfgpR8li3rrUd/lkvXP1WhbvlhxLI2SM8YohkN8OLoA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 190, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffffaaaaaaaaffffffffffffffffe9a2538f37b28a2c513dee40fecbb71a", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "Z-b2Wc3ehpovZfCU6U5bTfrWNrv5UZL-7tAbDz3rdGA", + "y": "o34KUfJYt661Hf5ZL1z9VoW75YcSyNkjPGKIZDfDi6A", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "042eb6412505aec05c6545f029932087e490d05511e8ec1f599617bb367f9ecaaf805f51efcc4803403f9b1ae0124890f06a43fedcddb31830f6669af292895cb0", + "wx": "2eb6412505aec05c6545f029932087e490d05511e8ec1f599617bb367f9ecaaf", + "wy": "00805f51efcc4803403f9b1ae0124890f06a43fedcddb31830f6669af292895cb0" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200042eb6412505aec05c6545f029932087e490d05511e8ec1f599617bb367f9ecaaf805f51efcc4803403f9b1ae0124890f06a43fedcddb31830f6669af292895cb0", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELrZBJQWuwFxlRfApkyCH5JDQVRHo\n7B9Zlhe7Nn+eyq+AX1HvzEgDQD+bGuASSJDwakP+3N2zGDD2ZprykolcsA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 191, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdb62f26b5f2a2b26f6de86d42ad8a13da3ab3cccd0459b201de009e526adf21f2", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "LrZBJQWuwFxlRfApkyCH5JDQVRHo7B9Zlhe7Nn-eyq8", + "y": "gF9R78xIA0A_mxrgEkiQ8GpD_tzdsxgw9maa8pKJXLA", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0484db645868eab35e3a9fd80e056e2e855435e3a6b68d75a50a854625fe0d7f356d2589ac655edc9a11ef3e075eddda9abf92e72171570ef7bf43a2ee39338cfe", + "wx": "0084db645868eab35e3a9fd80e056e2e855435e3a6b68d75a50a854625fe0d7f35", + "wy": "6d2589ac655edc9a11ef3e075eddda9abf92e72171570ef7bf43a2ee39338cfe" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000484db645868eab35e3a9fd80e056e2e855435e3a6b68d75a50a854625fe0d7f356d2589ac655edc9a11ef3e075eddda9abf92e72171570ef7bf43a2ee39338cfe", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhNtkWGjqs146n9gOBW4uhVQ146a2\njXWlCoVGJf4NfzVtJYmsZV7cmhHvPgde3dqav5LnIXFXDve/Q6LuOTOM/g==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 192, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbb1d9ac949dd748cd02bbbe749bd351cd57b38bb61403d700686aa7b4c90851e", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "hNtkWGjqs146n9gOBW4uhVQ146a2jXWlCoVGJf4NfzU", + "y": "bSWJrGVe3JoR7z4HXt3amr-S5yFxVw73v0Oi7jkzjP4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0491b9e47c56278662d75c0983b22ca8ea6aa5059b7a2ff7637eb2975e386ad66349aa8ff283d0f77c18d6d11dc062165fd13c3c0310679c1408302a16854ecfbd", + "wx": "0091b9e47c56278662d75c0983b22ca8ea6aa5059b7a2ff7637eb2975e386ad663", + "wy": "49aa8ff283d0f77c18d6d11dc062165fd13c3c0310679c1408302a16854ecfbd" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000491b9e47c56278662d75c0983b22ca8ea6aa5059b7a2ff7637eb2975e386ad66349aa8ff283d0f77c18d6d11dc062165fd13c3c0310679c1408302a16854ecfbd", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkbnkfFYnhmLXXAmDsiyo6mqlBZt6\nL/djfrKXXjhq1mNJqo/yg9D3fBjW0R3AYhZf0Tw8AxBnnBQIMCoWhU7PvQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 193, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd66755a00638cdaec1c732513ca0234ece52545dac11f816e818f725b4f60aaf2", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "kbnkfFYnhmLXXAmDsiyo6mqlBZt6L_djfrKXXjhq1mM", + "y": "SaqP8oPQ93wY1tEdwGIWX9E8PAMQZ5wUCDAqFoVOz70", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04f3ec2f13caf04d0192b47fb4c5311fb6d4dc6b0a9e802e5327f7ec5ee8e4834df97e3e468b7d0db867d6ecfe81e2b0f9531df87efdb47c1338ac321fefe5a432", + "wx": "00f3ec2f13caf04d0192b47fb4c5311fb6d4dc6b0a9e802e5327f7ec5ee8e4834d", + "wy": "00f97e3e468b7d0db867d6ecfe81e2b0f9531df87efdb47c1338ac321fefe5a432" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004f3ec2f13caf04d0192b47fb4c5311fb6d4dc6b0a9e802e5327f7ec5ee8e4834df97e3e468b7d0db867d6ecfe81e2b0f9531df87efdb47c1338ac321fefe5a432", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8+wvE8rwTQGStH+0xTEfttTcawqe\ngC5TJ/fsXujkg035fj5Gi30NuGfW7P6B4rD5Ux34fv20fBM4rDIf7+WkMg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 194, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd55a00c9fcdaebb6032513ca0234ecfffe98ebe492fdf02e48ca48e982beb3669", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "8-wvE8rwTQGStH-0xTEfttTcawqegC5TJ_fsXujkg00", + "y": "-X4-Rot9Dbhn1uz-geKw-VMd-H79tHwTOKwyH-_lpDI", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d92b200aefcab6ac7dafd9acaf2fa10b3180235b8f46b4503e4693c670fccc885ef2f3aebf5b317475336256768f7c19efb7352d27e4cccadc85b6b8ab922c72", + "wx": "00d92b200aefcab6ac7dafd9acaf2fa10b3180235b8f46b4503e4693c670fccc88", + "wy": "5ef2f3aebf5b317475336256768f7c19efb7352d27e4cccadc85b6b8ab922c72" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d92b200aefcab6ac7dafd9acaf2fa10b3180235b8f46b4503e4693c670fccc885ef2f3aebf5b317475336256768f7c19efb7352d27e4cccadc85b6b8ab922c72", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2SsgCu/Ktqx9r9msry+hCzGAI1uP\nRrRQPkaTxnD8zIhe8vOuv1sxdHUzYlZ2j3wZ77c1LSfkzMrchba4q5Iscg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 195, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdab40193f9b5d76c064a27940469d9fffd31d7c925fbe05c919491d3057d66cd2", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "2SsgCu_Ktqx9r9msry-hCzGAI1uPRrRQPkaTxnD8zIg", + "y": "XvLzrr9bMXR1M2JWdo98Ge-3NS0n5MzK3IW2uKuSLHI", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "040a88361eb92ecca2625b38e5f98bbabb96bf179b3d76fc48140a3bcd881523cde6bdf56033f84a5054035597375d90866aa2c96b86a41ccf6edebf47298ad489", + "wx": "0a88361eb92ecca2625b38e5f98bbabb96bf179b3d76fc48140a3bcd881523cd", + "wy": "00e6bdf56033f84a5054035597375d90866aa2c96b86a41ccf6edebf47298ad489" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200040a88361eb92ecca2625b38e5f98bbabb96bf179b3d76fc48140a3bcd881523cde6bdf56033f84a5054035597375d90866aa2c96b86a41ccf6edebf47298ad489", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECog2HrkuzKJiWzjl+Yu6u5a/F5s9\ndvxIFAo7zYgVI83mvfVgM/hKUFQDVZc3XZCGaqLJa4akHM9u3r9HKYrUiQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 196, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdca0234ebb5fdcb13ca0234ecffffffffcb0dadbbc7f549f8a26b4408d0dc8600", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "Cog2HrkuzKJiWzjl-Yu6u5a_F5s9dvxIFAo7zYgVI80", + "y": "5r31YDP4SlBUA1WXN12QhmqiyWuGpBzPbt6_RymK1Ik", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d0fb17ccd8fafe827e0c1afc5d8d80366e2b20e7f14a563a2ba50469d84375e868612569d39e2bb9f554355564646de99ac602cc6349cf8c1e236a7de7637d93", + "wx": "00d0fb17ccd8fafe827e0c1afc5d8d80366e2b20e7f14a563a2ba50469d84375e8", + "wy": "68612569d39e2bb9f554355564646de99ac602cc6349cf8c1e236a7de7637d93" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d0fb17ccd8fafe827e0c1afc5d8d80366e2b20e7f14a563a2ba50469d84375e868612569d39e2bb9f554355564646de99ac602cc6349cf8c1e236a7de7637d93", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0PsXzNj6/oJ+DBr8XY2ANm4rIOfx\nSlY6K6UEadhDdehoYSVp054rufVUNVVkZG3pmsYCzGNJz4weI2p952N9kw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 197, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff3ea3677e082b9310572620ae19933a9e65b285598711c77298815ad3", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "0PsXzNj6_oJ-DBr8XY2ANm4rIOfxSlY6K6UEadhDdeg", + "y": "aGEladOeK7n1VDVVZGRt6ZrGAsxjSc-MHiNqfedjfZM", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04836f33bbc1dc0d3d3abbcef0d91f11e2ac4181076c9af0a22b1e4309d3edb2769ab443ff6f901e30c773867582997c2bec2b0cb8120d760236f3a95bbe881f75", + "wx": "00836f33bbc1dc0d3d3abbcef0d91f11e2ac4181076c9af0a22b1e4309d3edb276", + "wy": "009ab443ff6f901e30c773867582997c2bec2b0cb8120d760236f3a95bbe881f75" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004836f33bbc1dc0d3d3abbcef0d91f11e2ac4181076c9af0a22b1e4309d3edb2769ab443ff6f901e30c773867582997c2bec2b0cb8120d760236f3a95bbe881f75", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEg28zu8HcDT06u87w2R8R4qxBgQds\nmvCiKx5DCdPtsnaatEP/b5AeMMdzhnWCmXwr7CsMuBINdgI286lbvogfdQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 198, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd266666663bbbbbbbe6666666666666665b37902e023fab7c8f055d86e5cc41f4", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "g28zu8HcDT06u87w2R8R4qxBgQdsmvCiKx5DCdPtsnY", + "y": "mrRD_2-QHjDHc4Z1gpl8K-wrDLgSDXYCNvOpW76IH3U", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0492f99fbe973ed4a299719baee4b432741237034dec8d72ba5103cb33e55feeb8033dd0e91134c734174889f3ebcf1b7a1ac05767289280ee7a794cebd6e69697", + "wx": "0092f99fbe973ed4a299719baee4b432741237034dec8d72ba5103cb33e55feeb8", + "wy": "033dd0e91134c734174889f3ebcf1b7a1ac05767289280ee7a794cebd6e69697" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000492f99fbe973ed4a299719baee4b432741237034dec8d72ba5103cb33e55feeb8033dd0e91134c734174889f3ebcf1b7a1ac05767289280ee7a794cebd6e69697", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkvmfvpc+1KKZcZuu5LQydBI3A03s\njXK6UQPLM+Vf7rgDPdDpETTHNBdIifPrzxt6GsBXZyiSgO56eUzr1uaWlw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 199, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff36db6db7a492492492492492146c573f4c6dfc8d08a443e258970b09", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "kvmfvpc-1KKZcZuu5LQydBI3A03sjXK6UQPLM-Vf7rg", + "y": "Az3Q6RE0xzQXSInz688behrAV2cokoDuenlM69bmlpc", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d35ba58da30197d378e618ec0fa7e2e2d12cffd73ebbb2049d130bba434af09eff83986e6875e41ea432b7585a49b3a6c77cbb3c47919f8e82874c794635c1d2", + "wx": "00d35ba58da30197d378e618ec0fa7e2e2d12cffd73ebbb2049d130bba434af09e", + "wy": "00ff83986e6875e41ea432b7585a49b3a6c77cbb3c47919f8e82874c794635c1d2" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d35ba58da30197d378e618ec0fa7e2e2d12cffd73ebbb2049d130bba434af09eff83986e6875e41ea432b7585a49b3a6c77cbb3c47919f8e82874c794635c1d2", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE01uljaMBl9N45hjsD6fi4tEs/9c+\nu7IEnRMLukNK8J7/g5huaHXkHqQyt1haSbOmx3y7PEeRn46Ch0x5RjXB0g==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 200, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffdbfffffff2aaaaaab7fffffffffffffffc815d0e60b3e596ecb1ad3a27cfd49c4", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "01uljaMBl9N45hjsD6fi4tEs_9c-u7IEnRMLukNK8J4", + "y": "_4OYbmh15B6kMrdYWkmzpsd8uzxHkZ-OgodMeUY1wdI", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "048651ce490f1b46d73f3ff475149be29136697334a519d7ddab0725c8d0793224e11c65bd8ca92dc8bc9ae82911f0b52751ce21dd9003ae60900bd825f590cc28", + "wx": "008651ce490f1b46d73f3ff475149be29136697334a519d7ddab0725c8d0793224", + "wy": "00e11c65bd8ca92dc8bc9ae82911f0b52751ce21dd9003ae60900bd825f590cc28" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200048651ce490f1b46d73f3ff475149be29136697334a519d7ddab0725c8d0793224e11c65bd8ca92dc8bc9ae82911f0b52751ce21dd9003ae60900bd825f590cc28", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhlHOSQ8bRtc/P/R1FJvikTZpczSl\nGdfdqwclyNB5MiThHGW9jKktyLya6CkR8LUnUc4h3ZADrmCQC9gl9ZDMKA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 201, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd7fffffff55555555ffffffffffffffffd344a71e6f651458a27bdc81fd976e37", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "hlHOSQ8bRtc_P_R1FJvikTZpczSlGdfdqwclyNB5MiQ", + "y": "4RxlvYypLci8mugpEfC1J1HOId2QA65gkAvYJfWQzCg", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "046d8e1b12c831a0da8795650ff95f101ed921d9e2f72b15b1cdaca9826b9cfc6def6d63e2bc5c089570394a4bc9f892d5e6c7a6a637b20469a58c106ad486bf37", + "wx": "6d8e1b12c831a0da8795650ff95f101ed921d9e2f72b15b1cdaca9826b9cfc6d", + "wy": "00ef6d63e2bc5c089570394a4bc9f892d5e6c7a6a637b20469a58c106ad486bf37" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200046d8e1b12c831a0da8795650ff95f101ed921d9e2f72b15b1cdaca9826b9cfc6def6d63e2bc5c089570394a4bc9f892d5e6c7a6a637b20469a58c106ad486bf37", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbY4bEsgxoNqHlWUP+V8QHtkh2eL3\nKxWxzaypgmuc/G3vbWPivFwIlXA5SkvJ+JLV5sempjeyBGmljBBq1Ia/Nw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 202, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd3fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192aa", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "bY4bEsgxoNqHlWUP-V8QHtkh2eL3KxWxzaypgmuc_G0", + "y": "721j4rxcCJVwOUpLyfiS1ebHpqY3sgRppYwQatSGvzc", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "040ae580bae933b4ef2997cbdbb0922328ca9a410f627a0f7dff24cb4d920e15428911e7f8cc365a8a88eb81421a361ccc2b99e309d8dcd9a98ba83c3949d893e3", + "wx": "0ae580bae933b4ef2997cbdbb0922328ca9a410f627a0f7dff24cb4d920e1542", + "wy": "008911e7f8cc365a8a88eb81421a361ccc2b99e309d8dcd9a98ba83c3949d893e3" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200040ae580bae933b4ef2997cbdbb0922328ca9a410f627a0f7dff24cb4d920e15428911e7f8cc365a8a88eb81421a361ccc2b99e309d8dcd9a98ba83c3949d893e3", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECuWAuukztO8pl8vbsJIjKMqaQQ9i\neg99/yTLTZIOFUKJEef4zDZaiojrgUIaNhzMK5njCdjc2amLqDw5SdiT4w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 203, + "comment": "edge case for u2", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd5d8ecd64a4eeba466815ddf3a4de9a8e6abd9c5db0a01eb80343553da648428f", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "CuWAuukztO8pl8vbsJIjKMqaQQ9ieg99_yTLTZIOFUI", + "y": "iRHn-Mw2WoqI64FCGjYczCuZ4wnY3Nmpi6g8OUnYk-M", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963838a40f2a36092e9004e92d8d940cf5638550ce672ce8b8d4e15eba5499249e9", + "wx": "5b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963", + "wy": "00838a40f2a36092e9004e92d8d940cf5638550ce672ce8b8d4e15eba5499249e9" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963838a40f2a36092e9004e92d8d940cf5638550ce672ce8b8d4e15eba5499249e9", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEW4Ev1SGq+mmDWoSczm+962mDtELS\nRE/nDhNMAn/EaWODikDyo2CS6QBOktjZQM9WOFUM5nLOi41OFeulSZJJ6Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 204, + "comment": "point duplication during verification", + "flags": [ + "PointDuplication" + ], + "msg": "313233343030", + "sig": "6f2347cab7dd76858fe0555ac3bc99048c4aacafdfb6bcbe05ea6c42c4934569bb726660235793aa9957a61e76e00c2c435109cf9a15dd624d53f4301047856b", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "W4Ev1SGq-mmDWoSczm-962mDtELSRE_nDhNMAn_EaWM", + "y": "g4pA8qNgkukATpLY2UDPVjhVDOZyzouNThXrpUmSSek", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc469637c75bf0c5c9f6d17ffb16d2726bf30a9c7aaf31a8d317472b1ea145ab66db616", + "wx": "5b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc46963", + "wy": "7c75bf0c5c9f6d17ffb16d2726bf30a9c7aaf31a8d317472b1ea145ab66db616" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045b812fd521aafa69835a849cce6fbdeb6983b442d2444fe70e134c027fc469637c75bf0c5c9f6d17ffb16d2726bf30a9c7aaf31a8d317472b1ea145ab66db616", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEW4Ev1SGq+mmDWoSczm+962mDtELS\nRE/nDhNMAn/EaWN8db8MXJ9tF/+xbScmvzCpx6rzGo0xdHKx6hRatm22Fg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 205, + "comment": "duplication bug", + "flags": [ + "PointDuplication" + ], + "msg": "313233343030", + "sig": "6f2347cab7dd76858fe0555ac3bc99048c4aacafdfb6bcbe05ea6c42c4934569bb726660235793aa9957a61e76e00c2c435109cf9a15dd624d53f4301047856b", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "W4Ev1SGq-mmDWoSczm-962mDtELSRE_nDhNMAn_EaWM", + "y": "fHW_DFyfbRf_sW0nJr8wqceq8xqNMXRyseoUWrZtthY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "046adda82b90261b0f319faa0d878665a6b6da497f09c903176222c34acfef72a647e6f50dcc40ad5d9b59f7602bb222fad71a41bf5e1f9df4959a364c62e488d9", + "wx": "6adda82b90261b0f319faa0d878665a6b6da497f09c903176222c34acfef72a6", + "wy": "47e6f50dcc40ad5d9b59f7602bb222fad71a41bf5e1f9df4959a364c62e488d9" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200046adda82b90261b0f319faa0d878665a6b6da497f09c903176222c34acfef72a647e6f50dcc40ad5d9b59f7602bb222fad71a41bf5e1f9df4959a364c62e488d9", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEat2oK5AmGw8xn6oNh4ZlprbaSX8J\nyQMXYiLDSs/vcqZH5vUNzECtXZtZ92ArsiL61xpBv14fnfSVmjZMYuSI2Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 206, + "comment": "point with x-coordinate 0", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "0000000000000000000000000000000000000000000000000000000000000001555555550000000055555555555555553ef7a8e48d07df81a693439654210c70", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "at2oK5AmGw8xn6oNh4ZlprbaSX8JyQMXYiLDSs_vcqY", + "y": "R-b1DcxArV2bWfdgK7Ii-tcaQb9eH530lZo2TGLkiNk", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "042fca0d0a47914de77ed56e7eccc3276a601120c6df0069c825c8f6a01c9f382065f3450a1d17c6b24989a39beb1c7decfca8384fbdc294418e5d807b3c6ed7de", + "wx": "2fca0d0a47914de77ed56e7eccc3276a601120c6df0069c825c8f6a01c9f3820", + "wy": "65f3450a1d17c6b24989a39beb1c7decfca8384fbdc294418e5d807b3c6ed7de" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200042fca0d0a47914de77ed56e7eccc3276a601120c6df0069c825c8f6a01c9f382065f3450a1d17c6b24989a39beb1c7decfca8384fbdc294418e5d807b3c6ed7de", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEL8oNCkeRTed+1W5+zMMnamARIMbf\nAGnIJcj2oByfOCBl80UKHRfGskmJo5vrHH3s/Kg4T73ClEGOXYB7PG7X3g==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 207, + "comment": "point with x-coordinate 0", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "010000000000000000000000000000000000000000000000000000000000000000003333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aa9", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "L8oNCkeRTed-1W5-zMMnamARIMbfAGnIJcj2oByfOCA", + "y": "ZfNFCh0XxrJJiaOb6xx97PyoOE-9wpRBjl2Aezxu194", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04dd86d3b5f4a13e8511083b78002081c53ff467f11ebd98a51a633db76665d25045d5c8200c89f2fa10d849349226d21d8dfaed6ff8d5cb3e1b7e17474ebc18f7", + "wx": "00dd86d3b5f4a13e8511083b78002081c53ff467f11ebd98a51a633db76665d250", + "wy": "45d5c8200c89f2fa10d849349226d21d8dfaed6ff8d5cb3e1b7e17474ebc18f7" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004dd86d3b5f4a13e8511083b78002081c53ff467f11ebd98a51a633db76665d25045d5c8200c89f2fa10d849349226d21d8dfaed6ff8d5cb3e1b7e17474ebc18f7", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3YbTtfShPoURCDt4ACCBxT/0Z/Ee\nvZilGmM9t2Zl0lBF1cggDIny+hDYSTSSJtIdjfrtb/jVyz4bfhdHTrwY9w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 208, + "comment": "comparison with point at infinity ", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "555555550000000055555555555555553ef7a8e48d07df81a693439654210c703333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aa9", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "3YbTtfShPoURCDt4ACCBxT_0Z_EevZilGmM9t2Zl0lA", + "y": "RdXIIAyJ8voQ2Ek0kibSHY367W_41cs-G34XR068GPc", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "044fea55b32cb32aca0c12c4cd0abfb4e64b0f5a516e578c016591a93f5a0fbcc5d7d3fd10b2be668c547b212f6bb14c88f0fecd38a8a4b2c785ed3be62ce4b280", + "wx": "4fea55b32cb32aca0c12c4cd0abfb4e64b0f5a516e578c016591a93f5a0fbcc5", + "wy": "00d7d3fd10b2be668c547b212f6bb14c88f0fecd38a8a4b2c785ed3be62ce4b280" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200044fea55b32cb32aca0c12c4cd0abfb4e64b0f5a516e578c016591a93f5a0fbcc5d7d3fd10b2be668c547b212f6bb14c88f0fecd38a8a4b2c785ed3be62ce4b280", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAET+pVsyyzKsoMEsTNCr+05ksPWlFu\nV4wBZZGpP1oPvMXX0/0Qsr5mjFR7IS9rsUyI8P7NOKiksseF7TvmLOSygA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 209, + "comment": "extreme value for k and edgecase s", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978555555550000000055555555555555553ef7a8e48d07df81a693439654210c70", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "T-pVsyyzKsoMEsTNCr-05ksPWlFuV4wBZZGpP1oPvMU", + "y": "19P9ELK-ZoxUeyEva7FMiPD-zTiopLLHhe075izksoA", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04c6a771527024227792170a6f8eee735bf32b7f98af669ead299802e32d7c3107bc3b4b5e65ab887bbd343572b3e5619261fe3a073e2ffd78412f726867db589e", + "wx": "00c6a771527024227792170a6f8eee735bf32b7f98af669ead299802e32d7c3107", + "wy": "00bc3b4b5e65ab887bbd343572b3e5619261fe3a073e2ffd78412f726867db589e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004c6a771527024227792170a6f8eee735bf32b7f98af669ead299802e32d7c3107bc3b4b5e65ab887bbd343572b3e5619261fe3a073e2ffd78412f726867db589e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExqdxUnAkIneSFwpvju5zW/Mrf5iv\nZp6tKZgC4y18MQe8O0teZauIe700NXKz5WGSYf46Bz4v/XhBL3JoZ9tYng==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 210, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978b6db6db6249249254924924924924924625bd7a09bec4ca81bcdd9f8fd6b63cc", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "xqdxUnAkIneSFwpvju5zW_Mrf5ivZp6tKZgC4y18MQc", + "y": "vDtLXmWriHu9NDVys-VhkmH-Ogc-L_14QS9yaGfbWJ4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04851c2bbad08e54ec7a9af99f49f03644d6ec6d59b207fec98de85a7d15b956efcee9960283045075684b410be8d0f7494b91aa2379f60727319f10ddeb0fe9d6", + "wx": "00851c2bbad08e54ec7a9af99f49f03644d6ec6d59b207fec98de85a7d15b956ef", + "wy": "00cee9960283045075684b410be8d0f7494b91aa2379f60727319f10ddeb0fe9d6" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004851c2bbad08e54ec7a9af99f49f03644d6ec6d59b207fec98de85a7d15b956efcee9960283045075684b410be8d0f7494b91aa2379f60727319f10ddeb0fe9d6", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhRwrutCOVOx6mvmfSfA2RNbsbVmy\nB/7JjehafRW5Vu/O6ZYCgwRQdWhLQQvo0PdJS5GqI3n2BycxnxDd6w/p1g==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 211, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978cccccccc00000000cccccccccccccccc971f2ef152794b9d8fc7d568c9e8eaa7", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "hRwrutCOVOx6mvmfSfA2RNbsbVmyB_7JjehafRW5Vu8", + "y": "zumWAoMEUHVoS0EL6ND3SUuRqiN59gcnMZ8Q3esP6dY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04f6417c8a670584e388676949e53da7fc55911ff68318d1bf3061205acb19c48f8f2b743df34ad0f72674acb7505929784779cd9ac916c3669ead43026ab6d43f", + "wx": "00f6417c8a670584e388676949e53da7fc55911ff68318d1bf3061205acb19c48f", + "wy": "008f2b743df34ad0f72674acb7505929784779cd9ac916c3669ead43026ab6d43f" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004f6417c8a670584e388676949e53da7fc55911ff68318d1bf3061205acb19c48f8f2b743df34ad0f72674acb7505929784779cd9ac916c3669ead43026ab6d43f", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9kF8imcFhOOIZ2lJ5T2n/FWRH/aD\nGNG/MGEgWssZxI+PK3Q980rQ9yZ0rLdQWSl4R3nNmskWw2aerUMCarbUPw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 212, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc476699783333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "9kF8imcFhOOIZ2lJ5T2n_FWRH_aDGNG_MGEgWssZxI8", + "y": "jyt0PfNK0PcmdKy3UFkpeEd5zZrJFsNmnq1DAmq21D8", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04501421277be45a5eefec6c639930d636032565af420cf3373f557faa7f8a06438673d6cb6076e1cfcdc7dfe7384c8e5cac08d74501f2ae6e89cad195d0aa1371", + "wx": "501421277be45a5eefec6c639930d636032565af420cf3373f557faa7f8a0643", + "wy": "008673d6cb6076e1cfcdc7dfe7384c8e5cac08d74501f2ae6e89cad195d0aa1371" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004501421277be45a5eefec6c639930d636032565af420cf3373f557faa7f8a06438673d6cb6076e1cfcdc7dfe7384c8e5cac08d74501f2ae6e89cad195d0aa1371", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUBQhJ3vkWl7v7GxjmTDWNgMlZa9C\nDPM3P1V/qn+KBkOGc9bLYHbhz83H3+c4TI5crAjXRQHyrm6JytGV0KoTcQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 213, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997849249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "UBQhJ3vkWl7v7GxjmTDWNgMlZa9CDPM3P1V_qn-KBkM", + "y": "hnPWy2B24c_Nx9_nOEyOXKwI10UB8q5uicrRldCqE3E", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "040d935bf9ffc115a527735f729ca8a4ca23ee01a4894adf0e3415ac84e808bb343195a3762fea29ed38912bd9ea6c4fde70c3050893a4375850ce61d82eba33c5", + "wx": "0d935bf9ffc115a527735f729ca8a4ca23ee01a4894adf0e3415ac84e808bb34", + "wy": "3195a3762fea29ed38912bd9ea6c4fde70c3050893a4375850ce61d82eba33c5" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200040d935bf9ffc115a527735f729ca8a4ca23ee01a4894adf0e3415ac84e808bb343195a3762fea29ed38912bd9ea6c4fde70c3050893a4375850ce61d82eba33c5", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDZNb+f/BFaUnc19ynKikyiPuAaSJ\nSt8ONBWshOgIuzQxlaN2L+op7TiRK9nqbE/ecMMFCJOkN1hQzmHYLrozxQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 214, + "comment": "extreme value for k", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997816a4502e2781e11ac82cbc9d1edd8c981584d13e18411e2f6e0478c34416e3bb", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "DZNb-f_BFaUnc19ynKikyiPuAaSJSt8ONBWshOgIuzQ", + "y": "MZWjdi_qKe04kSvZ6mxP3nDDBQiTpDdYUM5h2C66M8U", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "045e59f50708646be8a589355014308e60b668fb670196206c41e748e64e4dca215de37fee5c97bcaf7144d5b459982f52eeeafbdf03aacbafef38e213624a01de", + "wx": "5e59f50708646be8a589355014308e60b668fb670196206c41e748e64e4dca21", + "wy": "5de37fee5c97bcaf7144d5b459982f52eeeafbdf03aacbafef38e213624a01de" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200045e59f50708646be8a589355014308e60b668fb670196206c41e748e64e4dca215de37fee5c97bcaf7144d5b459982f52eeeafbdf03aacbafef38e213624a01de", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXln1Bwhka+iliTVQFDCOYLZo+2cB\nliBsQedI5k5NyiFd43/uXJe8r3FE1bRZmC9S7ur73wOqy6/vOOITYkoB3g==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 215, + "comment": "extreme value for k and edgecase s", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296555555550000000055555555555555553ef7a8e48d07df81a693439654210c70", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "Xln1Bwhka-iliTVQFDCOYLZo-2cBliBsQedI5k5NyiE", + "y": "XeN_7lyXvK9xRNW0WZgvUu7q-98Dqsuv7zjiE2JKAd4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04169fb797325843faff2f7a5b5445da9e2fd6226f7ef90ef0bfe924104b02db8e7bbb8de662c7b9b1cf9b22f7a2e582bd46d581d68878efb2b861b131d8a1d667", + "wx": "169fb797325843faff2f7a5b5445da9e2fd6226f7ef90ef0bfe924104b02db8e", + "wy": "7bbb8de662c7b9b1cf9b22f7a2e582bd46d581d68878efb2b861b131d8a1d667" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004169fb797325843faff2f7a5b5445da9e2fd6226f7ef90ef0bfe924104b02db8e7bbb8de662c7b9b1cf9b22f7a2e582bd46d581d68878efb2b861b131d8a1d667", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFp+3lzJYQ/r/L3pbVEXani/WIm9+\n+Q7wv+kkEEsC2457u43mYse5sc+bIvei5YK9RtWB1oh477K4YbEx2KHWZw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 216, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296b6db6db6249249254924924924924924625bd7a09bec4ca81bcdd9f8fd6b63cc", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "Fp-3lzJYQ_r_L3pbVEXani_WIm9--Q7wv-kkEEsC244", + "y": "e7uN5mLHubHPmyL3ouWCvUbVgdaIeO-yuGGxMdih1mc", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04271cd89c000143096b62d4e9e4ca885aef2f7023d18affdaf8b7b548981487540a1c6e954e32108435b55fa385b0f76481a609b9149ccb4b02b2ca47fe8e4da5", + "wx": "271cd89c000143096b62d4e9e4ca885aef2f7023d18affdaf8b7b54898148754", + "wy": "0a1c6e954e32108435b55fa385b0f76481a609b9149ccb4b02b2ca47fe8e4da5" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004271cd89c000143096b62d4e9e4ca885aef2f7023d18affdaf8b7b548981487540a1c6e954e32108435b55fa385b0f76481a609b9149ccb4b02b2ca47fe8e4da5", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJxzYnAABQwlrYtTp5MqIWu8vcCPR\niv/a+Le1SJgUh1QKHG6VTjIQhDW1X6OFsPdkgaYJuRScy0sCsspH/o5NpQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 217, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296cccccccc00000000cccccccccccccccc971f2ef152794b9d8fc7d568c9e8eaa7", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "JxzYnAABQwlrYtTp5MqIWu8vcCPRiv_a-Le1SJgUh1Q", + "y": "ChxulU4yEIQ1tV-jhbD3ZIGmCbkUnMtLArLKR_6OTaU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "043d0bc7ed8f09d2cb7ddb46ebc1ed799ab1563a9ab84bf524587a220afe499c12e22dc3b3c103824a4f378d96adb0a408abf19ce7d68aa6244f78cb216fa3f8df", + "wx": "3d0bc7ed8f09d2cb7ddb46ebc1ed799ab1563a9ab84bf524587a220afe499c12", + "wy": "00e22dc3b3c103824a4f378d96adb0a408abf19ce7d68aa6244f78cb216fa3f8df" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200043d0bc7ed8f09d2cb7ddb46ebc1ed799ab1563a9ab84bf524587a220afe499c12e22dc3b3c103824a4f378d96adb0a408abf19ce7d68aa6244f78cb216fa3f8df", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPQvH7Y8J0st920brwe15mrFWOpq4\nS/UkWHoiCv5JnBLiLcOzwQOCSk83jZatsKQIq/Gc59aKpiRPeMshb6P43w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 218, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2963333333300000000333333333333333325c7cbbc549e52e763f1f55a327a3aaa", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "PQvH7Y8J0st920brwe15mrFWOpq4S_UkWHoiCv5JnBI", + "y": "4i3Ds8EDgkpPN42WrbCkCKvxnOfWiqYkT3jLIW-j-N8", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04a6c885ade1a4c566f9bb010d066974abb281797fa701288c721bcbd23663a9b72e424b690957168d193a6096fc77a2b004a9c7d467e007e1f2058458f98af316", + "wx": "00a6c885ade1a4c566f9bb010d066974abb281797fa701288c721bcbd23663a9b7", + "wy": "2e424b690957168d193a6096fc77a2b004a9c7d467e007e1f2058458f98af316" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004a6c885ade1a4c566f9bb010d066974abb281797fa701288c721bcbd23663a9b72e424b690957168d193a6096fc77a2b004a9c7d467e007e1f2058458f98af316", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpsiFreGkxWb5uwENBml0q7KBeX+n\nASiMchvL0jZjqbcuQktpCVcWjRk6YJb8d6KwBKnH1GfgB+HyBYRY+YrzFg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 219, + "comment": "extreme value for k and s^-1", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29649249248db6db6dbb6db6db6db6db6db5a8b230d0b2b51dcd7ebf0c9fef7c185", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "psiFreGkxWb5uwENBml0q7KBeX-nASiMchvL0jZjqbc", + "y": "LkJLaQlXFo0ZOmCW_HeisASpx9Rn4Afh8gWEWPmK8xY", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "048d3c2c2c3b765ba8289e6ac3812572a25bf75df62d87ab7330c3bdbad9ebfa5c4c6845442d66935b238578d43aec54f7caa1621d1af241d4632e0b780c423f5d", + "wx": "008d3c2c2c3b765ba8289e6ac3812572a25bf75df62d87ab7330c3bdbad9ebfa5c", + "wy": "4c6845442d66935b238578d43aec54f7caa1621d1af241d4632e0b780c423f5d" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200048d3c2c2c3b765ba8289e6ac3812572a25bf75df62d87ab7330c3bdbad9ebfa5c4c6845442d66935b238578d43aec54f7caa1621d1af241d4632e0b780c423f5d", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjTwsLDt2W6gonmrDgSVyolv3XfYt\nh6tzMMO9utnr+lxMaEVELWaTWyOFeNQ67FT3yqFiHRryQdRjLgt4DEI/XQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 220, + "comment": "extreme value for k", + "flags": [ + "ArithmeticError" + ], + "msg": "313233343030", + "sig": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c29616a4502e2781e11ac82cbc9d1edd8c981584d13e18411e2f6e0478c34416e3bb", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "jTwsLDt2W6gonmrDgSVyolv3XfYth6tzMMO9utnr-lw", + "y": "TGhFRC1mk1sjhXjUOuxU98qhYh0a8kHUYy4LeAxCP10", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5", + "wx": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296", + "wy": "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaxfR8uEsQkf4vOblY6RA8ncDfYEt\n6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9Q==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 221, + "comment": "public key shares x-coordinate with generator", + "flags": [ + "PointDuplication" + ], + "msg": "313233343030", + "sig": "bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2", + "result": "invalid" + }, + { + "tcId": 222, + "comment": "public key shares x-coordinate with generator", + "flags": [ + "PointDuplication" + ], + "msg": "313233343030", + "sig": "44a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY", + "y": "T-NC4v4af5uO5-tKfA-eFivOM1drMV7Oy7ZAaDe_UfU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296b01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a", + "wx": "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296", + "wy": "00b01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296b01cbd1c01e58065711814b583f061e9d431cca994cea1313449bf97c840ae0a", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaxfR8uEsQkf4vOblY6RA8ncDfYEt\n6zOg9KE5RdiYwpawHL0cAeWAZXEYFLWD8GHp1DHMqZTOoTE0Sb+XyECuCg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 223, + "comment": "public key shares x-coordinate with generator", + "flags": [ + "PointDuplication" + ], + "msg": "313233343030", + "sig": "bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2", + "result": "invalid" + }, + { + "tcId": 224, + "comment": "public key shares x-coordinate with generator", + "flags": [ + "PointDuplication" + ], + "msg": "313233343030", + "sig": "44a5ad0ad0636d9f12bc9e0a6bdd5e1cbcb012ea7bf091fcec15b0c43202d52e249249246db6db6ddb6db6db6db6db6dad4591868595a8ee6bf5f864ff7be0c2", + "result": "invalid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY", + "y": "sBy9HAHlgGVxGBS1g_Bh6dQxzKmUzqExNEm_l8hArgo", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0404aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad587d9315798aaa3a5ba01775787ced05eaaf7b4e09fc81d6d1aa546e8365d525d", + "wx": "04aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad5", + "wy": "0087d9315798aaa3a5ba01775787ced05eaaf7b4e09fc81d6d1aa546e8365d525d" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000404aaec73635726f213fb8a9e64da3b8632e41495a944d0045b522eba7240fad587d9315798aaa3a5ba01775787ced05eaaf7b4e09fc81d6d1aa546e8365d525d", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBKrsc2NXJvIT+4qeZNo7hjLkFJWp\nRNAEW1IuunJA+tWH2TFXmKqjpboBd1eHztBeqve04J/IHW0apUboNl1SXQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 225, + "comment": "pseudorandom signature", + "flags": [ + "ValidSignature" + ], + "msg": "", + "sig": "b292a619339f6e567a305c951c0dcbcc42d16e47f219f9e98e76e09d8770b34a0177e60492c5a8242f76f07bfe3661bde59ec2a17ce5bd2dab2abebdf89a62e2", + "result": "valid" + }, + { + "tcId": 226, + "comment": "pseudorandom signature", + "flags": [ + "ValidSignature" + ], + "msg": "4d7367", + "sig": "530bd6b0c9af2d69ba897f6b5fb59695cfbf33afe66dbadcf5b8d2a2a6538e23d85e489cb7a161fd55ededcedbf4cc0c0987e3e3f0f242cae934c72caa3f43e9", + "result": "valid" + }, + { + "tcId": 227, + "comment": "pseudorandom signature", + "flags": [ + "ValidSignature" + ], + "msg": "313233343030", + "sig": "a8ea150cb80125d7381c4c1f1da8e9de2711f9917060406a73d7904519e51388f3ab9fa68bd47973a73b2d40480c2ba50c22c9d76ec217257288293285449b86", + "result": "valid" + }, + { + "tcId": 228, + "comment": "pseudorandom signature", + "flags": [ + "ValidSignature" + ], + "msg": "0000000000000000000000000000000000000000", + "sig": "986e65933ef2ed4ee5aada139f52b70539aaf63f00a91f29c69178490d57fb713dafedfb8da6189d372308cbf1489bbbdabf0c0217d1c0ff0f701aaa7a694b9c", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "BKrsc2NXJvIT-4qeZNo7hjLkFJWpRNAEW1IuunJA-tU", + "y": "h9kxV5iqo6W6AXdXh87QXqr3tOCfyB1tGqVG6DZdUl0", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "044f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000ed9dea124cc8c396416411e988c30f427eb504af43a3146cd5df7ea60666d685", + "wx": "4f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000", + "wy": "00ed9dea124cc8c396416411e988c30f427eb504af43a3146cd5df7ea60666d685" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200044f337ccfd67726a805e4f1600ae2849df3807eca117380239fbd816900000000ed9dea124cc8c396416411e988c30f427eb504af43a3146cd5df7ea60666d685", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETzN8z9Z3JqgF5PFgCuKEnfOAfsoR\nc4Ajn72BaQAAAADtneoSTMjDlkFkEemIww9CfrUEr0OjFGzV336mBmbWhQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 229, + "comment": "x-coordinate of the public key has many trailing 0's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "d434e262a49eab7781e353a3565e482550dd0fd5defa013c7f29745eff3569f19b0c0a93f267fb6052fd8077be769c2b98953195d7bc10de844218305c6ba17a", + "result": "valid" + }, + { + "tcId": 230, + "comment": "x-coordinate of the public key has many trailing 0's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "0fe774355c04d060f76d79fd7a772e421463489221bf0a33add0be9b1979110b500dcba1c69a8fbd43fa4f57f743ce124ca8b91a1f325f3fac6181175df55737", + "result": "valid" + }, + { + "tcId": 231, + "comment": "x-coordinate of the public key has many trailing 0's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "bb40bf217bed3fb3950c7d39f03d36dc8e3b2cd79693f125bfd06595ee1135e3541bf3532351ebb032710bdb6a1bf1bfc89a1e291ac692b3fa4780745bb55677", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "TzN8z9Z3JqgF5PFgCuKEnfOAfsoRc4Ajn72BaQAAAAA", + "y": "7Z3qEkzIw5ZBZBHpiMMPQn61BK9DoxRs1d9-pgZm1oU", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "043cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f49726500493584fa174d791c72bf2ce3880a8960dd2a7c7a1338a82f85a9e59cdbde80000000", + "wx": "3cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935", + "wy": "0084fa174d791c72bf2ce3880a8960dd2a7c7a1338a82f85a9e59cdbde80000000" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200043cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f49726500493584fa174d791c72bf2ce3880a8960dd2a7c7a1338a82f85a9e59cdbde80000000", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPPA9YU2JOc/UmaB4c/rCgWGPBrj/\nh+gBXD9JcmUASTWE+hdNeRxyvyzjiAqJYN0qfHoTOKgvhanlnNvegAAAAA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 232, + "comment": "y-coordinate of the public key has many trailing 0's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "664eb7ee6db84a34df3c86ea31389a5405badd5ca99231ff556d3e75a233e73a59f3c752e52eca46137642490a51560ce0badc678754b8f72e51a2901426a1bd", + "result": "valid" + }, + { + "tcId": 233, + "comment": "y-coordinate of the public key has many trailing 0's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "4cd0429bbabd2827009d6fcd843d4ce39c3e42e2d1631fd001985a79d1fd8b439638bf12dd682f60be7ef1d0e0d98f08b7bca77a1a2b869ae466189d2acdabe3", + "result": "valid" + }, + { + "tcId": 234, + "comment": "y-coordinate of the public key has many trailing 0's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "e56c6ea2d1b017091c44d8b6cb62b9f460e3ce9aed5e5fd41e8added97c56c04a308ec31f281e955be20b457e463440b4fcf2b80258078207fc1378180f89b55", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "PPA9YU2JOc_UmaB4c_rCgWGPBrj_h-gBXD9JcmUASTU", + "y": "hPoXTXkccr8s44gKiWDdKnx6EzioL4Wp5Zzb3oAAAAA", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "043cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f4972650049357b05e8b186e38d41d31c77f5769f22d58385ecc857d07a561a6324217fffffff", + "wx": "3cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f497265004935", + "wy": "7b05e8b186e38d41d31c77f5769f22d58385ecc857d07a561a6324217fffffff" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200043cf03d614d8939cfd499a07873fac281618f06b8ff87e8015c3f4972650049357b05e8b186e38d41d31c77f5769f22d58385ecc857d07a561a6324217fffffff", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPPA9YU2JOc/UmaB4c/rCgWGPBrj/\nh+gBXD9JcmUASTV7BeixhuONQdMcd/V2nyLVg4XsyFfQelYaYyQhf////w==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 235, + "comment": "y-coordinate of the public key has many trailing 1's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "1158a08d291500b4cabed3346d891eee57c176356a2624fb011f8fbbf3466830228a8c486a736006e082325b85290c5bc91f378b75d487dda46798c18f285519", + "result": "valid" + }, + { + "tcId": 236, + "comment": "y-coordinate of the public key has many trailing 1's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "b1db9289649f59410ea36b0c0fc8d6aa2687b29176939dd23e0dde56d309fa9d3e1535e4280559015b0dbd987366dcf43a6d1af5c23c7d584e1c3f48a1251336", + "result": "valid" + }, + { + "tcId": 237, + "comment": "y-coordinate of the public key has many trailing 1's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "b7b16e762286cb96446aa8d4e6e7578b0a341a79f2dd1a220ac6f0ca4e24ed86ddc60a700a139b04661c547d07bbb0721780146df799ccf55e55234ecb8f12bc", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "PPA9YU2JOc_UmaB4c_rCgWGPBrj_h-gBXD9JcmUASTU", + "y": "ewXosYbjjUHTHHf1dp8i1YOF7MhX0HpWGmMkIX____8", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "042829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffffa01aafaf000e52585855afa7676ade284113099052df57e7eb3bd37ebeb9222e", + "wx": "2829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffff", + "wy": "00a01aafaf000e52585855afa7676ade284113099052df57e7eb3bd37ebeb9222e" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200042829c31faa2e400e344ed94bca3fcd0545956ebcfe8ad0f6dfa5ff8effffffffa01aafaf000e52585855afa7676ade284113099052df57e7eb3bd37ebeb9222e", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKCnDH6ouQA40TtlLyj/NBUWVbrz+\nitD236X/jv////+gGq+vAA5SWFhVr6dnat4oQRMJkFLfV+frO9N+vrkiLg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 238, + "comment": "x-coordinate of the public key has many trailing 1's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "d82a7c2717261187c8e00d8df963ff35d796edad36bc6e6bd1c91c670d9105b43dcabddaf8fcaa61f4603e7cbac0f3c0351ecd5988efb23f680d07debd139929", + "result": "valid" + }, + { + "tcId": 239, + "comment": "x-coordinate of the public key has many trailing 1's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "5eb9c8845de68eb13d5befe719f462d77787802baff30ce96a5cba063254af782c026ae9be2e2a5e7ca0ff9bbd92fb6e44972186228ee9a62b87ddbe2ef66fb5", + "result": "valid" + }, + { + "tcId": 240, + "comment": "x-coordinate of the public key has many trailing 1's", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "96843dd03c22abd2f3b782b170239f90f277921becc117d0404a8e4e36230c28f2be378f526f74a543f67165976de9ed9a31214eb4d7e6db19e1ede123dd991d", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "KCnDH6ouQA40TtlLyj_NBUWVbrz-itD236X_jv____8", + "y": "oBqvrwAOUlhYVa-nZ2reKEETCZBS31fn6zvTfr65Ii4", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f55a8abcba2dda8474311ee54149b973cae0c0fb89557ad0bf78e6529a1663bd73", + "wx": "00fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f5", + "wy": "5a8abcba2dda8474311ee54149b973cae0c0fb89557ad0bf78e6529a1663bd73" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004fffffff948081e6a0458dd8f9e738f2665ff9059ad6aac0708318c4ca9a7a4f55a8abcba2dda8474311ee54149b973cae0c0fb89557ad0bf78e6529a1663bd73", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE////+UgIHmoEWN2PnnOPJmX/kFmt\naqwHCDGMTKmnpPVairy6LdqEdDEe5UFJuXPK4MD7iVV60L945lKaFmO9cw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 241, + "comment": "x-coordinate of the public key is large", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "766456dce1857c906f9996af729339464d27e9d98edc2d0e3b760297067421f6402385ecadae0d8081dccaf5d19037ec4e55376eced699e93646bfbbf19d0b41", + "result": "valid" + }, + { + "tcId": 242, + "comment": "x-coordinate of the public key is large", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "c605c4b2edeab20419e6518a11b2dbc2b97ed8b07cced0b19c34f777de7b9fd9edf0f612c5f46e03c719647bc8af1b29b2cde2eda700fb1cff5e159d47326dba", + "result": "valid" + }, + { + "tcId": 243, + "comment": "x-coordinate of the public key is large", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "d48b68e6cabfe03cf6141c9ac54141f210e64485d9929ad7b732bfe3b7eb8a84feedae50c61bd00e19dc26f9b7e2265e4508c389109ad2f208f0772315b6c941", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "____-UgIHmoEWN2PnnOPJmX_kFmtaqwHCDGMTKmnpPU", + "y": "Woq8ui3ahHQxHuVBSblzyuDA-4lVetC_eOZSmhZjvXM", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "0400000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e1099872070e8e87c555fa13659cca5d7fadcfcb0023ea889548ca48af2ba7e71", + "wx": "03fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e", + "wy": "1099872070e8e87c555fa13659cca5d7fadcfcb0023ea889548ca48af2ba7e71" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d0301070342000400000003fa15f963949d5f03a6f5c7f86f9e0015eeb23aebbff1173937ba748e1099872070e8e87c555fa13659cca5d7fadcfcb0023ea889548ca48af2ba7e71", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAAAAA/oV+WOUnV8DpvXH+G+eABXu\nsjrrv/EXOTe6dI4QmYcgcOjofFVfoTZZzKXX+tz8sAI+qIlUjKSK8rp+cQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 244, + "comment": "x-coordinate of the public key is small", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "b7c81457d4aeb6aa65957098569f0479710ad7f6595d5874c35a93d12a5dd4c7b7961a0b652878c2d568069a432ca18a1a9199f2ca574dad4b9e3a05c0a1cdb3", + "result": "valid" + }, + { + "tcId": 245, + "comment": "x-coordinate of the public key is small", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "6b01332ddb6edfa9a30a1321d5858e1ee3cf97e263e669f8de5e9652e76ff3f75939545fced457309a6a04ace2bd0f70139c8f7d86b02cb1cc58f9e69e96cd5a", + "result": "valid" + }, + { + "tcId": 246, + "comment": "x-coordinate of the public key is small", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "efdb884720eaeadc349f9fc356b6c0344101cd2fd8436b7d0e6a4fb93f106361f24bee6ad5dc05f7613975473aadf3aacba9e77de7d69b6ce48cb60d8113385d", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "AAAAA_oV-WOUnV8DpvXH-G-eABXusjrrv_EXOTe6dI4", + "y": "EJmHIHDo6HxVX6E2Wcyl1_rc_LACPqiJVIykivK6fnE", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015000000001352bb4a0fa2ea4cceb9ab63dd684ade5a1127bcf300a698a7193bc2", + "wx": "00bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015", + "wy": "1352bb4a0fa2ea4cceb9ab63dd684ade5a1127bcf300a698a7193bc2" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015000000001352bb4a0fa2ea4cceb9ab63dd684ade5a1127bcf300a698a7193bc2", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvLspFMefBF6qbsu8YSgWs75dLWeW\ncH2BJen4UcGK8BUAAAAAE1K7Sg+i6kzOuatj3WhK3loRJ7zzAKaYpxk7wg==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 247, + "comment": "y-coordinate of the public key is small", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "31230428405560dcb88fb5a646836aea9b23a23dd973dcbe8014c87b8b20eb070f9344d6e812ce166646747694a41b0aaf97374e19f3c5fb8bd7ae3d9bd0beff", + "result": "valid" + }, + { + "tcId": 248, + "comment": "y-coordinate of the public key is small", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "caa797da65b320ab0d5c470cda0b36b294359c7db9841d679174db34c4855743cf543a62f23e212745391aaf7505f345123d2685ee3b941d3de6d9b36242e5a0", + "result": "valid" + }, + { + "tcId": 249, + "comment": "y-coordinate of the public key is small", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "7e5f0ab5d900d3d3d7867657e5d6d36519bc54084536e7d21c336ed8001859459450c07f201faec94b82dfb322e5ac676688294aad35aa72e727ff0b19b646aa", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "vLspFMefBF6qbsu8YSgWs75dLWeWcH2BJen4UcGK8BU", + "y": "AAAAABNSu0oPoupMzrmrY91oSt5aESe88wCmmKcZO8I", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "google-wycheproof", + "version": "0.9rc5" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015fffffffeecad44b6f05d15b33146549c2297b522a5eed8430cff596758e6c43d", + "wx": "00bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015", + "wy": "00fffffffeecad44b6f05d15b33146549c2297b522a5eed8430cff596758e6c43d" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004bcbb2914c79f045eaa6ecbbc612816b3be5d2d6796707d8125e9f851c18af015fffffffeecad44b6f05d15b33146549c2297b522a5eed8430cff596758e6c43d", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvLspFMefBF6qbsu8YSgWs75dLWeW\ncH2BJen4UcGK8BX////+7K1EtvBdFbMxRlScIpe1IqXu2EMM/1lnWObEPQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 250, + "comment": "y-coordinate of the public key is large", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "d7d70c581ae9e3f66dc6a480bf037ae23f8a1e4a2136fe4b03aa69f0ca25b35689c460f8a5a5c2bbba962c8a3ee833a413e85658e62a59e2af41d9127cc47224", + "result": "valid" + }, + { + "tcId": 251, + "comment": "y-coordinate of the public key is large", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "341c1b9ff3c83dd5e0dfa0bf68bcdf4bb7aa20c625975e5eeee34bb396266b3472b69f061b750fd5121b22b11366fad549c634e77765a017902a67099e0a4469", + "result": "valid" + }, + { + "tcId": 252, + "comment": "y-coordinate of the public key is large", + "flags": [ + "EdgeCasePublicKey" + ], + "msg": "4d657373616765", + "sig": "70bebe684cdcb5ca72a42f0d873879359bd1781a591809947628d313a3814f67aec03aca8f5587a4d535fa31027bbe9cc0e464b1c3577f4c2dcde6b2094798a9", + "result": "valid" + } + ], + "publicKeyJwk": { + "kty": "EC", + "crv": "P-256", + "x": "vLspFMefBF6qbsu8YSgWs75dLWeWcH2BJen4UcGK8BU", + "y": "_____uytRLbwXRWzMUZUnCKXtSKl7thDDP9ZZ1jmxD0", + "kid": "none" + } + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9cf5308020eed460c649ddae61d4ef8bb79958113f106befaf4f18876d12a5e64", + "wx": "264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9", + "wy": "cf5308020eed460c649ddae61d4ef8bb79958113f106befaf4f18876d12a5e64" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9cf5308020eed460c649ddae61d4ef8bb79958113f106befaf4f18876d12a5e64", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJk15ag2rmzdtNO6m/il93hx7c+U5\nRLyWyPHopoULtsnPUwgCDu1GDGSd2uYdTvi7eZWBE/EGvvr08Yh20SpeZA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 253, + "comment": "r = 5, x = 5 is valid", + "flags": [ + "ValidSignature" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "0000000000000000000000000000000000000000000000000000000000000005ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "valid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04add76677e54a92e79bbee36a70e1754838273ec4b39295e4018a587290a7fc73f240d625642c943e610d80d953c5c6b8a12760a624ba3b90a0b7902755e1ae79", + "wx": "add76677e54a92e79bbee36a70e1754838273ec4b39295e4018a587290a7fc73", + "wy": "f240d625642c943e610d80d953c5c6b8a12760a624ba3b90a0b7902755e1ae79" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004add76677e54a92e79bbee36a70e1754838273ec4b39295e4018a587290a7fc73f240d625642c943e610d80d953c5c6b8a12760a624ba3b90a0b7902755e1ae79", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErddmd+VKkuebvuNqcOF1SDgnPsSz\nkpXkAYpYcpCn/HPyQNYlZCyUPmENgNlTxca4oSdgpiS6O5Cgt5AnVeGueQ==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 254, + "comment": "r = 6, x = 5 is invalid", + "flags": [ + "ArithmeticError" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "0000000000000000000000000000000000000000000000000000000000000006ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9cf5308020eed460c649ddae61d4ef8bb79958113f106befaf4f18876d12a5e64", + "wx": "264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9", + "wy": "cf5308020eed460c649ddae61d4ef8bb79958113f106befaf4f18876d12a5e64" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004264d796a0dab9b376d34eea6fe297dde1c7b73e53944bc96c8f1e8a6850bb6c9cf5308020eed460c649ddae61d4ef8bb79958113f106befaf4f18876d12a5e64", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJk15ag2rmzdtNO6m/il93hx7c+U5\nRLyWyPHopoULtsnPUwgCDu1GDGSd2uYdTvi7eZWBE/EGvvr08Yh20SpeZA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 255, + "comment": "r = 5 + n, x = 5 is invalid; r was not reduced mod n", + "flags": [ + "ArithmeticError" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632556ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04e7e49dd82812432744fefe723f7f69663214ad1b85c02b2650b4ca0354743a325223c51c415f457aec69cb019bbe3d27585b38f8b79c39dfea6c27c2f0d8146a", + "wx": "e7e49dd82812432744fefe723f7f69663214ad1b85c02b2650b4ca0354743a32", + "wy": "5223c51c415f457aec69cb019bbe3d27585b38f8b79c39dfea6c27c2f0d8146a" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004e7e49dd82812432744fefe723f7f69663214ad1b85c02b2650b4ca0354743a325223c51c415f457aec69cb019bbe3d27585b38f8b79c39dfea6c27c2f0d8146a", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5+Sd2CgSQydE/v5yP39pZjIUrRuF\nwCsmULTKA1R0OjJSI8UcQV9FeuxpywGbvj0nWFs4+LecOd/qbCfC8NgUag==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 256, + "comment": "r = n - 3, x = n - 2 is invalid", + "flags": [ + "ArithmeticError" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254effffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04ce24c99032d52ac6ead23c0ae3ec68ef41e51a281fd457808c83136d7dcce90e8f7a154b551e9f39c59279357aa491b2a62bdebc2bb78613883fc72936c057e0", + "wx": "ce24c99032d52ac6ead23c0ae3ec68ef41e51a281fd457808c83136d7dcce90e", + "wy": "8f7a154b551e9f39c59279357aa491b2a62bdebc2bb78613883fc72936c057e0" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004ce24c99032d52ac6ead23c0ae3ec68ef41e51a281fd457808c83136d7dcce90e8f7a154b551e9f39c59279357aa491b2a62bdebc2bb78613883fc72936c057e0", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEziTJkDLVKsbq0jwK4+xo70HlGigf\n1FeAjIMTbX3M6Q6PehVLVR6fOcWSeTV6pJGypivevCu3hhOIP8cpNsBX4A==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 257, + "comment": "r = 3, x = n + 3 is the smallest possible x with a reduction", + "flags": [ + "ValidSignature" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "0000000000000000000000000000000000000000000000000000000000000003ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "valid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04c981c75ddfd3910387eb147098fe5658c43aaaa34c681cd6d514b6ad5b6baa6d14fbddb53a6e6db18e90602bc60f2e736d625765f7f2cca4be76f4eeccf12c18", + "wx": "c981c75ddfd3910387eb147098fe5658c43aaaa34c681cd6d514b6ad5b6baa6d", + "wy": "14fbddb53a6e6db18e90602bc60f2e736d625765f7f2cca4be76f4eeccf12c18" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004c981c75ddfd3910387eb147098fe5658c43aaaa34c681cd6d514b6ad5b6baa6d14fbddb53a6e6db18e90602bc60f2e736d625765f7f2cca4be76f4eeccf12c18", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyYHHXd/TkQOH6xRwmP5WWMQ6qqNM\naBzW1RS2rVtrqm0U+921Om5tsY6QYCvGDy5zbWJXZffyzKS+dvTuzPEsGA==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 258, + "comment": "r = 4, x = n + 3 is invalid", + "flags": [ + "ArithmeticError" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "0000000000000000000000000000000000000000000000000000000000000004ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "040ec505bc19b14a43e05678cccf07a443d3e871a2e19b68a4da91859a0650f32477300e4f64e9982d94dff5d294428bb37cc9be66117cae9c389d2d495f68b987", + "wx": "0ec505bc19b14a43e05678cccf07a443d3e871a2e19b68a4da91859a0650f324", + "wy": "77300e4f64e9982d94dff5d294428bb37cc9be66117cae9c389d2d495f68b987" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200040ec505bc19b14a43e05678cccf07a443d3e871a2e19b68a4da91859a0650f32477300e4f64e9982d94dff5d294428bb37cc9be66117cae9c389d2d495f68b987", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDsUFvBmxSkPgVnjMzwekQ9PocaLh\nm2ik2pGFmgZQ8yR3MA5PZOmYLZTf9dKUQouzfMm+ZhF8rpw4nS1JX2i5hw==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 259, + "comment": "r = p - n + 5, x = 5 is invalid; r is too large to compare r + n with x", + "flags": [ + "ArithmeticError" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "000000000000000000000000000000004319055358e8617b0c46353d039cdab3ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-r-s-edge-cases", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "04d42ce21e730f3d2a84e949828574b4dceeb77d4f89556735f34fba03028ee3ed32daf8bfd3f0a7a0821170840f4e032056722386b35d9bdd4f4f450696f4fb52", + "wx": "d42ce21e730f3d2a84e949828574b4dceeb77d4f89556735f34fba03028ee3ed", + "wy": "32daf8bfd3f0a7a0821170840f4e032056722386b35d9bdd4f4f450696f4fb52" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d03010703420004d42ce21e730f3d2a84e949828574b4dceeb77d4f89556735f34fba03028ee3ed32daf8bfd3f0a7a0821170840f4e032056722386b35d9bdd4f4f450696f4fb52", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1CziHnMPPSqE6UmChXS03O63fU+J\nVWc180+6AwKO4+0y2vi/0/CnoIIRcIQPTgMgVnIjhrNdm91PT0UGlvT7Ug==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 260, + "comment": "r = 2^256 - n + 5, x = 5 is invalid; r + n is too large to compare r + n with x, and overflows 2^256 bits", + "flags": [ + "ArithmeticError" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "00000000ffffffff00000000000000004319055258e8617b0c46353d039cdab4ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254e", + "result": "invalid" + } + ] + }, + { + "type": "EcdsaP1363Verify", + "source": { + "name": "github/davidben/ecdsa-s-pow2", + "version": "0.1" + }, + "publicKey": { + "type": "EcPublicKey", + "curve": "secp256r1", + "keySize": 256, + "uncompressed": "046955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfae012ffc24e92c72be71ff2622ee7e549dcb59e7b708f6921c4d4ea29512e2aba", + "wx": "6955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfa", + "wy": "e012ffc24e92c72be71ff2622ee7e549dcb59e7b708f6921c4d4ea29512e2aba" + }, + "publicKeyDer": "3059301306072a8648ce3d020106082a8648ce3d030107034200046955a72c0dad4ed60356f7692649b951fa8ea474bf1cc9549b96c68de4782dfae012ffc24e92c72be71ff2622ee7e549dcb59e7b708f6921c4d4ea29512e2aba", + "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaVWnLA2tTtYDVvdpJkm5UfqOpHS/\nHMlUm5bGjeR4LfrgEv/CTpLHK+cf8mIu5+VJ3LWee3CPaSHE1OopUS4qug==\n-----END PUBLIC KEY-----\n", + "sha": "SHA-256", + "tests": [ + { + "tcId": 261, + "comment": "s = 2^128", + "flags": [ + "ValidSignature" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c40000000000000000000000000000000100000000000000000000000000000000", + "result": "valid" + }, + { + "tcId": 262, + "comment": "s = n - 2^128", + "flags": [ + "ValidSignature" + ], + "msg": "68656c6c6f2c20776f726c64", + "sig": "5f6d3aa0d327c13702513d4299f297ab182fcf670f96291fab19572e7a6e01c4ffffffff00000000fffffffffffffffebce6faada7179e84f3b9cac2fc632551", + "result": "valid" + } + ] + } + ] +} diff --git a/core/spec/v1/registry.md b/core/spec/v1/registry.md index 5ec9056c1..77641117c 100644 --- a/core/spec/v1/registry.md +++ b/core/spec/v1/registry.md @@ -49,6 +49,15 @@ denied. There is no fallback or version negotiation. | `ed25519-v1` | 32-byte compressed point | 64 bytes | RFC 8032 verification of exact preimage | | `p256-sha256-v1` | 33-byte compressed SEC1 | 64-byte `r || s` | ECDSA/SHA-256, low-S required | +An `ed25519-v1` public key uses RFC 8032's canonical compressed encoding: +the 255-bit little-endian y-coordinate is below `2^255 - 19`, and the high +bit records the x-coordinate's sign. For y equal to 1 or `2^255 - 20`, x is +zero and the sign bit must be clear. Noncanonical encodings are invalid keys, +including when a permissive curve decoder accepts them. Point decompression +is also required; verification retains the strict implementation's rejection +of small-order points and malformed signatures. A canonical encoding by +itself does not authenticate a key or message. + A `p256-sha256-v1` public key is exactly 33 bytes: prefix `0x02` or `0x03` followed by the x-coordinate of a point on the curve. The identity (`0x00`), uncompressed (`0x04`), compact (`0x05`), and hybrid (`0x06`/`0x07`) SEC1 diff --git a/demos/airtable-gateway/web/styles.css b/demos/airtable-gateway/web/styles.css index cafb35838..3b7484cfd 100644 --- a/demos/airtable-gateway/web/styles.css +++ b/demos/airtable-gateway/web/styles.css @@ -1,3 +1,3 @@ -:root{font-family:Inter,ui-sans-serif,system-ui,sans-serif;color:#122035;background:#f7f8fa;font-synthesis:none}*{box-sizing:border-box}body{margin:0}header,footer{padding:24px max(24px,calc((100vw - 1120px)/2));display:flex;justify-content:space-between;gap:20px;border-bottom:1px solid #dde2ea}header a{font-weight:800;letter-spacing:.08em;text-decoration:none;color:#122035}header span{font-size:11px;letter-spacing:.09em;font-weight:700;color:#25615a}main{max-width:1120px;margin:auto;padding:64px 24px}.eyebrow{font-size:12px;text-transform:uppercase;letter-spacing:.15em;color:#416489;font-weight:700}h1{font-size:clamp(30px,4vw,49px);line-height:1.16;letter-spacing:-.045em;margin:14px 0 22px}h2{font-size:21px;margin-top:0}.intro{font-size:18px;line-height:1.6;max-width:750px;color:#4a5c72}#connection{margin:30px 0;padding:14px 18px;border-left:3px solid #3574d5;background:#eef3fb;font-size:14px}.workbench{display:grid;grid-template-columns:1fr 1fr;gap:24px;margin:32px 0}article,.result{border:1px solid #dbe2ed;background:white;border-radius:12px;padding:28px}article p,.limits p{font-size:14px;line-height:1.7;color:#526074}dl{display:grid;grid-template-columns:1fr 1.4fr;gap:14px;font-size:13px}dt{color:#637389}dd{margin:0;font-weight:650;overflow-wrap:anywhere}.digest{font-family:ui-monospace,monospace;font-size:11px}label{display:block;font-size:13px;font-weight:700;margin:24px 0 10px}select{width:100%;padding:14px;background:#f7f9fd;border:1px solid #b7c6da;border-radius:7px;font:inherit;font-size:14px}button{width:100%;padding:16px;border:0;border-radius:7px;background:#2563eb;color:white;font:inherit;font-size:14px;font-weight:700;cursor:pointer}button:disabled{opacity:.5;cursor:wait}.small{font-size:12px!important}.stages{display:flex;flex-wrap:wrap;gap:8px;list-style:none;padding:0;color:#55708c;font-size:12px}.stages li{border:1px solid #dde5ef;padding:8px;border-radius:5px}.result #outcome{overflow-wrap:anywhere;font-size:26px}.result p{line-height:1.7;color:#526074}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#111f34;color:#d7e5f7;border-radius:8px;padding:22px;font:12px/1.65 ui-monospace,monospace;max-height:450px;overflow:auto}.result a{display:inline-block;padding-top:12px;font-size:14px;font-weight:700;color:#2563eb}.limits{padding:34px 2px 0;max-width:860px}footer{border-top:1px solid #dde2ea;font-size:12px;color:#637389;justify-content:center}@media(max-width:760px){main{padding-top:34px}.workbench{grid-template-columns:1fr}header{flex-direction:column}article,.result{padding:22px}dl{grid-template-columns:1fr 1fr}.result #outcome{font-size:21px}} +:root{font-family:Inter,ui-sans-serif,system-ui,sans-serif;color:#122035;background:#f7f8fa;font-synthesis:none}*{box-sizing:border-box}body{margin:0}header,footer{padding:24px max(24px,calc((100vw - 1120px)/2));display:flex;justify-content:space-between;gap:20px;border-bottom:1px solid #dde2ea}header a{font-weight:800;letter-spacing:.08em;text-decoration:none;color:#122035}header span{font-size:11px;letter-spacing:.09em;font-weight:700;color:#25615a}main{max-width:1120px;margin:auto;padding:64px 24px}.eyebrow{font-size:12px;text-transform:uppercase;letter-spacing:.15em;color:#416489;font-weight:700}h1{font-size:clamp(30px,4vw,49px);line-height:1.16;letter-spacing:-.045em;margin:14px 0 22px}h2{font-size:21px;margin-top:0}.intro{font-size:18px;line-height:1.6;max-width:750px;color:#4a5c72}#connection{margin:30px 0;padding:14px 18px;border-left:3px solid #3574d5;background:#eef3fb;font-size:14px}.workbench{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr);gap:24px;margin:32px 0}article,.result{min-width:0;overflow-wrap:anywhere;border:1px solid #dbe2ed;background:white;border-radius:12px;padding:28px}article p,.limits p{font-size:14px;line-height:1.7;color:#526074}dl{display:grid;grid-template-columns:1fr 1.4fr;gap:14px;font-size:13px}dt{color:#637389}dd{margin:0;font-weight:650;overflow-wrap:anywhere}.digest{font-family:ui-monospace,monospace;font-size:11px}label{display:block;font-size:13px;font-weight:700;margin:24px 0 10px}select{min-width:0;max-width:100%;width:100%;padding:14px;background:#f7f9fd;border:1px solid #b7c6da;border-radius:7px;font:inherit;font-size:14px}button{width:100%;padding:16px;border:0;border-radius:7px;background:#2563eb;color:white;font:inherit;font-size:14px;font-weight:700;cursor:pointer}button:disabled{opacity:.5;cursor:wait}.small{font-size:12px!important}.stages{display:flex;flex-wrap:wrap;gap:8px;list-style:none;padding:0;color:#55708c;font-size:12px}.stages li{border:1px solid #dde5ef;padding:8px;border-radius:5px}.result #outcome{overflow-wrap:anywhere;font-size:26px}.result p{line-height:1.7;color:#526074}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#111f34;color:#d7e5f7;border-radius:8px;padding:22px;font:12px/1.65 ui-monospace,monospace;max-height:450px;overflow:auto}.result a{display:inline-block;padding-top:12px;font-size:14px;font-weight:700;color:#2563eb}.limits{padding:34px 2px 0;max-width:860px}footer{border-top:1px solid #dde2ea;font-size:12px;color:#637389;justify-content:center}@media(max-width:760px){main{padding-top:34px}.workbench{grid-template-columns:minmax(0,1fr)}header{flex-direction:column}article,.result{padding:22px}dl{grid-template-columns:1fr 1fr}.result #outcome{font-size:21px}} #provider-link{display:block;margin:14px 0;color:#2563eb;font-weight:700;font-size:14px}#provider-link[hidden]{display:none} diff --git a/demos/stripe-gateway/web/styles.css b/demos/stripe-gateway/web/styles.css index cafb35838..3b7484cfd 100644 --- a/demos/stripe-gateway/web/styles.css +++ b/demos/stripe-gateway/web/styles.css @@ -1,3 +1,3 @@ -:root{font-family:Inter,ui-sans-serif,system-ui,sans-serif;color:#122035;background:#f7f8fa;font-synthesis:none}*{box-sizing:border-box}body{margin:0}header,footer{padding:24px max(24px,calc((100vw - 1120px)/2));display:flex;justify-content:space-between;gap:20px;border-bottom:1px solid #dde2ea}header a{font-weight:800;letter-spacing:.08em;text-decoration:none;color:#122035}header span{font-size:11px;letter-spacing:.09em;font-weight:700;color:#25615a}main{max-width:1120px;margin:auto;padding:64px 24px}.eyebrow{font-size:12px;text-transform:uppercase;letter-spacing:.15em;color:#416489;font-weight:700}h1{font-size:clamp(30px,4vw,49px);line-height:1.16;letter-spacing:-.045em;margin:14px 0 22px}h2{font-size:21px;margin-top:0}.intro{font-size:18px;line-height:1.6;max-width:750px;color:#4a5c72}#connection{margin:30px 0;padding:14px 18px;border-left:3px solid #3574d5;background:#eef3fb;font-size:14px}.workbench{display:grid;grid-template-columns:1fr 1fr;gap:24px;margin:32px 0}article,.result{border:1px solid #dbe2ed;background:white;border-radius:12px;padding:28px}article p,.limits p{font-size:14px;line-height:1.7;color:#526074}dl{display:grid;grid-template-columns:1fr 1.4fr;gap:14px;font-size:13px}dt{color:#637389}dd{margin:0;font-weight:650;overflow-wrap:anywhere}.digest{font-family:ui-monospace,monospace;font-size:11px}label{display:block;font-size:13px;font-weight:700;margin:24px 0 10px}select{width:100%;padding:14px;background:#f7f9fd;border:1px solid #b7c6da;border-radius:7px;font:inherit;font-size:14px}button{width:100%;padding:16px;border:0;border-radius:7px;background:#2563eb;color:white;font:inherit;font-size:14px;font-weight:700;cursor:pointer}button:disabled{opacity:.5;cursor:wait}.small{font-size:12px!important}.stages{display:flex;flex-wrap:wrap;gap:8px;list-style:none;padding:0;color:#55708c;font-size:12px}.stages li{border:1px solid #dde5ef;padding:8px;border-radius:5px}.result #outcome{overflow-wrap:anywhere;font-size:26px}.result p{line-height:1.7;color:#526074}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#111f34;color:#d7e5f7;border-radius:8px;padding:22px;font:12px/1.65 ui-monospace,monospace;max-height:450px;overflow:auto}.result a{display:inline-block;padding-top:12px;font-size:14px;font-weight:700;color:#2563eb}.limits{padding:34px 2px 0;max-width:860px}footer{border-top:1px solid #dde2ea;font-size:12px;color:#637389;justify-content:center}@media(max-width:760px){main{padding-top:34px}.workbench{grid-template-columns:1fr}header{flex-direction:column}article,.result{padding:22px}dl{grid-template-columns:1fr 1fr}.result #outcome{font-size:21px}} +:root{font-family:Inter,ui-sans-serif,system-ui,sans-serif;color:#122035;background:#f7f8fa;font-synthesis:none}*{box-sizing:border-box}body{margin:0}header,footer{padding:24px max(24px,calc((100vw - 1120px)/2));display:flex;justify-content:space-between;gap:20px;border-bottom:1px solid #dde2ea}header a{font-weight:800;letter-spacing:.08em;text-decoration:none;color:#122035}header span{font-size:11px;letter-spacing:.09em;font-weight:700;color:#25615a}main{max-width:1120px;margin:auto;padding:64px 24px}.eyebrow{font-size:12px;text-transform:uppercase;letter-spacing:.15em;color:#416489;font-weight:700}h1{font-size:clamp(30px,4vw,49px);line-height:1.16;letter-spacing:-.045em;margin:14px 0 22px}h2{font-size:21px;margin-top:0}.intro{font-size:18px;line-height:1.6;max-width:750px;color:#4a5c72}#connection{margin:30px 0;padding:14px 18px;border-left:3px solid #3574d5;background:#eef3fb;font-size:14px}.workbench{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr);gap:24px;margin:32px 0}article,.result{min-width:0;overflow-wrap:anywhere;border:1px solid #dbe2ed;background:white;border-radius:12px;padding:28px}article p,.limits p{font-size:14px;line-height:1.7;color:#526074}dl{display:grid;grid-template-columns:1fr 1.4fr;gap:14px;font-size:13px}dt{color:#637389}dd{margin:0;font-weight:650;overflow-wrap:anywhere}.digest{font-family:ui-monospace,monospace;font-size:11px}label{display:block;font-size:13px;font-weight:700;margin:24px 0 10px}select{min-width:0;max-width:100%;width:100%;padding:14px;background:#f7f9fd;border:1px solid #b7c6da;border-radius:7px;font:inherit;font-size:14px}button{width:100%;padding:16px;border:0;border-radius:7px;background:#2563eb;color:white;font:inherit;font-size:14px;font-weight:700;cursor:pointer}button:disabled{opacity:.5;cursor:wait}.small{font-size:12px!important}.stages{display:flex;flex-wrap:wrap;gap:8px;list-style:none;padding:0;color:#55708c;font-size:12px}.stages li{border:1px solid #dde5ef;padding:8px;border-radius:5px}.result #outcome{overflow-wrap:anywhere;font-size:26px}.result p{line-height:1.7;color:#526074}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#111f34;color:#d7e5f7;border-radius:8px;padding:22px;font:12px/1.65 ui-monospace,monospace;max-height:450px;overflow:auto}.result a{display:inline-block;padding-top:12px;font-size:14px;font-weight:700;color:#2563eb}.limits{padding:34px 2px 0;max-width:860px}footer{border-top:1px solid #dde2ea;font-size:12px;color:#637389;justify-content:center}@media(max-width:760px){main{padding-top:34px}.workbench{grid-template-columns:minmax(0,1fr)}header{flex-direction:column}article,.result{padding:22px}dl{grid-template-columns:1fr 1fr}.result #outcome{font-size:21px}} #provider-link{display:block;margin:14px 0;color:#2563eb;font-weight:700;font-size:14px}#provider-link[hidden]{display:none} diff --git a/docs/adr/0016-bounded-qualification-commissioning-authority.md b/docs/adr/0016-bounded-qualification-commissioning-authority.md index 427067a8b..04909b563 100644 --- a/docs/adr/0016-bounded-qualification-commissioning-authority.md +++ b/docs/adr/0016-bounded-qualification-commissioning-authority.md @@ -147,7 +147,7 @@ completed production bootstrap. The accounting component reuses the existing bounded opaque record store's insert-once and compare-and-swap operations. `commissioning-budget` is a fifth, -non-expiring record kind in PostgreSQL schema 6. Schema 5 is rejected; disposable +non-expiring record kind in the current PostgreSQL schema 7. Older schemas are rejected; disposable prelaunch databases must be recreated, with no migration or compatibility reader. The existing lifecycle transition contract remains version 4 because its transition and receipt semantics are unchanged. diff --git a/docs/assurance/AP_SPEC_069_STATUS.md b/docs/assurance/AP_SPEC_069_STATUS.md new file mode 100644 index 000000000..fc8af753c --- /dev/null +++ b/docs/assurance/AP_SPEC_069_STATUS.md @@ -0,0 +1,1367 @@ +# AP-SPEC-069 implementation status + +This is the implementation ledger for +[AP-SPEC-069](../specs/0069-authorization-to-execution-formal-assurance.md). +It is not an assurance claim. Completion requires the specification's exact +shipping-source refinement and hosted evidence gates. + +## Qualified payload and protocol-field checkpoint — 17 October 2026 + +**917 compiled/audited claims** qualify, with all 902 previous complete declaration +records unchanged. The 3,534-job Lean build, 18/18 cases, two byte-identical full +translations, all 173 xtask tests and xtask linting pass. No shipping Rust +algorithm, external model, generated artifact inventory or axiom basis changes. + +The new source proofs cover borrowed payloads, bytes and text; raw definite and +indefinite collection heads; protocol map/array/key/null/text helpers; bounded +owned byte copying and exactly 32-byte digests. Accepted payloads earn their exact +contiguous input span and bounds. Thirty-one source-composed cases check large +length/overflow/truncation, UTF-8, cursor, collection, key and digest boundaries. +Standard UTF-8, allocation and copying remain explicit leaf contracts. + +Source: `182ce049a050aeef56cb3ac53dad37a08f5ef9b35d1fbf27816471bd22ca3ac0`. +Review: `ap-spec-069-payload-and-fields-2026-10-17`; inventory: +`0925d275cd5b9885ad2598fc031238737b8e5f2c7ed04ed3226a5bfd02e81d84`; +boundary: `33fbd99ec34b7e232db2b65d19c55419a4ff5c82b1d7e371a0ed6bb35d96ea18`. + +Next: compose these helpers into full object codecs with constructor closure and +inverse completeness, then complete §13.5's verifier, caller, backend history and +cryptographic integration. The private owned-String/profile composition prototype +is not included here. E1–E5/M6 and exact-release hosted gates remain open. See +spec §§13.40–13.41; keep coding without waiting on CI. + +## Qualified record-validator and cursor checkpoint — 17 October 2026 + +**902 compiled/audited claims** qualify, with all 886 previous full declaration +records unchanged and no new axioms. The complete 3,531-job Lean build, 18/18 +qualification cases, two byte-identical full translations, all 173 xtask tests +and affected-target linting pass. There are 25 reviewed external models and zero +compiled external axioms. Two transparent String methods extend the existing +ordering model's interface; the logical interface change is explicitly reviewed. + +The shipping complete record validator now earns nonempty bounded collections, +global ordering, text validity, duplicate absence and temporal shape from actual +acceptance, with exact typed refusal precedence. Concrete native String/profile +comparison dictionaries close the prior generic premises. Frozen native parity +covers 43,200 complete records; 43 connection and 232 active gateway tests pass, +with 26 existing gateway tests still ignored. + +The source-exact cursor batch covers construction, head/integer/null reads, +first-byte classification and completion. It preserves refusal cursor semantics +and exposes two caller limits: peeking is not payload validation and a completion +length check does not establish input identity. The harness inventory now safely +excludes flat explicit-path test modules and checks all 48 real harnesses without +counting test helpers as shipping targets. It still fails closed on unresolved +module/include constructs. + +Source: `b5aa6810c742d3ee53b37b18d2d7a9b5a3f25c5cf5f2af83cf398ede95e33814`. +Review: `ap-spec-069-record-and-cursor-2026-10-17`; inventory: +`9ca7caa5ab864d0bcc5936fd696f7beeefdbf1b34a51599357d558e2ca7a5d69`; +boundary: `33fbd99ec34b7e232db2b65d19c55419a4ff5c82b1d7e371a0ed6bb35d96ea18`. + +Next: payload/UTF-8/collection and full object-codec source proofs. The private +payload prototype is not included in this checkpoint. Full E1–E5/M6 and +exact-release hosted gates remain open. See spec §§13.36–13.39; keep coding +without waiting on CI. + +## Qualified strict-order checkpoint — 17 October 2026 + +**886 compiled/audited claims** qualify, preserving all 882 preceding full +records and the existing axiom basis. The 3,524-job Lean build, 18/18 cases, +two byte-identical full translations, 42 connection tests, 232 active gateway +tests, affected-target linting and nine coverage/historical regressions pass. +The existing 26 ignored gateway tests and 25 reviewed model basis are unchanged. + +Both real allowlist consumers now call the source-proved allocation-free +ordering scan. Its exact result and earned duplicate absence expose the +comparator contract and strict-order laws. Frozen parity covers 5,461 sequences +per integer/String/profile comparator and 688 complete allowlist/decoder cases. +The temporal oracle retains its own frozen ordering helper. + +Source: `1a15772736daa1ab26f69e4859691cb0316e5232cdb2f54925142ff68ca79255`. +Review: `ap-spec-069-strict-allowlist-order-2026-10-17`; inventory: +`dc748ef710367d4817f350f08dc1fccba042d454fa20af73eef1136d6a536cfe`; +boundary: `e3c0b057f86b94b84182655b8cd8b4b923a5f54b50ba7031923891976758c375`. + +Next: close the actual String/profile comparator instances and compose the +complete record validator; its private construction prototype is not qualified. +Full E1–E5/M6 and exact-release hosted gates remain open. See spec §§13.34–13.35. + +## Qualified complete record-time checkpoint — 17 October 2026 + +The latest batch qualifies **882 compiled claims**, all 877 preceding full +records unchanged and no new axioms. The full 3,523-job Lean build, 18/18 cases +and two byte-identical clean translations pass; there remain 25 reviewed models, +none unreviewed and zero compiled external axioms. Source closure: +`10abedf6c85d16e017b07b4177983a0e58db46a099995b01c8a7b56f6c4e26ec`. + +Actual constructor/decoder validation consumes the complete proved temporal +shape: ordered creation/update, revocation timestamp exactly for revoked state, +and inclusive lifetime bounds on every present revocation timestamp. Two +independent model laws preserve that shape through the existing administrative +conditions and field updates. Neither claims a whole native I/O caller proof. + +All 40 connection tests, 232 active gateway tests and affected-target/xtask linting +pass; 26 ignored gateway tests stay unchanged. A frozen complete validator and the +real canonical decoder agree on 450 combinations: 65 accepted complete records +and 385 typed refusals. Source cases cover useful success and malformed shapes. +Coverage v4 and historical reproduction retain the primary 134/1047 function, +1833/11563 line and 23/82 check-site scope. + +Review: `ap-spec-069-complete-record-times-2026-10-17`; inventory: +`b4353da77341c99dd42adde58ed8777272ca301797322aa29978145f7e796bca`; +boundary: `fc09192a131ddba7b342418e42f24f58e141d0a740c2a73b0ed01ad4af1c7256`. + +Full record/resource/caller closure, physical-clock correspondence and the rest +of §13.5/E1–E5/M6 remain open, including hosted exact-revision evidence. Strict +allowlist ordering is prepared privately with a source-exact generic loop and +independent pairwise/no-duplicate laws under explicit comparator contracts. +Continue that cutover without waiting on CI. See spec §§13.32–13.33. + +## Qualified actual String-constructor checkpoint — 17 October 2026 + +The latest checkpoint qualifies **877 compiled claims**, all 871 preceding full +declaration records unchanged, with no new axioms. The 3,522-job Lean build, +18/18 qualification cases and two byte-identical clean full translations pass. +There remain 25 reviewed models, none unreviewed and zero compiled external +axioms. Source closure: +`00e36a422d77f9710709d41550f7fe4c7918d5173b4552bafcd023e4168b88d9`. + +The actual ProviderKind, ConnectionAlias and SemanticId owned-String constructors +now have exact source language/error proofs and success-earned payload validity. +Their explicit portable U32 representation bound belongs to the existing reviewed +String/UTF-8 interface. It assumes no valid identifier or desired parser result. +The three standard projections are direct aliases to existing reviewed models; +all Auths constructors/helpers are transparent. Positive/Unicode-refusal witnesses +are kernel-checked without native axioms. + +All 39 connection tests and affected-target/xtask linting pass. Character-language +oracles check 116,608 UTF-8 cases, with 7,618 provider, 7,618 alias and 20,026 semantic +successes, exact payloads/errors, additional Unicode/NUL and size boundaries. +Selector checksum/path regressions pass. The expanded unit contains four +non-shipping selectors, 17 imported function records and three uncompiled standard +interface template stubs; the artifact inventory has 99 files. Coverage v4 and +historical reproduction retain 134/1047 functions, 1833/11563 lines and 23/82 sites. + +Review: `ap-spec-069-actual-string-constructors-2026-10-17`; inventory: +`9450e7c2b425e8691d8eb74bafe494b3863715961aea74549ff7ed4b59892ef2`; +boundary: `730bcc49302621155bf0ed66b4a3eb493b43b0595a69a17584f6017df083a040`. + +Other Into paths, complete record/codec/caller closure and the remaining +§13.5/E1–E5/M6 program stay open, including exact-revision hosted evidence. The +complete durable-record timestamp predicate and preservation proofs are prepared +privately, outside this checkpoint. Continue with that cutover without waiting +for hosted CI. See spec §§13.30–13.31. + +## Qualified recovery and administration checkpoint — 17 October 2026 + +The latest batch qualifies **871 compiled claims**, with all 861 previous full +declaration records unchanged and no new axioms. Two clean full translations +are byte-identical; all 18 qualification cases pass. There remain 25 reviewed +external models, none unreviewed and no compiled external axioms. Source closure: +`016c236971e9cd58ab0d6fd762ac7febf2e86919bda2a376e95802a80d10c8aa`. + +Five actual record methods consume source-proved recovery/administration guards. +Revocation always refuses recovery first. Successful recovery earns a positive +operation generation bounded by the durable record; binding selection earns the +exact current pair or a valid older recorded pair. The actual constant-time +commitment check is preserved. State changes, rotation and authorization +replacement earn terminal revocation and nondecreasing timestamps. + +The 3,520-job full Lean build, 38 connection tests, 232 active gateway tests and +affected-target/xtask linting pass; 26 existing ignored gateway tests stay unchanged. +Frozen full-record/native parity covers 2,250 bindings (210 successes), 450 state +transitions, 450 rotations and 600 authorization replacements. Rotation and +replacement each have 30 useful successes. Source qualification also exercises +success, zero/future generation refusal, terminal revocation, commitment selection, +no-op state changes and time regression. The enum-context regression preserves +all native enum bodies and rejects inventory drift. + +Review: `ap-spec-069-connection-recovery-administration-2026-10-17`; inventory: +`978677ea2fd11b7b04029f70566e6b7711650b907006a5057ac21de7b9349e6d`; +boundary: `e47a70caeb2efe34fdbd8936cbf4091c81d191de15000389ba457434c699df5d`. + +Complete record/caller projection, operation authentication, primitive comparison +correspondence, actual credential-store lease and reload/write histories remain +open under §13.5/E1–E5/M6, as does exact-revision hosted evidence. Direct String +constructor proofs are being prepared privately using the existing reviewed +standard-interface models. See spec §§13.28–13.29; continue without waiting on CI. + +## Qualified constructor and connection-key checkpoint — 17 October 2026 + +The latest batch qualifies **861 compiled claims**, with all 838 previously +pushed complete declaration records unchanged. Two clean full translations are +byte-identical; all 18 qualification cases pass, with 25 reviewed external +models, none unreviewed and no compiled external axioms. Source closure: +`390c119b23d2172f15bc6b026236af76a28d9f0f3d13e705b770de7914e9ee0c`. + +Shipping constructors consume proved full-buffer provider/alias, workload and +semantic-identifier grammars. Acceptance earns the stated size bounds and NUL +absence; semantic identifiers also earn whole-buffer ASCII. The actual unchanged +profile constructor has a direct transparent source proof of its version refusal +and exact field preservation. The gateway hashes a source-proved domain/provider/ +separator/alias preimage whose independent framing proof binds both fields under +the earned provider grammar. No hash-injectivity axiom is added. + +The complete 3,519-job Lean build, 35 connection tests, 40 kernel tests, 232 active +gateway tests and affected-target/xtask linting pass. Existing ignored gateway +tests remain 26. Native tests compare every byte pair and size boundaries, +589,824 binary preimages and 64 typed gateway keys with frozen preceding behavior. +Coverage v4 inventories the actual transparent constructor selected by a +non-shipping entrypoint, preserves full local spans and validates its imported +declaration span separately. Historical coverage reproduction stays byte-identical; +headline scope remains 134/1047 decision functions, 1833/11563 lines and 23/82 sites. + +Review: `ap-spec-069-connection-byte-framing-2026-10-17`; inventory: +`1b4a2587677994a404e5f8808c10d0f1fbc2288e10d1b8c13d3e42fffbf1beb2`; +boundary: `94d0a3fefdb75a3344bb2822641bdefff372d261deef3ebd81a2a55c1abeca49`. + +The complete String/record decoder, actual reload/lease/write association, backend +history and whole §13.5/E1–E5/M6 program remain open, including exact-revision +hosted evidence. A recovery-lease component is being prepared privately; it is +not part of this qualified checkpoint. Continue implementation without waiting +on hosted CI. See spec §§13.25–13.27. + +## Qualified connection-entry checkpoint — 17 October 2026 + +The latest batch qualifies **838 compiled claims**, preserving all 832 previous +complete declaration records. Two clean full translations reproduce +byte-identically; all 18 qualification cases pass, with 25 reviewed models, +none unreviewed, and no compiled external axioms. Shipping source closure: +`dbdeafb8829de25fd97cdee75384bf275314efc725134b4fb388e1681a72a141`. + +The runtime consumes exact source-proved active-state, workload-membership and +full profile identifier/version checks, plus the existing proved exact-byte +primitive for reload comparison. Native parity checks 1,728 constructor-valid +record queries (126 permitted, 1,602 refused) and every canonical byte mutation. +The full Lean build, 231 active gateway tests, 39 kernel tests and affected-target/ +xtask linting pass. Existing ignored gateway tests remain 26. Source qualification +checks useful acceptance, disablement and profile-version mismatch witnesses. + +Complete record decoding, record-to-projection correspondence, reload/lease/write +association and full E4.6 runtime composition remain open, as does the rest of +§13.5/E1–E5/M6 and exact-revision hosted evidence. Constructor byte predicates +are the next privately prepared component. See spec §13.24. + +## Qualified reservation checkpoint — 17 October 2026 + +The latest batch qualifies **832 compiled claims**, with all 798 complete +records from the previous pushed checkpoint unchanged. Both clean full +translations reproduce byte-identically; all 18 qualification cases pass. +There are 25 reviewed external models, none unreviewed, and no compiled +external axioms. Production source closure: +`1a07b71048278076845fd283106a674087d05a89d4bd2dd3560c2f17dd99dce5`. + +Shipping code now consumes the proved complete claim/count/sum builder, exact +decoded cumulative-record validator, shared count-to-sum slot lookup and complete +ordered reservation decision. Successful admission earns every count/slot/sum +bound, all parallel-vector lengths and overflow-safe sums. Native tests cover +all 289 aligned batch layouts, 486 decoded record combinations with independent +success/refusal counts, and 139,968 ordered admission combinations. + +The full Lean build and 229 active gateway, 38 kernel and 24 bounded-policy +library tests pass, as do affected-target/xtask linting and final store aggregate +scenarios. Existing ignored gateway tests remain 26. Coverage v3 reports +134/1047 decision functions, 1833/11563 code lines and 23/82 check sites; +the historical study still reproduces byte-identically. + +Full authenticated caller mapping, backend linearization and runtime/history +correspondence remain open, as do the rest of E1–E5/M6 and exact-revision hosted +evidence. The next connection-entry membership component is a private prototype, +not qualified shipping code. See spec §§13.20–13.23 and the remaining-program +table in §13.5. + +## Qualified complete slot-batch checkpoint — 16 October 2026 + +The latest batch qualifies **809 compiled claims**, with all 798 previous +complete declaration records unchanged. Both clean full translations reproduce +byte-identically; all 18 qualification cases pass, with 25 reviewed external +models, none unreviewed, and no compiled external axioms. Source closure: +`339d80930b9e3b5cb85900bd15713284f49802820a7225c7d44afa5792a43d9e`. + +Shipping reservation assembly consumes the proved complete builder: exactly one +claim first, every count and sum slot, and at most 33 entries on success. +Mismatched vectors, excessive cardinalities and cumulative overflow fail closed. +All 227 active gateway tests, 35 kernel tests and affected-target clippy pass. +A frozen shipping constructor oracle checks canonical bytes, keys and expiries +for all 289 aligned layouts. Coverage version 3 fixes numbered-loop +classification using explicit translation metadata; all seven regression checks +pass and the historical study remains byte-identical. + +The next component validates decoded cumulative records. JSON parsing, backend +linearization, authenticated caller mapping, count/sum coupling and full +runtime/history composition remain separate obligations. Whole E1–E5/M6 +completion and exact-revision hosted evidence remain open. See spec §13.20. + +## Qualified aggregation/retry checkpoint — 16 October 2026 + +The latest batch qualifies **798 compiled claims**, with all 757 previous +complete declaration records unchanged. Both clean full translations reproduce +byte-identically; all 18 qualification cases pass. The inventory has 25 reviewed +external models, none unreviewed, and no compiled external axioms. Source closure: +`d75d2be54aeef9a943fb35736ead1ff024ffe838c11565c10f9ef647b99193c4`. + +Shipping count/sum counter derivation consumes the actual proved aggregators. +The source loops earn unique IDs and minimum per-ID capacities on the admitted +16-link domain; sum updates retain the first count-slot bound. Reservation retries +consume a total checked interpreter for claim/count/sum conflicts, including +malformed indices, parallel-array bounds and word overflow. The slot-availability +guard now uses the already proved length-checking count predicate. + +The complete Lean build, 225 active gateway tests, 33 kernel tests and affected +Rust clippy pass. Native parity compares complete sorted count/sum/slot results +to the preceding implementation. The decision-scope coverage measurement remains +133/1046 functions, 1814/11544 lines and 23/82 check sites; gateway additions are +recorded in its separate translation inventory. Exact-revision hosted evidence +remains required; no whole E1–E5/M6 milestone is complete. + +The subsequent complete slot-batch checkpoint above supersedes the prepared +prototype status recorded at this aggregation/retry checkpoint. Full authenticated caller mapping, +count/sum coupling, backend linearization, cumulative-record decoding and +runtime/history composition remain open. See spec §§13.18–13.20. + +## Qualified counter/slot checkpoint — 16 October 2026 + +The current batch qualifies **757 compiled claims**. All 741 previous complete +declaration records are unchanged. Both clean full translations reproduce +byte-identically; all 18 qualification cases pass, with 25 reviewed external +models, none unreviewed, and no compiled external axioms. The source closure is +`8701bdf464825fa990591db6833a3b35dc58806769a80520651dcade26968222`. + +Production counter/slot hashing now consumes the translated exact preimage +builders. The new proofs cover the component lengths and bytes, all four +domains, window coordinates, typed counter IDs and slot words; count/sum +source-output identity binding; framing injectivity; and 774/844-byte counter +frame bounds. SHA-256 security remains a separate primitive contract. The +actual hashing callers match their frozen previous implementation in native +parity tests. The complete Lean build, 224 gateway tests, 26 kernel tests and +affected-target clippy pass. Hosted exact-revision evidence remains required. + +Counter aggregation, full runtime/backend correspondence and the remaining +E1–E5/M6 obligations remain open. A separate keyed-minimum prototype is prepared +for the next batch. See spec §13.17. + +## Qualified checkpoint — 16 October 2026 + +The current local batch qualifies **741 compiled claims**, including all 671 +previous complete statement/constant/axiom records unchanged. Two clean full +translations reproduce byte-identically; all 18 qualification cases pass, with +24 reviewed external models, none unreviewed, and no compiled external axioms. +The shipping source closure is +`f9041056a71f53030c45a3a9e0c4208da53fc5a56d26b03466ef119e54104549`. + +New components cover the complete principal-ID constructor, constructor-earned +scope ordering through trust decoding and status selection, exact schema-name +lookup, logical-operation token/framing, and the actual frontier search methods +with a composed 64-read bound. The shipping compiler rejects duplicate JSON +members before source/lock decoding. Independent history models combine +chain/count/sum bounds with durable claims, crashes, lost acknowledgements and +one-use ownership; actual backend/driver correspondence remains separate. + +The affected native crates pass 327 library tests (26 existing gateway tests +remain ignored). Coverage's six checks include byte-identical historical +reproduction and compiled-constant handling of method notation. Coverage v2 +reports 133/1046 decision functions and 1814/11544 decision code lines in the +refined closure, and 23/82 check sites. Exact-revision hosted gates remain +pending; no complete E1–E5 or M6 milestone is claimed. + +| Milestone | State | Evidence / remaining work | +| --- | --- | --- | +| M0: claims and extraction slices | In progress | Shipping head reading/writing and identifier lookahead/scanning refine explicit grammars, with positive/refusal cases and compiled statement/axiom audits. Full protocol-object refinement and hosted qualification remain required. | +| M1: complete codec | In progress | The head codec has a source-to-source round trip and a one-to-nine-byte output bound. Successful canonical-action decoding has exact re-encoding and accepted-encoding uniqueness proofs. The shared identifier validator has exact scan/bounds refinements and a validated-string representation bridge. Complete object/carrier, work/allocation, constructor and codec refinements and hosted corpus/property evidence remain required. | +| M2: crypto integration | In progress | The shipping shared signing framer refines an independent byte grammar, supplies its validated frame premises, and proves input binding, object-domain separation, exact length and oversized-profile refusal. The shipping Ed25519 field/sign and P-256 compressed-form guards now have total exact refinements. Caller unsigned-object construction, complete suite glue/dispatch and commitments remain E5.1–E5.4 obligations. | +| M3: complete verifier | In progress | The public observed evaluator now refines independent structural validation followed by all/any/k semantics. The source validator accepts iff the independent structural contract holds; invalid plans preserve both callback states without callback premises. The ordinary facade and event accessor are now also refined. Callback implementations, registry/stage composition, sealed projection and the full E2.1–E2.5 claim remain. Exact-revision hosted gates are pending for this expansion. | +| M4: mapping and driver | In progress | Exact source field-name lookup and an independent named/positional projection relation are proved; duplicate source/lock JSON members are refused. Full source compiler, sealed projection and driver-to-I/O correspondence remain E3.1–E3.5. | +| M5: history and storage | In progress | Both backends fence slot admission against a durable monotone collection cutoff. The native verifier now retains the selected witness's temporal horizon, which the final driver intersects with installed gates and the operational cap. Exact endpoint and cutoff leaves refine independent models. Complete temporal-witness, backend, admission and driver-history correspondence remain to be qualified. | +| M6: composed assurance | Pending | Final history theorem, adequacy review, and exact-release evidence. | + +No E1–E5 workstream is complete yet. Existing component claims retain their +current scope; new source or a successful model proof alone does not expand +the public assurance claim. + +## First exact-source slice + +`Auths.Codec.Refinement.read_head_refines` covers the translated production +`read_head` and `read_tail`. Every result is a typed CBOR success or refusal; +success agrees with the independent grammar and advances one through nine +bytes without exceeding the input. `read_tail_bounded` fixes both verdict and +value for widths zero through eight. `read_head_accepts_encoding` supplies +completeness on valid independent head encodings with arbitrary following +bytes. The shipping head encoder now also refines the independent grammar: +it refuses invalid major tags, emits the shortest head for valid tags, and +produces one through nine bytes. Its actual output round-trips through the +shipping reader with arbitrary following bytes. These are head-codec claims; +they do not yet establish a complete protocol-object codec. + +The qualification corpus includes an accepted unsigned head, a missing-byte +refusal at an outlying cursor, and a truncated four-byte argument. The +compiled axiom check reports only `propext`, `Classical.choice`, and +`Quot.sound`, within the existing allowlist. Existing audited theorem +statements were compared with their previous statement hashes and are +unchanged. Authoritative Lean now additionally replays the public theorem +closure into a fresh kernel environment with the pinned `leanchecker`. + +The local qualification construction passed two byte-identical clean +translations, all ten qualification cases, and the compiled audit of 338 +claims. A separate fresh-environment replay of `Auths.Codec.Refinement` +passed. These are development results; the exact pushed revision still +requires the hosted authoritative gates. + +The canonical-action path now uses a bounded owned attachment transition and +an owned encoder fold. Named error converters and explicit borrowed-result +matches keep the actual source visible to both translation and coverage. Its +complete Auths constructor closure is extracted; no Auths algorithm in that +closure is opaque. The accepted-byte and uniqueness theorems are component +properties; totality, inverse completeness, resource bounds, full carrier +validity and every other protocol object remain open. + +## Collection-fence slice + +The file store persists and synchronizes `.collection.json` before deleting +slots. PostgreSQL schema `/7` (transactional-store contract `/5`) orders +admissions with a shared row lock and collection with an exclusive row lock; +the cutoff and deletions commit together. Both backends check every slot's +actual expiry in the atomic claim/slot batch. A closed window records a +terminal refusal without reserving slots or granting an execution handle. +Collection with a zero deletion limit still closes the window conservatively. + +File stores reject obsolete unmarked state and missing, corrupt, oversized, +or obsolete collection metadata. Missing locks are not silently recreated for +an initialized store. File reads check size before allocation and cap the +read even if the file changes. Key uniqueness and wrong-kind reads now agree +with PostgreSQL across all five record kinds. + +The independent cutoff model permits arbitrary finite interleavings and any +number of workers, including crashes, recovery, lost acknowledgements, and +partial sweeps. The shipping cutoff comparison and monotone-advance functions +refine that model. These statements do **not** yet establish the actual +backend/driver-to-history correspondence, aggregate counter derivation, the +complete admission algorithm, or E4 as a whole. The shared backend suite adds +collection/admission races, restart and old-clock attempts, lost commit +acknowledgements, marker/lock corruption, and refusal before any lease/write. +Hosted conformance remains required evidence. + +The collection-fence qualification includes the ninth production extraction +crate, four accepted/refused boundary examples, six additional audited +claims, and two byte-identical clean translations. The source comparisons +remain narrower than the backend transaction and crash-recovery contracts. + +## Entry-deadline slice + +The sealed native result retains the successful anchors and grants/actions' +expiry, counted approvals and their anchors/status, selected observation +freshness and observer anchors, and selected assurance freshness. Status +methods return a typed horizon with their decision; the native method uses +only the relevant latest in-scope statements. Missing revocation-list entries +retain the snapshot window, without inventing a statement-age requirement. +Failed branches and ignored approvals do not contribute temporal bounds. + +The production command intersects that witness with the 60-second maximum. +Preparation retains the accepted qualification or commissioning endpoint; +the final gate intersects it with the current installed gate and refuses +clock rollback. Inclusive native/qualification bounds and exclusive +commissioning bounds keep their endpoint modes, without adding one to a +timestamp. Expiry refuses entry and retains consumed claim/slot capacity. +The monotonic deadline and final secret-lease check remain required. + +The new Lean endpoint model covers arbitrary finite intersections, including +equality, and the translated shipping intersection and time predicate refine +it. The complete verifier-to-temporal-witness and driver-to-I/O proofs remain +open; the endpoint refinements alone do not establish those correspondences. +Native quorum, status-age, exclusive/inclusive boundary, rollback, and retained +capacity cases are added for hosted validation. + +The deadline slice passed the local qualification construction: two +byte-identical translations, ten qualification cases, and the compiled +338-claim audit. The previous 332 statements are unchanged. The new claims +use only the existing foundational axiom allowlist. Hosted end-to-end and +backend evidence is still required for this revision. + +## Head-encoder slice + +The actual `encode_head` and bounded `append_tail` now refine the independent +big-endian grammar. Invalid major tags receive a typed refusal, successful +output has one through nine bytes, and every valid encoding round-trips +through the actual head reader with arbitrary following bytes. Positive +qualification cases cover the inline boundary and maximum u64 argument; +an invalid major tag is refused. This does not prove complete-object +canonicality or physical allocator behavior. + +Local qualification passed two byte-identical clean translations, ten +qualification cases, and the compiled audit of 342 claims. Existing theorem +statements are unchanged. The hosted lint failure was reproduced on affected +packages and fixed without weakening the gate; the exact pushed revision +still requires authoritative hosted tests. + +An isolated action-decoder experiment with owned attachment state now passes +strict translation with the constructor bodies included. The candidate uses +bounded byte validation for identifier control/whitespace rules and owned +attachment transitions. Exhaustive native comparison covers every Unicode +scalar and allowed-scalar concatenations. Constructor and object refinement +proofs are still required; the experiment remains outside the production +qualification inventory. + +## Verification checkpoint: 15 October 2026 + +Hosted run `38808755694` passed repository preflight, generated-artifact +freshness, fast Lean feedback, Kani, compliance, secret scanning, and the +OpenTofu, PostgreSQL, and records API live jobs. The full authoritative job +found a stale gateway semantic-closure fixture and an incorrect new test +expectation: replay recovery may lease a credential for its read-only +observation. The corrected test checks exactly one read and no provider +writes; the focused file-store conformance case passes locally. The closure +fixture was regenerated from its real production inputs. + +The dependency gate also reported four Rustls advisories fixed upstream in +0.23.46. The workspace requirement and lockfile now select that release, +without advisory exceptions. The patched closure passes local qualification +construction: 342 audited claims, all ten qualification cases, and two +byte-identical translations. The patched revision still needs hosted gates; +none of these results completes an E1–E5 workstream. + +## Identifier-validation slice + +The shipping model now uses one bounded byte validator before copying an +identifier into its owned string. Its fixed UTF-8 prefix set agrees with the +pinned character rule for control and whitespace characters. URI-scheme +validation and every identifier-specific bound remain in their existing +constructors. There is one production path. + +The independent scalar model proves correctness for any finite stream through +U+10FFFF, including arbitrary following bytes and the absence of false matches +across scalar boundaries. The exact shipping lookahead is total on every byte +slice/cursor; the full scan terminates with a decreasing remaining-byte +measure. The bounded validator fixes acceptance for every translated carrier +and maximum. Its Unicode-policy composition retains an explicit UTF-8 byte +representation premise; this does not by itself prove UTF-8 decoding or every +constructor/carrier invariant. + +The qualification now extracts 141 local model function records and seven +standard-library externals, with zero opaque local functions. The additional +externals are transparent borrowed-string length, emptiness, and byte access; +they introduce no axiom or assumed Auths predicate. Positive/refusal cases +cover exact byte bounds, empty input, U+2028, and the nearby permitted U+200B. +Native qualification includes every Unicode scalar in isolation and an ASCII +frame, the concatenation of all allowed scalars, and randomized comparison +with the previous character predicate. + +Local qualification passed two byte-identical translations, ten qualification +cases, and 347 compiled claims. The previous 342 statement hashes are unchanged; +the five additions use only the existing foundational axiom allowlist. The +hosted authoritative implementation job for the preceding `f97d7e7f` checkpoint +passed, including the storage and deadline tests. This identifier checkpoint +still requires its own hosted gates. No E1–E5 workstream is complete yet. + +The preceding hosted translation job found a seven/eight-character tool-version +reporting mismatch in the two newly extracted crates. Normalization now derives +every report path from the authoritative artifact mapping and records the full +pinned commit; a regression test covers all nine reports and rejects an +unrelated tool identity. This changes reporting, not the translated algorithm +or accepted toolchain. Local qualification of this repair again passes all +347 claims, ten cases, and byte-identical reproduction. + +The PostgreSQL fixture now creates its host output directory before Docker, +preserving runner ownership of `target/`. Source qualification plans were +regenerated with the current schema-7 store descriptor; all six focused plan +and commissioning tests pass. The hosted PostgreSQL qualification for `62f859c5` passed, including multi-host +capacity checks, hostile gateway/store conformance and physical backup/restore +([run](https://github.com/auths-dev/auths-proof/actions/runs/38822086710)). +This backend evidence does not complete the E4 driver/history correspondence. + +## Canonical-action and string bridge construction + +The expanded codec has accepted-byte and encoding-uniqueness proofs, together +with exact validated-string representation, copying, borrowing and UTF-8 model +acceptance. The compiled audit contains 353 declarations; the preceding 347 +statements are unchanged and the transitive axioms remain `propext`, +`Classical.choice` and `Quot.sound`. Qualification passes all ten modules, +native codec/model/authority/author tests and two byte-identical translations. +The expanded codec has 73 local and 75 imported function records, including +its actual constructors, with zero opaque Auths functions. Its six reviewed +external models introduce no compiled axiom. The exact production source +closure is `f67c463f9f8e7d4e8c9674f86f385da7e4144edbd38f9ceede3b8f93263e463e`. +The hosted gates for the expanded checkpoint remain required. + +Native tests retain the former action codec and attachment checks only as +refactor-equivalence oracles. They cover successful random actions, optional +budgets, truncation, byte mutations, duplicate attachments, collection bounds +and aggregate-byte bounds. The qualification now includes native codec tests. +The reviewed sorting model is restricted to the actual stateless digest-key +callback and lawful digest order; arbitrary stateful callbacks are not modeled. + +This does not complete E1. Full constructor validity, inverse completeness, resource accounting and the +remaining protocol objects still require work. The positive whole-decoder +witness is supplied by the following slice. + +## Whole-action witnesses and constructor validity + +The complete translated action decoder now has a kernel-checked positive +witness: a 26-byte nonempty canonical action with every required field, under +explicit valid limits. Its encoder returns those exact bytes. The same source +refuses duplicate keys and nonminimal integers as `NonCanonical`, and invalid +UTF-8, truncation and trailing bytes as `Malformed`. A 25-byte action limit +refuses the input; the exact 26-byte limit accepts it. These are codec witnesses; +the opaque profile and body do not claim application authorization. + +Five typed string constructors now have exact decisions on every validated +UTF-8 string within the standard-library byte-carrier bound, against an +independent nonempty/byte-length/Unicode predicate. The action constructor +also has an exact nonempty/8 MiB body decision, preserving its other incoming +typed fields. For every successful complete action decode, the actual returned +body is nonempty and fits both the protocol ceiling and the deployment's +canonical-body-byte limit. These are accepted-result guarantees; totality, +full decoded-carrier validity, inverse completeness and aggregate work and +allocation bounds remain open. + +The proof evaluation rules are equalities proved for all their inputs. They +use a conservative 32-bit branch that works on either supported machine width +and retain the original operation elsewhere. No platform-width assumption, +`native_decide`, opaque Auths algorithm or new axiom is introduced. Native +integration cases mirror the exact positive/refusal inputs for hosted parity. + +The compiled construction audit has 374 declarations. All preceding 353 +statements are unchanged, and every transitive axiom remains in the existing +three-name allowlist. The new full qualification passes: two byte-identical clean translations, all +ten qualification modules and the native codec/model/authority/author tests, +including the new positive/refusal integration cases. The bound production +source closure is `f67c463f9f8e7d4e8c9674f86f385da7e4144edbd38f9ceede3b8f93263e463e`. +The exact-revision hosted gates remain required; no E1–E5 workstream is complete. + +The preceding checkpoint `39c0cfd8` passed hosted PostgreSQL lifecycle +qualification, recipe qualification, gateway isolation, both customer demos +and Python/TypeScript package checks. Main CI passed preflight, fast Lean, +compliance, dependency/secrets and live-provider jobs. Its authoritative +workspace job exposed a valid base64url public key beginning with `-` being +misparsed as an option in the release CLI. Both certificate commands now +accept that argument, with a deterministic parser regression and the exact +previously failing commissioning journey passing locally. The patched revision +still requires the hosted authoritative gate. + +Coverage continues to use the declared local-translation measurement. Imported +constructor bodies are present in the extraction and compiled proof closure, +but are not newly counted as local functions to inflate the headline metric. + +## Shared signing-frame slice + +The actual `hash::signing_preimage` is now extracted with its complete Auths +closure. It emits exactly the independent protocol grammar: `AUTHS`, protocol +V1, registered object tag, profile byte length and bytes, profile version, +unsigned-statement byte length and bytes. The qualified source supports the +six existing tags, including observation 9 and approval 10. The source's own +successful checked conversions establish every frame-validity premise. + +For every successful source call, equal preimage bytes imply equal object +kind, profile bytes, profile version and unsigned statement bytes. Different +object kinds cannot share preimage bytes. Exact output length is +`21 + profile_bytes + statement_bytes`; a profile longer than 65,535 bytes is +refused with `LimitExceeded`. These are syntactic byte-binding statements, +without any assertion of collision-free hashes. Kernel examples cover an +ordinary Grant frame and an Approval frame with a multibyte profile and the +maximum u16 profile version. + +The shipping implementation now uses the existing named typed-error converter +and three explicit checked capacity additions. This preserves the prior +preimage bytes and errors and exposes the real source to translation and +coverage. The former helper exists only inside the test module as a parity +oracle. Native qualification compares arbitrary strings, versions and bodies +across all six tags, plus exact ASCII/UTF-8 length boundaries. + +Full local qualification passes: 387 audited declarations, all ten modules, +native model/codec/authority/author cases, and two byte-identical clean +translations. The prior 374 statement records are unchanged; all transitive +axioms remain in the original three-name allowlist. The codec closure has +74 local and 76 imported function records and zero opaque Auths functions. +The additional reviewed usize-to-u16 adapter is a transparent checked +conversion, with no compiled axiom. Production source closure: +`60a181a4bac97f3663b5ac49b6663924fac04d94b635525cd44827b3631dc899`. + +This does not complete E5. The public signing wrappers' construction of the +canonical unsigned object and signature descriptor, suite/key decoding and +dispatch, commitment preimages, primitive contracts and composed authorization +still require their own source-bound proofs. The exact pushed revision must +also pass hosted qualification. At the preceding `d386aec2` checkpoint, +authoritative implementation, Kani, fast Lean, compliance, dependencies, +secrets and the live-provider jobs passed; translation remained in progress +when this slice was prepared. + + +## Finite child-summary slice + +The shipping composition evaluator now uses one constant-space summary of +immediate-child outcomes. It retains the authorized and indeterminate counts +and the minimum denial/requirement directly, replacing the prior diagnostic +vectors. All child evaluations and observer calls remain in their previous +order. The former evaluator exists only as a native test oracle. Property tests +compare nested conjunctions, alternatives and thresholds with callbacks that +share mutable test state, checking the exact result, visited leaves, observer +events and final callback state. + +The actual accumulator update, conjunction finalizer and threshold finalizer +are translated without opaque Auths functions. Their source proofs give exact +natural-number updates and final decisions, including saturating addition on +either supported machine width. Every bounded finite sequence of actual source +updates matches the independent folded summary. The model proves both counts +and minimum diagnostics for every child sequence, conjunction acceptance iff +every child authorizes, and threshold acceptance iff its count is sufficient. +Structural invalidity contributes a denial to its parent; a successful +alternative can still authorize, as the protocol specifies. + +A single source catalog owns each stable diagnostic string and its comparison +rank. Kernel proofs cover every pair of the 46 denial and 21 requirement +variants against independent published-code byte tables. Native tests separately +check each public string getter, parser round trip and pairwise ordering. +The borrowed-string getter itself is not in this extraction. Nine positive, +denied and indeterminate Lean witnesses have matching native operation cases. + +Qualification passes with 418 compiled declarations, the prior 387 statement +records unchanged, all 11 modules, native model/codec/composition/authority/ +author cases, and two byte-identical clean translations. The composition slice +has four local and five imported function records and zero opaque Auths +functions. The six existing external models remain unchanged in number and +introduce no compiled axiom. A separately inventoried, metadata-only naming +normalization reuses the pinned Aeneas discriminant generator and scopes its +anonymous instance names; it changes no datatype or discriminant match body. +The compiled multi-import cases check distinct explicit tags on enums with the +same short name. Bound production source closure: +`003df1917fd715485d8f7fa0cb69a4c7cff4854a39069fa5d9d0fa34b4310adb`. + +This does not complete E2. The qualified slice does not establish that the +recursive plan evaluator supplies exactly this child sequence, validates the +plan, invokes callbacks/observers with the expected state, or composes every +verifier stage and sealed projection. The private full-evaluator prototype is +not a qualified claim. Exact-revision hosted gates remain required. The preceding +`d386aec2` checkpoint passed every main CI gate, including authoritative Lean +replay and final evidence. At `fead08c4`, hosted PostgreSQL lifecycle, recipe +qualification, gateway isolation, both customer demos, operator package and +Python/TypeScript package checks pass; the main formal gates are still running. +All E1–E5 workstreams remain open. + +## Recursive inner-plan refinement + +The complete extracted inner evaluator now has a source equality with an +independently recursive plan model for every represented finite plan. Native +and model branch/observer contracts are explicit quantified premises; the +statement fixes the result and both states, so a different visit order or +missing post-order event cannot satisfy it. Source corollaries establish node +event count and exact leaf order. The structural model proves node count is +at most depth times leaf count for nonempty plans; explicit depth-16 and +128-leaf bounds yield at most 2,048 source observer calls. Public validation +correspondence, callback cost and the complete verifier bound remain open. + +A positive length-indexed bounded vector solves the recursive-carrier issue +without changing the Rust plan type. Both conversions with the pinned Aeneas +Vec round-trip, their map is injective, and deref is exact delegation. Only +this standard container representation and discriminant instance naming are +normalized. The official recursive-loop extraction switch leaves Auths +function bodies untouched. The expanded report has nine local and nine +imported function records, including the generated loop record, with zero +opaque Auths functions and two additional transparent standard-library models. + +Kernel-checked two-/three-leaf witnesses cover accepted, denied and +indeterminate outcomes and exact post-order events. Native mirrors use the +public validating wrapper, and a joint 128-leaf/depth-16 witness checks all +1,921 events. Constructors now reject excessive member counts before sorting, +preserving threshold/empty-input error precedence and canonical accepted plans. +This runtime bounds correction is source-reviewed and natively tested; no +constructor-refinement theorem is inferred from the inner evaluator proof. + +Qualification passes all 435 compiled statements, all 11 modules, native +parity cases (including the joint hard boundary), and two byte-identical +translations. Every prior 418 declaration record is unchanged; the only +transitive axioms remain `propext`, `Classical.choice` and `Quot.sound`. +The exact source closure is +`64d845b2d6cebe06e27879dbaccda54b8425fbb29e7733e1a5f5e5c4a5737ede`. +The exact pushed revision still requires its hosted authoritative gates. +No E1–E5 workstream or M6 is complete on the strength of this slice. + + +## Public structural validation and observed evaluation + +`ValidationContract.source_accepts_iff_valid` connects the actual shipping +validator to an independent structural relation: nonempty well-formed +operators, valid thresholds, per-node width, total depth, distinct references +and total leaf count. Both acceptance and refusal are proved; validity is not +defined by a successful checker call. The public source equality in +`ValidationPublic.public_evaluator_refines` includes the actual validator and +then the independent three-valued evaluator. Success fixes the result and both +callback states under explicit exact callback contracts. Every structurally +invalid plan is refused with both states unchanged, without any premise about +the callback implementations. + +The returned shape retains the independently computed reference set in strict +order and the checker's maximum-depth state. The consuming set iterator and +vector collection loop preserve every reference. The public event bound +requires no trusted validation-success flag: independent validity and the +explicit protocol caps imply at most 2,048 events. It remains an event bound, +not a claim about callback cost, physical allocations, host stack or full +verifier work. + +A shared source child-validation loop removes duplicate control flow. Explicit +collection and an explicit public error match keep the whole path visible to +the pinned extractor and coverage scanner. The only representation changes +remain standard-container models: the positive bounded vector delegates its +operations to the pinned Vec, and a reviewed ordered-set contract is scoped +to Global allocation and copied ProofRef values. The actual derived ProofRef +comparison is proved equal to lawful lexical byte order. The library's tree +implementation and physical allocation remain external boundaries. The +trait-default maximum adapter follows the pinned Rust second-argument tie +rule. No Auths validation algorithm is opaque or replaced by a model. + +Qualification passes 471 audited statements, all prior 435 complete records +unchanged, all 11 qualification cases, native parity cases and two +byte-identical clean translations. There are ten reviewed standard-library +models, no unreviewed model and zero compiled external axioms. The only +transitive axioms remain `propext`, `Classical.choice` and `Quot.sound`. +The composition report has ten local and 27 imported function records; every +Auths function in its closure is transparent. The exact source closure is +`4040407246158f925ab3e1ca2569573196977d706975f4b8a05a785528ea7dd1`. + +Kernel witnesses cover useful two-leaf authorization, a three-leaf +indeterminate threshold, duplicate references, a zero threshold, and reduced +width/depth limits. Native cases additionally check sorted shape output, +lower-limit refusal before callbacks and the joint hard limit. The template +inventory now detects both same-line and split-line axiom names; a regression +also proves that a split-line declaration is refused in a compiled bridge. + +The measured decision denominator remains explicit: 122/1,044 functions and +1,478/11,535 lines, including 8/10 composition functions. Imported source +validator refinements are audited even though the coverage definition counts +only local translation functions; no denominator was removed to improve these +figures. The facade and event getter still need their own extraction bridge. +The staged verifier, registered handlers, leaf cryptography, sealed projection +and complete resource bound remain E2 obligations. All E1–E5 workstreams and +M6 remain open. + +The preceding `9c810f75` checkpoint passed every main hosted gate, including +authoritative Lean and final formal evidence: +[CI 38852805698](https://github.com/auths-dev/auths-proof/actions/runs/38852805698). +This public-validation expansion still requires hosted verification on its +exact pushed revision. + + +## Canonical signature-key encoding + +The public Ed25519 key contract requires canonical RFC 8032 field/sign form. +The pinned library's decoder follows ZIP-215 and accepts additional encodings, +including some non-weak points with a noncanonical field representative. +`auths-signature-core` now checks the RFC form before library point recovery; +key validation and signature verification share that one decoding path. +The existing strict signature verification and P-256 low-S rules remain. +This is a rejection-boundary correction, not evidence of a signature forgery. +The native suite retains canonical low-order *encodings* at key validation; +strict signature verification refuses weak keys and weak R points. + +`Auths.Crypto.Encoding.Ed25519.guard_refines` proves the actual source guard +returns precisely the independent decoded-coordinate criterion for every +32-byte array: y below 2^255-19, with the forbidden negative-zero sign choices +excluded. The independent model uses base-256 numeric decoding; the shipping +code scans bounded bytes. Their equivalence includes totality and in-bounds +reads for that guard. `P256.guard_refines` proves the actual compressed-form +check is total on every represented slice and accepts exactly length 33 with +tag 2 or 3. Form acceptance alone makes no curve-membership claim. + +The guard extraction has three local function records, zero external +function records, and zero opaque Auths functions. It requires no custom +crypto model or axiom. Published RFC public signature data supplies native +positive and changed-message cases. Tests distinguish the library's broader +point decoder from Auths canonical validation, and a valid high-S P-256 +signature from the low-S form Auths accepts. Go and TypeScript independently +implement the settled field/sign rule using integer coordinates. Their +strict-verification filters also exclude all eight canonical low-order points; +the crypto libraries remain responsible for point recovery and the equation. + +The construction build audits 490 statements, with every previous 471 full +record unchanged and only the three allowed foundations. Seven new kernel +witnesses cover accepted and refused encoding forms, including a canonical +identity encoding that still grants no signature authority. The exact-source qualification passes all 12 cases, native parity and two +byte-identical fresh translations. It audits all 490 statements with only the +three allowed foundations, ten reviewed library models, zero unreviewed models +and zero compiled external axioms. Its source closure is +`dc9b524b6ba84d63d55346b0e9053fe0b489a604703b5017151d3a3f7ca81503`. +Hosted verification remains required on the exact pushed revision. Whole-suite decoding, principal binding, dispatch, exact +caller unsigned bytes, commitments, and composed E5 remain open. + +Primary contracts: [RFC 8032 section 5.1.3](https://www.rfc-editor.org/rfc/rfc8032#section-5.1.3) +and the pinned [dalek decoder contract](https://docs.rs/ed25519-dalek/2.2.0/ed25519_dalek/struct.VerifyingKey.html#method.from_bytes). + + +## Public composition facade and event projection + +The ordinary public `evaluate` facade now has its own exact source refinement. +It agrees with independent structural validation and three-valued evaluation, +including the exact final branch state. Its actual stateless observer is +proved rather than assumed. Independently invalid structure is refused before +any branch call, without a callback correctness or termination premise. +The event accessor returns exactly the independent proof/aggregate outcome. +Native callback implementations and the staged verifier remain E2 obligations. + +The additional extraction contains 14 local and 27 imported function records. +Two local records are compiler-generated closure call shims. They remain in +the refinement dependency graph and in the explicit translation inventory; +the handwritten-function metric treats them separately, just as it already +distinguishes compiler-generated loop and derived-method records. This does +not remove any handwritten Rust function from the denominator. All 10 +composition functions now reach the audited closure; decision coverage is +124/1,044 functions and 1,490/11,535 lines. The staged verifier and callback +implementations remain outside this component claim. + +The pinned backend erases the concrete unit output of the empty observer's +call, while the generic FnMut dictionary retains a Unit-times-state result. +One exact dictionary-field adapter restores that component. Both Result round +trips hold for arbitrary state, success, failure and divergence, with **zero +axioms**. Generated Rust function bodies and constructors are preserved. The +normalizer refuses missing, repeated or already-adapted dictionary sites; +focused regressions also prevent ordinary handwritten functions from being +classified as closure shims. The current inventory contains eleven reviewed +library/representation models and no compiled external axiom. + +The construction audit passes 500 statements, with all previous 490 full +records unchanged and only the existing foundations. Kernel executions cover +a useful two-leaf conjunction, structural duplicate refusal before callbacks, +and a three-leaf indeterminate threshold through the actual facade. Exact +source qualification passes all 12 cases, native parity and two byte-identical +fresh translations, with the 500-statement compiled audit. Its source closure +is `c73c2fce779537862d90aa9ba9d35c651d53c76ba81a131a83597f7cbf9fced2`. +Hosted gates remain required on the exact pushed revision. +The current encoding checkpoint's hosted preflight found an iterator-style +lint on the already-qualified explicit fixed range. A single-site lint +expectation records the source-linked proof reason; focused Clippy passes. +No index check, resource limit, predicate or CI job is disabled. + + +## Concrete signature glue under primitive contracts + +The native entry points now call one shared parameterized source algorithm +per suite. The vetted libraries retain point recovery, scalar parsing and the +signature equations. Canonicality, exact widths, Ed25519 weak-coordinate and +R-form restrictions, P-256 low-S, refusal precedence, and exact byte forwarding +are visible in the shipping Auths glue and its extraction. Native key-format +validation still permits a canonical weak encoding; verification refuses it +after the signature-width check, preserving the existing error precedence. +The Ed25519 library's own strict checks remain in the selected primitive. + +`LowContract.guard_refines` proves the concrete 64-byte P-256 scalar guard is +total and returns exactly `s <= floor(n/2)` in big-endian numeric meaning. +The constant is proved equal to half the secp256r1 order. A separate theorem +shows the first 32 bytes cannot influence that decision. The source no longer +uses an assumed low-S callback or a library-normalization decision for the +Auths rule. Parser errors still precede low-S refusal. + +The Ed25519 coordinate comparator is proved equal to the decoded unsigned +255-bit ordinate, preserving every coordinate bit and ignoring only the sign. +The source weak-coordinate filter matches the independent numeric set. Its +combination with the canonical point-form guard excludes the eight canonical +weak encodings. The R checker recovers exactly the first 32 signature bytes +and checks their canonical non-weak form. These results do not prove curve +arithmetic or cryptographic security. + +`Strict.SuiteRefinement` proves both complete parameterized source algorithms +return exactly the independent models, including each error class and its +precedence. `Strict.SourceAcceptance` proves success iff independent accepted- +input relations hold. The only primitive premises are the displayed exact +total point-decoder, scalar-parser and equation contracts. No source success, +trusted Auths guard flag, opaque Auths algorithm, custom crypto model or global +crypto axiom is introduced. The extraction has 14 local function records and +zero external function records. + +Nine native tests pass, including the published RFC public signature tuple, +changed messages, noncanonical/non-weak keys, all eight canonical weak points, +P-256 boundary/normalizer parity and a mathematically valid high-S tuple. +Call-order witnesses use explicit mocks that would accept everything: weak +Ed25519 input and high-S P-256 input never reach that equation, while admitted +form forwards the exact key, message and signature/parser result. Mock success +is not evidence of signature authenticity. Focused Clippy passes. + +The construction audit passes 536 statements with all previous 500 full +records unchanged. Eight kernel guard examples include exact half-order, +just-above-half, maximum scalar, canonical weak coordinate and accepted/refused +R forms. An allowed form (including zero s) alone grants no authority. +Exact-source qualification passes all 12 cases, native parity and two byte-identical fresh translations, with all 536 compiled claims and eleven reviewed models, zero unreviewed models and zero compiled external axioms. The source closure is `c9c3f9ef750e8cce0f39656f549dd1e8d351354434bf0416c87a9e45bfe98e35`. Hosted gates remain required on the exact pushed revision. +The concrete library-leaf/default-wrapper correspondence, suite/principal +dispatch, caller unsigned-object construction, complete commitment integration +and E5 as a whole remain open, along with the other AP-SPEC-069 workstreams. + + +## Public Ed25519 API and explicit foreign implementation + +The shipping public Ed25519 verify and key-validation entry points now have +exact source refinements, including their selected callback dictionaries, +library adapters and result projections. `Native.public_verify_refines` +covers the complete result and stable refusal precedence for arbitrary +represented byte slices. `Native.public_verify_accepts_iff` connects success +to the independent canonical/non-weak exact-message suite relation. +The decoded-key validator has its own exact Unit/error projection theorem. + +Three foreign library calls are fields of an explicit implementation parameter: +point recovery, fixed-width signature construction and the strict equation. +Their exact total contracts are displayed theorem premises. There is no +default/global implementation instance, global crypto axiom, opaque Auths +helper or rewritten Rust function body. A reviewed section declaration threads +only that parameter through dependent generated declarations. Missing, repeated +and already-generalized normalization inputs are rejected, and a regression +checks exact recovery of every generated body by removing only that declaration. +Transparent Result-to-Option and existing Result-map models handle projections. + +The construction audit passes 545 claims with all previous 536 full records +unchanged and only the existing three foundations. Concrete kernel witnesses +check exact message/signature forwarding, changed-message refusal and malformed +key refusal before any primitive call. The explicit forwarding mock is an +inhabited contract and call-binding witness; it establishes no cryptographic +authenticity. Existing published native signature tuples remain separate evidence. + +The extraction has 23 local and five external function records. Four local +records are compiler-generated non-generic closure call shims. They remain in +the complete dependency/report inventory and are classified separately from +handwritten functions, as the generic composition shims already were. +A focused regression rejects unrelated methods, receiver mismatches and malformed +closure names. No handwritten function is removed from a coverage denominator. +The complete fresh qualification passes all 12 cases, native parity and two +byte-identical translations, with all 545 compiled claims, thirteen reviewed +external models, zero unreviewed models and zero compiled external axioms. +Its exact source closure is +`bc6f231fa8c0594a57748ba5a52e34bdc743f15cf965cb4b19c1bb955041fbd1`. +Hosted evidence remains required on the exact new revision. + +P-256's parameterized source algorithm and concrete numeric low-S guard remain +proved. Its public native-wrapper extraction hits a pinned Charon associated- +type normalization failure even on the isolated library point-decoding call; +monomorphization gets past that stage but fails in the pinned Aeneas translator. +No failed or partially translated artifact is in the qualification inventory. +That public binding, suite/principal dispatch, caller unsigned-object closure, +all commitments and whole E5 remain open, as do the other full AP-SPEC-069 gates. + +The preceding 500-claim facade checkpoint passed every hosted main CI gate, +including authoritative Lean, clean checking and final formal evidence: +[CI 38875070290](https://github.com/auths-dev/auths-proof/actions/runs/38875070290). + + +The assurance source resolver now uses the pinned Lean header parser and module +resolver in one process, rather than launching Lean once per source. The +resolved set was compared exactly against the prior 145-source result. The +resolver implementation itself is included in the hashed source inputs, and +the Rust caller rejects foreign/duplicate paths and a missing audit root. +Invalid-header and outside-root construction cases fail closed. Each claim +must still name the exact independently resolved closure and its digest; the +audit hashes the common snapshot once and rehashes it before publishing, so a +source change during the audit is refused. No theorem statement, source input, +axiom check, evidence digest, or hosted gate is removed by this cost reduction. + + +## One-shot hashing, exact commitment frames and signed capacity + +The production codec now uses the selected one-shot SHA-256 call. Application +commitments and identifier hashes first build explicit, checked preimages; +the streaming implementations remain only as independent native test oracles. +The wire transcripts and digests are unchanged for admitted inputs. Five +focused native tests pass, including randomized old-transcript comparison, +all nine identifier tags, UTF-8 byte limits and unrepresentable allocation +requests. The gateway semantic-closure fixture is regenerated from the source. + +The new buffer guard checks signed pointer-size representability before Vec +allocation. Checked usize addition alone did not establish that requirement. +`BufferAllocation.buffer_refines` characterizes its complete abstract result; +success implies an empty buffer and the signed-capacity bound. Physical memory +availability and allocator behavior remain the declared standard-library/host +boundary. The source check does not promise allocation success under exhaustion. + +`CommitmentFrames` independently defines the exact application and identifier +transcripts. It proves their lengths, framing injectivity on the stated valid +relations, and separation from each other and the signing domain. The shipping +preimage functions have successful-output byte-exact refinements, including all +nine identifier tags. Those conditional results do not establish all-input +framing totality, the complete valid-carrier bridge or general admissible-input +acceptance. Concrete kernel witnesses accept a useful application frame and +every identifier tag, and reject empty/oversized domains before payload work. +The previous signing statements are preserved with proofs for the new guard. + +A second compilation unit for the same actual codec crate monomorphizes the +native SHA-256 leaf. The pinned name-pattern emitter cannot print foreign +`Instantiated` names. Eleven exact foreign name paths receive export aliases; +a checked ledger retains their original concrete identities and source spans. +The adapter checks every Auths name and every body, signature, generic, layout, +source span and call/type ID unchanged. Tests reject an Auths declaration, +missing/unreviewed names and name substitution inside executable data, and +reject repeated primitive-context generalization. Charon reparses the resulting +hash-consed AST before translation. No failed/partial translation earns a claim. + +The two selected foreign operations, digest and Into<[u8;32]>, are explicit +`Sha256Primitives` fields. `Sha256Native.raw_hash_refines` proves exact input +forwarding and output construction under their displayed total functional +contract. It asserts no primitive correctness, hash injectivity, collision +resistance, preimage resistance or global implementation instance. Explicit +byte-echo mocks witness forwarding only; they are not SHA-256 implementations. +The foreign aliases in that unit's report are linked to actual declarations by +the normalization ledger and do not represent new Rust source symbols. + +Local exact-source qualification passes 567 claims, with all previous 545 full +records unchanged and only the existing three foundations: two byte-identical +fresh translations, 13/13 qualification cases, and 16 reviewed external models +with no unreviewed model or compiled external axiom. The source closure is +`c84be514413fea52bd330d905ac5d2b3e23c93d8695215bf0e86dc27c2553ba4`. +The exact revision still requires hosted gates. Complete caller +unsigned-object/descriptor construction, hash-call integration for every +commitment, the P-256 public binding and whole E5 remain open, along with the +other full AP-SPEC-069 milestones. + +Hosted CI for the preceding 545-claim checkpoint reported the generic key rule +on a public upstream function type in an immutable, uncompiled Aeneas template. +The reviewed exception names only that historical commit/path/rule/line. The +pinned 8.28.0 scanner passes both the exact staged remediation and full local +history. No credential, generated byte, broad rule, path or scanner gate was +changed; the correction is committed for the next hosted revision. + +## Accepted commitment-frame validity and input binding + +The shipping application and identifier framing now supply the independent +valid-frame premises directly from acceptance. Equal accepted preimage bytes +therefore imply equality of the original domain/tag and payload, without a +caller-supplied validity premise. Exact successful output lengths are also +proved for every represented input and all registered identifier tags. + +Local exact-source qualification passes 573 claims; every previous 567 full +statement record is unchanged, and the six additions use only the permitted +foundations. Two fresh translations match byte-for-byte, all 13 qualification +cases pass, and 16 external models are reviewed with zero compiled external +axioms. Source closure: +`57d8e7d80c72736d88c803642ef4bae8833974d6d5fc4844379d30f748669c43`. +Exact-revision hosted gates remain required. These are +preimage-byte properties. They assert no SHA-256 injectivity or cryptographic +security, and do not yet establish all-input totality, general acceptance, +caller unsigned-object construction, every commitment or complete E5. + +## Complete bounds classification for the three shared framers + +The actual signing, application-commitment and content-identifier framers now +have all-input totality in the qualified Result semantics. Each accepts iff +its independent numeric domain holds, and returns exactly `LimitExceeded` +iff that domain does not hold. The domains retain exact UTF-8 byte lengths, +protocol word widths, checked unsigned capacity and the actual signed +pointer-size allocation ceiling. Empty signing profiles remain admitted; +application commitment domains must be nonempty and at most 128 bytes. + +Together with the previous successful-byte, valid-frame, exact-length and +input-binding results, this closes the shared framer's complete bounds/result +classification. The proofs inspect every translated branch and append bound. +They introduce no implementation premise that assumes successful framing. +Physical allocator behavior and memory availability remain explicit standard +library/host contracts, rather than a claim that arbitrary memory exists. + +Local exact-source qualification passes 582 claims. All prior 573 complete +statement records are unchanged; the nine additions use only the existing +foundations. Two fresh translations are byte-identical, all 13 qualification +cases pass, and 16 external models are reviewed with zero compiled external +axioms. Source closure: +`0daa0c0f1cb323def162abff2add05fbcb94433b88aee7ef5804082ec58ae087`. +Exact-revision hosted gates remain required. +Caller unsigned-object and descriptor construction, all commitment call sites, +P-256 public native-library integration, the remaining complete-object codec +and complete E5 remain open. No whole AP-SPEC-069 milestone is declared done. + +## Native P-256 public API and explicit primitive interface + +The production P-256 verifier now shares one explicit private primitive +interface for point recovery, scalar parsing and the exact-message equation. +Its fixed-width signature conversion owns exactly 64 copied bytes, avoiding +region-erased borrowed array types in monomorphic extraction. The public key +validator uses a direct result match. Public Rust APIs and stable decisions +are preserved; no second production verifier or compatibility route is added. + +The actual native public verification and key-validation APIs now refine the +independent suite models under displayed foreign functional contracts. The +accepted-input equivalence requires compressed form, a decoded point, exact +signature width, a parsed scalar, numeric low-S and the exact-message equation. +Concrete guards and the actual native adapters are translated. Library +correctness and elliptic-curve arithmetic/security are not proved or assumed +as global axioms. Explicit forwarding mocks demonstrate key, message and +signature binding and changed-input refusal; they assert no authenticity. + +The native unit translates 14 local functions and ten explicit foreign/standard +interfaces, with no opaque Auths function. The reviewed name adapter preserves +every body, signature, generic, layout, source span and call/type ID. Thirty-one +foreign export paths receive aliases. Two unique Auths helper specializations +lose only their final name-only instantiation suffix; their original complete +identities remain in the ledger and their base source names are retained. +Exactly dependent types/functions receive an explicit primitive parameter. +The standard monomorphic Result/Option/Try and array/slice operations are +transparent; three foreign calls are implementation projections with no +installed instance. The explicit key-validation match removes the erased +unit-callback issue without a callback model or callback premise. + +Local exact-source qualification passes 599 claims: 17 additions and exactly +three reviewed statement changes from FnOnce callback arguments to the explicit +P256Primitive dictionary, retaining the same independent functional contracts. +The other 579 complete records are unchanged, and only the permitted foundations +occur. Two fresh translations are byte-identical, all 14 qualification cases +pass, and 19 external models are reviewed with zero compiled external axioms. +Native signature tests, focused lint, name-adapter rejection tests and gateway +semantic-closure regeneration also pass. Qualified source closure: +`494fbe483fbf5aa946ccc33f87b1d122bb1b1c697757551866118ae02b7244e7`. +Exact-revision hosted gates remain required. Suite/principal +dispatch, caller unsigned-object/descriptor construction, every commitment, +the complete verifier and whole E5/M6 remain open. + +## Qualified suite verification adapters + +The actual Ed25519 and P-256 SignatureSuite verification methods now refine +the independent suite results and acceptance predicates, including all three +input fields and exhaustive port-error mapping. Their two imported core calls +delegate directly to the previously qualified public native implementations. +A closed owner-link inventory requires exact Rust/Lean identities, transparent +local owners, and compiled delegation theorems mentioning both exact constants. +The compiled statement audit now records kernel constant references, including +implicit implementation instances, and binds these to the reviewed digest. +Readable statement text cannot substitute for a missing owner reference. + +Four explicit-mock witnesses cover exact input acceptance and changed-message +refusal; these demonstrate forwarding, not authentic cryptographic signatures. +All previous 599 readable statement texts, modules, kinds and axiom sets are +unchanged; the new constant-reference metadata is added to every audit record. +The construction audit has 613 claims, with only the permitted foundations. +Focused owner-link, digest-rejection and nested closure-scanner tests pass. +Fresh exact-source qualification passes all 613 audited claims, 15/15 cases, +21 reviewed models and zero compiled external axioms. Two clean translations +are byte-identical. Qualified source closure: +`17a0056b33dcb6769fe574e62f8cf3a6422e208b56c6b9a041b94e946827c7cc`. +Exact-revision hosted evidence remains required for this expansion. Suite +constructors, IDs, registry selection, key/principal binding, caller object +construction, remaining commitments, and complete E5/M6 remain open. + +## Independent P-256 conformance corpus + +The pinned public Wycheproof P-256/SHA-256 P1363 corpus is now vendored and +adapted deterministically to the registered Auths compressed-point/low-S +policy. All 262 upstream cases are retained. The shared corpus has 653 cases, +including 173 admitted signatures over 98 distinct public keys, high-S twins, +changed messages, malformed points/scalars/widths and refusal-priority checks. +The original source hash is required by the offline byte-for-byte generator. +Rust checks the actual native API, key validation and suite-adapter error +mapping. The independent Go and TypeScript implementations consume the same +corpus. Native qualification and hosted bindings conformance include these +checks; the corpus and adapters are bound into the exact source/release +inventories. Native tests, focused Rust lint and independent Go/TypeScript cases pass. +Fresh source qualification passes 613 unchanged complete audit records, +15/15 cases, 21 reviewed models, zero compiled external axioms and two +byte-identical translations. Qualified source closure: +`231fa58fa3a0200c0d5914a35d613e5672096992199df9b56c33f64f20275c03`. +Exact-revision hosted evidence remains required. These tests support the explicit primitive +contracts and do not prove them or complete E5/M2. + +## Actual selected-witness expiry helpers + +The shipping verifier's status-decision, status-horizon and selected-assurance +horizon helpers now refine independently defined status/expiry semantics. The +actual loop terminates for every represented finite input. Missing requirement +references and required observation timestamps fail closed; unbounded rules +need no timestamp; selected deadlines use exact saturating 64-bit addition +and their minimum. A successful native horizon admits exactly the maximum +word bound and all selected expiries. Status endpoints are inclusive and +principal/grant failures preserve their distinct stable classes. + +The native unit has four local declarations (three Rust functions and one +loop), 14 transparent imported Auths helpers and one standard Option import. +No Auths algorithm is opaque. A scoped, unconditional standard comparison +adapter projects only partial_cmp; no generated function body is rewritten. +The pure model imports no generated Rust. Nine Lean witnesses separate actual +status calls from pure expiry examples. Five native tests use actual validated +Rust constructors; focused lint, context rejection tests and gateway semantic +closure regeneration pass. The construction audit has 634 claims, all 613 +previous complete records unchanged and only the permitted foundations. +Fresh exact-source qualification passes 634 compiled claims, all 613 prior +complete records unchanged, 16/16 cases, 22 reviewed models and zero compiled +external axioms. Two clean translations are byte-identical. Qualified closure: +`d0e1dba843ae5f0bba50a2b00cf8f779721756069e3bc1481feaab81d1b836d5`. +Exact-revision hosted evidence remains required. + +These are expiry-only claims. Authenticity, selection by the actual assurance +evaluator, observation-time ordering, satisfaction of every required policy, +complete verification, other horizon intersections and the actual runtime +consumer remain separate E2/E4/M6 obligations. No whole milestone is closed. + + +## Approval-view status-selection source refinement + +The actual principal and grant selectors now use one indexed scan each, +without temporary collections. Shipping first-rule lookup and approval-view +visibility refine independent list rules. Both actual public port methods +have total Result refinements against an operational accumulator, including +all policies, snapshot refusal order and complete decision/horizon results. +Nine kernel-checked witnesses exercise the actual principal port. The pure +filter/max/tie-set specification is separate; its equivalence to the scan is +still an open obligation, as are anchor-view refinement, evidence authenticity +and complete verifier composition. + +The prior algorithms remain test-only independent references. More than +19,000 constructor-valid snapshot pairs compare both selectors in three views, +with dedicated word-limit, saturation, rollback and latest-tie cases. Focused +native parity, lint and generated-context rejection checks pass. The standard +binary-search model follows the pinned standard library's size/base/half +transitions; sorted-scope membership is not yet claimed. + +Fresh source qualification passes 658 compiled claims, all 634 preceding +complete records unchanged, 17/17 cases, 23 reviewed models, zero unreviewed +models, zero compiled external axioms and two byte-identical clean translations. +Qualified production closure: +`597b19ee0354614b37b9f048c7248e5684e69cf2c0d05a92a8b224a0b1172c7f`. +The preceding 634-claim revision `e4770a2b` passed all ten hosted workflows, +including [main CI](https://github.com/auths-dev/auths-proof/actions/runs/38931405294). +The new source slice requires exact-revision hosted gates. E1–E5/M6 remain open. + + +## Independent status-selection adequacy + +The operational accumulator now equals the independent filter/max/tie-set +specification for every finite input, subject equality operation, view and +policy, without an input-validity or source-success premise. The proof earns +an attained maximum, preserves every highest-sequence tie, treats rollback +as absorbing, and connects exact minimum horizons to the independent fold. +Its semantic modules import no generated Rust. + +Both actual principal and grant approval-view port methods now refine that +independent specification, returning the exact decision and horizon. This +closes the scan-versus-specification gap recorded in the preceding checkpoint. +Anchor-view source refinement, evidence authentication, closed dispatch and +complete verifier/runtime consumption remain open. No whole E2/E4/M6 +milestone is complete. + +Fresh qualification passes 661 compiled claims, all 658 preceding complete +records unchanged, 17/17 cases, 23 reviewed models, zero unreviewed models, +zero compiled external axioms and two byte-identical fresh translations. +Qualified production closure: +`678c19c1155869c45fed1cb7e849c147bca5bde0e07df567f413487335ab6669`. +Only the permitted foundational axioms occur. Exact-revision hosted gates +remain required. + +Hosted implementation checking of `85bc1e0f` found that the gateway checksum +still described the differential test file before its final lint cleanup. +The generated artifact is refreshed in this checkpoint; its focused native +check must pass again. No gate or checksum input is excluded to accommodate +the change. Other hosted results for that revision remain separately recorded. + + +## All-view status source refinement on ordered scopes + +The actual principal and grant ports now refine the independent status +specification in every view. The proof includes the existing binary-search +lookup: its reviewed pinned-standard model terminates, preserves membership +through each interval reduction, and returns a bounded index; the actual Auths +contains wrapper returns exact list membership. Actual visibility then agrees +with the per-issuer OwnAnchor, listed-anchor and AnyAnchor rules. + +The all-view statements require ordered listed-anchor scopes. This is a +legitimate representation invariant, not a desired-result premise; derivation +from the actual sorting/validation constructor remains open. Approval-view +statements retain their earlier unrestricted represented-input contracts. +Five new cases check first/last listed anchors, an absent anchor, active status +through the issuer own anchor and hidden status through another anchor. The +last two quantify over unrelated anchor fields and assert selection only; +their synthetic evidence is not an authentication witness. + +Fresh exact-source qualification passes 671 claims, all 661 preceding complete +records unchanged, 17/17 cases, 23 reviewed models, zero unreviewed models and +zero compiled external axioms. Two clean translations are byte-identical. +Production closure: +`0e96ae702036cbe01af7fe60060ac560482b17fc4f473bb24e653ca35a6b5b60`. +Only the three permitted foundational axioms occur. Exact-revision hosted +verification remains required. Constructor validity, evidence authenticity, +closed dispatch, full verifier composition and runtime/history consumption +remain separate E1/E2/E4/M6 obligations. diff --git a/docs/assurance/PROOF_COVERAGE.md b/docs/assurance/PROOF_COVERAGE.md index 5b207aeb5..0c0b4c28a 100644 --- a/docs/assurance/PROOF_COVERAGE.md +++ b/docs/assurance/PROOF_COVERAGE.md @@ -4,13 +4,13 @@ ## 1. Claim -At the commit that contains this document, 110 of 1,031 decision-scope functions (10.7%) and 1,289 of 11,353 code lines (11.4%) are translated to Lean and reached from audited theorem statements, and 15 of 82 kernel check sites map only to such functions. The rest of the decision path, including the staged verifier control flow, the composition evaluator, the registry handlers, the codec, and the signature suites, is tested, not proved. +At the commit that contains this document, 134 of 1,047 decision-scope functions (12.8%) and 1,833 of 11,563 code lines (15.9%) are translated to Lean and reached from audited theorem statements, and 23 of 82 kernel check sites map only to such functions. The rest of the decision path, including the staged verifier control flow, the registry handlers, and the codec, is tested, not proved. - Revision: the commit that contains this document and `formal/proof-coverage-v1.json`; a release binds it in its assurance evidence. -- Measurement inputs: sha256 `56f5f8df74c31a2554725ec967451d36bfa6e7c4a49004b3c83bb5cd32c35f52` over the 89 files listed in `formal/proof-coverage-v1.json`. -- Tool: `cargo xtask formal coverage`, version 1. +- Measurement inputs: sha256 `a0ea986d5dc60e711d5f43033c2b45a0c5715e880576aa36001273fdf2785857` over the 140 files listed in `formal/proof-coverage-v1.json`. +- Tool: `cargo xtask formal coverage`, version 4. - Toolchain pins: `formal/lean-toolchain` = `leanprover/lean4:v4.31.0`; `formal/translation-toolchain.lock` sha256 `0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53`. -- Role table: `formal/coverage-scope-v1.toml`, sha256 `053f0be216b0003768d422d9ccc92a692726488874284fa80615657b30a495b5`. Figures computed under a different role table are not comparable. +- Role table: `formal/coverage-scope-v1.toml`, sha256 `ed030ce60262669dce62637a8f8016799e07f45e468055c2087b0e6a9ebab885`. Figures computed under a different role table are not comparable. ## 2. Definitions and file roles @@ -30,31 +30,48 @@ Files in scoped crates with a non-decision role (every other scoped file is deci | --- | --- | | `core/crates/auths-codec/src/approval.rs` | decoding | | `core/crates/auths-codec/src/bounded_policy.rs` | decoding | +| `core/crates/auths-codec/src/cbor.rs` | decoding | | `core/crates/auths-codec/src/decode.rs` | decoding | | `core/crates/auths-codec/src/encode.rs` | decoding | | `core/crates/auths-codec/src/error.rs` | decoding | | `core/crates/auths-codec/src/hash.rs` | decoding | | `core/crates/auths-codec/src/lib.rs` | decoding | | `core/crates/auths-codec/src/observation.rs` | decoding | +| `core/crates/auths-codec/src/scope_decode_tests.rs` | test-support | +| `core/crates/auths-composition/src/oracle.rs` | test-support | +| `core/crates/auths-model/src/principal_scheme_tests.rs` | test-support | +| `core/crates/auths-model/src/scope_constructor_tests.rs` | test-support | | `core/crates/auths-ports/src/binding.rs` | interface | | `core/crates/auths-ports/src/diagnostics.rs` | interface | | `core/crates/auths-ports/src/lib.rs` | interface | | `core/crates/auths-ports/src/path.rs` | interface | +| `core/crates/auths-registries/src/status_selection_tests.rs` | test-support | +| `core/crates/auths-signature-core/src/lib.rs` | crypto | +| `core/crates/auths-signature/src/lib.rs` | crypto | | `core/crates/auths-verifier/src/causal.rs` | explanation | +| `core/crates/auths-verifier/src/temporal_tests.rs` | test-support | | `core/crates/auths-verifier/src/trace.rs` | explanation | +| `formal/qualification/aeneas/entrypoints/profile_construction.rs` | interface | +| `product/runtime/auths-connections/src/record_time_tests.rs` | test-support | +| `product/runtime/auths-connections/src/recovery_guard_tests.rs` | test-support | +| `product/runtime/auths-connections/src/strict_order_tests.rs` | test-support | +| `product/runtime/auths-connections/src/string_constructor_tests.rs` | test-support | | `product/runtime/auths-lifecycle/src/codec.rs` | decoding | | `product/runtime/auths-lifecycle/src/sealed.rs` | storage | | `product/runtime/auths-lifecycle/src/test_support.rs` | test-support | +| `product/stores/auths-stores/src/gateway_attempt.rs` | storage | +| `product/stores/auths-stores/src/lib.rs` | interface | +| `product/stores/auths-stores/src/lifecycle.rs` | storage | ## 3. Scope table | Scope | Functions | Translated | Refined directly | Refined closure | Code lines | Translated | Refined directly | Refined closure | | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | -| decision | 1,031 | 110 (10.7%) | 56 (5.4%) | 110 (10.7%) | 11,353 | 1,289 (11.4%) | 856 (7.5%) | 1,289 (11.4%) | -| verifier-core | 785 | 86 (11.0%) | 41 (5.2%) | 86 (11.0%) | 8,802 | 907 (10.3%) | 558 (6.3%) | 907 (10.3%) | -| translated-crates | 1,138 | 210 (18.5%) | 70 (6.2%) | 210 (18.5%) | 10,662 | 2,508 (23.5%) | 1,024 (9.6%) | 2,508 (23.5%) | -| verifier-closure | 1,083 | 86 (7.9%) | 41 (3.8%) | 86 (7.9%) | 13,762 | 907 (6.6%) | 558 (4.1%) | 907 (6.6%) | -| decision-nontrivial | 443 | 81 (18.3%) | 44 (9.9%) | 81 (18.3%) | 9,589 | 1,202 (12.5%) | 820 (8.6%) | 1,202 (12.5%) | +| decision | 1,047 | 134 (12.8%) | 77 (7.4%) | 134 (12.8%) | 11,563 | 1,833 (15.9%) | 1,356 (11.7%) | 1,833 (15.9%) | +| verifier-core | 800 | 109 (13.6%) | 60 (7.5%) | 109 (13.6%) | 8,993 | 1,432 (15.9%) | 1,033 (11.5%) | 1,432 (15.9%) | +| translated-crates | 1,839 | 389 (21.2%) | 205 (11.1%) | 389 (21.2%) | 22,550 | 4,544 (20.2%) | 2,791 (12.4%) | 4,544 (20.2%) | +| verifier-closure | 1,147 | 182 (15.9%) | 98 (8.5%) | 182 (15.9%) | 14,272 | 2,065 (14.5%) | 1,460 (10.2%) | 2,065 (14.5%) | +| decision-nontrivial | 456 | 104 (22.8%) | 64 (14.0%) | 104 (22.8%) | 9,790 | 1,743 (17.8%) | 1,317 (13.5%) | 1,743 (17.8%) | Decision scope by crate: @@ -63,11 +80,11 @@ Decision scope by crate: | `core/crates/auths-algebra-kernel` | 15 | 73 | 2 | 2 | 17 | | `core/crates/auths-assurance` | 3 | 89 | 0 | 0 | 0 | | `core/crates/auths-authority` | 21 | 341 | 13 | 13 | 241 | -| `core/crates/auths-composition` | 8 | 160 | 0 | 0 | 0 | -| `core/crates/auths-model` | 540 | 3,886 | 71 | 71 | 649 | -| `core/crates/auths-registries` | 82 | 1,152 | 0 | 0 | 0 | -| `core/crates/auths-verifier` | 116 | 3,143 | 0 | 0 | 0 | -| `product/policy/auths-bounded-policy` | 108 | 716 | 18 | 18 | 182 | +| `core/crates/auths-composition` | 10 | 155 | 10 | 10 | 155 | +| `core/crates/auths-model` | 548 | 3,944 | 75 | 75 | 695 | +| `core/crates/auths-registries` | 83 | 1,202 | 6 | 6 | 262 | +| `core/crates/auths-verifier` | 120 | 3,239 | 3 | 3 | 62 | +| `product/policy/auths-bounded-policy` | 109 | 735 | 19 | 19 | 201 | | `product/runtime/auths-lifecycle` | 138 | 1,835 | 6 | 6 | 200 | Per-crate code lines are summed per function, so a function nested in another counts in both; the scope table counts each line once. @@ -76,23 +93,26 @@ Sensitivities of the decision-scope refined-closure figure: | Reading | Functions | Code lines | | --- | ---: | ---: | -| Headline | 110 of 1,031 (10.7%) | 1,289 of 11,353 (11.4%) | -| Without functions defined in `macro_rules!` bodies | 109 of 1,014 (10.7%) | 1,286 of 11,300 (11.4%) | -| Closure of exact and verdict-exact theorems only | 109 of 1,031 (10.6%) | 1,286 of 11,353 (11.3%) | -| Closure of exact theorems only | 105 of 1,031 (10.2%) | 1,198 of 11,353 (10.6%) | -| Closure without trait-instance records | 109 of 1,031 (10.6%) | 1,286 of 11,353 (11.3%) | - -**Second parser.** 1014 of 1031 decision-scope function spans (98.4%) agree with an independent parse by syn over 30 files. Disagreements: - -- `core/crates/auths-model/src/lib.rs` `name::parse` (lines 142-144): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::as_str` (lines 147-149): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::fmt` (lines 153-155): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::new` (lines 271-273): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::from_digest` (lines 276-278): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::digest` (lines 281-283): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::as_bytes` (lines 286-288): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `name::from` (lines 292-294): inside a macro_rules! body (syn parses it as a token tree). -- `core/crates/auths-model/src/lib.rs` `Digest::from` (lines 298-300): inside a macro_rules! body (syn parses it as a token tree). +| Headline | 134 of 1,047 (12.8%) | 1,833 of 11,563 (15.9%) | +| Without functions defined in `macro_rules!` bodies | 133 of 1,027 (13.0%) | 1,830 of 11,498 (15.9%) | +| Closure of exact and verdict-exact theorems only | 128 of 1,047 (12.2%) | 1,584 of 11,563 (13.7%) | +| Closure of exact theorems only | 124 of 1,047 (11.8%) | 1,496 of 11,563 (12.9%) | +| Closure without trait-instance records | 133 of 1,047 (12.7%) | 1,830 of 11,563 (15.8%) | + +**Second parser.** 1027 of 1047 decision-scope function spans (98.1%) agree with an independent parse by syn over 32 files. Disagreements: + +- `core/crates/auths-model/src/lib.rs` `name::parse` (lines 131-136): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::as_str` (lines 139-141): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::fmt` (lines 145-147): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::new` (lines 253-255): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::from_digest` (lines 258-260): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::digest` (lines 263-265): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::as_bytes` (lines 268-270): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `name::from` (lines 274-276): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `Digest::from` (lines 280-282): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `code` (lines 4983-4985): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `code_precedes` (lines 4993-4995): inside a macro_rules! body (syn parses it as a token tree). +- `core/crates/auths-model/src/lib.rs` `code_order` (lines 4997-4999): inside a macro_rules! body (syn parses it as a token tree). - `product/policy/auths-bounded-policy/src/identifier.rs` `name::parse` (lines 69-72): inside a macro_rules! body (syn parses it as a token tree). - `product/policy/auths-bounded-policy/src/identifier.rs` `name::as_str` (lines 76-78): inside a macro_rules! body (syn parses it as a token tree). - `product/runtime/auths-lifecycle/src/digest.rs` `name::from_bytes` (lines 28-30): inside a macro_rules! body (syn parses it as a token tree). @@ -106,19 +126,11 @@ syn finds 0 non-test function spans in those files that the scanner does not. ## 4. Decision-critical coverage -`formal/check-site-functions-v1.toml` maps each of the 82 `CHECK_SITES` entries (`core/testkit/auths-testkit/src/check_sites.rs`) to the function that constructs its refusal, the predicate its guard calls, and further deciding functions, by study 006's innermost-function rule. A site is covered when every one of those functions is in the refined closure. 15 of 82 are covered (18.3%). +`formal/check-site-functions-v1.toml` maps each of the 82 `CHECK_SITES` entries (`core/testkit/auths-testkit/src/check_sites.rs`) to the function that constructs its refusal, the predicate its guard calls, and further deciding functions, by study 006's innermost-function rule. A site is covered when every one of those functions is in the refined closure. 23 of 82 are covered (28.0%). | Site | Code | Deciding functions outside the closure | Covering stage | | --- | --- | --- | --- | -| `decode.action-bytes` | `resource-limit-exceeded` | `decode_canonical_action` (refusal) | codec: AP-SPEC-061 | -| `decode.action-map` | `malformed-proof` | `map` (refusal), `decode_canonical_action` (also) | codec: AP-SPEC-061 | -| `decode.action-key` | `non-canonical-proof` | `key` (refusal), `decode_canonical_action` (also) | codec: AP-SPEC-061 | -| `decode.action-field` | `malformed-proof` | `decode_canonical_action` (refusal), `profile_ref` (also), `text` (also), `bounded_bytes` (also), `array` (also) | codec: AP-SPEC-061 | -| `decode.action-body-bytes` | `resource-limit-exceeded` | `bounded_bytes` (refusal), `decode_canonical_action` (also) | codec: AP-SPEC-061 | -| `decode.attachment-bytes` | `resource-limit-exceeded` | `bounded_bytes` (refusal), `decode_canonical_action` (also) | codec: AP-SPEC-061 | -| `decode.action-attachment-duplicate` | `malformed-proof` | `CanonicalAction::with_detached_attachments` (refusal), `decode_canonical_action` (also) | codec: AP-SPEC-061 | -| `decode.action-trailing` | `malformed-proof` | `ensure_complete` (refusal), `decode_canonical_action` (also) | codec: AP-SPEC-061 | -| `decode.action-canonical` | `non-canonical-proof` | `decode_canonical_action` (refusal), `encode_canonical_action` (also) | codec: AP-SPEC-061 | +| `decode.action-attachment-duplicate` | `malformed-proof` | `CanonicalAction::with_detached_attachments` (refusal) | codec: AP-SPEC-061 | | `binding.embedded-body` | `action-body-mismatch` | `validate_action_binding` (refusal) | stage 3 | | `binding.profile` | `action-body-mismatch` | `validate_action_binding` (refusal) | stage 3 | | `binding.media-type` | `action-body-mismatch` | `validate_action_binding` (refusal) | stage 3 | @@ -146,11 +158,11 @@ syn finds 0 non-test function spans in those files that the scanner does not. | `branch.untrusted-root` | `untrusted-root` | `verify_branch` (refusal) | stage 3 | | `branch.principal-status-extension-accepted` | `critical-extension-unknown` | `check_status_extensions` (refusal), `AcceptedRegistries::accepts_critical_extension` (guard), `check_principal_status` (also) | stages 2 and 3 | | `branch.principal-status-extension-handler` | `unsupported-critical-extension` | `check_status_extensions` (refusal), `check_principal_status` (also) | stage 3 | -| `branch.anchor-principal-status` | `principal-revoked` | `status_decision` (refusal), `select_principal` (guard), `check_principal_status` (also), `ExactStatusMethod::principal` (also) | stages 2 and 3 | +| `branch.anchor-principal-status` | `principal-revoked` | `check_principal_status` (also) | stages 2 and 3 | | `branch.grant-status-extension-accepted` | `critical-extension-unknown` | `check_status_extensions` (refusal), `AcceptedRegistries::accepts_critical_extension` (guard), `check_grant_status` (also) | stages 2 and 3 | | `branch.grant-status-extension-handler` | `unsupported-critical-extension` | `check_status_extensions` (refusal), `check_grant_status` (also) | stage 3 | -| `branch.grant-status` | `grant-revoked` | `status_decision` (refusal), `select_grant` (guard), `check_grant_status` (also), `ExactStatusMethod::grant` (also) | stages 2 and 3 | -| `branch.subject-principal-status` | `principal-revoked` | `status_decision` (refusal), `select_principal` (guard), `check_principal_status` (also), `ExactStatusMethod::principal` (also) | stages 2 and 3 | +| `branch.grant-status` | `grant-revoked` | `check_grant_status` (also) | stages 2 and 3 | +| `branch.subject-principal-status` | `principal-revoked` | `check_principal_status` (also) | stages 2 and 3 | | `branch.resource-matcher` | `unsupported-resource-matcher` | `validate_resource_constraints` (refusal), `ImmutableRegistries::resource_matcher` (guard) | stage 2 | | `branch.grant-namespace` | `resource-namespace-mismatch` | `validate_resource_constraints` (refusal), `UriNamespaceMatcher::matches` (guard) | stage 2 | | `branch.action-namespace` | `resource-namespace-mismatch` | `validate_resource_constraints` (refusal), `UriNamespaceMatcher::matches` (guard) | stage 2 | @@ -180,13 +192,16 @@ syn finds 0 non-test function spans in those files that the scanner does not. ## 5. Translated functions outside the refined closure -None: every function Aeneas translates is in the refined closure. +- `auths_profile_construction::construct` (`formal/qualification/aeneas/entrypoints/profile_construction.rs`, lines 5-10) +- `auths_profile_construction::parse_provider` (`formal/qualification/aeneas/entrypoints/profile_construction.rs`, lines 13-17) +- `auths_profile_construction::parse_alias` (`formal/qualification/aeneas/entrypoints/profile_construction.rs`, lines 20-24) +- `auths_profile_construction::parse_semantic` (`formal/qualification/aeneas/entrypoints/profile_construction.rs`, lines 27-31) ## 6. Mutation adequacy `cargo xtask formal mutations` runs study 006's three campaigns: S1 applies each case of `formal/refinement-mutations-v1.json`, S2 mutates comparison, Boolean, and result-position operators in the model's `def` bodies, and S3 replaces each translated function's body with `fail .panic`. A mutant is killed when the build of the audited targets fails, and stillborn when its first error lies in the mutated definition itself. The first error (the earliest in the mutated file, else the least location among the failing modules, so that parallel builds record the same one) and its declaration are recorded; an S1 mutant whose build reports no error in its case's named witness is reported as killed elsewhere. Every survivor must be fixed or explained before a release; pull requests are not blocked. -**Some results predate the current formal sources** (current formal inputs `f250c011aa84a978f1f65e91ead3ed8aee7e3b6502e7d80868a583381df305db`); re-run the stale campaigns before a release. +**Some results predate the current formal sources** (current formal inputs `bae0cd9f691cdc246d4b82603c819912a7fe18ec83a52ddb2cffadbdba354e44`); re-run the stale campaigns before a release. | Campaign | Mutants | Killed | Of which killed elsewhere | Survived | Stillborn | Current | | --- | ---: | ---: | ---: | ---: | ---: | --- | @@ -199,25 +214,275 @@ None: every function Aeneas translates is in the refined closure. ## 7. Theorem kinds -Every audited theorem whose statement names a translated function carries a kind in `formal/theorem-kinds-v1.toml`: exact (for every input meeting its premises the function returns exactly its specification's value), verdict-exact (the statement fixes the component of the result that decides authorization), partial (a property that does not fix the verdict, or a subclass of inputs), or case (specific inputs). Counts: 65 exact, 1 verdict-exact, 8 partial, 1 case. +Every audited theorem whose statement names a translated function carries a kind in `formal/theorem-kinds-v1.toml`: exact (for every input meeting its premises the function returns exactly its specification's value), verdict-exact (the statement fixes the component of the result that decides authorization), partial (a property that does not fix the verdict, or a subclass of inputs), or case (specific inputs). Counts: 205 exact, 12 verdict-exact, 120 partial, 84 case. -Recomputed over the closure of exact and verdict-exact theorems only, the decision-scope figure is 109 of 1,031 functions (10.6%) and 1,286 of 11,353 code lines (11.3%). +Recomputed over the closure of exact and verdict-exact theorems only, the decision-scope figure is 128 of 1,047 functions (12.2%) and 1,584 of 11,563 code lines (13.7%). The 33 theorems study 006 classified keep the kind both of its raters gave; theorems added since were classified by the agent that added them and await a second rater. | Theorem | Kind | | --- | --- | +| `Auths.Codec.Action.accepted_encoding_unique` | partial | +| `Auths.Codec.Action.bounded_bytes_valid` | partial | +| `Auths.Codec.Action.decode_encode_exact` | partial | +| `Auths.Codec.Action.decoded_body_valid` | partial | +| `Auths.Codec.Action.decoded_body_within_deployment` | partial | +| `Auths.Codec.Collection.array_exact` | exact | +| `Auths.Codec.Collection.collection_exact` | exact | +| `Auths.Codec.Collection.map_exact` | exact | +| `Auths.Codec.Cursor.at_exact` | exact | +| `Auths.Codec.Cursor.datatype_exact` | exact | +| `Auths.Codec.Cursor.ensure_complete_exact` | exact | +| `Auths.Codec.Cursor.head_exact` | exact | +| `Auths.Codec.Cursor.new_exact` | exact | +| `Auths.Codec.Cursor.null_exact` | exact | +| `Auths.Codec.Cursor.position_exact` | exact | +| `Auths.Codec.Cursor.u16_exact` | exact | +| `Auths.Codec.Cursor.u64_exact` | exact | +| `Auths.Codec.Cursor.u8_exact` | exact | +| `Auths.Codec.Examples.action_byte_limit_exact` | case | +| `Auths.Codec.Examples.action_byte_limit_refused` | case | +| `Auths.Codec.Examples.duplicate_key_refused` | case | +| `Auths.Codec.Examples.invalid_utf8_refused` | case | +| `Auths.Codec.Examples.minimal_action_accepted` | case | +| `Auths.Codec.Examples.minimal_encoding_exact` | case | +| `Auths.Codec.Examples.nonminimal_integer_refused` | case | +| `Auths.Codec.Examples.trailing_byte_refused` | case | +| `Auths.Codec.Examples.truncated_refused` | case | +| `Auths.Codec.Fields.array_exact` | exact | +| `Auths.Codec.Fields.bounded_bytes_exact` | exact | +| `Auths.Codec.Fields.digest_bytes_exact` | exact | +| `Auths.Codec.Fields.is_null_exact` | exact | +| `Auths.Codec.Fields.key_exact` | exact | +| `Auths.Codec.Fields.map_exact` | exact | +| `Auths.Codec.Fields.null_exact` | exact | +| `Auths.Codec.Fields.text_exact` | exact | +| `Auths.Codec.Payload.bytes_exact` | exact | +| `Auths.Codec.Payload.payload_exact` | exact | +| `Auths.Codec.Payload.str_exact` | exact | +| `Auths.Codec.Payload.success_earns_span` | partial | +| `Auths.Codec.Refinement.Encoder.append_tail_exact` | partial | +| `Auths.Codec.Refinement.Encoder.encode_head_byte_bound` | partial | +| `Auths.Codec.Refinement.Encoder.encode_head_refines` | exact | +| `Auths.Codec.Refinement.Encoder.encode_head_roundtrip` | partial | +| `Auths.Codec.Refinement.read_head_accepts_encoding` | partial | +| `Auths.Codec.Refinement.read_head_refines` | exact | +| `Auths.Codec.Refinement.read_tail_bounded` | exact | +| `Auths.Composition.Bounds.source_bounded_events` | partial | +| `Auths.Composition.Facade.evaluate_refines` | exact | +| `Auths.Composition.Facade.event_outcome_exact` | exact | +| `Auths.Composition.Facade.invalid_plan_preserves_callback` | partial | +| `Auths.Composition.Facade.observer_mut_exact` | exact | +| `Auths.Composition.Facade.observer_once_exact` | exact | +| `Auths.Composition.FacadeExamples.conjunction_authorizes` | case | +| `Auths.Composition.FacadeExamples.duplicate_refused` | case | +| `Auths.Composition.FacadeExamples.threshold_indeterminate` | case | +| `Auths.Composition.PlanExamples.all_visits_after_denial` | case | +| `Auths.Composition.PlanExamples.any_visits_after_authorization` | case | +| `Auths.Composition.PlanExamples.threshold_indeterminate` | case | +| `Auths.Composition.PlanExamples.threshold_refused` | case | +| `Auths.Composition.PlanExamples.two_leaf_conjunction` | case | +| `Auths.Composition.Refinement.all_exact` | exact | +| `Auths.Composition.Refinement.push_exact` | partial | +| `Auths.Composition.Refinement.threshold_authorized_exact` | verdict-exact | +| `Auths.Composition.Refinement.threshold_exact` | exact | +| `Auths.Composition.Traversal.evaluator_refines` | exact | +| `Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks` | partial | +| `Auths.Composition.ValidationContract.public_event_bound` | partial | +| `Auths.Composition.ValidationContract.valid_public_evaluator_refines` | exact | +| `Auths.Composition.ValidationExamples.duplicate_refused` | case | +| `Auths.Composition.ValidationExamples.narrow_refused` | case | +| `Auths.Composition.ValidationExamples.public_conjunction` | case | +| `Auths.Composition.ValidationExamples.public_threshold_indeterminate` | case | +| `Auths.Composition.ValidationExamples.shallow_refused` | case | +| `Auths.Composition.ValidationExamples.zero_threshold_refused` | case | +| `Auths.Composition.ValidationPublic.public_evaluator_refines` | exact | +| `Auths.Composition.Work.source_event_count` | partial | +| `Auths.Composition.Work.source_leaf_order` | partial | +| `Auths.Crypto.BufferAllocation.accepted_capacity_fits` | partial | +| `Auths.Crypto.BufferAllocation.accepted_empty` | partial | +| `Auths.Crypto.BufferAllocation.buffer_refines` | exact | +| `Auths.Crypto.CommitmentExamples.application_sample_admitted` | case | +| `Auths.Crypto.CommitmentExamples.empty_domain_refused` | case | +| `Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted` | case | +| `Auths.Crypto.CommitmentExamples.oversized_domain_refused` | case | +| `Auths.Crypto.CommitmentRefinement.application_preimage_exact` | partial | +| `Auths.Crypto.CommitmentRefinement.identifier_preimage_exact` | partial | +| `Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind` | partial | +| `Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind` | partial | +| `Auths.Crypto.CommitmentValidity.application_accepted_frame_valid` | partial | +| `Auths.Crypto.CommitmentValidity.application_output_length` | partial | +| `Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid` | partial | +| `Auths.Crypto.CommitmentValidity.identifier_output_length` | partial | +| `Auths.Crypto.CoordinateContract.guard_refines` | exact | +| `Auths.Crypto.CoordinateScan.loop_refines` | partial | +| `Auths.Crypto.Encoding.Ed25519.guard_refines` | verdict-exact | +| `Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted` | case | +| `Auths.Crypto.Encoding.Examples.compressed_form_accepted` | case | +| `Auths.Crypto.Encoding.Examples.field_alias_refused` | case | +| `Auths.Crypto.Encoding.Examples.negative_zero_refused` | case | +| `Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted` | case | +| `Auths.Crypto.Encoding.Examples.short_compressed_refused` | case | +| `Auths.Crypto.Encoding.Examples.uncompressed_tag_refused` | case | +| `Auths.Crypto.Encoding.P256.guard_refines` | verdict-exact | +| `Auths.Crypto.Encoding.RootFlags.root_flags` | partial | +| `Auths.Crypto.Encoding.Scan.loop_refines` | partial | +| `Auths.Crypto.Examples.minimal_preimage_exact` | case | +| `Auths.Crypto.Examples.unicode_preimage_exact` | case | +| `Auths.Crypto.FramingTotality.application_accepts_iff` | exact | +| `Auths.Crypto.FramingTotality.application_refuses_iff` | exact | +| `Auths.Crypto.FramingTotality.application_total` | exact | +| `Auths.Crypto.FramingTotality.identifier_accepts_iff` | exact | +| `Auths.Crypto.FramingTotality.identifier_refuses_iff` | exact | +| `Auths.Crypto.FramingTotality.identifier_total` | exact | +| `Auths.Crypto.FramingTotality.signing_accepts_iff` | exact | +| `Auths.Crypto.FramingTotality.signing_refuses_iff` | exact | +| `Auths.Crypto.FramingTotality.signing_total` | exact | +| `Auths.Crypto.LowContract.guard_refines` | exact | +| `Auths.Crypto.LowContract.r_bytes_irrelevant` | partial | +| `Auths.Crypto.LowScan.loop_refines` | partial | +| `Auths.Crypto.Native.decode_leaf_refines` | exact | +| `Auths.Crypto.Native.equation_leaf_refines` | exact | +| `Auths.Crypto.Native.public_validate_refines` | exact | +| `Auths.Crypto.Native.public_verify_accepts_iff` | verdict-exact | +| `Auths.Crypto.Native.public_verify_refines` | exact | +| `Auths.Crypto.NativeExamples.changed_message_is_refused` | case | +| `Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract` | case | +| `Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes` | case | +| `Auths.Crypto.P256Encoding.guard_refines` | exact | +| `Auths.Crypto.P256Examples.changed_key_is_refused` | case | +| `Auths.Crypto.P256Examples.changed_message_is_refused` | case | +| `Auths.Crypto.P256Examples.changed_signature_is_refused` | case | +| `Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract` | case | +| `Auths.Crypto.P256Examples.public_call_forwards_exact_bytes` | case | +| `Auths.Crypto.P256LowContract.guard_refines` | exact | +| `Auths.Crypto.P256LowContract.r_bytes_irrelevant` | partial | +| `Auths.Crypto.P256LowScan.loop_refines` | exact | +| `Auths.Crypto.P256Native.decode_leaf_refines` | exact | +| `Auths.Crypto.P256Native.decode_refines` | exact | +| `Auths.Crypto.P256Native.equation_leaf_refines` | exact | +| `Auths.Crypto.P256Native.parse_leaf_refines` | exact | +| `Auths.Crypto.P256Native.public_accepts_iff` | verdict-exact | +| `Auths.Crypto.P256Native.public_validate_refines` | exact | +| `Auths.Crypto.P256Native.public_verify_refines` | exact | +| `Auths.Crypto.RContract.guard_refines` | exact | +| `Auths.Crypto.Refinement.accepted_frame_valid` | partial | +| `Auths.Crypto.Refinement.accepted_preimages_bind_inputs` | partial | +| `Auths.Crypto.Refinement.object_domains_separate` | partial | +| `Auths.Crypto.Refinement.preimage_length_exact` | partial | +| `Auths.Crypto.Refinement.profile_limit_refused` | partial | +| `Auths.Crypto.Refinement.signing_preimage_exact` | partial | +| `Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest` | case | +| `Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest` | case | +| `Auths.Crypto.Sha256Native.raw_hash_refines` | exact | +| `Auths.Crypto.Strict.Examples.above_half_s_refused` | case | +| `Auths.Crypto.Strict.Examples.half_s_form_allowed` | case | +| `Auths.Crypto.Strict.Examples.identity_coordinate_is_weak` | case | +| `Auths.Crypto.Strict.Examples.maximum_s_refused` | case | +| `Auths.Crypto.Strict.Examples.public_r_form_allowed` | case | +| `Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak` | case | +| `Auths.Crypto.Strict.Examples.weak_r_form_refused` | case | +| `Auths.Crypto.Strict.Examples.zero_s_form_allowed` | case | +| `Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff` | verdict-exact | +| `Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff` | verdict-exact | +| `Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines` | exact | +| `Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines` | exact | +| `Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines` | exact | +| `Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines` | exact | +| `Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines` | exact | +| `Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused` | case | +| `Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted` | case | +| `Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused` | case | +| `Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted` | case | +| `Auths.Crypto.SuiteAdapters.ed_accepts_iff` | verdict-exact | +| `Auths.Crypto.SuiteAdapters.ed_public_refines` | exact | +| `Auths.Crypto.SuiteAdapters.p256_accepts_iff` | verdict-exact | +| `Auths.Crypto.SuiteAdapters.p256_public_refines` | exact | +| `Auths.Crypto.WeakContract.guard_refines` | exact | | `Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich` | exact | | `Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich` | exact | | `Auths.Lifecycle.Refinement.translated_replay_refines_rich` | exact | +| `Auths.Lifecycle.Refinement.translated_terminal_refines_rich` | exact | | `Auths.Lifecycle.Refinement.translated_transition_refines_rich` | exact | +| `Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact` | exact | +| `Auths.Product.ConnectionBytes.Refinement.lower_tail_exact` | exact | +| `Auths.Product.ConnectionBytes.Refinement.lower_valid_exact` | exact | +| `Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul` | partial | +| `Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound` | partial | +| `Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul` | partial | +| `Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound` | partial | +| `Auths.Product.ConnectionEntry.Refinement.entry_allows_exact` | exact | +| `Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact` | exact | +| `Auths.Product.ConnectionEntry.Refinement.source_disabled_refused` | partial | +| `Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile` | partial | +| `Auths.Product.ConnectionEntry.Refinement.source_revoked_refused` | partial | +| `Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact` | exact | +| `Auths.Product.CounterAggregation.Refinement.aggregate_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.contribute_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.contribute_sum_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.count_capacity_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.counter_equal_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.counter_position_spec` | exact | +| `Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact` | exact | +| `Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities` | partial | +| `Auths.Product.CounterAggregation.Refinement.source_aggregate_unique` | partial | +| `Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities` | partial | +| `Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique` | partial | +| `Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum` | exact | +| `Auths.Product.CounterAggregation.Refinement.sum_position_spec` | exact | +| `Auths.Product.CounterFrames.Refinement.component_exact` | exact | +| `Auths.Product.CounterFrames.Refinement.coordinates_exact` | exact | +| `Auths.Product.CounterFrames.Refinement.count_exact` | exact | +| `Auths.Product.CounterFrames.Refinement.count_slot_exact` | exact | +| `Auths.Product.CounterFrames.Refinement.count_source_binds_inputs` | partial | +| `Auths.Product.CounterFrames.Refinement.sum_exact` | exact | +| `Auths.Product.CounterFrames.Refinement.sum_slot_exact` | exact | +| `Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs` | partial | +| `Auths.Product.CounterFrames.Refinement.word_exact` | exact | +| `Auths.Product.Frontier.Refinement.candidate_exact` | exact | +| `Auths.Product.Frontier.Refinement.observe_exact` | exact | +| `Auths.Product.Frontier.Refinement.probe_exact` | exact | +| `Auths.Product.Frontier.Refinement.source_work_bound` | partial | +| `Auths.Product.Frontier.Refinement.start_exact` | exact | +| `Auths.Product.OperationIdentity.Refinement.logical_preimage_exact` | exact | +| `Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity` | partial | +| `Auths.Product.OperationIdentity.Refinement.token_exact` | exact | +| `Auths.Product.ProfileConstructor.Refinement.constructor_exact` | exact | +| `Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields` | partial | +| `Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused` | partial | +| `Auths.Product.RecordShape.Refinement.profile_order_exact` | exact | +| `Auths.Product.RecordShape.Refinement.profiles_exact` | exact | +| `Auths.Product.RecordShape.Refinement.record_shape_exact` | exact | +| `Auths.Product.RecordShape.Refinement.success_earns_all_invariants` | partial | +| `Auths.Product.RecordShape.Refinement.text_order_exact` | exact | +| `Auths.Product.RecordShape.Refinement.workloads_exact` | exact | +| `Auths.Product.RecordTimes.Refinement.record_times_exact` | exact | +| `Auths.Product.RecordTimes.Refinement.success_earns_order` | partial | +| `Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape` | partial | +| `Auths.Product.RecoveryGate.Refinement.binding_requirement_exact` | exact | +| `Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation` | partial | +| `Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time` | partial | +| `Auths.Product.RecoveryGate.Refinement.record_change_exact` | exact | +| `Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation` | partial | +| `Auths.Product.RecoveryGate.Refinement.recovery_exact` | exact | +| `Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation` | partial | +| `Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time` | partial | +| `Auths.Product.RecoveryGate.Refinement.state_transition_exact` | exact | +| `Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state` | partial | | `Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model` | exact | | `Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model` | exact | +| `Auths.Product.Refinement.CollectionFence.translated_advance_refines_model` | exact | +| `Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses` | partial | +| `Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model` | exact | | `Auths.Product.Refinement.Connections.translated_lease_generation_refines_model` | exact | | `Auths.Product.Refinement.Connections.translated_next_generation_refines_model` | exact | | `Auths.Product.Refinement.Connections.translated_retained_generation_refines_model` | exact | | `Auths.Product.Refinement.Connections.translated_rotation_refines_model` | exact | | `Auths.Product.Refinement.Connections.translated_state_change_refines_model` | exact | +| `Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses` | partial | +| `Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model` | exact | +| `Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model` | exact | | `Auths.Product.Refinement.Gateway.translated_construct_action_read_refines_model` | exact | | `Auths.Product.Refinement.Gateway.translated_construct_credential_read_refines_model` | exact | | `Auths.Product.Refinement.Gateway.translated_construct_write_refines_model` | exact | @@ -238,6 +503,41 @@ The 33 theorems study 006 classified keep the kind both of its raters gave; theo | `Auths.Product.Refinement.translated_checked_sub_refines_nat` | exact | | `Auths.Product.Refinement.translated_configuration_refines_projection` | exact | | `Auths.Product.Refinement.translated_window_index_refines_nat` | exact | +| `Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact` | exact | +| `Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds` | partial | +| `Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors` | partial | +| `Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow` | partial | +| `Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum` | partial | +| `Auths.Product.ReservationRetry.Refinement.retry_target_exact` | exact | +| `Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay` | partial | +| `Auths.Product.ReservationRetry.Refinement.source_count_progress_safe` | partial | +| `Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe` | partial | +| `Auths.Product.SchemaIndex.Refinement.field_index_spec` | exact | +| `Auths.Product.SchemaIndex.Refinement.field_name_equal_spec` | exact | +| `Auths.Product.SemanticId.Refinement.semantic_head_exact` | exact | +| `Auths.Product.SemanticId.Refinement.semantic_tail_exact` | exact | +| `Auths.Product.SemanticId.Refinement.semantic_valid_exact` | exact | +| `Auths.Product.SemanticId.Refinement.source_earns_ascii` | partial | +| `Auths.Product.SemanticId.Refinement.source_earns_bounds` | partial | +| `Auths.Product.SemanticId.Refinement.source_earns_no_nul` | partial | +| `Auths.Product.SlotBatch.Refinement.build_exact` | exact | +| `Auths.Product.SlotBatch.Refinement.count_loop_exact` | exact | +| `Auths.Product.SlotBatch.Refinement.source_claim_first` | partial | +| `Auths.Product.SlotBatch.Refinement.source_complete_entry_count` | partial | +| `Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused` | partial | +| `Auths.Product.SlotBatch.Refinement.sum_loop_exact` | exact | +| `Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec` | exact | +| `Auths.Product.SlotRecord.Refinement.source_accepted_binds_record` | partial | +| `Auths.Product.SlotRecord.Refinement.source_invalid_record_refused` | partial | +| `Auths.Product.SlotRecord.Refinement.validate_cumulative_exact` | exact | +| `Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates` | partial | +| `Auths.Product.StrictOrder.Refinement.strict_order_exact` | exact | +| `Auths.Product.StringConstructors.Refinement.actual_alias_exact` | exact | +| `Auths.Product.StringConstructors.Refinement.actual_provider_exact` | exact | +| `Auths.Product.StringConstructors.Refinement.actual_semantic_exact` | exact | +| `Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload` | partial | +| `Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload` | partial | +| `Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload` | partial | | `Auths.Refinement.Approval.translated_approval_counts_refines_model` | exact | | `Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model` | exact | | `Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model` | exact | @@ -245,6 +545,11 @@ The 33 theorems study 006 classified keep the kind both of its raters gave; theo | `Auths.Refinement.Approval.translated_approver_verdict_refines_model` | exact | | `Auths.Refinement.Approval.translated_principal_ids_contain_refines_model` | exact | | `Auths.Refinement.Approval.translated_principal_ids_subset_refines_model` | exact | +| `Auths.Refinement.Identifier.forbidden_at_exact` | exact | +| `Auths.Refinement.Identifier.identifier_exact` | exact | +| `Auths.Refinement.Identifier.identifier_string_exact` | partial | +| `Auths.Refinement.Identifier.identifier_unicode_exact` | partial | +| `Auths.Refinement.Identifier.scan_exact` | exact | | `Auths.Refinement.Observation.translated_condition_test_equal_refines_model` | exact | | `Auths.Refinement.Observation.translated_condition_value_holds_refines_model` | exact | | `Auths.Refinement.Observation.translated_fact_name_equal_refines_model` | exact | @@ -282,6 +587,62 @@ The 33 theorems study 006 classified keep the kind both of its raters gave; theo | `Auths.Refinement.translated_inexpressible_absent_request_is_covered` | partial | | `Auths.Refinement.translated_rust_refines_rich_spec` | exact | | `Auths.Rich.Mutations.profile_version_equality` | case | +| `Auths.ScopeConstructor.DecodeExamples.accepts_any` | case | +| `Auths.ScopeConstructor.DecodeExamples.accepts_listed` | case | +| `Auths.ScopeConstructor.DecodeExamples.accepts_own` | case | +| `Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit` | case | +| `Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list` | case | +| `Auths.ScopeConstructor.DecodeExamples.refuses_empty_list` | case | +| `Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id` | case | +| `Auths.ScopeConstructor.DecodeExamples.refuses_truncation` | case | +| `Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag` | case | +| `Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list` | case | +| `Auths.ScopeConstructor.accepted_rule_valid` | partial | +| `Auths.ScopeConstructor.accepted_scope_valid` | partial | +| `Auths.ScopeConstructor.accepted_trust_valid` | partial | +| `Auths.ScopeConstructor.constructed_grant_selection` | partial | +| `Auths.ScopeConstructor.constructed_principal_selection` | partial | +| `Auths.ScopeConstructor.decoded_scope_covers` | partial | +| `Auths.ScopeConstructor.decoded_trust_grant` | partial | +| `Auths.ScopeConstructor.decoded_trust_principal` | partial | +| `Auths.StatusSelection.AnchorExamples.other_anchor_hidden` | case | +| `Auths.StatusSelection.AnchorExamples.own_anchor_active` | case | +| `Auths.StatusSelection.Examples.active_selected_horizon` | case | +| `Auths.StatusSelection.Examples.latest_ties_conservatively_revoke` | case | +| `Auths.StatusSelection.Examples.missing_uses_snapshot_window` | case | +| `Auths.StatusSelection.Examples.newer_discards_old_stale_revocation` | case | +| `Auths.StatusSelection.Examples.revoked_selected_horizon` | case | +| `Auths.StatusSelection.Examples.rollback_despite_newer` | case | +| `Auths.StatusSelection.Examples.stale_selected_refused` | case | +| `Auths.StatusSelection.Examples.unknown_issuer_refused` | case | +| `Auths.StatusSelection.Examples.wrong_method_refused` | case | +| `Auths.StatusSelection.freshness_exact` | partial | +| `Auths.StatusSelection.grant_loop_refines` | partial | +| `Auths.StatusSelection.grant_method_all_views` | partial | +| `Auths.StatusSelection.grant_method_approver_independent` | partial | +| `Auths.StatusSelection.grant_method_approver_refines` | partial | +| `Auths.StatusSelection.grant_selector_approver_refines` | partial | +| `Auths.StatusSelection.principal_loop_refines` | partial | +| `Auths.StatusSelection.principal_method_all_views` | partial | +| `Auths.StatusSelection.principal_method_approver_independent` | partial | +| `Auths.StatusSelection.principal_method_approver_refines` | partial | +| `Auths.StatusSelection.principal_selector_approver_refines` | partial | +| `Auths.StatusSelection.sequence_floor_refines` | exact | +| `Auths.TemporalWitness.Examples.expired_status_refused` | case | +| `Auths.TemporalWitness.Examples.inclusive_status_endpoint` | case | +| `Auths.TemporalWitness.Examples.revoked_grant_refused` | case | +| `Auths.TemporalWitness.Examples.revoked_principal_refused` | case | +| `Auths.TemporalWitness.Status.decision_refines` | exact | +| `Auths.TemporalWitness.assurance_entry_refines` | exact | +| `Auths.TemporalWitness.assurance_loop_refines` | exact | +| `Auths.TemporalWitness.native_horizon_permits_iff` | partial | +| `Auths.TemporalWitness.status_decision_accepts_iff` | verdict-exact | +| `Auths.TemporalWitness.status_horizon_accepts_iff` | verdict-exact | +| `Auths.TemporalWitness.status_horizon_exact` | exact | +| `Auths.TemporalWitness.status_horizon_stale_refused` | partial | +| `Auths.TemporalWitness.successful_native_horizon_exact` | partial | +| `AuthsSuiteAdapters.ed25519_delegates` | partial | +| `AuthsSuiteAdapters.p256_delegates` | partial | ## 8. Trusted base diff --git a/docs/operations/GATEWAY_TRUST_AND_GIT_SIGNING_RUNBOOK.md b/docs/operations/GATEWAY_TRUST_AND_GIT_SIGNING_RUNBOOK.md index b5c69dffa..a447006d0 100644 --- a/docs/operations/GATEWAY_TRUST_AND_GIT_SIGNING_RUNBOOK.md +++ b/docs/operations/GATEWAY_TRUST_AND_GIT_SIGNING_RUNBOOK.md @@ -85,16 +85,26 @@ held which key, is operator evidence and is not produced by this code. - **Attempt store.** A production installation keeps logical-operation claims, provider-bound evidence, and outcome stages in the multi-host - PostgreSQL store (its qualification, AP-SPEC-038 Epic 2, is open), through + PostgreSQL store, through the reference deployment's secret slots `AUTHS_POSTGRES_URL`, `AUTHS_POSTGRES_CA_PEM`, and `AUTHS_POSTGRES_SERVER_NAME`. Connections are TLS-only with certificate and server-name verification. The schema is - `auths.lifecycle.postgresql/6`; it installs only into an empty database. - A database created at schema 4 or earlier is disposable prelaunch state: - recreate it. Gateway claims are stored as attempt record + `auths.lifecycle.postgresql/7`; it installs only into an empty database. + Production qualification must bind this exact schema and gateway semantic + closure. A database created at any earlier schema is disposable prelaunch + state: recreate it. Gateway claims are stored as attempt record `auths.gateway-attempt/3`; a store holding `/2` records is refused as corrupt, so the file store's attempts directory is recreated too. + The file store additionally requires its intact `auths.gateway-file-store/1` + marker and lock; an unmarked nonempty directory or lost marker is refused. +- **Collection and old clocks.** Both stores durably retain a monotone + `collected_through` cutoff. Every slot insert checks its actual expiry + against that cutoff atomically with the claim. Collection never deletes + claims, and a zero-deletion sweep still publishes the cutoff. An older + worker, restart, lost acknowledgement, or partially completed sweep cannot + reopen a collected window. Slot consumption remains conservative; there + are no refunds after later refusal or an uncertain provider response. - **Several gateway processes** may serve from the same database. Each logical operation is claimed once, by an insert-once row; stage changes are compare-and-swap on the exact stored record. A second process that loses a diff --git a/docs/specs/0038-production-runtime-custody-observability-and-assurance.md b/docs/specs/0038-production-runtime-custody-observability-and-assurance.md index 45bd0289e..7fcb98677 100644 --- a/docs/specs/0038-production-runtime-custody-observability-and-assurance.md +++ b/docs/specs/0038-production-runtime-custody-observability-and-assurance.md @@ -308,7 +308,7 @@ Implemented (engineering only; no production claim): | Requirement | Where | Evidence | | --- | --- | --- | -| §9.1 Epic 2: claims, provider-bound evidence, and outcome stages on the multi-host PostgreSQL store (Epic 2 qualification open) | `GatewayAttemptStore` in `auths-gateway`; `PostgresLifecycleStore` rows in schema `auths.lifecycle.postgresql/6` (AP-SPEC-063 §9.4 replaced `/4`) | One conformance suite on both stores: claim exactly once, replay, fresh challenge, unknown and re-observe, `echo-mismatch`, concurrent re-observation, fail-closed reads, and concurrent claims from two gateway processes. The PostgreSQL variants run in the PostgreSQL lifecycle workflow against its TLS fixture. | +| §9.1 Epic 2: claims, provider-bound evidence, and outcome stages on the multi-host PostgreSQL store (Epic 2 qualification open) | `GatewayAttemptStore` in `auths-gateway`; `PostgresLifecycleStore` rows in schema `auths.lifecycle.postgresql/7` (AP-SPEC-063 §9.4 replaced `/4`) | One conformance suite on both stores: claim exactly once, replay, fresh challenge, unknown and re-observe, `echo-mismatch`, concurrent re-observation, fail-closed reads, and concurrent claims from two gateway processes. The PostgreSQL variants run in the PostgreSQL lifecycle workflow against its TLS fixture. | | §9.1 Epic 2 fault matrix: replay, fresh challenge, crash after entry, concurrent re-observation | same | The attempt-scenario corpus and the conformance suite, on both stores. The TLS/pooling/failover/backup parts of the Epic 2 matrix are Epic 2's own open work. | | §9.1 Epic 4: observer and Git roots behind `auths-custody` | `GatewayObserver::from_custody`, `CustodyKeySigner`, `CustodyKey` | KMS- and PKCS#11-held keys, through the reference adapters over mock provider APIs, sign observations and grants that verify in the kernel. The shared custody conformance kit runs every `CustodyConformanceCase` and every lifecycle state on both paths. | | §9.1 Epic 4: each signer reports its custody kind | `ObserverCustody`, `GitProofSigner::custody` | Unit tests. | diff --git a/docs/specs/0061-end-to-end-machine-checked-verifier.md b/docs/specs/0061-end-to-end-machine-checked-verifier.md index eeb814fe0..054b0579c 100644 --- a/docs/specs/0061-end-to-end-machine-checked-verifier.md +++ b/docs/specs/0061-end-to-end-machine-checked-verifier.md @@ -20,6 +20,12 @@ landed, and its predicates are already translated (§6). - **Followed by:** the reference-monitor theorem (board §3), which needs this spec's end-to-end statement as its verifier premise. +- **Coordination:** [AP-SPEC-069](0069-authorization-to-execution-formal-assurance.md) + specifies the five authorization-to-execution assurance extensions. This + spec owns the codec, crypto integration, and core-verifier implementation + route; 069 adds their joint acceptance criteria and the gateway/history + composition. Its §1.2 clarifies how pending obligations and primitive + contracts are represented without weakening the current assurance audit. - **Scope:** extend the machine-checked surface from the authority algebra and rich authority predicates to the whole path `verify_v1(proof_cbor, action_cbor, context_cbor) → result_cbor`. That @@ -71,7 +77,8 @@ Each phase has its own permitted claim sentence (§5). - the link from those specifications to executable code (§3.2): - under the linked-implementation reading, HACL*'s F* proofs, the unverified translation of that code to Rust, and libcrux's edits to it; - - under the fallback, a specification axiom over the current libraries; + - under the current-library route, explicit implementation-meets-spec + premises over those libraries; - the premises of adapters outside the proved set (§4). **Never claimed:** @@ -135,8 +142,9 @@ accepted. ### 3.2 Hashing and signatures Proving elliptic-curve implementations in Lean from scratch is out of scope. -The link from the Lean specifications to executable code is one of two -readings. The owner decides between them when phase 2 starts (§8). +The link from the Lean specifications to executable code has two readings. +AP-SPEC-069 §8 fixes (c) for the initial implementation; switching to (b) +requires a later dependency/evidence review (§8). - **(b) Linked verified implementation.** - **What:** `libcrux-ed25519`, `libcrux-ecdsa` (P-256) and `libcrux-sha2`, @@ -152,21 +160,23 @@ readings. The owner decides between them when phase 2 starts (§8). - **Blocker:** `cargo deny` fails on RUSTSEC-2026-0173 through `hax-lib`. So (b) requires either an owner-reviewed advisory exception or an upstream release without that dependency. -- **(c) Specification axiom** over `ed25519-dalek`, `p256` and `sha2`, with the +- **(c) Specification premises** over `ed25519-dalek`, `p256` and `sha2`, with the smaller claim sentence. It is a smaller claim, not a skipped phase. -Under either reading, the link is a named, reviewed axiom per primitive: +Under either reading, the link is a named, reviewed implementation-meets-spec +contract per primitive. As fixed by AP-SPEC-069 §1.2 and §8, represent these +contracts as explicit theorem premises, not new global Lean axioms: ```text -axiom ed25519_impl_meets_spec : +Ed25519ImplMeetsSpec := ∀ pk msg sig, impl_verify pk msg sig = true ↔ Ed25519.Spec.verify pk msg sig ``` -There is one of these for Ed25519, one for P-256 ECDSA, and one for SHA-256. -The P-256 axiom states ECDSA as specified, which allows any s ∈ [1, n−1]; the -low-S rule is part of the glue. +There is one of these premises for Ed25519, one for P-256 ECDSA, and one for +SHA-256. The P-256 contract states ECDSA as specified, which allows any +s ∈ [1, n−1]; the low-S rule is part of the glue. -**Suite glue.** The axioms cover only the primitive. The glue around them MUST +**Suite glue.** The premises cover only the primitive. The glue around them MUST be extracted and proved under either reading: 1. **Ed25519 key.** @@ -179,7 +189,8 @@ be extracted and proved under either reading: - Exactly 64 bytes. - R is not a small-order encoding. - S < L and the cofactorless verification equation sit inside the axiom. + S < L and the cofactorless verification equation sit inside the primitive + contract. 2. **P-256 key.** - Exactly 33 bytes, with prefix `0x02` or `0x03`. - Decoded by the verified `compressed_to_coordinates` under (b), or after @@ -200,7 +211,7 @@ a non-canonical key, the result class changes from a verification failure to `InvalidKey`. That change MUST land in phase 2 with corpus vectors, and with the Go and TypeScript verifiers agreeing. Rule 2 is the registry's key rule. The Go and TypeScript verifiers enforce it, and Rust enforces it after the -P-256 key-encoding change (PR #176). Under (c), the axioms +P-256 key-encoding change (PR #176). Under (c), the primitive contracts are true only once these rules hold, because RFC 8032 decoding and the registry reject inputs that the current libraries accept. @@ -237,7 +248,7 @@ went through six layers). declared work bound" is a theorem about that counter, because the translation cannot supply fuel. - **The P-256 primitive** stays opaque (Charon overflows its stack on it) and - is covered by §3.2's axiom. + is covered by §3.2's explicit primitive premise. ### 3.4 Extraction rules @@ -276,15 +287,23 @@ relying party can therefore tell a fully proved decision from one that crossed a tested boundary. The result MUST carry a boolean `proved_configuration`, set when every executed handler is in the proved set. +The in-scope stages also include AP-SPEC-065's native K-of-N approvals and +grant-carried approval requirements, AP-SPEC-060's observation-requirement +laws, and AP-SPEC-064's status issuer scope. Their existing pure refinements +must join the complete verifier theorem; cryptographic/status checks and +stage orchestration cannot remain assumed while claiming that stage is +proved. Product-layer bounded-policy admission and persistent replay remain +outside this offline verifier and are composed under AP-SPEC-069. + ## 5. Phases, gates, and permitted claims Sizes are at agent speed, from research 0001 and 0002. | Phase | Work | Size | Claim permitted after its gate is green | | --- | --- | --- | --- | -| 0 | Fix the Lean statement of the target theorem, the codec model, and the axiom list. Add them to `assurance-manifest-v1.toml` as open claims. | 2–3 days | None; the statement is public | +| 0 | Fix the Lean statement of the target theorem, the codec model, and the explicit assumption list. Keep unproved obligations in AP-SPEC-069; add assurance-manifest entries only as audited theorems land. The current manifest has no `open` status. | 2–3 days | None; the statement is public | | 1 | Extractable canonical codec under §3.4, with §3.1's three theorems; cutover; corpus and fuzz parity | 2–3 weeks | "Canonical decoding is machine-checked to be total, bounded, and unique." | -| 2 | Decide §3.2's reading; extract and prove the suite glue; tighten Ed25519 key validation with vectors; add P-256 corpus vectors; prove domain-separated preimage construction | 1–2 weeks | (b): "Signature checks are proved against the RFC 8032, FIPS 186-5 and FIPS 180-4 specifications, assuming the pinned libcrux Ed25519, P-256 ECDSA and SHA-256 code meets them; that code is verified in F* (HACL*) and translated to Rust by an unverified compiler." (c): "Signature checks are proved against the RFC 8032, FIPS 186-5 and FIPS 180-4 specifications, assuming a specification axiom that `ed25519-dalek`, `p256` and `sha2` implement them; those libraries are tested, not verified." | +| 2 | Use §3.2's initial current-library route; extract and prove the suite glue; tighten Ed25519 key validation with vectors; add P-256 corpus vectors; prove domain-separated preimage construction | 1–2 weeks | (b), after separate review: "Signature checks are proved against the RFC 8032, FIPS 186-5 and FIPS 180-4 specifications, assuming the pinned libcrux Ed25519, P-256 ECDSA and SHA-256 code meets them; that code is verified in F* (HACL*) and translated to Rust by an unverified compiler." Initial (c): "Signature checks are proved against the RFC 8032, FIPS 186-5 and FIPS 180-4 specifications, under explicit premises that `ed25519-dalek`, `p256` and `sha2` implement them; those libraries are tested, not verified." | | 3 | §3.4 refactor of the staged verifier and the §4 adapter set, as gated per-stage slices; closed-enum entry point; work counter and bound | 4–7 weeks | "For the proved configuration, `verify_v1` is machine-checked end to end against the rich authority model, assuming the published trusted computing base." | | 4 | AP-SPEC-060's translated observation predicates join the end-to-end statement; `proved_configuration` in results and all bindings | 2–3 days | Same, with observation requirements included | @@ -330,7 +349,7 @@ Each phase gate requires all of the following: | Sentence | Readings | Pick | | --- | --- | --- | -| Board: "with verified crypto" | (a) prove curve arithmetic in Lean; (b) link a verified implementation by a named axiom; (c) axiomatize the spec over the current libraries | (b) if the owner approves the RUSTSEC-2026-0173 exception when phase 2 starts; otherwise (c). PROVISIONAL default: (c), the narrower reading, with no new dependency and a smaller claim. Both need §3.2's glue. | +| Board: "with verified crypto" | (a) prove curve arithmetic in Lean; (b) link a verified implementation by explicit premises; (c) explicit specification premises over the current libraries | Initial route (c), fixed by AP-SPEC-069: no new dependency or advisory exception, with the narrower conditional claim. Route (b) requires a later dependency/evidence review. Both need §3.2's glue. | | Board: "End-to-end" | (a) every adapter; (b) a stated proved configuration | (b), with `proved_configuration` in results (§4) | | Board: "After 059/060" | (a) do not start until both land; (b) start phases 0–1, which touch neither | (b). This is now moot: both have landed. | diff --git a/docs/specs/0063-generalized-gateway.md b/docs/specs/0063-generalized-gateway.md index da6442da5..55aa423fb 100644 --- a/docs/specs/0063-generalized-gateway.md +++ b/docs/specs/0063-generalized-gateway.md @@ -641,7 +641,7 @@ follows this order. The last column names the epic that adds each new step. | 9 | Lease the credential (30-second deadline); apply the prefix guard (§5.2); when declared, the account read (§5.7), then each denied read in order (§5.8) | Recorded `not-entered` | today; guard, account, and denied reads 3 | | 10 | When declared, run the pre-entry re-read (§5.3), then the relative-ceiling read and check (§5.6); record their observations and basis in one `attempting → attempting` | Recorded `not-entered`, keeping what was read | 3 | | 11 | Increment the in-flight count; reload the shared record; require it unchanged | Recorded `not-entered`, `gateway.connection.changed` | 5 | -| 12 | Refuse entry after `evaluated_at + 60` seconds, on the gateway clock or the monotonic deadline started at step 1 | Recorded `not-entered`, `gateway.attempt.entry-deadline` | 3 | +| 12 | Refuse a clock sample before `evaluated_at`, outside the sealed authority/installed-gate horizon, after `evaluated_at + 60`, or outside the monotonic deadline started at step 1; preserve each inclusive/exclusive endpoint | Recorded `not-entered`, `gateway.attempt.entry-deadline` | 3; temporal witness 069 | | 13 | Send the one write, with provider headers, the account-scope header, the key or declared field, and the echo | Before network entry: recorded `not-entered`, `gateway.transport.not-entered` | today; account scope 2; other additions 3 | | 14 | Record the response (status, digest, locator), or `unknown` | — | today; locator 3 | | 15 | Decrement the in-flight count; perform at most one read-back | — | 5; today | @@ -1519,7 +1519,7 @@ entry, with its test evidence, in the change that introduces it: | Kind | Identities | | --- | --- | | Recipe | `auths.gateway-recipe-source/2`, `auths.gateway-compiled-recipe/2`, `auths.gateway-recipe-review/2`, `auths.gateway-recovery-capability/1` | -| Store | `auths.gateway-attempt/3`, `auths.gateway-bounded-count/2`, `auths.gateway-bounded-sum/1`, `auths.gateway-connection/1`, `auths.lifecycle.postgresql/6` | +| Store | `auths.gateway-attempt/3`, `auths.gateway-bounded-count/2`, `auths.gateway-bounded-sum/1`, `auths.gateway-connection/1`, `auths.lifecycle.postgresql/7` | | Policy | `auths.gateway.argument-ceiling-window-count/2`, `auths.gateway.argument-ceiling-policy/2`, `auths.gateway-counter-set/1` | | Evidence | `auths.gateway-pre-entry/1`, `auths.gateway-outcome/2`, `auths.gateway-observe/2`, `auths.gateway-audit-bundle/2`, `auths.gateway-audit-report/2`, `auths.gateway-echo-verification/1`, `auths.gateway-codes/1` | | Operator | `auths.gateway-operator-attestation/1`, `auths.gateway-installation/3`, `auths.gateway-admin-request/1`, `auths.gateway-admin-response/1` | @@ -1577,15 +1577,17 @@ continues. Rolling back is sound because `insert_all` returns only after step 4 is durable, so a batch file means the engine never received the claim and nothing was leased or sent. -### 9.4 PostgreSQL schema 5 +### 9.4 PostgreSQL store -`auths.lifecycle.postgresql/6` replaces `/4`; a `/4` database is refused, not -migrated. `auths_gateway_attempts` is replaced by: +The current schema is `auths.lifecycle.postgresql/7` with transactional-store +contract `/5`. AP-SPEC-069 adds the shared collection fence; `/6` and earlier +databases are refused without migration. The record table introduced by this +specification is: ```sql CREATE TABLE auths_gateway_records ( record_key BYTEA PRIMARY KEY CHECK (octet_length(record_key) = 32), - record_kind TEXT NOT NULL CHECK (record_kind IN ('attempt', 'count-slot', 'sum-slot', 'connection')), + record_kind TEXT NOT NULL CHECK (record_kind IN ('attempt', 'count-slot', 'sum-slot', 'connection', 'commissioning-budget')), expires_at BIGINT NULL, record_bytes BYTEA NOT NULL CHECK (octet_length(record_bytes) BETWEEN 1 AND 262144), record_sha256 BYTEA NOT NULL CHECK (octet_length(record_sha256) = 32), @@ -1593,13 +1595,23 @@ CREATE TABLE auths_gateway_records ( ); CREATE INDEX auths_gateway_records_expiry ON auths_gateway_records (expires_at) WHERE record_kind IN ('count-slot', 'sum-slot'); +CREATE TABLE auths_gateway_collection ( + singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton), + collected_through BIGINT NULL CHECK (collected_through IS NULL OR collected_through >= 0) +); +INSERT INTO auths_gateway_collection (singleton, collected_through) VALUES (TRUE, NULL); ``` -`insert_all` is one transaction that inserts in ascending key order, each row +`insert_all` first holds a shared lock on the collection row and refuses the +whole batch if any slot expires at or before its cutoff. It then inserts in +ascending key order, each row with `ON CONFLICT DO NOTHING RETURNING record_key`. A missing row rolls the transaction back and reports that entry's index, and the fixed order prevents -deadlock. `sweep_expired` deletes at most `limit` rows through the expiry -index. The pool and statement timeout are the lifecycle store's +deadlock. `sweep_expired` holds an exclusive lock on the same row, advances +the cutoff monotonically even for a zero deletion limit, and deletes at most +`limit` rows through the expiry index in that transaction. Missing collection +metadata fails closed. A lost acknowledgement cannot authorize execution or +undo a committed cutoff. The pool and statement timeout are the lifecycle store's (`PostgresStoreConfig`). ### 9.5 Conformance @@ -1611,6 +1623,8 @@ and `postgres_store_passes_attempt_store_conformance` in `engine.rs`) adds: count and sum slots; - a crash at every step of the file batch; - sweep bounds; +- collection/admission races, stale clocks, restart, and lost acknowledgements; +- missing or invalid file-store collection metadata and locks; - shared-connection-record visibility across two processes. The PostgreSQL variants run in the PostgreSQL lifecycle workflow, as today. diff --git a/docs/specs/0066-production-gateway-polish-and-recipe-qualification.md b/docs/specs/0066-production-gateway-polish-and-recipe-qualification.md index baba3850a..5dce6595a 100644 --- a/docs/specs/0066-production-gateway-polish-and-recipe-qualification.md +++ b/docs/specs/0066-production-gateway-polish-and-recipe-qualification.md @@ -1488,7 +1488,7 @@ Each was taken unattended as the narrower or fail-closed reading. rederived from the installed files. The semantic closure, package, version, operating system, and architecture are the build's. The build digest is SHA-256 of the running executable. The store kind and schema - follow the deployment (`postgresql-v1` with `auths.lifecycle.postgresql/6`, + follow the deployment (`postgresql-v1` with `auths.lifecycle.postgresql/7`, or `shared-file-v1` with `auths.gateway-attempt/3`). The recipe family and the provider contract identifier are declared by the operator at install, because a gateway cannot derive them; a wrong declaration matches no diff --git a/docs/specs/0069-authorization-to-execution-formal-assurance.md b/docs/specs/0069-authorization-to-execution-formal-assurance.md new file mode 100644 index 000000000..1a5591e95 --- /dev/null +++ b/docs/specs/0069-authorization-to-execution-formal-assurance.md @@ -0,0 +1,2045 @@ +# AP-SPEC-069: Formal assurance from authorization to execution + +- **Status:** Implementation in progress. The latest qualified development + checkpoint has 917 compiled claims on 17 October 2026. E1–E5 and M6 remain + open; see §13.5 and §§13.25–13.41 for exact completed components, evidence + boundaries and the next source obligations. This document itself adds no proof. +- **Source baseline:** `3e01401fb5aa3fc9433da44bcdaa82ecc7214f1c`. +- **Purpose:** strengthen the claim that a person or agent can perform useful, + narrowly authorized work without receiving the provider credential. Cover + the five remaining assurance boundaries identified in the source review: + canonical decoding, complete verification, authorized request construction, + concurrent durable admission, and cryptographic integration. +- **Depends on:** [AP-SPEC-011](0011-rich-authority-refinement-and-bounded-authorization.md), + [ADR 0011](../adr/0011-rich-authority-rust-lean-link.md), + [AP-SPEC-026](0026-reservation-and-execution-state-semantics.md), + [AP-SPEC-053](0053-declarative-credential-isolated-gateway.md), + [AP-SPEC-060](0060-evidence-conditioned-authority.md), + [AP-SPEC-061](0061-end-to-end-machine-checked-verifier.md), + [AP-SPEC-063](0063-generalized-gateway.md), + [AP-SPEC-064](0064-status-issuer-scope.md), + [AP-SPEC-065](0065-native-k-of-n-approvals.md), and + [AP-SPEC-066](0066-production-gateway-polish-and-recipe-qualification.md). +- **Governing boundary:** [profile and domain abstraction plan](../target-state/PROFILE_AND_DOMAIN_ABSTRACTION_BOUNDARY_PLAN.md). + Provider writes remain data-only recipes in the generic gateway. Core stays + offline, deterministic, bounded, and independent of credentials and stores. +- **Normative language:** **MUST**, **MUST NOT**, **SHOULD**, and **MAY** specify + implementation requirements. + +## 1. Decision and intended behavior + +The product promise is limited authority with enforceable consequences. A +worker may possess an Auths signing key and delegated permission, yet must be +unable to turn an approval for one action into a different provider request, +use retries to obtain another execution, exceed a shared allowance through +delegates, or interpret an ambiguous response as fresh permission. + +For example, an approval to attach an existing payment to a named invoice +must bind the exact payment, invoice, operator namespace, logical operation, +recipe, and any required case commitment. The gateway must derive its request +from that action. The business fact that those objects belong together is +owned by the profile, recipe author, and approval policy; a hash of a case +version alone does not establish that fact. + +If the intended business invariant must hold when the provider mutates state, +the integration needs a qualified provider-supported conditional write or +reservation with that meaning. A signed snapshot or a fresh pre-entry read +cannot prove that another writer did not change state in the interval. + +This program strengthens five links in one chain: + +```text + operator-owned trust / registry / recipe / connection + | | + untrusted proof + action bytes | + | | + [E1 canonical decoding] | + | | + [E5 exact signature boundary] | + | | + [E2 complete verification] | + | sealed verified action | + [E3 checked mapping + driver] <-----+ + | exact request / operation / counters + [E4 atomic claim + durable state] + | entry checks + sealed credential lease + [one bounded transport invocation] ------> provider + | | + [recorded outcome / signed evidence] <--------+ +``` + +The five workstreams are assurance extensions to existing mechanisms. They +are not a replacement gateway, a new policy language, or a second verifier. + +### 1.1 Existing evidence and remaining boundaries + +The baseline is the checked-in assurance evidence, not an inference that +production qualification is unfinished. Recipe/provider qualification and +software proof coverage answer different questions and retain their own +exact-artifact gates. + +| Boundary | Already present | Extension required here | +| --- | --- | --- | +| Authority | Rich authority, attenuation, approval/observation predicates, and selected shipping-Rust refinements | Compose these results with the actual verifier stages and registered handlers | +| Codec | Canonical re-encoding checks, bounded constructors, corpus, and fuzzing | Prove decoding/encoding and their connection to constructor-valid carriers | +| Requests | `RequestConstruction` theorems and translated construction leaves | Prove source validation/lowering, verified argument projection, and the driver/transport handoff | +| Execution | `SubmitOrder.at_most_one_send`, recovery transitions, aggregate count/sum bounds, and store conformance | Prove their composition across concurrent submissions and durable storage transitions | +| Connections | Credential-generation and revocation model/refinement theorems | Connect those checks to the execution trace and state precisely when an administrative change takes effect | +| Cryptography | Central signature primitives and protocol preimage construction | Prove the surrounding encoding, selection, and message-binding logic under explicit primitive contracts | + +Sources: [formal README](../../formal/README.md), +[assurance manifest](../../formal/assurance-manifest-v1.toml), +[coverage report](../assurance/PROOF_COVERAGE.md), and +[translation qualification](../../formal/qualification/aeneas/qualification.toml). +The coverage report's `decision` denominator excludes codec/crypto roles and +does not describe the whole gateway. A percentage increase alone is not a +completion criterion. + +### 1.2 Relationship to AP-SPEC-061 + +AP-SPEC-061 owns the implementation route for E1, E5, and the core portion of +E2. This document coordinates their acceptance criteria with E3 and E4, the +gateway reference-monitor result that AP-SPEC-061 leaves for later work. +There MUST be one codec cutover and one production verification path for each +supported configuration, not competing implementations under the two specs. + +Two details of AP-SPEC-061 are clarified here: + +1. Unproved obligations stay in this specification until proved. The current + assurance manifest accepts `proved`, `qualified`, and `assumed`, not + `open`. A placeholder theorem or an `assumed` row MUST NOT satisfy a done + gate for a proved obligation. +2. Crypto-library contracts are named explicit theorem premises, not new + global Lean axioms. This preserves the current foundational axiom + allowlist while making the conditional claim visible in both the theorem + and the manifest. It does not prove the primitive contract itself. + +## 2. Threat model and limits of the claim + +The adversary controls the application and its network submissions. It may +own a legitimately delegated actor key, reorder or duplicate attachments, +mix authentic material from different requests, alter approved fields, +choose fresh operation IDs, race many workers, disconnect at any boundary, +and restart a process. Provider responses may be unavailable, delayed, +malformed, oversized, inconsistent, or produced by another authorized writer. + +The proof MUST NOT assume that a request is honest because it is correctly +signed, that a controller key represents a human decision, or that the worker +will choose a stable business operation ID. + +The trusted boundary is explicit: + +| Premise | Meaning and enforcement evidence | +| --- | --- | +| Operator provisioning | Trust anchors, context, required verifier configuration, recipes, and connections come from the operator plane. Decoding a caller-supplied context does not make it trusted. | +| Cryptographic contracts | The selected primitive implements its stated function. Collision resistance and signature security, where used to interpret commitments or authenticity, remain separately named cryptographic assumptions. | +| Store contract | Successful acknowledged claims are durable; batches are atomic; compare-and-swap and uniqueness have the stated concurrency behavior. Backend conformance supplies evidence for this contract. | +| Clock contract | Verification uses the supplied evaluation time; runtime freshness and lease/entry deadlines use the named clock samples. Mathematical time predicates do not establish that a wall clock is correct. | +| Runtime and transport | The Rust compiler, OS isolation, credential adapter, HTTP/TLS stack, and external I/O satisfy the inventoried leaf contracts. Unproved parts remain named assumptions. | +| Provider contract | The provider interprets a request according to its independently reviewed API contract. Auths does not define provider business meaning. | + +A compromised gateway host or operator, a stolen provider credential used +outside Auths, and rollback of all durable state to an undetectable old backup +are outside this claim. Backup/restore procedures MUST preserve claims, +counter history, and generation/fencing state; a missing or obsolete store +must not silently become a fresh installation under the same authority. + +No theorem here claims provider exactly-once effects, settlement, constant +time, unforgeability, correctness of every principal adapter, or atomicity +between an external read and a later write. + +## 3. Architecture, APIs, and user-visible behavior + +### 3.1 Ownership and API invariants + +| Surface | Required contract | +| --- | --- | +| Core `verify_v1` / sealed verifier | Explicit bounded inputs and trusted configuration; deterministic result; only the sealed authorized result can project a verified action | +| Gateway `submit(proof_cbor, action_cbor)` | Application supplies no provider URL, headers, credential selector, trust replacement, connection generation, or caller assertion that a check passed | +| Recipe compilation | Validates a closed source and exact profile lock; emits digest-bound plans; grants no execution authority | +| Durable admission | Claims the logical operation and every required counter slot before credential lease; only the winning acknowledged claim produces an execution handle | +| Credential/transport boundary | Uses the operator-bound generation and a bounded lease; accepts only the closed request attached to that handle; adds credentials only at the transport leaf | +| Recovery and audit | Preserve the original action, recipe, operation, observation plan, and outcome provenance; re-observation cannot mint a write handle | + +Names for new Lean declarations below are proposed obligation names, not +claims that these declarations exist. Preserve current public Rust/SDK APIs +unless a phase identifies a missing invariant. Any required wire/result +change updates specifications, canonical fixtures, bindings, and independent +implementations atomically. + +### 3.2 Approval and result UX + +This program requires no new customer screen. Existing SDK review, approval, +receipt, and readiness surfaces MUST preserve these distinctions: + +- Review data comes from the canonical action and installed recipe. Show the + relevant account/resource identifiers, quantities, units, operation, and + policy commitments without truncation that makes distinct actions look + identical. If business data is represented by a commitment, the approving + application must separately validate the committed data and display it. +- Editing any approval-bound field requires a new exact-action approval. + A valid old approval must not be reused because a case label is unchanged. +- `Authorized`, transport entry, an HTTP response, a matched provider + observation, and a confirmed business effect are different states. + HTTP 200 alone cannot become a business-success assertion. +- Evidence identifies which data is native signed evidence and which is an + unsigned provider read. An auditor verifies signatures against independently + supplied trust and binds the evidence to the exact action and recipe. +- A future `proved_configuration` indication follows AP-SPEC-061. It is + computed from actual executed handlers and exact build/configuration + evidence, never supplied by an application or inferred from a green UI. + +## 4. E1: Canonical, total, bounded decoding + +**Risk:** the prover reasons about one value while the signer, SDK, or executor +interprets different bytes; hostile lengths or nesting bypass the resource +limits before a constructor can reject them. + +**Owners:** `core/crates/auths-codec`, constructor invariants in `auths-model`, +and new `formal/Auths/Codec/` model/refinement/theorem modules. Use +AP-SPEC-061's in-repository extractable tokenizer and direct source cutover. +The old codec may remain only as a test oracle. + +### 4.1 Required obligations + +For each security-bearing object on the proved configuration's input/output +closure, including action, proof, context, grants, status, approvals, +observations, and critical-extension payloads: + +| ID | Quantified property | +| --- | --- | +| E1.1 `decode_total_bounded` | For every byte string and valid deployment limits, decode returns a value or typed error without an out-of-bounds read, arithmetic overflow, or panic; input traversal, depth, collection counts, allocation requests, and abstract work stay within the specified bounds. | +| E1.2 `decode_encode_exact` | `decode(L, b) = ok v` implies constructor-valid `v`, complete input consumption, and `encode(v) = ok b`. | +| E1.3 `encode_decode_exact` | For every constructor-valid `v` whose encoding and structural dimensions fit `L`, `decode(L, encode(v)) = ok v`. | +| E1.4 `validated_carrier_refines` | Every successfully decoded carrier satisfies the representation premises used by the rich and translated authority, approval, observation, and policy proofs. | + +E1.2 plus determinism gives one accepted encoding per decoded value. E1.3 +MUST use a declared well-formedness relation and explicit limits; it cannot +quantify over values whose encoded form the deployment intentionally rejects. + +The specification MUST define the allowed CBOR subset independently of the +implementation: definite lengths, shortest integers, ordered unique map keys, +well-formed text, permitted fields, exact types, and no trailing data. Check +declared lengths before allocating or iterating. A byte limit on the final +object does not justify an unbounded intermediate allocation. + +Work bounds concern a named abstract operation counter and allocation model, +not a promise about wall-clock time or OS out-of-memory behavior. The bound +must include failed parses, re-encoding, and nested extension payloads. + +### 4.2 Evidence and exit + +The shipping codec's translated functions MUST refine the readable model; +tests of a second Lean decoder are insufficient. Add positive, malformed, +truncated, duplicate-key, non-minimal-integer, trailing-byte, invalid UTF-8, +oversized-length, deepest-nesting, and exact-limit fixtures. Differentially +check Rust, WASM, Python, TypeScript, and the existing independent verifier +implementations where applicable. Any changed existing wire decision is +resolved explicitly before cutover. + +**Permitted claim:** canonical decoding for the named objects is +machine-checked for exactness, totality, and the stated resource bounds, +subject to the published translation/compiler boundary. + +## 5. E2: Complete verifier soundness and useful authorization + +**Risk:** individually correct predicates are skipped, fed the wrong values, +combined incorrectly, or followed by an unauthorized result projection. + +**Owners:** `auths-verifier`, `auths-composition`, `auths-registries`, the +existing authority/model kernels, and new `formal/Auths/Verifier/` modules. +AP-SPEC-061's closed-registry entry point and extractable per-stage slices +remain the implementation route. Extend its proved set to include native +K-of-N approvals and AP-SPEC-064 status issuer scope. + +### 5.1 Required obligations + +| ID | Quantified property | +| --- | --- | +| E2.1 `verify_authorized_sound` | For every bounded proof/action input under operator-provisioned context and the declared primitive/adapter contracts, `Authorized` implies the independent rich authorization relation for those exact decoded values. | +| E2.2 `composition_refines_plan` | The shipping evaluator agrees with a structural Lean plan evaluator for every valid bounded plan, including `all_of`, `any_of`, `k_of_n`, structural invalidity, and the three-valued branch outcomes. | +| E2.3 `checks_and_projection_exact` | Required/executed configuration, all action-binding fields, handler dispatch, accepted branch selection, and the sealed result/action projection agree with their specifications. Stable denial/indeterminate codes retain the specified precedence. | +| E2.4 `verifier_total_bounded` | Every bounded input terminates within the declared complete verifier work bound; no failing branch, status lookup, attachment traversal, or composition recursion escapes it. | +| E2.5 `valid_requests_authorize` | Declared well-formed, sufficiently authorized requests are accepted. Prove a semantic completeness result for the closed proved configuration and concrete positive witnesses for each supported action/approval configuration. | + +The authorization relation MUST be written independently of the implementation +result. Defining it as “the verifier returned Authorized” proves nothing. +Soundness alone also permits an implementation that refuses everything; +E2.5 prevents that failure mode. + +The proof's check inventory MUST include: + +- canonical action/body/profile/permission binding, audience, challenge, + validity, exact required configuration, attachments, and shared action + identity across the plan; +- trusted-root provenance, signature/principal control, every delegation edge, + terminal coverage, registry acceptance, unknown critical extensions, and + the executable extension-law implementations; +- status authenticity, issuer scope, freshness, and revocation according to + the supplied context; evidence presence cannot substitute for a status + decision; +- distinct counted approvers, correct requirement ID, exact action/audience/ + challenge binding, relevant grant and context requirements, and separation + of approval from authority. Principal distinctness is the current contract; + do not silently claim distinct humans or distinct underlying keys; +- observation signature/anchor/schema/subject/fact binding, freshness, + authority-chain separation, and retained requirements through delegation; +- composition thresholds, distinct-actor/root floors, authorized branch + selection, and every deciding pure registry predicate named by the + check-site inventory. + +Missing required evidence MUST remain denied or indeterminate according to +the protocol, never become authorized through fallback. Optional invalid or +stray approvals follow AP-SPEC-065's ignore/count rules; this requirement +must not accidentally turn them into blanket request denials. + +### 5.2 Evidence and exit + +Every deciding and refusal site in the proved configuration must map to a +translated, audited theorem with adequate strength. Prove the registry shell +dispatch/projection bridge or retain it as an explicitly tested boundary and +withhold the complete-verifier claim. A configuration commitment or a boolean +coverage flag by itself does not prove that bridge. + +Adversarial fixtures must splice valid material across actions, contexts, +requirements, issuers, and profiles; duplicate approvers; mix authorized and +indeterminate branches; and exercise every threshold boundary. Include +multiple sufficient approval subsets so no positional or single-happy-path +implementation can satisfy E2.5. + +**Permitted claim:** the exact proved verifier configuration refines the rich +authorization relation, conditionally on its published primitive, adapter, +translation, compiler, and provisioning contracts. + +## 6. E3: Authorized action to exact outbound request + +**Risk:** a correct approval/verifier is bypassed by a compiler field-index +mistake, a different JSON interpretation, a stale request object, or an I/O +driver that uses data not covered by the verified action. + +**Owners:** `auths-gateway/src/recipe/{source,validate,lower,runtime}.rs`, +`recipe.rs`, `engine.rs`, `submit.rs`, and `auths-gateway-kernel`. Extend +`RequestConstruction`/`SubmitOrder` and their refinements; add focused +compilation and driver models rather than another request language. + +### 6.1 Required obligations + +| ID | Quantified property | +| --- | --- | +| E3.1 `compile_preserves_recipe` | For every accepted source/profile lock, source decoding, validation, digest canonicalization, and lowering preserve the independent declarative mapping and all bounds. | +| E3.2 `verified_projection_exact` | The command, named fields, positional argument vector, operation identity, scope, and policy inputs are lossless projections of the sealed canonical action; rejection cannot yield an executable value. | +| E3.3 `closed_request_refines_recipe` | For every accepted source and verified action, the constructed request tuple equals the source-level recipe interpretation: method, origin, path, declared headers, content type, and body. | +| E3.4 `driver_refines_commands` | Every security-relevant driver effect is exactly the command selected by the proved step machine, with the verified action, request, claim, connection binding, and lease from that same attempt. | +| E3.5 `execution_requires_authority` | Compose E2 with E3 and E4: each gateway write entry has a matching authorized action, approved mapping, winning durable claim, reserved counters, required entry checks, and exact request. | + +Model the recipe's decoded source semantics independently of its lowered +plans. Proving two functions that both use an incorrect field index does not +establish the intended mapping. Source/lock JSON parsing and canonicalization +must either be included in the refinement or remain explicit external +contracts; in the latter case, publish only the smaller decoded-source claim. + +The proof must establish header-name/value safety, exact enum/type checks, +JSON escaping and integer precision, form encoding, profile-field ordering, +and unambiguous operation/idempotency/echo commitment preimages. Prove that +unreferenced fields cannot affect a rendered component, and referenced fields +cannot be substituted by similarly named values from an unverified request. +Specify duplicate-member, number, and Unicode handling at each JSON boundary. +Recipe-source whitespace may normalize to the same decoded source and digest; +this is different from E1's canonical CBOR uniqueness. No consumer may review +one interpretation of a duplicate member while executing another. + +For each security-relevant approved field, record whether it is emitted into +the request or checked by a named admission condition/commitment contract. +An opaque case commitment does not tell the generic gateway that a selected +invoice is correct or a database version is current. Such business meaning +needs an independently checked profile/approval oracle; it must not become a +provider-specific branch in the gateway. +Quantity contracts must state their units, currency where applicable, and +rounding rules. Agreement on an integer alone does not establish agreement +on its financial meaning. + +### 6.2 Driver, transport, and credential boundary + +The existing `SubmitOrder` proof already constrains the command sequence. +E3.4 must additionally cover the actual driver's command-to-I/O mapping, +event/result conversion, request ownership, cancellation, and one-use handle +consumption. Qualify the extraction route before restructuring that code. +If async code cannot translate, move decisions and payload/handle transitions +into a translatable closed kernel consumed by the shipping driver. Any +remaining interpreter correspondence assumption stays named; E3.4/E3.5 are +not complete merely because the kernel has a theorem. + +The request property ends at the exact transport invocation. The HTTP leaf +must have a reviewed contract for URL parsing/normalization, credential-header +injection, default headers, DNS pinning, TLS hostname validation, no proxy, +no redirects, no automatic write retry, and response/time bounds. Include +an independent wire oracle for the actual pinned HTTP stack, covering +dot-segments, percent encoding, encoded separators, header collisions, and +body preservation. Do not claim that a theorem about a URL string proves +the request a client library puts on the wire. + +Secret bytes remain outside action/proof/recipe/evidence data. Prove structural +confinement of credential access and explicit output projections; continue +isolation and redaction tests for actual secrets. This is not a proof of OS +isolation, all memory behavior, or absence of side channels. + +**Permitted claim:** the named production mapping and driver boundary execute +only requests derived from the authorized action and installed recipe, +subject to the specifically retained transport/runtime contracts. + +## 7. E4: Concurrent admission, crashes, and durable state + +**Risk:** a theorem about one submission or sequential arrivals does not +establish safety of concurrent read/claim/retry sequences, lost commit +acknowledgements, recovery, or counter collection. + +**Owners:** `auths-gateway/src/{bounds,store,submit,connection}.rs`, +`auths-connections`, and `auths-stores/src/gateway_attempt.rs`. Extend +`CeilingCount`, `Recovery`, `ConnectionGenerations`, and their refinements +with a global history model and the shipping admission algorithm. + +### 7.1 State and transition model + +Model arbitrarily many workers and arbitrary finite interleavings. State +includes logical-operation claims, count/sum slots and their cumulative +values, attempt records, connection/credential generations, collection +fences, and outstanding one-use execution handles. Crashes discard volatile +handles; they do not erase acknowledged durable state. + +Use the actual identity `(operator_namespace, logical_operation_id)`. Prove +its framed key derivation under the declared hash assumption. Changing the +challenge, proof, actor, case version, recipe, process, or credential +generation must not clear an existing claim for that identity. A genuinely +different operation ID remains a different operation; see §7.4. + +The store model MUST permit an error or lost acknowledgement after a batch +committed. The caller may proceed only after the success that grants its +execution handle. “An error occurred” must not imply “the claim is absent.” +Likewise, rollback of a transaction is distinct from rollback of the durable +database to an older snapshot. + +### 7.2 Required obligations + +| ID | Quantified property | +| --- | --- | +| E4.1 `claim_has_one_owner` | Every logical identity has at most one successful execution owner across workers/restarts. Replays, conflicts, indeterminate commits, and read-only recovery mint no new owner. | +| E4.2 `admission_refines_aggregate_bounds` | The actual counter derivation, smallest applicable capacities, frontier search, cumulative reads, conflict retries, and atomic claim/slot batch refine the existing aggregate count/sum specification for every interleaving. | +| E4.3 `every_history_preserves_capacity` | Every finite history preserves each applicable chain/partition/window bound; delegates, sibling workers, and alternate valid proofs cannot multiply a shared allowance. | +| E4.4 `crash_recovery_preserves_authority` | Every crash/restart prefix preserves claim identity, counter commitments, observation plan, checkpoint/response provenance, and valid compare-and-swap transitions. Uncertainty cannot grant another write or fabricated evidence. | +| E4.5 `collection_cannot_reopen_capacity` | Slot collection never reopens an admitted/reclaimed window, even after another process uses an earlier clock value; claims are not collected. | +| E4.6 `connection_checks_bind_entry` | A lease and write entry use the connection/credential generations that passed their specified reloads, readiness/qualification gates, account/scope guards, and authority-derived entry deadline. No stale-generation fallback or expired authorization may license a new entry. | + +The gateway's present fixed-window slots are consumed at admission and are +never released within the window, including after a later pre-entry refusal +or unknown response. Preserve that contract. The older lifecycle model's +reserve/commit/release theorems do not authorize adding refunds to gateway +slots. Exhaustion may retain a terminal `not-entered` claim without slots; +contention exhaustion may safely refuse. Specify both cases exactly. + +These are fixed windows, not rolling intervals. Adjacent windows can each +admit their full allowance near a boundary. Preserve and expose that policy +meaning; a rolling-period promise requires its own model and mechanism. + +E4.5 requires a shared durable collection/admission fence, or an existing +shipping mechanism proved equivalent. The initial design is one monotone +`collected_through` cutoff in the shared gateway store: + +1. Before deleting slots eligible at cutoff `t`, the sweeper durably advances + the fence to at least `t`; a crash may leave fewer deletions, never an + unrecorded deletion boundary. +2. A bounded admission atomically checks that its slot expiry is strictly + greater than the current fence and inserts its claim/slots. A separate + fence read followed by the old unconditional `insert_all` is insufficient. +3. Fence advancement and fenced admission have ordered linearization points. + A stale worker cannot insert into a collected window after its slots have + disappeared. Unknown commit outcomes retain the same conservative rules + as claims. Mixed window lengths use their actual validated slot expiry. + +This needs a narrow conditional-batch operation in the gateway store port and +both backends, not a caller-held boolean. A process-local last-sweep timestamp +is not sufficient. The fence may conservatively close an old window whose +slots were not deleted after a crash. Until this mechanism lands, any +window-safety claim must retain its clock/collection premise and cannot claim +tolerance of clock rollback. Correct wall-clock time remains a separate +assumption even with this fence. + +### 7.3 Revocation, recovery, and backend evidence + +E2 establishes validity at the supplied evaluation time. E4 must also prevent +an approval or grant that expires while the worker is waiting from licensing +a later entry. Project an internal `EntryNotAfter` from the exact sufficient +authorization witness: the relevant grants/action, counted approvals, +required observations/status freshness horizons, and installed time-limited +gates. Preserve inclusive/exclusive endpoints from the respective contracts. +It is the minimum of those applicable horizons and the existing maximum +verification-to-entry interval; it cannot come from caller JSON. + +At the final deadline gate require a valid clock sample at or after the +evaluation time and within `EntryNotAfter`, together with the existing +monotonic elapsed-time limit and lease deadline. An expired horizon or +disallowed rollback must produce the existing typed pre-entry failure, +retain any claim/slots, and send no write. A proof that the earlier evaluation +time was valid, or that fewer than 60 seconds elapsed, is insufficient by +itself. This is an +execution-boundary extension; it does not change offline verification's +evaluation-time contract or promise cancellation of an in-flight request. + +Use the existing connection semantics: a committed disable/revocation/rotation +is observed at the next shared-record reload. A submission that passed its +last entry reload may already be in flight. Prove that actual rule, including +the local drain and credential-retirement interval; do not describe it as +instant cancellation of requests already past the gate. A stronger global +quiescence contract would be separate work. + +Re-observation is read-only and uses the stored observation plan. A response +locator cannot resolve a lost response that never recorded that locator. +Unlinked observations cannot become linked recovery evidence. Another +writer producing a matching field or token does not prove exclusive causation. + +The abstract store contract must include atomic batches, unique keys, +compare-and-swap against exact expected record bytes, durable success, +fail-closed corrupt/unreadable loads, and the relevant collection fence. +Specify a linearization point for each operation. PostgreSQL may implement +the contract with its actual transaction isolation, unique constraints, and +rollback; do not assume the backend uses serializable isolation. File-store +evidence must cover locking, journal recovery, file and directory durability, +and every partial batch boundary. + +Run the same backend conformance against multi-process races, commit-before- +acknowledgement loss, every persisted crash boundary, replacement races, +collection/admission races, and restart with missing/corrupt/obsolete state. +These tests support the external store premise; they are not a proof of the +database, filesystem, or storage hardware. + +### 7.4 Business identity and progress + +The application cannot be trusted to implement “once per payment” merely by +usually choosing the same operation ID. A product making that promise MUST +derive or enforce its stable business identity in the trusted profile, +approval issuer, or operator-owned workflow, bind it into the exact action, +and test fresh-ID attempts. This requirement is domain-owned; core must not +learn Stripe payment semantics. A fresh ID must also remain subject to the +same applicable aggregate budget. + +Safety holds under arbitrary scheduling. Progress is conditional on available +dependencies, valid input, deadlines, and finite contention. Prove a positive +available-capacity admission witness and bounded termination of retries; +do not promise starvation freedom or availability during a partition. + +**Permitted claim:** across the declared store/clock/runtime contracts, the +gateway admits one owner per logical operation, conserves the stated shared +allowances, and preserves these properties through the modeled failures. +This is at-most-once gateway write entry, not provider exactly-once effect. + +## 8. E5: Exact cryptographic integration + +**Risk:** a vetted primitive receives the wrong key, suite, object type, +profile, or signing bytes; a correct signature then authenticates a different +statement from the one the verifier uses. + +**Owners:** `auths-codec/src/hash.rs`, `auths-signature-core`, the signature +adapters and proved principal/status handlers, plus new +`formal/Auths/Crypto/` integration modules. Use AP-SPEC-061's phase 2 route. + +### 8.1 Required obligations + +| ID | Quantified property | +| --- | --- | +| E5.1 `signing_preimage_exact` | Every object uses exactly its registered prefix, protocol/object/profile/version tags, length framing, canonical unsigned statement, and signature descriptor. | +| E5.2 `framing_is_unambiguous` | On the validated bounded domain, equality of preimage bytes implies equality of their framed inputs; different object/domain tags cannot share a preimage. This does not assert collision-free hashes. | +| E5.3 `suite_glue_refines_spec` | Key/signature decoding, suite dispatch, key/principal binding, low-S and other registry rules, and the exact message passed to the primitive refine the named suite specification. | +| E5.4 `commitments_bind_exact_inputs` | Core and gateway action/operation/recipe/account/echo/idempotency commitments use the specified preimages without omitted fields or ambiguous concatenation, under separately recorded hash assumptions. | + +Cover approvals, observations, principal/grant status, grants, actions, and +any outcome signatures used by the composed execution claim. Keep different +protocol hash/signature domains distinct. Validate Ed25519 encodings against +the declared RFC 8032/registry contract and P-256's compressed-key, fixed-width +signature, point-validity, and low-S rules; do not assume a library constructor +enforces every protocol restriction. Coordinate any tightening of accepted +inputs and stable errors across the corpus and independent implementations. + +The initial dependency choice is AP-SPEC-061's current-library route: +`ed25519-dalek`, `p256`, and `sha2`, with named implementation-meets-spec +premises. This specification adds no cryptographic dependency or advisory +exception. A later switch to a verified implementation needs its own evidence +and dependency review and retains the translation/compiler assumptions. + +Represent primitive contracts as explicit parameters, for example: + +```text +CryptoRefines(impl, spec) -> + suite_verify(impl, key_bytes, message_bytes, signature_bytes) = accepted -> + SuiteSpecAccepts(spec, key_bytes, message_bytes, signature_bytes) +``` + +This is a proposed statement shape, not an unconditional proof that the +libraries meet their specifications. Keep the existing foundational axiom +allowlist; forbid `sorryAx` and native-evaluation axioms in new public claims. +Every manifest entry and permitted claim sentence must expose the relevant +primitive premise. Collision resistance does not mean SHA-256 is injective +over all byte strings, and it must never be silently derived from functional +correctness of SHA-256. + +Use published algorithm/encoding vectors and independent negative cases: +wrong domains/profiles/suites, modified lengths/descriptors, noncanonical or +small-order Ed25519 encodings as applicable to the declared suite, invalid +P-256 points/forms, high-S signatures, and actual P-256 positive tuples. + +**Permitted claim:** signature and commitment integration is machine-checked +against the named specifications, conditional on the explicit primitive and +cryptographic assumptions. No claim that elliptic-curve arithmetic or +cryptographic security has been proved in Lean is introduced. + +## 9. Composed claim and adequacy + +The final reference-monitor statement is over every finite prefix of a +reachable system history, not one canned demonstration. Informally: + +```text +For every supported installation I and history H, + Provisioned(I) and ExternalContracts(I, H) and Reachable(I, H) + imply that every GatewayWriteEntry in H has: + an exact decoded and authorized action under I's supplied trust; + all required approvals, evidence, and applicable product policy; + a request equal to I's approved recipe applied to that action; + one winning durable operation owner and its reserved counters; + the required connection, credential, freshness, and entry checks; + at most one write entry for that logical operation in H; + outcome/evidence transitions justified by what was actually recorded. +``` + +`ExternalContracts` MUST enumerate the contracts in §2 and any smaller +remaining runtime/transport boundary. It cannot contain “all writes are +authorized,” “the driver behaves like the theorem,” or the desired budget +bound as a disguised premise. An intermediate result may retain a precisely +named driver/store bridge premise, but it cannot satisfy the corresponding +uncompleted E3/E4 obligation or the final M6 gate. Physical I/O and backend +contracts remain external as defined above; the shipping authorization, +mapping, and admission algorithms must be related to their specifications. + +The public statement and all its definitions require review independently of +the proof implementation. Add positive witnesses and targeted mutations: + +| Attack or defect | Required result | +| --- | --- | +| Change invoice, payment, account, amount/currency, case commitment, namespace, operation, or recipe while reusing the original approval | That approval cannot authorize the changed action; the unchanged proof cannot license a write | +| Reuse authentic approval/evidence under another audience, challenge, requirement, issuer, or profile | Refusal or indeterminate according to the protocol; no write | +| Duplicate an approver or count an authority principal as a required approver | Quorum is not inflated | +| Mis-index a field, drop a compiler guard, or substitute the original unverified JSON | Corresponding refinement/adequacy obligation fails | +| Replay with a fresh challenge, worker, process, or credential generation | No second owner/write for the same logical identity | +| Invent a fresh operation ID for the same business event | The domain-owned once-per-business-event rule rejects it where that rule is promised; otherwise it remains subject to all approvals and shared bounds | +| Race the last count/sum capacity across delegates and workers | At most the allowed aggregate admission; no partial claim/slot batch grants execution | +| Lose a commit acknowledgement or kill a process at a persistence/transport boundary | No duplicate permission; retained state is conservatively recoverable | +| Collect old slots, then use an old clock/window | The collection fence prevents renewed admission | +| Disable/rotate between checks | The next defined reload rejects stale state; requests past the last gate retain their explicitly stated in-flight semantics | +| Return a 2xx response, mismatched echo, missing locator, or malformed read | Preserve the appropriate response/unknown/observation classification; never invent confirmed business success | +| Replace the implementation with deny-all or panic | Completeness/positive witnesses or totality proofs fail | + +Quantify over all bounded accepted inputs and arbitrary finite histories; +case fixtures and bounded Kani checks supplement those theorems. They cannot +replace an unbounded history invariant with a fixed worker count. + +## 10. Delivery sequence, proof hygiene, and done gates + +### 10.1 Bounded milestones + +| Milestone | Deliverable | Prerequisites and exit | +| --- | --- | --- | +| M0: Claims and extraction slices | Independent semantic relations, theorem contracts, source/assumption/check-site map, and small positive/negative translation examples | Freeze the intended claims before proofs; demonstrate the route on real shipping functions without extraction-only semantics | +| M1: E1 codec | Tokenizer, constructors, encoding, all E1 proofs, and direct cutover | Corpus parity, hostile bounds cases, and exact-source qualification | +| M2: E5 crypto integration | Framing and suite-glue proofs with explicit primitive contracts | E1 for byte-level claims; cross-language vectors; no global axiom expansion | +| M3: E2 verifier | Pure registry/composition refinements, staged verifier proofs, complete sealed projection | E1/E5 for the complete byte-to-authority claim; approvals/status/observations included | +| M4: E3 mapping and driver | Source/lock/argument/plan refinements and the driver bridge | Existing request/order proofs reused; E2 supplies the complete authorization premise | +| M5: E4 history and storage | Admission algorithm refinement, crash/collection/connection invariants, backend conformance | May develop against an explicit authorization premise before M3; the complete claim waits for composition | +| M6: Composed assurance | E3.5, full history statement, release-bound evidence, and truthful SDK/operator reporting | Every prerequisite and remaining assumption visible on the exact release revision | + +Each milestone is split into reviewable changes. First prove one complete +small path from shipping function to readable specification and a useful +positive action. Establish extraction/build cost on representative boundary +inputs before scaling. Reuse the pinned toolchain and qualified translation; +do not spend a phase proving an independent model with no production bridge. + +### 10.2 Required evidence for every proved claim + +1. The exact declaration and statement, full quantified domain, readable + definitions, non-vacuity witnesses, residual premises, and source closure. +2. Mechanically translated shipping functions, exact production feature set, + reviewed external models, strict warning gates, and two byte-identical + translation reproductions when that closure changes. +3. Updates to `Auths.Theorems`, the compiled `Auths.AssuranceAudit`, + `assurance-manifest-v1.toml`, and `theorem-kinds-v1.toml`. Prefer exact or + verdict-exact refinement; a weaker lemma cannot satisfy an exactness gate. +4. Transitive axiom audit, including dependencies. No `sorry`, blanket opaque + local predicate, extra global axiom, or native-evaluation admission may + discharge a new public obligation. +5. A fail-closed check of theorem premises and representation validity; their + source must not be replaced by a test-only constructor or trusted flag. +6. Updated check-site and coverage evidence with stable declared denominators. + Report codec, verifier, compiler/driver, and stateful-store coverage + separately; do not improve a headline by excluding hard code. +7. Corresponding adversarial, differential, property, fuzz, and mutation + evidence. Required security mutants must be killed; an equivalent mutant + needs a reviewed explanation. Results must match the release inputs. +8. Hosted CI on the exact revision, including the authoritative formal, + translation, Kani, implementation, compliance, and secret gates appropriate + to the change. Add clean proof rechecking with the pinned Lean toolchain's + supported checker to the authoritative proof job; audit statements as well + as proof terms. + +Follow the repository's GitHub-first policy. This documentation change runs +no formal qualification. Implementation work uses focused translation slices +to construct changes and hosted CI for the authoritative result. A fast Lean +feedback build alone does not qualify a milestone. + +### 10.3 Decisions fixed by this spec + +- Keep one monorepo and the existing layer boundaries. Reuse current kernels + and theorem modules; create no universal business-policy abstraction. +- Keep current crypto libraries for the initial proof route and use explicit + premises. No new dependency, advisory exception, or global axiom is implied. +- Preserve canonical wire behavior and stable decisions except separately + specified, reviewed security corrections such as stricter suite encodings. +- Preserve conservative gateway slot consumption and read-only recovery. +- Require a shared collection/admission fence before claiming tolerance of + clock rollback after collection; global instantaneous revocation and + provider-conditional business writes remain outside scope. +- Keep UI rendering, actual host isolation, and provider semantics supported + by their own evidence rather than describing them as consequences of Lean. + +Implementation choices within these contracts do not require changing the +public promise. A failed feasibility gate leaves its claim unearned; it does +not authorize weakening the theorem or moving the risk into an unnamed axiom. + +## 11. Evidence and references + +Local baseline references are listed in §1.1. Additional anchors: + +- [Qualified Rust-to-Lean decision](../adr/0011-rich-authority-rust-lean-link.md). +- [Gateway ordering model](../../formal/Auths/Product/SubmitOrder.lean), + [request construction](../../formal/Auths/Product/RequestConstruction.lean), + [recovery](../../formal/Auths/Product/Recovery.lean), + [aggregate bounds](../../formal/Auths/Product/CeilingCount.lean), and + [connection generations](../../formal/Auths/Product/ConnectionGenerations.lean). +- [Protocol domain separation](../../core/spec/v1/domain-separation.md). +- [Lean proof validation](https://lean-lang.org/doc/reference/latest/ValidatingProofs/): + statement meaning, transitive axioms, and proof rechecking are separate + review concerns. Tool availability must be checked against the pinned Lean + version rather than silently upgrading the toolchain. +- [Aeneas](https://github.com/AeneasVerif/aeneas): the repository's qualified + pinned revision, not upstream's current branch, governs extraction here. +- [RFC 8032](https://datatracker.ietf.org/doc/html/rfc8032): Ed25519 decoding and + verification specification referenced by E5 and AP-SPEC-061. + +## 12. What must be built to support this decision + +These are additions to the proof boundary, not assertions that existing +runtime features or provider qualifications are absent. + +| Build item | Evidence for the gap | Completion evidence | +| --- | --- | --- | +| Extractable canonical codec and constructor bridge | `formal/README.md` and AP-SPEC-061 exclude codecs from the current proof surface | E1.1–E1.4 on the shipping codec and full input closure | +| Full composition/registry/stage and sealed-result proofs | `PROOF_COVERAGE.md` identifies these functions/check sites outside the refined closure | E2.1–E2.5 with every required check mapped | +| Source/lock compiler, argument conversion, and driver bridges | Gateway refinement residual assumptions in the assurance manifest explicitly exclude compilation/conversion and the async I/O correspondence | E3.1–E3.5, with any retained JSON/transport/interpreter boundary named | +| Global admission and crash refinement | Existing aggregate predicates assume derived counters and atomic store behavior; the actual `reserve_with_claim` protocol is outside that proof | E4.1–E4.4 and multi-process backend conformance under the actual transaction/file semantics | +| Shared closed-window/admission fence | Baseline slot collection uses gateway time; `last_sweep` is process-local and the current proofs assume the clock/store boundary | E4.5, including collect/rollback/old-worker races, without claiming a trusted wall clock was proved | +| Execution-time connection and qualification bridge | Current generation proofs do not by themselves prove which runtime path consumes a lease and sends a request | E4.6 composed with E3.4, preserving the existing next-reload/in-flight contract | +| Authority-derived entry expiry | The current runtime checks a fixed verification-to-entry interval; the new contract also needs the exact authorization witness's remaining validity | Internal `EntryNotAfter` projection and final checks, with expiry/rollback/queue-delay cases and no caller override | +| Domain-owned business-identity and intent evidence | Logical-operation deduplication and an opaque case hash do not themselves establish once-per-payment behavior or correct invoice selection | A reference workflow that enforces stable business identity, validates committed facts before approval, and independently checks the recipe's intended mapping | +| Suite/preimage proofs and explicit primitive premises | Codec/hash, signature suites, and full signature dispatch remain outside the present proof surface | E5.1–E5.4 and audited conditional claims | +| Final claim and independent adequacy review | Current claims are scoped component/refinement statements | The composed history theorem, positive useful-work witnesses, mutation evidence, and exact-release public claim | + +The first implementation change should establish M0 and the smallest E1 +tokenizer/constructor refinement slice. It must leave a positive accepted +object and a meaningful malformed/bounds rejection proved against the exact +shipping code. That is the starting point for the larger codec cutover, +without claiming the other four enhancements have been completed. + + +## 13. Pause checkpoint and resume instructions — 16 October 2026 + +The owner requested a pause after a coherent checkpoint and subsequently +requested continuation on 16 October 2026. The following records the pause +state; work has resumed at §13.4. The implementation is substantial but is +**not close to completing every requirement of this spec**. No E1–E5 +workstream or M6 is declared complete. The claim count below measures audited +component statements, not a percentage of the end-to-end security promise. + +### 13.1 Saved branch and review state + +- Repository: `/Users/bordumb/workspace/repositories/auths-proof-base/auths-proof`. +- Branch: `codex/lean-enhancements`. +- Latest implementation checkpoint: `cdb2c837995c507d051a239864aa8fef880ee192` + (`feat(formal): qualify selected temporal-witness expiry`). +- Its preceding local checkpoint: `98adcfb5c358510f2729abe7c8eb2c2cddda0b32` + (`test(crypto): qualify shared independent P-256 corpus`). +- Draft review: [PR 209](https://github.com/auths-dev/auths-proof/pull/209). + Do not merge on the strength of these component results. +- At the pause check, the remote branch remains at + `59c56d5bf2a9db92b028fb430d997ff259e83ec2` (613-claim suite-adapter + checkpoint). The corpus and temporal checkpoints are saved locally and + have not been pushed, to avoid cancelling that revision's expensive + authoritative replay. Recheck the remote before publishing later work. +- Unrelated research documents and two report PDFs are left untouched and + untracked. No partially applied status-selector refactor is left in the + production tree. + +### 13.2 Evidence achieved at this checkpoint + +The detailed component ledger is +[AP_SPEC_069_STATUS.md](../assurance/AP_SPEC_069_STATUS.md). The executable +claim inventory, full compiled statements and kernel constant references, +exact source closures, and theorem kinds are committed under `formal/`. + +The latest construction qualification passes **634 compiled claims**, with +all 613 preceding complete audit records unchanged. It passes **16/16 +qualification cases**, **22 reviewed external models**, zero unreviewed +models, zero compiled external axioms, and two byte-identical fresh +translations. The transitive axiom audit uses only `propext`, +`Classical.choice`, and `Quot.sound`. Production source closure: +`d0e1dba843ae5f0bba50a2b00cf8f779721756069e3bc1481feaab81d1b836d5`. +The manifest separately binds the complete semantic/proof source closure. +Release semantic-freeze and gateway semantic-closure artifacts are refreshed. + +Completed component boundaries include canonical CBOR heads, accepted action +re-encoding/uniqueness, selected identifier validation, composition-plan +validation/evaluation and facade projection, shared signing/commitment framing +with exact bounds, native Ed25519/P-256 and one-shot SHA-256 integration under +explicit primitive contracts, linked signature-suite verification adapters, +collection/deadline leaves, and the new selected-witness expiry helpers. +These do not constitute complete-object decoding or a complete verifier. + +The new temporal proofs cover the actual status decision/horizon and selected +assurance-horizon helpers, loop termination, missing requirement/timestamp +refusal, unbounded rules, inclusive endpoints, exact saturating addition and +minimum expiry. Five focused native cases use validated constructors. **They +are expiry-only claims:** they do not establish witness authenticity, +selection by the full evaluator, observation-time ordering, satisfaction of +all required policies, or runtime consumption of the complete witness. + +The shared independent P-256 corpus contains **653 cases**, including all +262 pinned upstream Wycheproof cases and 173 admitted signatures over 98 +public keys. Native Rust, independent Go and independent TypeScript tests +pass. Explicit high-S policy transformations and provenance are recorded in +`core/fixtures/crypto/README.md`; the offline importer reproduces exact bytes. +Tests support the primitive contracts; they do not prove crypto arithmetic. + +Decision-code coverage is 127/1,044 functions, 1,552/11,535 lines and 23/82 +check sites. Existing mutation campaigns predate the current proof sources +and must be refreshed before a release. Do not interpret this pause as release +qualification. + +### 13.3 Hosted evidence still pending + +The last confirmed fully successful hosted checkpoint is `e119ec92` (567 +claims). At the pause check, the suite-adapter revision `59c56d5b` has passed +translation, but its authoritative Lean job is still running; no failed job +was reported by the current main-run query: + +- [Main run 38904220615](https://github.com/auths-dev/auths-proof/actions/runs/38904220615). +- [Authoritative job 116999215585](https://github.com/auths-dev/auths-proof/actions/runs/38904220615/job/116999215585). + +Neither local checkpoint `98adcfb5` nor `cdb2c837` has exact-revision hosted +results. On resumption, inspect the existing job and all required independent +workflows first. Preserve their actual conclusions, push the saved bounded +checkpoints, and obtain hosted evidence on the new exact revision. Update the +PR description with that distinction. Do not substitute a previous revision's +success or a local qualification for the required hosted merge gates. + +### 13.4 First next implementation slice: actual status selection + +Continue E2/E4 at the source that selects status evidence, before claiming +that the proved expiry helpers receive the right witnesses: + +- `core/crates/auths-registries/src/lib.rs`: `ExactStatusMethod` principal and + grant methods and `select_principal` / `select_grant`. +- `core/crates/auths-model/src/lib.rs`: `status_issuer_in_scope` and + `status_issuer_visible`. + +A disposable extraction experiment used the shipping trait implementation, +not a test wrapper. Charon extracted it, but Aeneas refused early returns +inside selector loops and lifetime constraints in iterator `find` reached via +filter/collect. No partial translation was admitted and no Auths selector was +replaced with an opaque premise. Prototype files under `/private/tmp` are +optional scratch material, not part of the saved implementation or a resume +dependency. + +The next bounded change should: + +1. Preserve the current selectors and visibility rules as **test-only** + independent reference algorithms. Cover complete verdict, validity horizon + and error precedence with validated native inputs and boundary/property + cases before a direct production cutover. +2. Reshape the actual principal and grant selectors into explicit bounded + scans with state flags, without early returns inside loops or iterator + `find`/filter pipelines. Keep the two concrete typed selectors. Retain one + shipping implementation and no compatibility switch. Rewrite the existing + visibility helpers similarly; do not introduce a second visibility policy + or change bounded-set membership without evidence. +3. Preserve the existing semantics: ExpiresOnly precedence, method and + snapshot refusal order, issuer scope visibility, the first matching trust + rule, rollback refusal for any trusted below-floor sequence, distinct + missing/wrong-method/untrusted outcomes, highest-sequence tie handling, + stale-before-revoked precedence, and the minimum of snapshot, statement + and saturating age deadlines. Unknown issuers remain visible to the scope + filter and are refused later as untrusted. +4. Re-extract that exact shipping closure with all Auths helpers transparent; + prove full result refinement against an independent selection model, + meaningful accepted/refused cases, termination and relevant bounds. Only + then connect selection to temporal-witness construction. +5. Update source/claim/model inventories, check-site coverage, gateway closure + and release identities together, reproduce translation twice, and obtain + exact-revision hosted evidence. A native parity test alone earns no Lean + selection claim. + +### 13.5 Remaining program after that slice + +| Workstream | Still required for completion | +| --- | --- | +| E1 / M1 | Full protocol-object/tokenizer/constructor validity closure; all-input refusal/totality and inverse completeness; resource/allocation bounds; complete shared-language codec corpus. | +| E5 / M2 | Suite constructors/IDs and closed registry dispatch; principal/key binding; actual caller unsigned-object and descriptor construction; every core/gateway commitment call; all required AP-SPEC-061 vectors. Existing crypto primitive contracts remain explicit. | +| E2 / M3 | Native callbacks and closed registries, approvals/status/observations, staged verifier, complete sealed projection and temporal-witness selection, required/executed configuration and work accounting, full byte-to-authority composition. | +| E3 / M4 | Actual source/lock parsing and compiler lowering, field/argument conversion, sealed projection to driver command, complete command-to-I/O bridge and independent wire oracle. | +| E4 / M5 | Actual counter derivation and admission refinement, arbitrary finite concurrency/crash/acknowledgement histories, backend correspondence, full witness and connection-generation consumption by the driver. Existing collection-fence and deadline components remain scoped evidence. | +| M6 | Composed history/reference-monitor theorem, independent adequacy review, useful positive actions, required mutation evidence and exact-release SDK/operator claims. | + +Resume from the committed artifacts and this list. Do not restart completed +component proofs or describe the five enhancements as finished because the +claim count grew. The exit gates in §10 remain authoritative. + + +### 13.6 Resumption — 16 October 2026 + +The preceding `59c56d5b` checkpoint passed the authoritative Lean replay and +all ten hosted workflows, including main CI, translation, implementation, +secret scanning, PostgreSQL, Stripe, isolation and SDK qualification. The +saved corpus, temporal and documentation commits through `e4770a2b` have now +been pushed to the existing draft PR for exact-revision hosted verification. +The historical pending/local-only statements in §13.1 and §13.3 describe the +pause time, not the resumed branch state. + +The next source slice is still status selection (§13.4). Its refactor and +extraction experiments are construction work until their complete source, +proof, inventory, reproducibility and hosted gates pass. The frozen old +algorithm is retained only under `#[cfg(test)]` as a differential oracle. + + +### 13.7 Approval-view status scan — 16 October 2026 + +The bounded source cutover in §13.4 now has one allocation-free indexed scan +per concrete principal/grant selector, plus indexed visibility and first-rule +lookup. The superseded algorithms exist only as independent test oracles. +More than 19,000 constructor-valid generated snapshot pairs compare complete +results in both anchor views and the approval view; dedicated cases cover +sequence/floor and saturating-time word limits. Focused native parity, lint, +and generated-context rejection checks pass. + +The new Lean source claims establish total principal and grant port results +against the operational accumulator for the approval view, exact first-rule +selection and freshness, and nine actual-port positive/refusal witnesses. +The independent filter/max/tie-set specification is present, but equivalence +to the accumulator is **not yet proved**. Anchor-view refinement, sorted +scope-search membership, evidence authenticity and the full verifier remain +open. No whole enhancement or milestone is complete. + +Fresh construction qualification passes **658 compiled claims**, preserving +all 634 preceding complete records, **17/17 cases**, **23 reviewed models**, +zero unreviewed models and zero compiled external axioms. Two clean +translations are byte-identical. Production source closure: +`597b19ee0354614b37b9f048c7248e5684e69cf2c0d05a92a8b224a0b1172c7f`. +Only the three permitted foundational axioms occur transitively. + +The preceding 634-claim revision `e4770a2b` has passed main CI and all nine +independent hosted workflows; main run +[38931405294](https://github.com/auths-dev/auths-proof/actions/runs/38931405294) +completed successfully. The 658-claim source slice still needs its own hosted +replay. Current work connects the accumulator to the independent selection +specification, then closes the anchor-view scope-search boundary before +connecting selection to temporal-witness construction. + + +### 13.8 Independent status semantics — 16 October 2026 + +The semantic gap in §13.7 is now closed for the approval-view source path. +The pure accumulator equals the independent candidate/method/trust filters, +maximum-sequence tie-set specification and complete decision/horizon result +for every finite input, every view and every policy, without an input-validity +or desired-result premise. Both actual principal and grant approval-view port +methods compose with that theorem. The proof earns maximum attainment and +complete tie handling; stale or revoked latest evidence cannot be dropped by +scan order. The semantic proof modules import no generated Rust. + +Fresh source qualification passes **661 compiled claims**, with all 658 prior +complete records unchanged, **17/17 cases**, **23 reviewed models**, zero +unreviewed models, zero compiled external axioms and two byte-identical clean +translations. Qualified production closure: +`678c19c1155869c45fed1cb7e849c147bca5bde0e07df567f413487335ab6669`. +The compiled audit uses only the permitted foundations. + +Hosted checking of the preceding `85bc1e0f` found a stale gateway checksum for +the differential test file after its final lint cleanup. Refresh the generated +artifact and require the focused checksum check and exact-revision hosted +replay. Keep the checksum's complete input boundary intact. + +Continue with anchor-view source visibility, including the actual sorted +scope binary search, then full verifier evidence authentication/dispatch and +selection-to-temporal-witness composition. The pure all-view equivalence does +not itself prove that the native anchor-view calls realize that model. E1–E5 +and M6 remain open under §10 and the remaining-program table in §13.5. + + +### 13.9 All-view status source results — 16 October 2026 + +Both actual port methods now refine the independent specification in every +view, under the ordered listed-scope representation invariant. The actual +Auths lookup wrapper returns exact membership; its transparent pinned-standard +binary-search model has a kernel-checked terminating interval/membership proof +and bounded result index. Source visibility covers own, listed and universal +scopes. The unrestricted represented-input approval-view claims remain intact. + +Five new cases cover first/last listed anchors, absent membership, active +status through the issuer own anchor, and hidden status through a different +anchor. The final two quantify over unrelated anchor fields. Their synthetic +status evidence proves selection behavior, not authenticity. + +Fresh qualification passes **671 compiled claims**, all 661 preceding complete +records unchanged, **17/17 cases**, **23 reviewed models**, zero unreviewed +models and zero compiled external axioms. Two fresh translations match exactly. +Production closure: +`0e96ae702036cbe01af7fe60060ac560482b17fc4f473bb24e653ca35a6b5b60`. +Only permitted foundations occur. Exact-revision hosted gates remain required. +The preceding 661-claim revision is in hosted verification at main run +[38944751348](https://github.com/auths-dev/auths-proof/actions/runs/38944751348). + +The next source slice derives ordered-scope validity from the actual +constructor/decoder. A disposable extraction of the current scope decoder +reached the constructor but was refused for early loop returns and the +constructor's windows/any iterator; no failed artifact is admitted. Prepare a +direct bounded loop cutover, independently comparing complete constructor +results and decoder result/cursor behavior against test-only former code. +Reject oversized constructor lists before sorting. Keep accepted values, +canonical ordering, stable errors and binary-search membership unchanged. +Then prove constructor validity and connect it to these conditional all-view +statements. Full E1–E5/M6 completion still follows §10 and §13.5. + +### 13.10 Constructor-earned scope validity — 16 October 2026 (in progress) + +The next source slice is implemented and its general Lean statements compile: + +- `StatusScopeAnchors::new` rejects empty or oversized lists before sorting, + sorts admitted carriers, and checks adjacent duplicates with a bounded indexed + loop. The public API, sorted result and typed refusal remain the same. +- The scope field decoder uses an indexed collection loop with the same first + error and cursor behavior. Independent test-only former implementations + compare complete constructor results and decoder results/cursors, including + randomized inputs, all tag bytes, truncated prefixes and limit boundaries. +- The actual constructor has an unconditional, total, result-complete refinement + against nonempty/maximum-length/uniqueness validation and sorted permutation. + Success earns the ordering used by actual binary-search membership. The + constructor also supplies all-view principal/grant selector invariants when + its constructed list is assigned to each supplied trust rule. +- Every successful actual scope decode earns structural scope validity. A + fieldwise bridge between translations of the same Rust enum feeds that + invariant into the actual native scope-coverage function, whose result equals + the independent scope semantics. +- Kernel-checked decoder examples cover own/any/listed acceptance, unknown tags, + truncation, empty listed scopes, invalid identifiers and collection limits. + Multi-element sorted/refusal witnesses are being completed. + +New `scope_codec` extraction starts at the actual shipping field decoder and +includes model bodies. Its inventory is 21 local/30 foreign function records; +all Auths bodies are transparent. Only four generated discriminant instance +names change. Standard interfaces reuse reviewed UTF-8, result/option, +conversion, comparison and stable key-sort models; ordinary sorting uses a +proved stateless identity key and concrete String comparison laws. This is not +an assurance claim about Rust standard-library machine code, arbitrary stateful +sorting callbacks, physical allocation or physical work. + +The first 19 new statements compiled with only the permitted three foundations; +all prior 671 full compiled audit records remained unchanged. The fresh +qualification and final count/digests for this source slice remain pending. +Hosted CI is deliberately deferred while implementation continues, as requested. + +Remaining within this slice: finish the multi-element witnesses, review the +complete statements and constants, reproduce both fresh translations, update +assurance evidence/coverage/freeze, then continue toward decoder totality and +complete canonical acceptance/rejection/round trips. Partial decoder safety +uses an actual successful-decode premise; it does not assume an authorization +result. Identifier-language completeness, per-rule/snapshot constructors, +evidence authentication, closed registry dispatch, full staged verification +and runtime/history consumption remain open. No whole E1–E5/M6 milestone is +closed by this slice. + + +### 13.11 Implementation-first continuation — 16 October 2026 + +Per the user's direction, broad translation/build qualification is deferred +until the remaining implementation batch is written. The 692-statement scope +slice compiled and its prior 671 records were unchanged; the fresh reproducer +completed two translations and started the Lean build before being deliberately +interrupted. It is not a qualified checkpoint. The assurance manifests, +coverage/freeze, gateway source checksums and final hosted evidence must be +regenerated and reviewed together after coding; do not reuse stale evidence. + +The next batch cuts principal URI-scheme parsing over to a bounded byte scan +with an independent character oracle, extends status-trust decoding to an +indexed collection loop, and carries decoder-earned scope validity through +actual per-rule decoding and the complete trust-rule collection. Its source +translation root will be expanded from `status_scope` to `status_trust`. +The independent principal grammar/model is already written. No whole E1–E5/M6 +completion is claimed; the remaining checklist is still §10 and §13.5. + + +Implementation-first batch written (not yet checked): + +- Shipping `PrincipalId::parse` uses bounded identifier validation plus the + ASCII scheme scanner before copying accepted strings; Unicode and adversarial + scheme/capacity tests retain the former character-based parser as an oracle. +- Shipping status-trust decoding uses one rule helper and an indexed collection + loop with first-error preservation. Its test oracle retains former control + flow and former scope decoding, comparing exact results and cursors. +- `PrincipalSchemeModel` defines an independent first-letter/tail/remainder + grammar and proves its Boolean evaluator equivalent. `PrincipalScheme` + connects byte leaves, the bounded source loop and entry point to that grammar. +- `ScopeTrustSafety`, `ScopeTrustCollection` and `ScopeTrustSelectors` carry + scope validity from actual per-rule decoding through the entire successful + trust collection into both actual all-view status ports. These are source + safety/composition obligations, with evidence authentication still separate. + +Translation inventory counts and generated artifacts for the expanded +`status_trust` root are intentionally pending the final translation/check phase. +The new batch is not registered as achieved assurance until that phase passes. + +The next E4 reference batch is also written in +`formal/Auths/Product/AdmissionHistory.lean` and `AdmissionOwnership.lean`. +It models arbitrary finite worker interleavings, duplicate-debit aggregation, +monotone collection fences, retained historical capacity, committed-but-lost +acknowledgements, process crashes, read-only recovery and one-use entry. +The stated invariants cover historical capacity and unique operation entry. +These modules await the final checking pass and source/store correspondence; +they do not yet establish the complete shipping admission or connection/driver +claims. No new public assurance claim is registered from unchecked modules. + +The gateway claim API documentation now matches the PostgreSQL/store contract: +a returned storage error grants no execution handle, but may follow a committed +batch whose acknowledgement was lost. It no longer promises that every error +implies nothing was stored. Retries keep the same logical identity. The new +history model explicitly distinguishes this committed/no-handle outcome. + +`AdmissionExamples.lean` adds executable-model witness statements for available +capacity, commit-before-lost-acknowledgement, refused replay ownership changes, +shared capacity exhaustion, no crash refunds, collection followed by an earlier +cutoff, and one-use entry. These are written and awaiting the deferred check +phase alongside their general history invariants and source-binding work. + +E3 field-binding implementation is being included in the same coding batch. +The shipping recipe compiler now resolves names through the extractable +`auths-gateway-kernel::construct::field_index` leaf. It snapshots schema names +once in BTreeMap key order, preserving the existing verified-argument order. +The leaf uses exact byte equality and first-match indexed lookup; a test-only +iterator oracle covers duplicate, absent, empty, case-distinct and arbitrary +byte names. The independent named/positional correspondence model and actual +leaf refinement are next; full JSON/source/lock/driver correspondence remains +outside this component until separately composed and checked. + +E3 source/lock ambiguity is now rejected by the shipping compiler before typed +parsing: duplicate decoded member names at any nesting depth, including escaped +spellings, produce the existing invalid-source/invalid-lock classification. +Previously a nested map could collapse duplicate names before validation. +The input byte bounds and serde_json recursion limit remain in force; valid +source/lock bytes retain their existing typed interpretation and digest. +The strict parser and its nested/escaped/trailing/depth cases are written and +await the final test pass. This strengthens the runtime boundary; it is not a +new claim that serde_json or canonicalization has been formally verified. + +`SchemaIndex.lean` and `Refinement/SchemaIndex.lean` now contain the written +named-field grammar, exact first-match position, named/positional alignment, +undeclared-field refusal, preserved field rendering and actual indexed-leaf +refinement obligations. The gateway extraction roots now include `field_index`. +As with the rest of this implementation-first batch, generated symbol shapes, +proof elaboration, inventories, checksums and native/hosted checks are deferred +to the final pass; these files are not yet achieved assurance evidence. + +E4/E5 logical identity now has shipping extractable leaves in the gateway +kernel. Namespace/operation token validation delegates to the exact bounded +ASCII byte scan; the gateway key hashes the leaf's explicit domain/namespace/ +NUL/operation preimage. Validated wire behavior and digest framing are preserved. +No challenge, actor, recipe or case version enters the logical identity. +Independent token and framing oracles accompany the cutover. Token validity, +NUL-free separation and preimage-injectivity proofs are being written; hash +security remains an explicitly separate cryptographic contract. + +`OperationIdentity.lean` and `Refinement/OperationIdentity.lean` now contain the +written independent token grammar, token-implies-NUL-free property, first-NUL +separator argument, exact preimage injectivity on validated namespace bytes, +and shipping token/preimage leaf refinements. The actual operation-key caller +now has an independent former incremental-hash oracle, including maximum +namespace/operation lengths. New caller/parser source files are explicitly +included in the source-closure inventory. This inventories their bytes without +pretending that hashing the source proves compiler/driver correspondence. + + +### 13.12 Batch implementation and verification — 16 October 2026 + +Following the request to code larger batches and defer full qualification, +the expanded implementation was written first and checked together. The full +Lean build passes for the initial expanded batch (721 inventoried statements), +and its compiled audit preserves all 671 previous declaration records exactly. +All compiled dependencies use only the three permitted foundational axioms; +there are no new opaque Auths algorithm assumptions or admitted proof terms. +This is compilation/audit evidence, not a completed translation qualification. + +The affected native crates pass 325 library tests: 39 codec, 42 model, 22 gateway +kernel, and 222 gateway (26 gateway tests retain their existing ignored status). +The gateway tests were rerun with local socket access after the restricted +sandbox refused their listeners. New differential cases include every Unicode +scalar for principal IDs, exact status-trust result/cursor parity, exhaustive +one/two-byte token validation, field lookup, unchanged logical-operation key +framing, and nested/escaped duplicate JSON members. The duplicate-member +correction is exercised through both real source and profile-lock compilation. +The expanded xtask builds; affected-crate linting passes after preserving the +extractable scalar classifier with a narrowly documented style-lint allowance. + +The next composition batch also connects the complete PrincipalId constructor +to the existing Unicode and new scheme policies, and connects native namespace +validation and native preimage production to exact namespace/operation binding. +It strengthens the lost-acknowledgement model statement to grant no handle in +any well-formed fresh-claim state, and includes the pre-commit-failure/retry and +terminal-refusal-without-capacity examples. These additions undergo the same +compiled statement audit before updating the reviewed inventory digest. + +Remaining qualification work includes regenerating the final changed-source +translations, two reproducible complete translations, checksum/freeze and +coverage updates, compiled statement/constant review, and exact-revision hosted +gates. Do not interpret a count of compiled component claims as completion of +E1–E5 or M6. The remaining work in §13.5 still applies, especially complete +object decoding, authenticated verifier/registry composition, full compiler and +I/O correspondence, and actual reservation/backend refinement of the history +model. The existing runtime capabilities are not being declared absent. + + +### 13.13 Composed bounded-claim reference history + +`BoundedClaimHistory.lean` combines the existing chain/count/ceiling/partition- +sum evaluator with durable claims and one-use worker handles for one fixed +window. Every arrival may carry a different chain and capacities: this removes +the fixed per-counter capacity limitation of the earlier small reference. +Lost acknowledgements still charge the admitted chain; crashes and read-only +recovery retain charges; occupied logical identities cannot charge again; +collection closes that window against subsequent admissions. The model uses +an atomic admission/claim step and retains historical charges separately from +physical slot deletion. It does not assume that the shipping reservation +protocol has already been proved to linearize to that step. + +The finite-history invariant simultaneously preserves per-link count limits, +ceiling/count spending bounds, partition sum limits and one-use claim +ownership. Two kernel-checked concrete histories show useful delegation after +a lost acknowledgement, shared root capacity exhaustion, and read-only +recovery refusing to reissue the lost handle while the acknowledged delegate +can enter exactly once. This is independent model/composition evidence, +linked to the already proved bounded-policy semantics. Actual counter +derivation, frontier/conflict retry, claim-batch/backend linearization and +driver entry correspondence still require source proofs under §13.5. + +The final changed-source scope and gateway units have also been re-extracted +and translated strictly from the current Rust. Their executable Lean bodies +are unchanged from the bodies used for the expanded proofs; only generated +source-location comments change. There are 62 scope-unit functions (25 local, +37 foreign) and 135 gateway functions, with zero opaque Auths bodies in either. +This focused comparison is not the required two full translation +reproductions or an exact-revision hosted qualification result. + + +### 13.14 Concurrent frontier source batch + +The actual store `frontier` loop now delegates its interval decisions to +`auths-gateway-kernel::frontier::FrontierSearch` while retaining each storage +read and error at the runtime boundary. The independent model proves shrinking +intervals and termination within 64 read transitions over the entire u64 bound, +for arbitrary answers. With an append-only occupied-prefix contract, stale +reads produce a candidate at most the latest frontier; a successful atomic +insertion at a still-free candidate therefore inserts at exactly that frontier. +This is the concurrency argument needed before composing conflict retries and +claim/slot batching, rather than assuming a stable snapshot during search. + +The new pure methods have strict transparent translations in the expanded +139-function gateway unit. Native comparisons cover every prefix up to 256, +every sparse 16-slot map, exact previous-loop read order, full-width bounds, +and changing monotone prefixes. The shipping loop uses the same probe, read +and observation order. The formal source-method bridges and their composed +answer-trace work bound are being checked as a batch. The trace is proof-owned; +the complete runtime read/transaction correspondence remains an E4 obligation. +The shared store's existing collection/admission fence is retained. + + +The frontier source-method bridges now compile on every represented source +state, including arithmetic safety. The proof-owned composition of actual Rust +methods also establishes the 64-read bound. The kernel's 24 library tests pass, +as do the gateway's 222 library tests after the shipping store refactor (26 +retain their existing ignored status); affected-crate linting passes. The +expanded main inventory and final transitive axiom review are checked next. +The gateway source boundary is 139 local functions, zero external functions, +with the four new methods explicitly inventoried and no opaque Auths bodies. +Full translation reproduction and exact-revision hosted gates remain deferred. + + +### 13.15 Compiled statement identities in coverage + +The full batch build and compiled audit pass at 741 declarations, preserving +all 671 previous complete records and allowing only the three established +foundational axioms. Full qualification caught a reporting defect: method dot +notation in Lean's displayed statements could hide the translated function's +qualified name. Coverage version 2 therefore uses the compiler's canonical +statement constants for live theorem mentions, and refuses live audits that +omit them. Historical study fixtures retain their original text scanner and +must still reproduce byte-identically. A regression also prevents printed +function-name text without a corresponding compiled constant from creating a +coverage edge. + +Canonical identities add the actual lifecycle terminal-method claim and the +new composed status/frontier statements to the proper classifications. The +codec identifier helper's imported copy is no longer credited as a directly +named locally owned function merely because a suffix resembles the owner's +name. Its assurance source claim and transparent translation remain intact; +the owning model function retains its own audited refinements. This follows +the existing ownership rule, without adding denominator rows for imports or +relabelling the source claim as a model. Qualification and publication are +rerun after this reporting correction; E1–E5/M6 remain scoped as above. + + +### 13.16 Qualified 741-claim checkpoint + +The complete batched qualification now passes after the coverage correction: +741 compiled/audited statements, all 671 previous complete records unchanged, +18/18 qualification cases, 24 reviewed external models, zero unreviewed models, +zero compiled external axioms and two byte-identical clean full translations. +Reviewed statement inventory: +`adba8d153e4bb16ed387ba05c9f102a36650a6a7e4e0e899180935726ad34852`. +Shipping source closure: +`f9041056a71f53030c45a3a9e0c4208da53fc5a56d26b03466ef119e54104549`. +Closed qualification boundary: +`89cbb9637b4ac2abe8d319601c55f89a69723633f9f1eae4a78a29ef549fd0f4`. +Affected native library tests: 327 passed; 26 gateway tests remain ignored. +Coverage regression/historical checks: 6 passed. Affected-crate linting and the +xtask build pass. Coverage v2 records 133/1046 decision functions, +1814/11544 decision code lines and 23/82 check sites in their declared scopes. + +This saves the implementation-first batch; it does not finish §13.5 or any +whole E1–E5/M6 milestone. Exact-revision hosted gates remain required. The next +counter/slot commitment-framing slice is prepared separately: its independent +byte-framing injectivity model compiles, prototype byte-parity tests pass, and +its actual Rust prototype translates after replacing unsupported nested borrows +with fixed-field composition. It has not yet been cut over into production or +added to this qualified inventory. Continue with that source/primitive bridge, +then actual counter derivation and reservation/backend correspondence. + + +### 13.17 Counter and slot framing batch — qualified 757-claim checkpoint + +The production counter/slot hashing callers now consume pure kernel builders for the exact preimages. The count/sum tags, eight-byte component lengths, namespace, link subject, evaluator, partition, fixed-window coordinates, 32-byte counter IDs and slot words are preserved. A frozen native incremental-hash oracle checks the actual callers, including Unicode, empty/unpartitioned values, embedded NUL and u64 boundaries. The pure kernel has 26 passing tests, and the affected Rust targets pass clippy. + +The complete Lean build passes with 16 new inventoried results: exact source framing helpers and all four public builders, source-output identity binding for count/sum, independent counter/slot framing injectivity, and explicit framing-size bounds. Count and sum frames are at most 774 and 844 bytes on the production size domain. Hash equality is not assumed to imply preimage equality. The two existing standard checked-conversion/Result definitions were moved unchanged into a minimal shared bridge so gateway proofs do not import unrelated string/sort models. + +The final audit qualifies **757 claims**, with all 741 previous complete declaration records unchanged, no unexpected axioms, **25 reviewed models**, zero unreviewed/compiled external axioms, **18/18 cases**, and **two byte-identical clean full translations**. Source closure: `8701bdf464825fa990591db6833a3b35dc58806769a80520651dcade26968222`. Statement review: `ap-spec-069-counter-slot-framing-2026-10-16`; inventory digest: `2709ec4fbc2601760e0937ff445a361dcb4b99fb866ea5ca3b573293858fab3d`; boundary contract: `cb3d1bff851332bd0f01c207b6b551a99c276beb4d0cc3022190b8db49593a4b`. All 224 active gateway tests and 26 kernel tests pass; the 26 existing ignored gateway tests are unchanged. Hosted exact-revision evidence remains required. Counter aggregation and runtime/backend correspondence remain open; a separate keyed-minimum aggregation prototype is prepared and is not part of this checkpoint. + + +### 13.18 Count and sum aggregation — qualified in the 798-claim checkpoint + +The actual count-counter derivation now computes its existing namespace/subject/window keys and consumes a pure kernel aggregator. Source proofs cover exact public 32-byte ID equality, first-match lookup, first-key capacity tightening, and the complete contribution loop on the admitted 16-link domain. The complete Lean build passes with these results included. The actual loop earns unique IDs from its own empty state and matches an independent pointwise minimum-capacity specification for every key, without assuming a caller-provided uniqueness invariant or desired result. + +Native parity compares the complete shipping chain derivation—including sorted count/sum records and sum slot bounds—to the frozen preceding implementation across repeated subjects, limits, partitions, partial zip inputs and extreme window coordinates. All 225 active gateway tests and the count kernel tests pass. The final combined count/sum/retry run passes 225 active gateway tests and 33 kernel tests. Literal formatting and checked test-index conversions corrected the focused lint findings; affected-target clippy now passes. + +Sum aggregation now uses the same source-proved minimum-capacity semantics and explicitly retains the first count-slot bound. Both actual source loops and their global uniqueness/capacity corollaries compile in the complete Lean build. The combined final qualification passes with **798 compiled claims**, all 757 preceding complete declaration records unchanged, 25 reviewed models, zero unreviewed/compiled external axioms, 18/18 cases and two byte-identical clean full translations. Source closure: `d75d2be54aeef9a943fb35736ead1ff024ffe838c11565c10f9ef647b99193c4`. Statement review: `ap-spec-069-counter-aggregation-retries-2026-10-16`; inventory digest: `ebf3c737a69822f3d0ead1c0d656565c1af5138cf47b7fcc2a05784f4e7a0a17`; boundary contract: `cae0940641d0ad3ad51cebd5e091ce76771f6c67561ee40486e6045abb11471d`. Hosted exact-revision evidence remains required. The caller's authenticated-chain-to-contribution mapping, count/sum coupling, atomic store admission and full runtime/history composition remain separate E4 obligations. + + +### 13.19 Reservation retry interpretation — qualified in the 798-claim checkpoint + +The shipping reservation loop now consumes a pure, total conflict interpreter. A conflict on entry zero is always Replay. Count conflicts advance exactly the identified count frontier. Sum conflicts read the exact conflicting slot before advancing, and validate the sum frontier, total and counter vector positions. Checked additions turn a corrupt maximal frontier into a typed Corrupt error instead of relying on an implicit arithmetic precondition. These branches grant no execution handle; the existing atomic-insert success remains the sole successful reservation path. + +The sum-slot availability check now reuses the already proved chain-count predicate, including its exact vector-length check, rather than relying on a truncating zip. Existing admitted inputs retain their previous behavior. Native boundary tests cover batch ordering, missing vectors, invalid/maximum indices and word limits. The complete model/source retry refinement and replay/progress corollaries compile in the full Lean build. The complete combined batch passes the qualification recorded in §13.18. This does not yet close store linearization, cumulative-record decoding, claim-batch construction or full driver/history correspondence. + + +### 13.20 Complete slot-batch construction — shipping cutover in progress + +The preceding shipping constructor paired count/sum metadata and frontiers using +zip. Its callers supply matching vectors; the new source cut makes that +invariant explicit and checked. A pure kernel constructor rejects +mismatched lengths, per-kind cardinalities above 16 and cumulative overflow, +then describes exactly one claim first, every count slot and every sum slot in +the order interpreted by the retry primitive. Both native boundary tests pass and the prototype translates without opaque +Auths code. The independent model establishes claim-first ordering, complete +entry count and at most 33 entries on success. The complete all-input source +constructor proof and both source loops compile, including a checked bridge +from the tail-recursive sum model to the independent list specification. + +Shipping claim-batch assembly now consumes these complete descriptions to build +counter metadata and every canonical claim/slot record. The per-kind bound is +shared with the gateway chain limit. Its outputs +are record descriptions, not authorization or execution capabilities. The +cutover must retain the existing canonical record fields, counter +metadata, slot keys, expiries and all-or-none store insertion, and has passed +complete source/compiled review, native parity and final qualification. The +preceding complete shipping constructor is retained only as a frozen native +test oracle; mismatched-vector tests require a Corrupt refusal. + + +The slot-batch cutover's complete Lean build passes with **809 compiled claims**, +including all 798 preceding complete declaration records unchanged and no new +axioms. The 11 new reviewed statements include both actual source loops, a +checked operational-to-independent sum bridge, the complete all-input builder, +claim-first ordering, exact complete entry count and malformed-shape refusal. +All 227 active gateway tests, 35 kernel tests and affected-target clippy pass. +The complete shipping parity oracle covers all 289 aligned count/sum layouts, +checking canonical record bytes, every slot key and expiry. Mismatched vectors +must return Corrupt. An extraction experiment showed the idiomatic question-mark +form introduces two additional ordinary Try/FromResidual interfaces; the +explicit Some/None branch is retained with a narrowly documented lint allowance +so this component adds no external translation interface. Final qualification +replay passes as recorded below. + + +The coverage publication check exposed a tooling defect: numbered generated +loop wrappers were classified as whole Rust functions by a suffix heuristic. +Coverage tool version 3 consumes the translator's explicit loop metadata and +retains the historical fallback. All seven focused regression checks pass and +the pinned study still reproduces byte-identically. The published primary +measurement remains 133/1046 functions, 1814/11544 lines and 23/82 check sites; +no denominator or source claim was weakened to bypass the check. + + +The final slot-batch qualification passes: **809 compiled/audited claims**, all +798 preceding complete declaration records unchanged, **18/18 cases**, **25 +reviewed models**, none unreviewed, no compiled external axioms, and two clean +full translations reproduced byte-identically. Source closure: +`339d80930b9e3b5cb85900bd15713284f49802820a7225c7d44afa5792a43d9e`. +Statement review: `ap-spec-069-complete-slot-batch-2026-10-16`; inventory digest: +`34b188789792dec4d1f15d74dc1e4f6900c2a78d5df6ef2e5184ec28aa1f68b4`; +boundary contract: +`fe1d1bedb6696b3346517bd2de9771cd6a5fac12586d897f71edfb410ef2be02`. +Actual backend atomicity, JSON decoding, authenticated caller mapping and full +runtime/history correspondence remain separate obligations. The next source +component validates the decoded cumulative sum-slot projection against the +exact schema, counter ID, slot and delta/cumulative relation. No complete +E1–E5/M6 milestone or exact-revision hosted evidence is claimed. + + +### 13.21 Decoded cumulative records and count/sum coupling — implementation batch + +The shipping cumulative reader now calls a pure translated validator after its +existing storage lookup and strict serde decoding. The validator checks exact +schema bytes, the complete canonical lowercase encoding of the 32-byte counter, +the requested slot, and delta no larger than the returned cumulative total. +The independent model proves byte-domain counter-encoding injectivity. The +complete actual comparison loop and validator have all-input source proofs, +with accepted-record identity/numeric binding and invalid-record refusal. +JSON parsing, authenticated storage, append-only histories and backend +linearization remain separate obligations. + +The count/sum coupling now uses an actual pure first-key capacity lookup and a +linked sum-contribution constructor. Their exact source refinements compose +with the actual count aggregator: a sum contribution's slot bound is earned +from the shared count-key minimum, without assuming input uniqueness or a +precomputed minimum. Both IDs remain explicit inputs; complete authenticated +ID derivation and the full caller graph remain open. + +The new proofs compile individually. The complete batch build/audit and final +clean replay pass as recorded in §13.23. Native checks pass: 229 active gateway tests, +38 kernel tests and affected-target/xtask linting; 26 existing ignored gateway +tests remain unchanged. The shipping cumulative-reader parity oracle checks +486 decoded combinations through the actual file-store lookup and serde path, +plus missing/malformed/duplicate-field/word-boundary cases. Kernel tests cover +all 256 repeated counter byte values and every encoded digit mutation. A real +source success witness qualifies a valid cumulative record. Shared byte-equality +and hex-digit proofs were extracted into a minimal proof module; existing +public theorem statements are preserved. No new external interface or opaque +Auths function was introduced by either source cutover. + + +### 13.22 Complete ordered reservation decision — implementation batch + +The shipping reservation loop now consumes one pure decision in the existing +bounded-policy kernel. The function combines every count frontier, every sum-slot +frontier and every cumulative sum, preserving window-exhaustion precedence and +the existing stable refusal codes. It neither inserts records nor grants handles. +Its independent specification uses complete pairwise relations over lists, +which earn matching lengths and every applicable numeric bound. The source +proof composes the existing exact count/sum leaves with the complete new guard; +no admission Boolean or desired result is an input premise. + +Native parity covers 139,968 combinations of vector shapes, zero/one/u64-max +values and amounts, with 24 bounded-policy library tests passing. Source proofs +also connect Admit to complete vector shapes and u64-safe cumulative additions. +Full batch compilation, statement review, final native replay and qualification +pass as recorded in §13.23. Actual caller identity derivation, backend linearization +and full runtime/history composition remain open as described in §13.5. + + +### 13.23 Qualified reservation checkpoint — 17 October 2026 + +The batched implementation qualifies **832 compiled/audited claims**, preserving +all 798 complete declaration records from the previous pushed checkpoint (and +all 821 from the intermediate cumulative/coupling audit). All **18/18 cases** +pass; two clean full translations reproduce byte-identically. There are **25 +reviewed external models**, none unreviewed, and zero compiled external axioms. +The new claims retain only the three established foundational axioms. + +Production source closure: +`1a07b71048278076845fd283106a674087d05a89d4bd2dd3560c2f17dd99dce5`. +Statement review: `ap-spec-069-complete-reservation-admission-2026-10-17`; +inventory digest: +`2993b22fef971e4247d9fa1eaec1fa4a2bc5a1cbd1f0efa949ee7dd4e95b50ef`; +closed boundary: +`5c0656e2e8da9949ea2fce62426a19d378ed11a53954b9caeb468391009dd156`. + +Native validation: **229 active gateway**, **38 gateway-kernel** and **24 +bounded-policy** library tests pass; 26 existing ignored gateway tests are +unchanged. Affected-target and xtask linting pass. The final capacity-view +refactor computes named count/sum/slot limits once per reservation, retaining +them across retries; the final store aggregate scenarios pass. The decoded +reader's test fixtures use the real expiry envelope and independently require +18 successful cases and 468 refusals, preventing parity from passing vacuously +at the outer file decoder. Every malformed-record mutation starts from an +accepted complete record. Source qualification includes useful acceptance and +refusal witnesses. Historical study reproduction remains byte-identical; +coverage v3 measures 134/1047 decision functions, 1833/11563 code lines and +23/82 check sites in the declared scopes. + +These results complete the source components in §§13.20–13.22. They do not +complete the whole §13.5/E1–E5/M6 program. Authenticated caller mapping, actual +backend/linearization correspondence, full runtime/history composition and +exact-revision hosted evidence remain open. Connection-entry workload/profile +membership is prepared separately as a private prototype; it has not yet been +cut over into shipping code or included in this qualified inventory. Continue +from that component and the remaining-program table without redoing these +completed proofs or waiting for GitHub CI during implementation. + + +### 13.24 Connection-entry membership — implementation batch + +The shipping connection-entry check now calls a pure predicate over explicit +administrative state, workload bytes and full profile identifier/version pairs. +Both list scans have exact source refinements; a positive result earns active +state and both exact memberships. Disabled and revoked inputs always refuse, +including when their lists contain the request. The runtime's unchanged-record +comparison now consumes the previously proved exact-byte equality primitive. + +The native adapter preserves the preceding full expression on 1,728 queries +against constructor-valid connection records: 126 positive and 1,602 negative +cases cover all states, workload case differences, absent identifiers and +profile-version mismatches. Every byte mutation of a canonical loaded record +changes the reload comparison. Projection allocations are bounded by the +connection constructor's existing workload/profile limits. Source qualification +includes useful positive, disabled and version-mismatch witnesses. This batch +also moves the reservation-loop comment back onto its intended function. + +Complete qualification passes as recorded below. The record-to-projection mapping, complete +record decoder, actual reload/lease/write association and full E4.6 runtime +composition remain separate obligations. This predicate supplies necessary +entry checks, not an execution handle. The remaining §13.5 program and hosted +exact-revision gates are unchanged. + + +The final connection-entry batch qualifies **838 compiled/audited claims**, +with all 832 preceding complete declaration records unchanged and no new axioms. +The full 3,510-job Lean build, 18/18 qualification cases and two byte-identical +clean full translations pass. The inventory remains 25 reviewed models, none +unreviewed, with zero compiled external axioms. Native checks pass: 231 active +gateway tests, 39 kernel tests and affected-target/xtask linting; the existing +26 ignored gateway tests remain unchanged. The earlier 24 bounded-policy tests +are unchanged by this component. The semantic-closure manifest explicitly +includes the new kernel file and all earlier extracted modules. + +Shipping source closure: +`dbdeafb8829de25fd97cdee75384bf275314efc725134b4fb388e1681a72a141`. +Statement review: `ap-spec-069-connection-entry-membership-2026-10-17`; +inventory digest: +`6b5d83e724e9cc0fc1eb6875881fe8e20f91df46e60176164b3311fd601e7eff`; +boundary: +`327f3b20152464c5d7e9d6d6295cdb47c576b24a1a00fd88c12d7414ac82a6ed`. +Coverage remains 134/1047 decision functions, 1833/11563 code lines and 23/82 +check sites, with byte-identical historical reproduction. Hosted evidence and +the whole E1–E5/M6 program remain open. Constructor byte predicates are prepared +privately for the next component; they are not yet qualified shipping code. + + +### 13.25 Connection text validation and actual profile construction — implementation batch + +Provider-kind and alias parsing, and connection workload validation, now consume +pure bounded byte predicates in the existing connection kernel. Exact source +proofs cover every byte buffer and maximum: lowercase first-letter tokens, +complete lowercase/digit/hyphen tails, and printable-ASCII workloads. Successful +results earn nonempty length bounds and whole-buffer NUL absence. Native parity +checks all 65,536 byte pairs at lengths 0–2 and five maxima, including zero and +usize max. All 34 connection library tests pass. Three narrowly scoped range +lint allowances preserve explicit translated scalar operations, consistent with +the existing request-construction boundary. + +The actual unchanged `ConnectionProfile::new` method also has a direct source +proof: zero versions return InvalidProfile, and success preserves the exact +supplied identifier and nonzero version. Charon cannot reliably seed this +inherent method by its name; nominal-path extraction was rejected when its +metadata contained zero functions. A non-shipping selector calls the actual +method, whose complete body remains transparent in the translation. The +selector introduces no runtime API, duplicate constructor or semantic cfg. Its +temporary Cargo manifest clones the shipping lock, resolves offline, refuses +unknown dependency identities/checksums and compiles locked. A regression test +checks these boundaries. String-to-SemanticId parsing remains separate. + +This component is included in the qualified 861-claim checkpoint in §13.27. E1's complete +constructor/decoder/allocation closure, E4's runtime correspondence and the +remaining §13.5 program are still open. This component proves the stated byte +rules and actual profile field/version behavior, not whole record validity. + +### 13.26 Semantic identifiers and connection-key input binding — implementation batch + +The actual SemanticId parser now consumes the kernel's complete byte grammar: +ASCII letter/digit first, then ASCII letters/digits or `._:/-`, nonempty and at +most 128 bytes. General source proofs fix both scalar classifiers and the full +loop on every buffer/maximum. Successful validation earns the size bound, +whole-buffer ASCII and NUL absence. Independent native parity covers every byte +pair and five maxima, plus every byte mutation at lengths 127, 128 and 129. +The 35 connection library tests pass, including existing durable record cases. + +The actual gateway connection-key caller now hashes an extracted exact +preimage builder: the registered domain, complete provider bytes, NUL, complete +alias bytes. Its source proof preserves every input byte within the existing +64-byte constructor bounds. An independent framing theorem proves that equal +preimages identify both fields, using NUL absence earned by the provider-name +validator. It assumes no injective hash. Native tests compare 589,824 binary +preimages and 64 actual typed gateway keys with frozen preceding algorithms; +all 40 kernel tests and four connection adapter tests pass. + +These proofs passed privately before shipping cutover and now qualify together +in the 861-claim checkpoint in §13.27. The preceding +850-claim replay produced identical translations but stopped at an inventory +error: a non-shipping selector was incorrectly required to be a workspace +package. Both source-closure consumers now map only that reviewed selector to +its sole shipping dependency, with a regression test; selector source and +checksum-identical dependencies remain hashed. Generated file-name metadata +is normalized without changing bodies, spans, options or embedded source. + +The complete String/record decoder, actual reload/lease/write association, +backend history and remaining §13.5 program remain open. Continue with the +combined batch checks and then those source obligations; do not wait on hosted +CI during implementation or equate claim counts with completion. + +### 13.27 Qualified constructor, identifier and connection-key checkpoint + +The batch in §§13.25–13.26 qualifies **861 compiled/audited claims**, preserving +all 838 previously pushed complete declaration records. All 850 records from +the intermediate constructor audit are also unchanged. The full 3,519-job Lean +build, 18/18 qualification cases and two byte-identical clean full translations +pass. There are 25 reviewed models, none unreviewed, no compiled external axioms +and only the three permitted foundational axioms. + +Shipping source closure: +`390c119b23d2172f15bc6b026236af76a28d9f0f3d13e705b770de7914e9ee0c`. +Review: `ap-spec-069-connection-byte-framing-2026-10-17`; inventory: +`1b4a2587677994a404e5f8808c10d0f1fbc2288e10d1b8c13d3e42fffbf1beb2`; +boundary: +`94d0a3fefdb75a3344bb2822641bdefff372d261deef3ebd81a2a55c1abeca49`. + +The 35 connection, 40 kernel and 232 active gateway tests, plus affected-target/ +xtask linting, pass; 26 existing ignored gateway tests remain unchanged. The +source-closure selector regression and checksum/path normalization regressions +pass. Coverage v4 includes the actual transparent constructor selected by the +non-shipping entrypoint, validates imported declaration spans against the Rust +scanner and retains strict complete spans for ordinary local functions. The +historical study reproduces byte-identically; primary scope remains 134/1047 +functions, 1833/11563 code lines and 23/82 check sites. + +This completes the stated components, not the full §13.5 program. Complete +record decoding, String/caller projection, actual reload/lease/write association, +backend histories and exact-revision hosted evidence remain open. Continue with +the private recovery-lease work and source obligations without waiting on CI. + +### 13.28 Recovery and administrative record guards — implementation batch + +Five actual record methods now consume pure source-proved guards: recovery lease +authorization, current-versus-recorded recovery credential selection, state +transition, credential rotation and authorization replacement. Revocation refuses +recovery before generation checks. Successful recovery earns a positive operation +generation no newer than the durable record. The binding classifier earns either +the exact current credential generation, or an older operation with a positive +recorded credential generation no newer than that operation. The existing native +constant-time commitment comparison remains on the current-credential path. + +Administrative guards earn a non-revoked source record and nondecreasing time; +state transitions additionally require a changed state. Rotation and authorization +replacement share their identical existing state/time rule. Generation increment, +credential-generation preservation/rotation and constructor validation retain their +existing implementations and previously proved arithmetic. + +The native frozen pre-cutover algorithms compare complete constructor-valid +records, every returned binding field, typed refusals and refusal order: 2,250 +recovery bindings (210 accepted, 2,040 refused), 450 state transitions, 450 +rotations and 600 authorization replacements. Rotation/replacement have 30 useful +successes each, covering every administrative state, zero and maximum timestamps, +generation overflow and malformed payloads. All 38 connection library tests pass. + +Ten general source proofs compile and qualify in the 871-claim checkpoint in +§13.29. Both clean translations are byte-identical. Enum context normalization only qualifies the three +native discriminant attributes; a regression preserves every enum body and +rejects inventory drift. This adds no external standard-library model, Auths +opaque algorithm or axiom. The exploratory direct method translation exposed +unnecessary NonZero representation interfaces; they were kept out of shipping +proofs. The actual methods instead consume the proved scalar policy guards. + +Complete String/NonZero/caller projection, record decoding, authentication of the +recorded operation, constant-time primitive correspondence, actual credential +store lease and reload/write histories remain separate obligations in §13.5. +These are proof boundaries, not assertions that the existing product behavior is +missing. Finish the assembled batch checks, then continue those source obligations. + +### 13.29 Qualified recovery and administration checkpoint + +The §13.28 batch qualifies **871 compiled/audited claims**, preserving all 861 +preceding complete declaration records. The full 3,520-job Lean build, 18/18 +qualification cases and two byte-identical clean full translations pass. The +reviewed model inventory remains 25, none unreviewed, with no new axioms and +zero compiled external axioms. Only the three permitted foundations occur. + +Shipping source closure: +`016c236971e9cd58ab0d6fd762ac7febf2e86919bda2a376e95802a80d10c8aa`. +Review: `ap-spec-069-connection-recovery-administration-2026-10-17`; +inventory: +`978677ea2fd11b7b04029f70566e6b7711650b907006a5057ac21de7b9349e6d`; +boundary: +`e47a70caeb2efe34fdbd8936cbf4091c81d191de15000389ba457434c699df5d`. + +All 38 connection library tests, 232 active gateway tests and affected-target/ +xtask linting pass; the 26 existing ignored gateway tests remain unchanged. +The earlier 40 gateway-kernel tests are unaffected. Frozen native parity and +useful positive/refusal source cases are detailed in §13.28. Coverage v4 and +historical reproduction retain the primary 134/1047 function, 1833/11563 line +and 23/82 check-site scope. + +The complete §13.5/E1–E5/M6 program is still open. Direct actual String constructor +proofs are now prepared privately, reusing the reviewed string/UTF-8 interface +models with their explicit portable representation bound. They are not yet +included in this checkpoint. Continue with that constructor/caller boundary and +the remaining decoder, verifier, backend/history and release obligations without +waiting for hosted CI. + +### 13.30 Actual owned-String constructors — implementation batch + +The actual generic ProviderKind, ConnectionAlias and SemanticId constructors, +specialized to String's standard identity conversion, now have direct source +proofs. Three exact theorems fix the complete UTF-8 language decision and closed +error category. Three success theorems earn both the full byte grammar and exact +input-payload preservation; none assumes that the input is a valid identifier. +Every Auths constructor and helper remains transparently translated. The copied +byte helpers reuse the qualified owner proofs by definitional equality. + +The proof reuses the three existing reviewed String/UTF-8 projection models +through direct aliases, without changing their semantics or adding a model or +axiom. Its explicit premise is the existing portable U32 byte-size representation +bound. That is a proof-interface boundary, not a new product limit or a premise +that parsing succeeds. Other Into implementations, larger modeled String +carriers, complete protocol decoding and allocation failure remain separate. +The upstream toStr native-default proof is avoided by supplying the bound. + +Native checks exercise every valid UTF-8 case at lengths 0–2 from all byte pairs: +116,608 cases, with independently derived positive counts of 7,618 provider names, +7,618 aliases and 20,026 semantic identifiers. They compare exact preserved +payloads and distinct error categories against character-language oracles, with +additional Unicode, NUL and 63/64/65/127/128/129-byte cases. All 39 connection tests +pass. Kernel-checked constructor witnesses cover acceptance and Unicode refusal; +explicit character-list strings and finite UTF-8 list-loop equations avoid native +axioms for closed String literal evaluation. + +The assembled 877-claim audit passes, with all 871 preceding complete records +unchanged and no new axioms. Selector lock/path tests and affected-target/xtask +linting pass. The expanded selection unit has four non-shipping entrypoints and +17 imported function records; no Auths algorithm is opaque. Its three generated +standard-interface template stubs stay uncompiled; the bridge aliases reviewed +definitions. Full clean replay and source-closure qualification pass as recorded in §13.31. +Continue with the remaining §13.5 program. + +### 13.31 Qualified actual String-constructor checkpoint + +The §13.30 component qualifies **877 compiled/audited claims**, with all 871 +preceding complete declaration records unchanged. The full 3,522-job Lean build, +18/18 cases and two byte-identical clean full translations pass. The reviewed +model inventory remains 25, none unreviewed, with zero compiled external axioms +and no new axioms beyond the three permitted foundations. + +Source closure: +`00e36a422d77f9710709d41550f7fe4c7918d5173b4552bafcd023e4168b88d9`. +Review: `ap-spec-069-actual-string-constructors-2026-10-17`; inventory: +`9450e7c2b425e8691d8eb74bafe494b3863715961aea74549ff7ed4b59892ef2`; +boundary: +`730bcc49302621155bf0ed66b4a3eb493b43b0595a69a17584f6017df083a040`. + +The 39 connection tests, selector checksum/path regressions and affected-target/ +xtask linting pass. This batch changes no shipping constructor algorithm; the +preceding 232-active gateway and 40 gateway-kernel results are unaffected. Closed +source witnesses use finite UTF-8 list-loop equations, avoiding native axioms. +Coverage v4 and byte-identical historical reproduction keep the primary scope at +134/1047 functions, 1833/11563 code lines and 23/82 check sites. + +The portable String bound, other Into implementations and full §13.5 +program remain explicit. A complete record-timestamp validator and its source/ +preservation proofs are prepared privately for the next cutover. Full record +codec/resource closure, verifier/caller composition, backend histories and +exact-revision hosted evidence remain open. Continue implementation without +waiting on hosted CI. + +### 13.32 Complete durable-record temporal shape — implementation batch + +Actual constructor/decoder validation now consumes a complete pure temporal +predicate: creation precedes update; revocation timestamp presence is equivalent +to revoked state; every present revocation timestamp lies within the inclusive +record lifetime. Exact source refinement and success-earned order/shape theorems +cover every state, u64 pair and optional timestamp. Two independent preservation +proofs show that the existing state-change and data-change conditions preserve +this complete temporal shape under the stated field updates. They are model +composition results, not claims that an entire I/O caller was translated. + +A frozen complete validator and the real canonical decoder agree on all 450 +state/time/optional-time combinations, with independently derived 65 accepted +and 385 refused records. Every accepted decoder result equals the complete input +record; refusals retain their typed category. All 40 connection library tests +pass. Allowlist checks retain their original order before temporal validation; +no schema, timestamp rule or product limit changes. + +Five proofs compile and qualify in the 882-claim checkpoint in §13.33. +Full clean replay, closure and integration checks pass. +The primitive uses only existing native enums and scalar comparisons, adding +no external model, opaque Auths body or axiom. Complete record codec/resource +closure, field/caller projection, physical-clock assumptions and actual runtime +histories remain separate under §13.5. Continue with the batch checks and those +remaining source obligations without waiting on hosted CI. + +### 13.33 Qualified complete record-time checkpoint + +The §13.32 component qualifies **882 compiled/audited claims**, preserving all +877 preceding complete declaration records. The full 3,523-job Lean build, +18/18 qualification cases and two byte-identical clean full translations pass. +There remain 25 reviewed models, none unreviewed, zero compiled external axioms +and no new axioms beyond the three permitted foundations. + +Source closure: +`10abedf6c85d16e017b07b4177983a0e58db46a099995b01c8a7b56f6c4e26ec`. +Review: `ap-spec-069-complete-record-times-2026-10-17`; inventory: +`b4353da77341c99dd42adde58ed8777272ca301797322aa29978145f7e796bca`; +boundary: +`fc09192a131ddba7b342418e42f24f58e141d0a740c2a73b0ed01ad4af1c7256`. + +All 40 connection tests, 232 active gateway tests and affected-target/xtask linting +pass; 26 ignored gateway tests remain unchanged. Native validation/decoder parity +and useful source witnesses are detailed in §13.32. Coverage v4 and byte-identical +historical reproduction keep the primary scope at 134/1047 functions, +1833/11563 code lines and 23/82 check sites. + +The full §13.5 program and exact-revision hosted evidence remain open. Strict +allowlist ordering has a private source-exact loop proof with explicit comparator +contracts and independent pairwise/no-duplicate laws; the shipping iterator +predicate has not yet been cut over. Continue with that component and remaining +codec, verifier, caller/backend/history obligations without waiting on hosted CI. + +### 13.34 Source-exact strict allowlist ordering — implementation batch + +The existing generic ordering helper has moved from the record model to its +translated kernel and uses an explicit adjacent-pair loop. Both existing +consumers use it directly; the shipping windows/iterator implementation is +removed. Its exact source proof covers every slice, including empty/singleton +inputs, every safe subtraction/index/increment and early refusal. It assumes a +specified lower-level comparator contract, not an expected checker result or +an already sorted list. Independent transitivity/irreflexivity laws turn the +adjacent-chain model into global pairwise ordering and duplicate absence; the +source no-duplicate theorem earns that conclusion from actual acceptance. + +This is a relocation of an existing mechanism, not new shared domain policy. +Workload strings and profile identifier/version pairs already consumed precisely +the same generic strict-order contract. Their identities and 256/32-element +bounds differ and remain record-owned; no credential, profile or provider +semantics are generalized. The replacement allocates nothing, retains the same +n-1 comparator calls/order and preserves native errors and wire representations. + +Frozen native comparison covers all 5,461 sequences of length 0–6 over four +ordered keys for integers, Strings and real ConnectionProfiles: each comparator +has exactly 16 accepted sequences. The full validator and canonical decoder +also agree on 344 workload and 344 profile records, including exact limits and +limit-plus-one, with 17 useful successes per family and unchanged typed refusals. +All 42 connection library tests pass. Previous temporal parity retains its own +frozen iterator oracle, so it cannot silently adopt the new scan as its reference. + +Four proofs compile and qualify in the 886-claim checkpoint in §13.35. +No opaque iterator model, Auths algorithm model or external axiom is introduced. +Closed String/profile comparator-instance correspondence and the complete +record/caller/codec/runtime program remain separate. The generic primitive +comparison contract and strict-order laws are explicit; they do not prove that +an arbitrary user-supplied unlawful Ord dictionary satisfies those laws. + + +### 13.35 Qualified strict-order checkpoint — 17 October 2026 + +The §13.34 source component qualifies **886 compiled/audited claims**, preserving +all 882 preceding complete declaration records. The full 3,524-job Lean build, +transitive axiom audit, **18/18 qualification cases**, and **two byte-identical +clean full Rust-to-Lean replays** pass. There are still **25 reviewed external +models**, no unreviewed models and zero compiled external axioms. All 42 +connection and 232 active gateway tests pass; the 26 previously ignored gateway +tests retain that status. Affected connections/gateway/xtask linting passes. + +Source closure: `1a15772736daa1ab26f69e4859691cb0316e5232cdb2f54925142ff68ca79255`. +Statement review: `ap-spec-069-strict-allowlist-order-2026-10-17`. +Inventory digest: `dc748ef710367d4817f350f08dc1fccba042d454fa20af73eef1136d6a536cfe`. +Boundary contract: `e3c0b057f86b94b84182655b8cd8b4b923a5f54b50ba7031923891976758c375`. +The generic comparator and law premises remain explicit. Closed native String +and profile comparator correspondence and the full record validator are the +next source batch; their private prototype is not included in this checkpoint. +The wider E1–E5 and M6 obligations in §13.5 remain open. Hosted exact-revision +release gates remain required; no GitHub CI wait is part of implementation. + + +### 13.36 Complete existing record-validator source batch + +`ConnectionRecord::validate` now calls one translated composition over its exact +stored workload/profile/state/time fields. The complete workload checker proves +1–256 entries, strict native String ordering and every 1–128-byte printable-ASCII +name; the profile checker proves 1–32 entries in strict identifier/version order. +Concrete generated String and profile dictionaries close the generic comparator +premises from §13.34. The composed verdict preserves workload, profile, then +timestamp error precedence and earns all collection/text/duplicate/time facts +from actual success. These are refinements of existing enforcement behavior. + +The construction proof uses the existing explicit portable String UTF-8 carrier +bound and five transparent standard interfaces. Two additional standard method +bodies spell out `String::partial_cmp = Some(cmp)` and the inert Eq marker in the +existing reviewed ordering model. All Auths comparison/scan/validation bodies are +translated; there is no opaque Auths predicate, comparator-result premise, +assumed valid list, global axiom or native-evaluation admission. + +The frozen original complete validator and actual decoder check 43,200 combined +records. Validation has 1,040 useful successes and 42,160 typed refusals, including +simultaneous bad guards, Unicode, exact/over text and collection limits and full +u64 timestamp boundaries. The unchanged decoder rejects collection bounds while +reading, before complete semantic validation; the regression preserves that +existing earlier error precedence independently. All 43 connection tests and 232 active gateway tests pass; the existing 26 ignored +gateway tests are unchanged. The source acceptance theorem is an iff with an +independent global-pairwise collection/text/time specification and additionally +earns explicit bounds and duplicate absence. Full build/audit and clean replay +pass in §13.39. Descriptor/hash/generation assembly, complete record codec/caller +projection and full E1–E5/M6/runtime/backend histories remain separate. + +### 13.37 Test-module path handling in the shipping-call inventory + +The final formal gate exposed a source-inventory limitation: it rejected the +existing flat `#[path = "..."]` test modules before checking the real Kani +harnesses. The inventory now resolves plain relative Rust file paths in file and +inline modules, excludes those exact test files, and continues to reject test +helpers as shipping proof targets. It rejects ambiguous, escaping, conditional, +missing, escaped/raw-string paths and explicit-path files with unresolved external +child modules or code inclusion. It does not claim to implement a general Rust +module resolver. Compiler-checked path fixtures, nine targeted regressions and the +real inventory of 48 harnesses across six packages pass. This is an inventory +repair, not a new Kani solver result. + +### 13.38 Exact decoder cursor, integer and null behavior + +Ten new source refinements cover the actual decoder's constructor, explicit +cursor constructor, position getter, typed head, u64/u8/u16 readers, null reader, +first-byte type query and completion guard. The independent list grammar gives +exact success/refusal and cursor/input behavior for every represented input and +arbitrary cursor; valid input, parse success and the expected answer are not +premises. All 256 first bytes agree with an independent major/additional-tag +classification through ordinary kernel-checked finite reasoning. + +A wide integer consumes its head before a u8/u16 narrowing refusal. A malformed, +truncated or wrong-major head leaves the cursor unchanged. The regression cases +exercise useful success, both narrowing boundaries, wrong-major/truncated heads, +null acceptance/refusal, indefinite-byte peeking and the distinctions below. +Peeking a U16 does not establish that its payload exists; the completion helper +compares the cursor with the explicitly supplied input's length and does not +establish input identity. Complete callers must supply that binding. Neither +behavior is silently strengthened into a full-object canonicality claim. + +No shipping codec algorithm, translation root or external model is changed in +this decoder batch. Payload/UTF-8/collection/object decoding, allocation/work +bounds, constructor closure, inverse completeness and the byte-to-authority +composition remain open. The broader E1–E5/M6 work in §13.5 remains open. + +### 13.39 Qualified record-validator and cursor checkpoint — 17 October 2026 + +The combined batch qualifies **902 compiled/audited claims**, preserving all 886 +previous complete declaration records. The full 3,531-job Lean build, transitive +axiom audit, 18/18 qualification cases and two byte-identical clean full +Rust-to-Lean replays pass. There are 25 reviewed models, none unreviewed, and zero +compiled external axioms. The two additional String standard methods in §13.36 +expand an existing model's interface; the unchanged model-row count is not a +claim that its logical surface was unchanged. The inventory has 101 generated +artifacts and 22 explicitly uncompiled standard-interface template stubs. + +Source closure: `b5aa6810c742d3ee53b37b18d2d7a9b5a3f25c5cf5f2af83cf398ede95e33814`. +Statement review: `ap-spec-069-record-and-cursor-2026-10-17`. +Inventory digest: `9ca7caa5ab864d0bcc5936fd696f7beeefdbf1b34a51599357d558e2ca7a5d69`. +Boundary contract: `33fbd99ec34b7e232db2b65d19c55419a4ff5c82b1d7e371a0ed6bb35d96ea18`. + +All 173 xtask tests and affected-target/xtask linting pass. Native connection and +gateway results are recorded in §13.36; the complete native-refinement vector +suite and all 48 shipping-call harness inventory checks pass in the final formal +gate. Kani solver execution was explicitly skipped; no new solver result is +claimed. Coverage +v4 and historical reproduction retain the primary 134/1047-function, +1833/11563-line and 23/82-check-site scope, which excludes codec roles. + +Continue with payload/UTF-8/collection and complete object-codec source proofs, +then the remaining verifier, caller, backend-history and cryptographic integration +obligations in §13.5. A private payload prototype is not part of this qualified +checkpoint. The full E1–E5/M6 program and exact-release hosted gates remain open; +implementation does not wait on GitHub CI. + +### 13.40 Exact payload, collection and protocol-field decoding + +Fifteen source claims connect the actual borrowed payload/byte/text readers, +collection/map/array heads and protocol field helpers to independent list +semantics. Every represented input and arbitrary cursor is covered, including +failed word conversion, addition overflow, truncation and malformed UTF-8. The +payload model needs only that the requested span is available: the proof shows +that machine-width refusal cannot discard an available in-bounds span. Actual +success additionally earns the exact contiguous source span, declared length, +final cursor and input bounds. + +Raw map/array heads accept their indefinite forms; the protocol guards reject +those forms. Exact field proofs preserve expected map counts, bounded array +lengths, key mismatches, null queries, UTF-8 bytes, bounded nonempty owned byte +copies and exactly 32-byte digest payloads. Refusals retain Malformed, +NonCanonical or LimitExceeded and the precise already-consumed cursor. Raw +nonminimal heads still need the enclosing canonical re-encoding check. + +The 31 added source-composed boundary cases include UINT64_MAX payload lengths, +truncated and trailing payloads, valid and malformed UTF-8, indefinite collections, +exact/over array limits, wrong/nonminimal/oversized keys, empty/nonempty byte +policy and 31/32/33-byte digest payloads. Ordinary kernel-checked computation +verifies these cases; no native-evaluation axiom is introduced. The UTF-8, +cloning, checked-word, array-copy and allocation interfaces retain their existing +explicit standard-library contracts. Physical allocator availability is not proved. + +### 13.41 Qualified payload/field checkpoint — 17 October 2026 + +**917 compiled/audited claims** qualify, all 902 preceding full declaration +records unchanged. The complete 3,534-job Lean build, 18/18 qualification cases, +two byte-identical clean full Rust-to-Lean replays, all 173 xtask tests and xtask +linting pass. There are still 25 reviewed external models, no unreviewed models, +zero compiled external axioms and no new foundational axioms. Shipping Rust +algorithms, the 101-artifact translation inventory and the reviewed boundary +contract are unchanged in this batch. + +Source closure: `182ce049a050aeef56cb3ac53dad37a08f5ef9b35d1fbf27816471bd22ca3ac0`. +Statement review: `ap-spec-069-payload-and-fields-2026-10-17`. +Inventory digest: `0925d275cd5b9885ad2598fc031238737b8e5f2c7ed04ed3226a5bfd02e81d84`. +Boundary contract: `33fbd99ec34b7e232db2b65d19c55419a4ff5c82b1d7e371a0ed6bb35d96ea18`. + +The source-exact helpers are prerequisites for complete protocol-object +parsers and inverse completeness; this checkpoint does not claim those complete +object results. A private next prototype has a checked owned-String byte bridge from valid UTF-8; +profile-field composition with existing identifier/version constructors is still +in development. It is outside this qualified checkpoint. +Continue object codecs, constructor closure, aggregate allocation/work bounds, +then the verifier/caller/backend-history/crypto composition in §13.5. E1–E5/M6 +and exact-release hosted gates remain open. Do not wait on GitHub CI. + +The final combined formal gate also passes native Rust refinement vectors, +byte-stable generated semantic vectors and all 48 shipping-call inventory checks. +Kani solver execution was explicitly skipped; no new solver result is claimed. diff --git a/formal/Auths/AssuranceAudit.lean b/formal/Auths/AssuranceAudit.lean index a6fdbcf53..d76c9f3c6 100644 --- a/formal/Auths/AssuranceAudit.lean +++ b/formal/Auths/AssuranceAudit.lean @@ -2,6 +2,7 @@ import Auths import Lean.Elab.Command import Lean.PrettyPrinter import Lean.Util.CollectAxioms +import Lean.Util.FoldConsts open Lean Lean.Elab Lean.Elab.Command @@ -35,6 +36,7 @@ private def auditDeclaration ("module", moduleName.toString), ("kind", declarationKind info), ("statement", statementFormat.pretty 120), + ("statement_constants", Json.arr <| info.type.getUsedConstants.qsort Name.lt |>.map (toJson ·.toString)), ("axioms", Json.arr <| axioms.qsort Name.lt |>.map (toJson ·.toString)) ] diff --git a/formal/Auths/Codec/Action.lean b/formal/Auths/Codec/Action.lean new file mode 100644 index 000000000..9d3cfdbff --- /dev/null +++ b/formal/Auths/Codec/Action.lean @@ -0,0 +1,88 @@ +import qualification.aeneas.generated.codec.Funs +import Mathlib.Tactic.CasesM +open Aeneas Aeneas.Std Result +open auths_codec +set_option maxHeartbeats 2000000 +set_option maxRecDepth 2048 + +namespace Auths.Codec.Action + +theorem branch_ok_iff {T E : Type} (value : core.result.Result T E) (output : T) : + core.result.Result.Insts.CoreOpsTry.branch value = + ok (core.ops.control_flow.ControlFlow.Continue output) ↔ value = .Ok output := by + cases value <;> simp [core.result.Result.Insts.CoreOpsTry.branch] + +theorem bytes_ne_exact (left right : Slice Std.U8) : + core.cmp.impls.PartialEqShared.ne + (Slice.Insts.CoreCmpPartialEqSlice core.cmp.PartialEqU8) left right + ⦃ result => result = decide (left ≠ right) ⦄ := by + have eqSpec := core.slice.cmp.PartialEqSlice.eq_homo_spec + core.cmp.PartialEqU8 left right (by + intro x y + simp [core.cmp.PartialEqU8]) + have neSpec := core.cmp.PartialEq.ne.trait_default.spec + (Slice.Insts.CoreCmpPartialEqSlice core.cmp.PartialEqU8) left right eqSpec + apply Aeneas.Std.WP.spec_mono neSpec + intro result property + cases result <;> simp_all + +theorem decode_encode_exact (input : Slice Std.U8) + (limits : auths_model.VerifierLimits) (action : auths_model.CanonicalAction) + (accepted : decode.decode_canonical_action input limits = ok (.Ok action)) : + ∃ bytes, encode.encode_canonical_action action = ok (.Ok bytes) ∧ bytes.val = input.val := by + unfold decode.decode_canonical_action at accepted + simp only [Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, + reduceCtorEq] at accepted + | contradiction + all_goals subst action + all_goals + rename_i encodedCall encodedResult encodedEq branchCall control bytes branchEq + borrowedCall borrowed borrowedEq compareCall different compared same + have resultOk := (branch_ok_iff encodedResult bytes).mp branchEq + rw [resultOk] at encodedEq + refine ⟨bytes, encodedEq, ?_⟩ + have borrowEq : alloc.vec.Vec.deref bytes = borrowed := by + simpa only [alloc.vec.Vec.as_slice, Result.ok.injEq] using borrowedEq + have comparison := bytes_ne_exact borrowed input + rw [compared] at comparison + simp only [Aeneas.Std.WP.spec_ok] at comparison + have sliceSame : borrowed = input := by + cases different <;> simp_all + exact congrArg Subtype.val (borrowEq.trans sliceSame) + +end Auths.Codec.Action + +namespace Auths.Codec.Action + +/-- Equal decoded actions cannot have different accepted encodings. This is a +byte equality statement and makes no assertion about hash collisions. -/ +theorem accepted_encoding_unique (left right : Slice Std.U8) + (limits : auths_model.VerifierLimits) (action : auths_model.CanonicalAction) + (leftAccepted : decode.decode_canonical_action left limits = ok (.Ok action)) + (rightAccepted : decode.decode_canonical_action right limits = ok (.Ok action)) : + left.val = right.val := by + obtain ⟨leftBytes, leftEncode, leftMeaning⟩ := decode_encode_exact left limits action leftAccepted + obtain ⟨rightBytes, rightEncode, rightMeaning⟩ := decode_encode_exact right limits action rightAccepted + rw [leftEncode] at rightEncode + have sameBytes : leftBytes = rightBytes := by simpa using rightEncode + exact leftMeaning.symm.trans ((congrArg Subtype.val sameBytes).trans rightMeaning) + +end Auths.Codec.Action + +namespace Auths.Codec.Action + +/-- The sole `sort_by_key` call has a stateless, exact digest-key callback. -/ +theorem attachment_key_stateless (attachment : auths_model.DetachedAttachment) : + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest.call_mut + () attachment = ok (attachment.digest, ()) := by + rfl + +end Auths.Codec.Action diff --git a/formal/Auths/Codec/ActionValidity.lean b/formal/Auths/Codec/ActionValidity.lean new file mode 100644 index 000000000..f76cb6fa6 --- /dev/null +++ b/formal/Auths/Codec/ActionValidity.lean @@ -0,0 +1,113 @@ +import Auths.Codec.Action +import Auths.Codec.Constructors +import Auths.Codec.ByteFields + +open Aeneas Aeneas.Std Result +set_option maxHeartbeats 2000000 +set_option maxRecDepth 2048 + +open auths_codec +open Auths.Codec.Constructors +namespace Auths.Codec.Action + +theorem attachments_preserve_body (action : auths_codec.auths_model.CanonicalAction) + (attachments : alloc.vec.Vec auths_codec.auths_model.DetachedAttachment) + (output : auths_codec.auths_model.CanonicalAction) + (accepted : auths_codec.auths_model.CanonicalAction.with_detached_attachments action attachments = ok (.Ok output)) : + output.body = action.body := by + unfold auths_codec.auths_model.CanonicalAction.with_detached_attachments at accepted + simp only [Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output; rfl + +theorem constructor_body_valid + (profile : auths_codec.auths_model.ProfileRef) (mediaType : auths_codec.auths_model.MediaType) + (body : alloc.vec.Vec Std.U8) (permission : auths_codec.auths_model.Permission) + (budget : Option auths_codec.auths_model.BudgetCeiling) (output : auths_codec.auths_model.CanonicalAction) + (accepted : auths_codec.auths_model.CanonicalAction.new profile mediaType body permission budget = ok (.Ok output)) : + 0 < output.body.val.length ∧ output.body.val.length ≤ 8388608 := by + rw [canonical_action_new_exact] at accepted + split at accepted + · rename_i valid + have same : (⟨profile, mediaType, body, permission, budget, alloc.vec.Vec.new _⟩ : + auths_codec.auths_model.CanonicalAction) = output := by simpa using accepted + subst output + exact valid + · simp at accepted + +theorem decoded_body_valid (input : Slice Std.U8) + (limits : auths_codec.auths_model.VerifierLimits) (action : auths_codec.auths_model.CanonicalAction) + (accepted : decode.decode_canonical_action input limits = ok (.Ok action)) : + 0 < action.body.val.length ∧ action.body.val.length ≤ 8388608 := by + unfold decode.decode_canonical_action at accepted + simp only [Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst action + all_goals casesm* core.result.Result auths_codec.auths_model.CanonicalAction _ + all_goals simp_all only [Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward constructor_body_valid) + (add safe forward attachments_preserve_body) + + + +theorem constructor_preserves_body + (profile : auths_codec.auths_model.ProfileRef) (mediaType : auths_codec.auths_model.MediaType) + (body : alloc.vec.Vec Std.U8) (permission : auths_codec.auths_model.Permission) + (budget : Option auths_codec.auths_model.BudgetCeiling) (output : auths_codec.auths_model.CanonicalAction) + (accepted : auths_codec.auths_model.CanonicalAction.new profile mediaType body permission budget = ok (.Ok output)) : + output.body = body := by + rw [canonical_action_new_exact] at accepted + split at accepted + · have same : (⟨profile, mediaType, body, permission, budget, alloc.vec.Vec.new _⟩ : + auths_codec.auths_model.CanonicalAction) = output := by simpa using accepted + subst output + rfl + · simp at accepted + +theorem decoded_body_within_deployment (input : Slice Std.U8) + (limits : auths_codec.auths_model.VerifierLimits) (action : auths_codec.auths_model.CanonicalAction) + (accepted : decode.decode_canonical_action input limits = ok (.Ok action)) : + action.body.val.length ≤ limits.canonical_body_bytes.val := by + unfold decode.decode_canonical_action at accepted + simp only [Bind.bind, Aeneas.Std.bind, auths_codec.auths_model.VerifierLimits.get] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst action + all_goals casesm* core.result.Result auths_codec.auths_model.CanonicalAction _ + all_goals casesm* core.result.Result (alloc.vec.Vec Std.U8) _ + all_goals simp_all only [Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward constructor_preserves_body) + (add safe forward attachments_preserve_body) + (add safe forward bounded_bytes_valid) + +end Auths.Codec.Action diff --git a/formal/Auths/Codec/ByteFields.lean b/formal/Auths/Codec/ByteFields.lean new file mode 100644 index 000000000..b3521e84e --- /dev/null +++ b/formal/Auths/Codec/ByteFields.lean @@ -0,0 +1,31 @@ +import Auths.Codec.Action +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec +namespace Auths.Codec.Action + +theorem cloned_bytes_exact (bytes : Slice Std.U8) : + alloc.slice.Slice.to_vec core.clone.CloneU8 bytes = ok bytes := by + change Slice.clone core.clone.CloneU8.clone bytes = ok bytes + have contract := Slice.clone_spec (s := bytes) (clone := core.clone.CloneU8.clone) (by intro value _; rfl) + obtain ⟨result, evaluates, meaning⟩ := spec_imp_exists contract + simpa only [← meaning] using evaluates + +theorem bounded_bytes_valid (decoder next : cbor.Decoder) (maximum : Std.Usize) + (nonEmpty : Bool) (bytes : alloc.vec.Vec Std.U8) + (accepted : decode.bounded_bytes decoder maximum nonEmpty = ok (.Ok bytes, next)) : + bytes.val.length ≤ maximum.val ∧ (nonEmpty = true → 0 < bytes.val.length) := by + unfold decode.bounded_bytes at accepted + simp only [Bind.bind, Aeneas.Std.bind, cloned_bytes_exact, bind_tc_ok, + core.slice.Slice.is_empty] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + bind_tc_ok, Result.ok.injEq, core.result.Result.Ok.injEq, + Prod.mk.injEq, reduceCtorEq] at accepted + | contradiction + all_goals simp_all [UScalar.lt_equiv, List.length_pos_iff] + +end Auths.Codec.Action diff --git a/formal/Auths/Codec/Collection.lean b/formal/Auths/Codec/Collection.lean new file mode 100644 index 000000000..b926d1230 --- /dev/null +++ b/formal/Auths/Codec/Collection.lean @@ -0,0 +1,101 @@ +import Auths.Codec.Cursor +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec +namespace Auths.Codec.Collection +open Cursor + +def collectionAt (input : List Nat) (position major : Nat) : Option (Option Nat) × Nat := + if input[position]? = some (major * 32 + 31) then (some none, position + 1) + else + let (value, next) := typedHead input position major + (value.map some, next) + +def collectionView (value : core.result.Result (Option Std.U64) cbor.Error) : Option (Option Nat) := + match value with + | .Err _ => none + | .Ok value => some (value.map UScalar.val) + +private theorem shift_marker (major : Std.U8) (valid : major.val < 8) : + (major <<< 5#i32) ⦃ shifted => (shifted ||| 31#u8).val = major.val * 32 + 31 ⦄ := by + apply spec_mono (U8.ShiftLeft_IScalar_spec major 5#i32 (by scalar_tac) (by scalar_tac)) + rintro shifted ⟨natural, bits⟩ + simp only [UScalar.val_or, natural] + have shiftValue : (5#i32).toNat = 5 := rfl + rw [shiftValue] + have sizeEq : U8.size = 256 := by simp [U8.size, U8.numBits] + rw [sizeEq] + change ((major.val <<< 5) % 256) ||| 31 = major.val * 32 + 31 + rcases major with ⟨value, bounds⟩ + change value < 8 at valid + change ((value <<< 5) % 256) ||| 31 = value * 32 + 31 + interval_cases value <;> decide + +private theorem option_eq (left : Option Std.U8) (right : Std.U8) : + core.option.Option.Insts.CoreCmpPartialEqOption.eq + (core.cmp.PartialEqShared core.cmp.PartialEqU8) left (some right) + = ok (decide (left = some right)) := by + cases left <;> simp [core.option.Option.Insts.CoreCmpPartialEqOption.eq, + _root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq, + core.cmp.PartialEqShared, core.cmp.impls.PartialEqShared.eq, + core.cmp.PartialEqU8, core.cmp.impls.PartialEqU8.eq] + +@[step] theorem collection_exact (self : cbor.Decoder) (major : Std.U8) + (valid : major.val < 8) : + cbor.Decoder.collection self major ⦃ actual => + (collectionView actual.1, actual.2.position.val) = + collectionAt (Refinement.byteList self.input.val) self.position.val major.val ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.collection + step with Refinement.slice_get_exact as ⟨first, firstAt⟩ + step with shift_marker major valid as ⟨shifted, markerMeaning⟩ + simp only [lift, bind_tc_ok] + rw [option_eq] + simp only [bind_tc_ok] + by_cases indefinite : first = some (shifted ||| 31#u8) + · have present : ∃ byte, self.input.val[self.position.val]? = some byte := by + exact ⟨_, firstAt.symm.trans indefinite⟩ + obtain ⟨byte, byteAt⟩ := present + have inside := (List.getElem?_eq_some_iff.mp byteAt).1 + have fits : self.position.val + 1 ≤ Usize.max := by + have bound := self.input.property + omega + obtain ⟨next, addition, nextMeaning⟩ := spec_imp_exists + (Usize.add_spec (x := self.position) (y := 1#usize) fits) + have byteMeaning : (Refinement.byteList self.input.val)[self.position.val]? = + some (major.val * 32 + 31) := by + simp [Refinement.byteList, List.getElem?_map, ← firstAt, indefinite, markerMeaning] + simp [indefinite, addition, collectionAt, byteMeaning, collectionView, nextMeaning] + · simp only [indefinite, decide_false, Bool.false_eq_true, ↓reduceIte] + step with Cursor.head_exact as ⟨head, next, meaning, inputSame⟩ + have different : (Refinement.byteList self.input.val)[self.position.val]? ≠ + some (major.val * 32 + 31) := by + intro equal + apply indefinite + cases first with + | none => simp [Refinement.byteList, List.getElem?_map, ← firstAt] at equal + | some byte => + have eqValue : byte.val = (shifted ||| 31#u8).val := by + simpa [Refinement.byteList, List.getElem?_map, ← firstAt, ← markerMeaning] using equal + exact congrArg some ((UScalar.eq_equiv _ _).mpr eqValue) + cases head <;> + simp [core.result.Result.map, BuiltinFnOnce, core.option.Option.Some, + collectionView, collectionAt, different, ← meaning, Cursor.wordView, inputSame] + +@[step] theorem map_exact (self : cbor.Decoder) : + cbor.Decoder.map self ⦃ actual => + (collectionView actual.1, actual.2.position.val) = + collectionAt (Refinement.byteList self.input.val) self.position.val 5 ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.map + simpa using collection_exact self 5#u8 (by decide) + +@[step] theorem array_exact (self : cbor.Decoder) : + cbor.Decoder.array self ⦃ actual => + (collectionView actual.1, actual.2.position.val) = + collectionAt (Refinement.byteList self.input.val) self.position.val 4 ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.array + simpa using collection_exact self 4#u8 (by decide) + +end Auths.Codec.Collection diff --git a/formal/Auths/Codec/Constructors.lean b/formal/Auths/Codec/Constructors.lean new file mode 100644 index 000000000..d781a16a1 --- /dev/null +++ b/formal/Auths/Codec/Constructors.lean @@ -0,0 +1,121 @@ +import Auths.Codec.Evaluation +import Auths.Codec.String +import Auths.Refinement.Identifier +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +set_option maxHeartbeats 2000000 +set_option maxRecDepth 2048 +namespace Auths.Codec.Constructors + +def identifierDecision (value : String) (maximum : Nat) : Bool := + !value.toByteArray.toList.isEmpty && decide (value.toByteArray.size ≤ maximum) && + !((value.toList.map Char.toNat).any + (fun scalar => decide (Auths.Model.Identifier.excluded scalar))) + +theorem identifier_exact (value : String) (maximum : Std.Usize) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_codec.auths_model.identifier.bounded_identifier_valid (toStr value bounded) maximum = + ok (identifierDecision value maximum.val) := by + have contract := Auths.Refinement.Identifier.identifier_string_exact value maximum bounded + change auths_codec.auths_model.identifier.bounded_identifier_valid (toStr value bounded) maximum + ⦃ result => result = _ ⦄ at contract + rw [spec_equiv_exists] at contract + obtain ⟨result, evaluates, meaning⟩ := contract + rw [meaning] at evaluates + convert evaluates using 1 + simp [identifierDecision, toStr, Auths.Model.Identifier.byte_array_list] + rfl + + +/-- The independent identifier contract uses UTF-8 byte length and scalar policy. -/ +def IdentifierValid (value : String) (maximum : Nat) : Prop := + value.toByteArray.size ≠ 0 ∧ value.toByteArray.size ≤ maximum ∧ + ∀ character ∈ value.toList, ¬ Auths.Model.Identifier.excluded character.toNat + +theorem identifier_decision_valid (value : String) (maximum : Nat) : + identifierDecision value maximum = true ↔ IdentifierValid value maximum := by + have empty : value.toByteArray.toList = [] ↔ value = "" := by + rw [List.eq_nil_iff_length_eq_zero] + simp [Auths.Model.Identifier.byte_array_list] + simp only [identifierDecision, Bool.and_eq_true, Bool.not_eq_true', + List.isEmpty_eq_false_iff, + List.any_eq_false, List.mem_map, decide_eq_true_eq] + simp [IdentifierValid, empty] + + +-- Exact checked constructors on their intended validated string carrier. +theorem media_type_parse_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_codec.auths_model.MediaType.parse (toStr value bounded) = + ok (if identifierDecision value 128 then .Ok value + else .Err auths_codec.auths_model.ModelError.InvalidMediaType) := by + unfold auths_codec.auths_model.MediaType.parse + rw [identifier_exact] + simp only [bind_tc_ok, UScalar.ofNatCore_val_eq] + split <;> simp_all [Auths.Codec.StringRefinement.string_copy_exact] +-- Exact checked constructors on their intended validated string carrier. +theorem profile_id_parse_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_codec.auths_model.ProfileId.parse (toStr value bounded) = + ok (if identifierDecision value 128 then .Ok value + else .Err auths_codec.auths_model.ModelError.InvalidProfile) := by + unfold auths_codec.auths_model.ProfileId.parse + rw [identifier_exact] + simp only [bind_tc_ok, UScalar.ofNatCore_val_eq] + split <;> simp_all [Auths.Codec.StringRefinement.string_copy_exact] +-- Exact checked constructors on their intended validated string carrier. +theorem capability_id_parse_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_codec.auths_model.CapabilityId.parse (toStr value bounded) = + ok (if identifierDecision value 128 then .Ok value + else .Err auths_codec.auths_model.ModelError.InvalidCapability) := by + unfold auths_codec.auths_model.CapabilityId.parse + rw [identifier_exact] + simp only [bind_tc_ok, UScalar.ofNatCore_val_eq] + split <;> simp_all [Auths.Codec.StringRefinement.string_copy_exact] +-- Exact checked constructors on their intended validated string carrier. +theorem resource_id_parse_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_codec.auths_model.ResourceId.parse (toStr value bounded) = + ok (if identifierDecision value 1024 then .Ok value + else .Err auths_codec.auths_model.ModelError.InvalidResource) := by + unfold auths_codec.auths_model.ResourceId.parse + rw [identifier_exact] + simp only [bind_tc_ok, UScalar.ofNatCore_val_eq] + split <;> simp_all [Auths.Codec.StringRefinement.string_copy_exact] +-- Exact checked constructors on their intended validated string carrier. +theorem budget_algebra_id_parse_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_codec.auths_model.BudgetAlgebraId.parse (toStr value bounded) = + ok (if identifierDecision value 128 then .Ok value + else .Err auths_codec.auths_model.ModelError.InvalidRegistryId) := by + unfold auths_codec.auths_model.BudgetAlgebraId.parse + rw [identifier_exact] + simp only [bind_tc_ok, UScalar.ofNatCore_val_eq] + split <;> simp_all [Auths.Codec.StringRefinement.string_copy_exact] + +/-- The constructor checks the nonempty body and the protocol byte ceiling; +other fields are preserved and retain their incoming constructor premises. -/ +theorem canonical_action_new_exact + (profile : auths_codec.auths_model.ProfileRef) + (mediaType : auths_codec.auths_model.MediaType) + (body : alloc.vec.Vec Std.U8) + (permission : auths_codec.auths_model.Permission) + (budget : Option auths_codec.auths_model.BudgetCeiling) : + auths_codec.auths_model.CanonicalAction.new profile mediaType body permission budget = + ok (if 0 < body.val.length ∧ body.val.length ≤ 8388608 then + .Ok ⟨profile, mediaType, body, permission, budget, alloc.vec.Vec.new _⟩ + else .Err auths_codec.auths_model.ModelError.InvalidCanonicalAction) := by + unfold auths_codec.auths_model.CanonicalAction.new + simp only [alloc.vec.Vec.is_empty, bind_tc_ok] + rw [Evaluation.hard_canonical_body_bytes] + simp only [bind_tc_ok, UScalar.lt_equiv, alloc.vec.Vec.len_val, + UScalar.ofNatCore_val_eq] + by_cases empty : body.val = [] + · simp [empty] + · have positive : 0 < body.val.length := List.length_pos_iff.mpr empty + simp [empty, positive] + split <;> rename_i bound <;> simp_all + + +end Auths.Codec.Constructors diff --git a/formal/Auths/Codec/Cursor.lean b/formal/Auths/Codec/Cursor.lean new file mode 100644 index 000000000..2f0a9aba5 --- /dev/null +++ b/formal/Auths/Codec/Cursor.lean @@ -0,0 +1,263 @@ +import Mathlib.Tactic.IntervalCases +import Auths.Codec.Refinement +import Auths.Codec.Evaluation +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec +namespace Auths.Codec.Cursor + +def wordView {ty : UScalarTy} (value : core.result.Result (UScalar ty) cbor.Error) : Option Nat := + match value with + | .Ok value => some value.val + | .Err _ => none + +/-- Independent typed-head grammar. Refusal preserves the original cursor; +a matching definite head consumes precisely the grammar's prefix. -/ +def typedHead (input : List Nat) (position major : Nat) : Option Nat × Nat := + match readHead (input.drop position) with + | none => (none, position) + | some (head, rest) => + if head.major = major then (some head.argument, input.length - rest.length) + else (none, position) + +@[step] theorem new_exact (input : Slice Std.U8) : + cbor.Decoder.new input ⦃ actual => actual.input = input ∧ actual.position.val = 0 ⦄ := by + simp [cbor.Decoder.new] + +@[step] theorem at_exact (input : Slice Std.U8) (position : Std.Usize) : + cbor.Decoder.at input position ⦃ actual => + actual = if position.val ≤ input.val.length then .Ok ⟨input, position⟩ else .Err () ⦄ := by + unfold cbor.Decoder.at + by_cases within : position.val ≤ input.val.length + · have gate : ¬ position > Slice.len input := by simpa [Slice.length] using within.not_gt + simp [gate, within] + · have gate : position > Slice.len input := by simpa [Slice.length] using Nat.lt_of_not_ge within + simp [gate, within] + +@[step] theorem position_exact (self : cbor.Decoder) : + cbor.Decoder.impl.position self ⦃ actual => actual = self.position ⦄ := by + rfl + +@[step] theorem head_exact (self : cbor.Decoder) (major : Std.U8) : + cbor.Decoder.head self major ⦃ actual => + (wordView actual.1, actual.2.position.val) = + typedHead (Refinement.byteList self.input.val) self.position.val major.val ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.head + step with Refinement.read_head_refines self.input self.position as ⟨read, meaning⟩ + cases read with + | Err error => + have refused : readHead ((Refinement.byteList self.input.val).drop self.position.val) = none := meaning + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, + wordView, typedHead, refused] + | Ok head => + obtain ⟨grammar, advances, bounded, work⟩ := meaning + have endPosition : (Refinement.byteList self.input.val).length - + ((Refinement.byteList self.input.val).drop head.next.val).length = head.next.val := by + simp only [Refinement.byteList, List.length_map, List.length_drop] + omega + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + by_cases same : head.major = major + · have sameValue : head.major.val = major.val := congrArg UScalar.val same + simp [same, wordView, typedHead, grammar, Refinement.headView, sameValue] + simp only [Refinement.byteList, List.length_map] at * + omega + · have differentValue : head.major.val ≠ major.val := by + intro identical + exact same ((UScalar.eq_equiv _ _).mpr identical) + simp [same, wordView, typedHead, grammar, Refinement.headView, differentValue] + +@[step] theorem u64_exact (self : cbor.Decoder) : + cbor.Decoder.u64 self ⦃ actual => + (wordView actual.1, actual.2.position.val) = + typedHead (Refinement.byteList self.input.val) self.position.val 0 ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.u64 + simpa using head_exact self 0#u8 + + +def narrowHead (input : List Nat) (position maximum : Nat) : Option Nat × Nat := + let (value, next) := typedHead input position 0 + (value.filter (fun value => decide (value ≤ maximum)), next) + +private theorem cast_u8_exact (value : Std.U64) : + U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from value ⦃ actual => + wordView actual = if value.val ≤ 255 then some value.val else none ⦄ := by + unfold U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from + rw [Evaluation.try_from] + have concrete : UScalar.cMax .U8 = 255 := rfl + have logical : UScalar.max .U8 = 255 := by scalar_tac + by_cases fits : value.val ≤ 255 <;> + simp [concrete, logical, fits, wordView, UScalar.ofNat] + +private theorem cast_u16_exact (value : Std.U64) : + U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from value ⦃ actual => + wordView actual = if value.val ≤ 65535 then some value.val else none ⦄ := by + unfold U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from + rw [Evaluation.try_from] + have concrete : UScalar.cMax .U16 = 65535 := rfl + have logical : UScalar.max .U16 = 65535 := by scalar_tac + by_cases fits : value.val ≤ 65535 <;> + simp [concrete, logical, fits, wordView, UScalar.ofNat] + +private theorem map_malformed {T : Type} (value : core.result.Result T cbor.Error) : + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError cbor.Error) + value cbor.malformed = ok value := by + cases value <;> simp [core.result.Result.map_err, BuiltinFnOnce, cbor.malformed] + +@[step] theorem u8_exact (self : cbor.Decoder) : + cbor.Decoder.u8 self ⦃ actual => + (wordView actual.1, actual.2.position.val) = + narrowHead (Refinement.byteList self.input.val) self.position.val 255 ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.u8 + step with u64_exact as ⟨result, next, meaning, inputSame⟩ + cases result with + | Err error => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, wordView, narrowHead, ← meaning, inputSame] + | Ok value => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step with cast_u8_exact as ⟨cast, castMeaning⟩ + simp only [map_malformed, bind_tc_ok, spec_ok] + constructor + · rw [castMeaning] + simp only [narrowHead, ← meaning, wordView] + by_cases fits : value.val ≤ 255 <;> simp [fits, Option.filter] + · exact inputSame + +@[step] theorem u16_exact (self : cbor.Decoder) : + cbor.Decoder.u16 self ⦃ actual => + (wordView actual.1, actual.2.position.val) = + narrowHead (Refinement.byteList self.input.val) self.position.val 65535 ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.u16 + step with u64_exact as ⟨result, next, meaning, inputSame⟩ + cases result with + | Err error => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, wordView, narrowHead, ← meaning, inputSame] + | Ok value => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step with cast_u16_exact as ⟨cast, castMeaning⟩ + simp only [map_malformed, bind_tc_ok, spec_ok] + constructor + · rw [castMeaning] + simp only [narrowHead, ← meaning, wordView] + by_cases fits : value.val ≤ 65535 <;> simp [fits, Option.filter] + · exact inputSame + +def nullAt (input : List Nat) (position : Nat) : Bool × Nat := + if input[position]? = some 246 then (true, position + 1) else (false, position) +def unitView (value : core.result.Result Unit cbor.Error) : Bool := + match value with | .Ok _ => true | .Err _ => false + +private theorem option_byte_ne (left right : Option Std.U8) : + core.cmp.PartialEq.ne.trait_default + (core.option.Option.Insts.CoreCmpPartialEqOption (core.cmp.PartialEqShared core.cmp.PartialEqU8)) + left right = ok (decide (left ≠ right)) := by + cases left <;> cases right <;> + simp [core.cmp.PartialEq.ne.trait_default, core.cmp.PartialEq.ne.default, + auths_codec.core.option.Option.Insts.CoreCmpPartialEqOption, _root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq, + core.cmp.PartialEqShared, core.cmp.impls.PartialEqShared.eq, core.cmp.PartialEqU8, core.cmp.impls.PartialEqU8.eq, UScalar.eq_equiv] + +@[step] theorem null_exact (self : cbor.Decoder) : + cbor.Decoder.null self ⦃ actual => + (unitView actual.1, actual.2.position.val) = nullAt (Refinement.byteList self.input.val) self.position.val ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.null + step with Refinement.slice_get_exact as ⟨byte, byteAt⟩ + simp only [option_byte_ne, bind_tc_ok] + cases byte with + | none => simp [unitView, nullAt, Refinement.byteList, List.getElem?_map, ← byteAt] + | some byte => + by_cases sameByte : byte = 246#u8 + · have present : self.input.val[self.position.val]? = some byte := byteAt.symm + have inside := (List.getElem?_eq_some_iff.mp present).1 + have fits : self.position.val + 1 ≤ Usize.max := by have bound := self.input.property; omega + obtain ⟨next, addition, nextMeaning⟩ := spec_imp_exists (Usize.add_spec (x := self.position) (y := 1#usize) fits) + simp [sameByte, addition, unitView, nullAt, Refinement.byteList, List.getElem?_map, ← byteAt, nextMeaning] + · have different : byte.val ≠ 246 := by + intro equal + apply sameByte + apply (UScalar.eq_equiv _ _).mpr + simpa using equal + simp [sameByte, unitView, nullAt, Refinement.byteList, List.getElem?_map, ← byteAt, different] + + +/-- Peeking classifies the first byte only; it neither consumes a head nor +establishes canonicality or availability of the following payload. -/ +def classify (byte : Nat) : cbor.Type := + let additional := byte % 32 + match byte / 32 with + | 0 => if additional ≤ 24 then .U8 + else if additional = 25 then .U16 + else if additional = 26 then .U32 + else if additional = 27 then .U64 else .Other + | 2 => if additional ≤ 27 then .Bytes else .Other + | 3 => if additional ≤ 27 then .String else .Other + | 7 => if additional = 22 then .Null else .Other + | _ => .Other + +private theorem classify_ranges (byte : Nat) (bound : byte < 256) : + classify byte = + if byte ≤ 24 then .U8 + else if byte = 25 then .U16 + else if byte = 26 then .U32 + else if byte = 27 then .U64 + else if byte = 246 then .Null + else if 64 ≤ byte ∧ byte ≤ 91 then .Bytes + else if 96 ≤ byte ∧ byte ≤ 123 then .String + else .Other := by + interval_cases byte <;> norm_num [classify] + +def typeAt (input : List Nat) (position : Nat) : core.result.Result cbor.Type cbor.Error := + match input[position]? with + | none => .Err () + | some byte => .Ok (classify byte) + +@[step] theorem datatype_exact (self : cbor.Decoder) : + cbor.Decoder.datatype self ⦃ actual => + actual = typeAt (Refinement.byteList self.input.val) self.position.val ⦄ := by + unfold cbor.Decoder.datatype + step with Refinement.slice_get_exact as ⟨byte, byteAt⟩ + cases byte with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, typeAt, Refinement.byteList, List.getElem?_map, ← byteAt] + | some byte => + simp only [core.option.Option.ok_or, bind_tc_ok, core.result.Result.Insts.CoreOpsTry.branch] + simp only [typeAt, Refinement.byteList, List.getElem?_map, ← byteAt, Option.map_some] + rcases byte with ⟨value, bounds⟩ + have upper : value < 256 := by scalar_tac + refine spec_mono (P₀ := fun actual => actual = .Ok + (if value ≤ 24 then cbor.Type.U8 + else if value = 25 then .U16 + else if value = 26 then .U32 + else if value = 27 then .U64 + else if value = 246 then .Null + else if 64 ≤ value ∧ value ≤ 91 then .Bytes + else if 96 ≤ value ∧ value ≤ 123 then .String + else .Other)) ?_ ?_ + · interval_cases value <;> rfl + · intro actual meaning + change actual = .Ok (classify value) + rw [classify_ranges value upper] + exact meaning + +/-- Completeness compares the cursor with the explicitly supplied input. A +caller must separately establish that this is the cursor's own input. -/ +@[step] theorem ensure_complete_exact (self : cbor.Decoder) (input : Slice Std.U8) : + decode.ensure_complete self input ⦃ actual => actual = + if self.position.val = input.val.length then .Ok () else .Err .Malformed ⦄ := by + unfold decode.ensure_complete + simp only [cbor.Decoder.impl.position, bind_tc_ok] + split <;> rename_i complete + all_goals simp_all [spec_ok, UScalar.eq_equiv, Slice.length] + +end Auths.Codec.Cursor diff --git a/formal/Auths/Codec/Encoder.lean b/formal/Auths/Codec/Encoder.lean new file mode 100644 index 000000000..b7f26f952 --- /dev/null +++ b/formal/Auths/Codec/Encoder.lean @@ -0,0 +1,203 @@ +import Auths.Codec.Refinement + +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open Auths.Codec Auths.Codec.Refinement +open auths_codec + +namespace Auths.Codec.Refinement.Encoder + +set_option maxHeartbeats 2000000 + +theorem bigEndian_cons (width value : Nat) : + bigEndian (width + 1) value = + (value / 256 ^ width % 256) :: bigEndian width value := by + induction width generalizing value with + | zero => simp [bigEndian] + | succ width ih => + rw [bigEndian, ih, bigEndian] + simp only [List.cons_append] + congr 2 + rw [Nat.div_div_eq_div_mul, Nat.pow_succ, Nat.mul_comm] + +theorem cast_byte (value : Std.U64) : + (UScalar.cast .U8 value).val = value.val % 256 := by + simp only [UScalar.cast, UScalar.val, BitVec.zeroExtend, BitVec.toNat_setWidth] + rfl + +@[step] theorem append_tail_exact (output : alloc.vec.Vec Std.U8) + (value : Std.U64) (remaining : Std.U8) + (width : remaining.val ≤ 8) + (capacity : output.val.length + remaining.val ≤ Usize.max) : + cbor.append_tail output value remaining ⦃ encoded => + byteList encoded.val = byteList output.val ++ bigEndian remaining.val value.val ⦄ := by + let expected := byteList output.val ++ bigEndian remaining.val value.val + unfold cbor.append_tail cbor.append_tail_loop + apply loop.spec_decr_nat + (measure := fun state => state.2.val) + (inv := fun state => state.2.val ≤ 8 ∧ + state.1.val.length + state.2.val ≤ Usize.max ∧ + byteList state.1.val ++ bigEndian state.2.val value.val = expected) + · rintro ⟨current, left⟩ ⟨leftWidth, leftCapacity, meaning⟩ + dsimp only at leftWidth leftCapacity meaning + unfold cbor.append_tail_loop.body + dsimp only + split <;> rename_i nonzero + · have positive : 0 < left.val := by scalar_tac + step as ⟨nextLeft, nextLeftEq⟩ + simp only [lift, bind_tc_ok] + step as ⟨shift, shiftEq⟩ + step as ⟨shifted, shiftedEq, shiftedBits⟩ + step as ⟨nextOutput, nextOutputEq⟩ + refine ⟨by omega, ?_, ?_, by omega⟩ + · simp [nextOutputEq] + omega + · have chunk := bigEndian_cons (left.val - 1) value.val + have leftEq : left.val - 1 + 1 = left.val := by omega + rw [leftEq] at chunk + rw [chunk] at meaning + have shiftAmount : shift.val = (left.val - 1) * 8 := by + simpa [nextLeftEq] using shiftEq + have power : 2 ^ ((left.val - 1) * 8) = 256 ^ (left.val - 1) := by + rw [Nat.mul_comm, Nat.pow_mul] + have digit : (UScalar.cast .U8 shifted).val = value.val / 256 ^ (left.val - 1) % 256 := by + rw [cast_byte, shiftedEq, Nat.shiftRight_eq_div_pow, shiftAmount, power] + have after : byteList nextOutput.val = byteList current.val ++ [value.val / 256 ^ (left.val - 1) % 256] := by + simp [byteList, nextOutputEq, digit] + rw [after, nextLeftEq] + simpa [List.append_assoc] using meaning + · simp only [spec_ok] + have zero : left.val = 0 := by scalar_tac + simpa [zero, bigEndian] using meaning + · exact ⟨width, capacity, rfl⟩ + +def EncodingRefines (major : Std.U8) (argument : Std.U64) + (result : core.result.Result (alloc.vec.Vec Std.U8) cbor.Error) : Prop := + match result with + | .Err _ => 7 < major.val + | .Ok output => major.val < 8 ∧ + byteList output.val = encodeHead ⟨major.val, argument.val⟩ + +theorem encode_head_refines (major : Std.U8) (argument : Std.U64) : + cbor.encode_head major argument ⦃ result => EncodingRefines major argument result ⦄ := by + have emptyFits : (alloc.vec.Vec.with_capacity Std.U8 9#usize).val.length < Usize.max := by + simp only [alloc.vec.Vec.with_capacity, alloc.vec.Vec.new] + scalar_tac + unfold cbor.encode_head + split <;> rename_i invalid + · simp only [spec_ok, EncodingRefines] + scalar_tac + · have majorValid : major.val < 8 := by scalar_tac + step as ⟨prefixByte, prefixEq⟩ + split <;> rename_i inline + · have inlineNat : argument.val < 24 := by scalar_tac + have castEq : (UScalar.cast .U8 argument).val = argument.val := by + rw [cast_byte, Nat.mod_eq_of_lt (by omega)] + simp only [lift, bind_tc_ok] + step as ⟨header, headerEq⟩ + step as ⟨output, outputEq⟩ + simp only [EncodingRefines] + refine ⟨majorValid, ?_⟩ + simp [byteList, outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, + encodeHead, additionalTag, argumentWidth, inlineNat, bigEndian, headerEq, prefixEq, castEq] + · split <;> rename_i fitsByte + · step as ⟨header, headerEq⟩ + step as ⟨output, outputEq⟩ + have tailFits : output.val.length + 8 ≤ Usize.max := by + simp only [outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, List.length_append, List.length_cons, List.length_nil] + scalar_tac + step as ⟨encoded, encodedEq⟩ + simp only [EncodingRefines] + refine ⟨majorValid, ?_⟩ + have aboveInline : ¬ argument.val < 24 := by scalar_tac + have withinByte : argument.val < 256 := by scalar_tac + simpa [encodeHead, additionalTag, argumentWidth, aboveInline, withinByte, + byteList, outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, headerEq, prefixEq] using encodedEq + · split <;> rename_i fitsShort + · step as ⟨header, headerEq⟩ + step as ⟨output, outputEq⟩ + have tailFits : output.val.length + 8 ≤ Usize.max := by + simp only [outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, List.length_append, List.length_cons, List.length_nil] + scalar_tac + step as ⟨encoded, encodedEq⟩ + simp only [EncodingRefines] + refine ⟨majorValid, ?_⟩ + have aboveInline : ¬ argument.val < 24 := by scalar_tac + have aboveByte : ¬ argument.val < 256 := by scalar_tac + have withinShort : argument.val < 65536 := by scalar_tac + simpa [encodeHead, additionalTag, argumentWidth, aboveInline, aboveByte, withinShort, + byteList, outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, headerEq, prefixEq] using encodedEq + · split <;> rename_i fitsWord + · step as ⟨header, headerEq⟩ + step as ⟨output, outputEq⟩ + have tailFits : output.val.length + 8 ≤ Usize.max := by + simp only [outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, List.length_append, List.length_cons, List.length_nil] + scalar_tac + step as ⟨encoded, encodedEq⟩ + simp only [EncodingRefines] + refine ⟨majorValid, ?_⟩ + have aboveInline : ¬ argument.val < 24 := by scalar_tac + have aboveByte : ¬ argument.val < 256 := by scalar_tac + have aboveShort : ¬ argument.val < 65536 := by scalar_tac + have withinWord : argument.val < 4294967296 := by scalar_tac + simpa [encodeHead, additionalTag, argumentWidth, aboveInline, aboveByte, aboveShort, withinWord, + byteList, outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, headerEq, prefixEq] using encodedEq + · step as ⟨header, headerEq⟩ + step as ⟨output, outputEq⟩ + have tailFits : output.val.length + 8 ≤ Usize.max := by + simp only [outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, List.length_append, List.length_cons, List.length_nil] + scalar_tac + step as ⟨encoded, encodedEq⟩ + simp only [EncodingRefines] + refine ⟨majorValid, ?_⟩ + have aboveInline : ¬ argument.val < 24 := by scalar_tac + have aboveByte : ¬ argument.val < 256 := by scalar_tac + have aboveShort : ¬ argument.val < 65536 := by scalar_tac + have aboveWord : ¬ argument.val < 4294967296 := by scalar_tac + simpa [encodeHead, additionalTag, argumentWidth, aboveInline, aboveByte, aboveShort, aboveWord, + byteList, outputEq, alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, headerEq, prefixEq] using encodedEq + + +theorem encode_head_byte_bound (major : Std.U8) (argument : Std.U64) : + cbor.encode_head major argument ⦃ result => + match result with + | .Err _ => 7 < major.val + | .Ok output => 1 ≤ output.val.length ∧ output.val.length ≤ 9 ⦄ := by + apply spec_mono (encode_head_refines major argument) + intro result refines + cases result with + | Err => exact refines + | Ok output => + obtain ⟨valid, encoded⟩ := refines + have lengthEq := congrArg List.length encoded + simp only [byteList, List.length_map] at lengthEq + have positive : 1 ≤ (encodeHead ⟨major.val, argument.val⟩).length := by + simp [encodeHead] + have bounded := encodeHead_length_le_nine ⟨major.val, argument.val⟩ + omega + +theorem encode_head_roundtrip (major : Std.U8) (argument : Std.U64) + (valid : major.val < 8) : + cbor.encode_head major argument ⦃ result => + ∃ output, result = .Ok output ∧ + ∀ (input : Slice Std.U8) (position : Std.Usize) (tail : List Nat), + (byteList input.val).drop position.val = byteList output.val ++ tail → + cbor.read_head input position ⦃ decoded => + ∃ head, decoded = .Ok head ∧ + headView head = ⟨major.val, argument.val⟩ ∧ + (byteList input.val).drop head.next.val = tail ∧ + head.next.val ≤ input.val.length ⦄ ⦄ := by + apply spec_mono (encode_head_refines major argument) + intro result refines + cases result with + | Err => simp only [EncodingRefines] at refines; omega + | Ok output => + refine ⟨output, rfl, ?_⟩ + intro input position tail encoded + have headValid : (Head.mk major.val argument.val).Valid := by + exact ⟨valid, by scalar_tac⟩ + apply read_head_accepts_encoding input position ⟨major.val, argument.val⟩ tail headValid + simpa only [refines.2] using encoded + + +end Auths.Codec.Refinement.Encoder diff --git a/formal/Auths/Codec/Evaluation.lean b/formal/Auths/Codec/Evaluation.lean new file mode 100644 index 000000000..da9e9a1f1 --- /dev/null +++ b/formal/Auths/Codec/Evaluation.lean @@ -0,0 +1,200 @@ +import qualification.aeneas.generated.codec.Funs +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +set_option cbv.warning false +/-! +Kernel-proved evaluation rules for the qualified codec closure. These rules +preserve the original result for every input. The conservative word-size branch +works on both supported machine widths; all other inputs retain the original +checked operation. They introduce no native-evaluation or platform-width axiom. +-/ +namespace Auths.Codec.Evaluation +attribute [cbv_eval] U8.max_eq U16.max_eq U32.max_eq U64.max_eq U128.max_eq + +/-- A proved portable fast path; the remaining inputs retain the exact original definition. -/ +@[cbv_eval] theorem try_mk (value : Nat) : + UScalar.tryMk .Usize value = + if bounded : value ≤ UScalar.cMax .Usize then + ok (UScalar.ofNat value bounded : Std.Usize) + else Result.ofOption (UScalar.tryMkOpt .Usize value) .integerOverflow := by + by_cases bounded : value ≤ UScalar.cMax .Usize + · have within := UScalar.bound_suffices .Usize value bounded + change value < 2 ^ System.Platform.numBits at within + simp [bounded, UScalar.tryMk, UScalar.tryMkOpt, UScalar.check_bounds, + within, UScalar.ofNat] + · simp [bounded, UScalar.tryMk] + +@[cbv_eval] theorem cast {source : UScalarTy} (target : UScalarTy) (value : UScalar source) : + UScalar.cast target value = + if bounded : value.val ≤ UScalar.cMax target then + (UScalar.ofNat value.val bounded : UScalar target) + else ⟨value.bv.zeroExtend target.numBits⟩ := by + by_cases bounded : value.val ≤ UScalar.cMax target + · simp only [bounded, ↓reduceDIte] + apply UScalar.eq_of_val_eq + have within := UScalar.bound_suffices target value.val bounded + simp only [UScalar.ofNat, UScalar.ofNatCore_val_eq] + simp only [UScalar.cast, UScalar.val, BitVec.zeroExtend, BitVec.toNat_setWidth] + exact Nat.mod_eq_of_lt within + · simp [bounded, UScalar.cast] + +@[cbv_eval] theorem try_from {source : UScalarTy} (target : UScalarTy) (value : UScalar source) : + core.num.tryFromUScalar target value = + if bounded : value.val ≤ UScalar.cMax target then + ok (.Ok (UScalar.ofNat value.val bounded : UScalar target)) + else if value.val ≤ UScalar.max target then + ok (.Ok (UScalar.cast target value)) + else ok (.Err ()) := by + by_cases bounded : value.val ≤ UScalar.cMax target + · have within : value.val ≤ UScalar.max target := by + have bound := UScalar.bound_suffices target value.val bounded + simp only [UScalar.max] at * + omega + simp [bounded, core.num.tryFromUScalar, within, cast] + · simp [bounded, core.num.tryFromUScalar] + +@[cbv_eval] theorem subtract (left right : Std.Usize) : + UScalar.sub left right = + if _ordered : right.val ≤ left.val then + if bounded : left.val - right.val ≤ UScalar.cMax .Usize then + ok (UScalar.ofNat (left.val - right.val) bounded : Std.Usize) + else ok ⟨BitVec.ofNat _ (left.val - right.val)⟩ + else fail .integerOverflow := by + by_cases ordered : right.val ≤ left.val + · by_cases bounded : left.val - right.val ≤ UScalar.cMax .Usize + · simp only [ordered, bounded, ↓reduceDIte] + have contract := UScalar.sub_spec ordered + rw [spec_equiv_exists] at contract + obtain ⟨result, evaluates, meaning, _⟩ := contract + change UScalar.sub left right = ok result at evaluates + rw [evaluates] + congr 1 + apply UScalar.eq_of_val_eq + simpa only [UScalar.ofNat, UScalar.ofNatCore_val_eq] using meaning + · simp [ordered, bounded, UScalar.sub, Nat.not_lt_of_ge ordered] + · have reversed : left.val < right.val := Nat.lt_of_not_ge ordered + simp [ordered, UScalar.sub, reversed] + +@[cbv_eval] theorem append_bytes (output : alloc.vec.Vec Std.U8) (input : Slice Std.U8) : + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 output input = + if small : output.val.length + input.val.length ≤ UScalar.cMax .Usize then + ok ⟨output.val ++ input.val, by + simp only [List.length_append] + have := UScalar.bound_suffices .Usize _ small + scalar_tac⟩ + else if within : output.val.length + input.val.length ≤ Usize.max then + ok ⟨output.val ++ input.val, by simpa only [List.length_append] using within⟩ + else fail .panic := by + have cloned : Slice.clone core.clone.CloneU8.clone input = ok input := by + have contract := Slice.clone_spec (s := input) (clone := core.clone.CloneU8.clone) + (by intro value _; rfl) + obtain ⟨result, evaluates, meaning⟩ := spec_imp_exists contract + simpa only [← meaning] using evaluates + change Slice.clone (liftFun1 core.clone.impls.CloneU8.clone) input = ok input at cloned + unfold alloc.vec.Vec.extend_from_slice + split + · rename_i within + split + · rename_i copied evaluated + have same : copied = input := by + have equality := evaluated.symm.trans cloned + exact Result.ok.inj equality + subst copied + by_cases small : output.val.length + input.val.length ≤ UScalar.cMax .Usize + · simp [small] + · simp [small] + · rename_i failure evaluated + have impossible := evaluated.symm.trans cloned + cases impossible + · rename_i evaluated + have impossible := evaluated.symm.trans cloned + cases impossible + · rename_i outside + have notSmall : ¬ output.val.length + input.val.length ≤ UScalar.cMax .Usize := by + intro small + have := UScalar.bound_suffices .Usize _ small + apply outside + scalar_tac + simp [notSmall] + +@[cbv_eval] theorem push {α : Type} (output : alloc.vec.Vec α) (value : α) : + alloc.vec.Vec.push output value = + if small : output.val.length + 1 ≤ UScalar.cMax .Usize then + ok ⟨output.val ++ [value], by + simp only [List.length_append, List.length_singleton] + have := UScalar.bound_suffices .Usize _ small + scalar_tac⟩ + else + if within : output.val.length + 1 ≤ U32.max || output.val.length + 1 ≤ Usize.max then + ok ⟨output.val.concat value, by simp; scalar_tac⟩ + else fail .maximumSizeExceeded := by + by_cases small : output.val.length + 1 ≤ UScalar.cMax .Usize + · have within : output.val.length + 1 ≤ U32.max := by + simpa only [UScalar.cMax, UScalar.rMax, U32.rMax, U32.max_eq] using small + simp [small, alloc.vec.Vec.push, within] + · simp only [small, ↓reduceDIte] + unfold alloc.vec.Vec.push + rfl + +@[cbv_eval] theorem hard_bundle_bytes : auths_codec.auths_model.HARD_MAX_BUNDLE_BYTES = ok (8388608#usize) := by + have contract : auths_codec.auths_model.HARD_MAX_BUNDLE_BYTES ⦃ value => value = 8388608#usize ⦄ := by + unfold auths_codec.auths_model.HARD_MAX_BUNDLE_BYTES + step as ⟨first, firstEq⟩ + step as ⟨second, secondEq⟩ + scalar_tac + rw [spec_equiv_exists] at contract + obtain ⟨value, evaluates, exactValue⟩ := contract + simpa only [exactValue] using evaluates + +@[cbv_eval] theorem hard_action_bytes : auths_codec.auths_model.HARD_MAX_ACTION_BYTES = ok (16777216#usize) := by + have contract : auths_codec.auths_model.HARD_MAX_ACTION_BYTES ⦃ value => value = 16777216#usize ⦄ := by + unfold auths_codec.auths_model.HARD_MAX_ACTION_BYTES + step as ⟨first, firstEq⟩ + step as ⟨second, secondEq⟩ + scalar_tac + rw [spec_equiv_exists] at contract + obtain ⟨value, evaluates, exactValue⟩ := contract + simpa only [exactValue] using evaluates + +@[cbv_eval] theorem hard_context_bytes : auths_codec.auths_model.HARD_MAX_CONTEXT_BYTES = ok (16777216#usize) := by + have contract : auths_codec.auths_model.HARD_MAX_CONTEXT_BYTES ⦃ value => value = 16777216#usize ⦄ := by + unfold auths_codec.auths_model.HARD_MAX_CONTEXT_BYTES + step as ⟨first, firstEq⟩ + step as ⟨second, secondEq⟩ + scalar_tac + rw [spec_equiv_exists] at contract + obtain ⟨value, evaluates, exactValue⟩ := contract + simpa only [exactValue] using evaluates + +@[cbv_eval] theorem hard_evidence_bytes : auths_codec.auths_model.HARD_MAX_EVIDENCE_BYTES = ok (2097152#usize) := by + have contract : auths_codec.auths_model.HARD_MAX_EVIDENCE_BYTES ⦃ value => value = 2097152#usize ⦄ := by + unfold auths_codec.auths_model.HARD_MAX_EVIDENCE_BYTES + step as ⟨first, firstEq⟩ + step as ⟨second, secondEq⟩ + scalar_tac + rw [spec_equiv_exists] at contract + obtain ⟨value, evaluates, exactValue⟩ := contract + simpa only [exactValue] using evaluates + +@[cbv_eval] theorem hard_attachment_bytes : auths_codec.auths_model.HARD_MAX_ATTACHMENT_BYTES = ok (8388608#usize) := by + have contract : auths_codec.auths_model.HARD_MAX_ATTACHMENT_BYTES ⦃ value => value = 8388608#usize ⦄ := by + unfold auths_codec.auths_model.HARD_MAX_ATTACHMENT_BYTES + step as ⟨first, firstEq⟩ + step as ⟨second, secondEq⟩ + scalar_tac + rw [spec_equiv_exists] at contract + obtain ⟨value, evaluates, exactValue⟩ := contract + simpa only [exactValue] using evaluates + +@[cbv_eval] theorem hard_canonical_body_bytes : auths_codec.auths_model.HARD_MAX_CANONICAL_BODY_BYTES = ok (8388608#usize) := by + have contract : auths_codec.auths_model.HARD_MAX_CANONICAL_BODY_BYTES ⦃ value => value = 8388608#usize ⦄ := by + unfold auths_codec.auths_model.HARD_MAX_CANONICAL_BODY_BYTES + step as ⟨first, firstEq⟩ + step as ⟨second, secondEq⟩ + scalar_tac + rw [spec_equiv_exists] at contract + obtain ⟨value, evaluates, exactValue⟩ := contract + simpa only [exactValue] using evaluates + +end Auths.Codec.Evaluation diff --git a/formal/Auths/Codec/Examples.lean b/formal/Auths/Codec/Examples.lean new file mode 100644 index 000000000..d1eb8fe41 --- /dev/null +++ b/formal/Auths/Codec/Examples.lean @@ -0,0 +1,141 @@ +import Auths.Codec.Evaluation + +open Aeneas Aeneas.Std Result +open auths_codec +set_option cbv.warning false +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 + +namespace Auths.Codec.Examples + +/-- Small positive carrier exercising every required canonical-action field. +The singleton body is opaque profile data; this is codec acceptance, not an +authorization claim for a registered application profile. -/ +def minimalLimits : auths_codec.auths_model.VerifierLimits := { + bundle_bytes := 1#usize + action_bytes := 128#usize + context_bytes := 1#usize + grants := 1#usize + actions := 1#usize + plan_leaves := 1#usize + plan_depth := 1#usize + plan_branching := 1#usize + evidence := 1#usize + evidence_bytes := 1#usize + bindings := 1#usize + principal_status := 1#usize + grant_status := 1#usize + attachments := 1#usize + attachment_bytes := 1#usize + signatures := 1#usize + signature_bytes := 1#usize + permissions := 1#usize + audiences := 1#usize + extensions := 1#usize + extension_bytes := 1#usize + body_digests := 1#usize + binding_evidence := 1#usize + canonical_body_bytes := 1#usize + registry_entries := 1#usize + trust_anchors := 1#usize + work_units := 1#u64 + approvals := 1#usize + approver_anchors := 1#usize + approval_requirements := 1#usize +} +def minimalInput : Slice Std.U8 := ⟨[ + 166#u8, 0#u8, 162#u8, 0#u8, 97#u8, 116#u8, 1#u8, 1#u8, + 1#u8, 97#u8, 109#u8, 2#u8, 65#u8, 1#u8, 3#u8, 162#u8, + 0#u8, 97#u8, 114#u8, 1#u8, 97#u8, 114#u8, 4#u8, 246#u8, 5#u8, 128#u8 +], by scalar_tac⟩ +def minimalAction : auths_codec.auths_model.CanonicalAction := { + profile := { id := "t", version := 1#u16 } + media_type := "m" + body := ⟨[1#u8], by scalar_tac⟩ + permission := { capability := "r", resource := "r" } + requested_budget := none + detached_attachments := alloc.vec.Vec.new _ +} + + +@[cbv_eval] theorem minimal_limits_valid : + auths_model.VerifierLimits.validate minimalLimits = ok (.Ok ()) := by + cbv + +@[cbv_eval] theorem minimal_encoding_exact : + encode.encode_canonical_action minimalAction = + ok (.Ok (⟨minimalInput.val, by scalar_tac⟩ : alloc.vec.Vec Std.U8)) := by + cbv + +/-- The whole shipping decoder accepts a nonempty, bounded action. -/ +theorem minimal_action_accepted : + decode.decode_canonical_action minimalInput minimalLimits = ok (.Ok minimalAction) := by + cbv + +def duplicateKeyInput : Slice Std.U8 := ⟨[ + 166#u8, 0#u8, 162#u8, 0#u8, 97#u8, 116#u8, 0#u8, 1#u8, + 1#u8, 97#u8, 109#u8, 2#u8, 65#u8, 1#u8, 3#u8, 162#u8, + 0#u8, 97#u8, 114#u8, 1#u8, 97#u8, 114#u8, 4#u8, 246#u8, + 5#u8, 128#u8 +], by scalar_tac⟩ + +theorem duplicate_key_refused : + decode.decode_canonical_action duplicateKeyInput minimalLimits = ok (.Err error.CodecError.NonCanonical) := by + cbv + +def nonminimalIntegerInput : Slice Std.U8 := ⟨[ + 166#u8, 0#u8, 162#u8, 0#u8, 97#u8, 116#u8, 1#u8, 24#u8, + 1#u8, 1#u8, 97#u8, 109#u8, 2#u8, 65#u8, 1#u8, 3#u8, + 162#u8, 0#u8, 97#u8, 114#u8, 1#u8, 97#u8, 114#u8, 4#u8, + 246#u8, 5#u8, 128#u8 +], by scalar_tac⟩ + +theorem nonminimal_integer_refused : + decode.decode_canonical_action nonminimalIntegerInput minimalLimits = ok (.Err error.CodecError.NonCanonical) := by + cbv + +def invalidUtf8Input : Slice Std.U8 := ⟨[ + 166#u8, 0#u8, 162#u8, 0#u8, 97#u8, 255#u8, 1#u8, 1#u8, + 1#u8, 97#u8, 109#u8, 2#u8, 65#u8, 1#u8, 3#u8, 162#u8, + 0#u8, 97#u8, 114#u8, 1#u8, 97#u8, 114#u8, 4#u8, 246#u8, + 5#u8, 128#u8 +], by scalar_tac⟩ + +theorem invalid_utf8_refused : + decode.decode_canonical_action invalidUtf8Input minimalLimits = ok (.Err error.CodecError.Malformed) := by + cbv + +def truncatedInput : Slice Std.U8 := ⟨[ + 166#u8, 0#u8, 162#u8, 0#u8, 97#u8, 116#u8, 1#u8, 1#u8, + 1#u8, 97#u8, 109#u8, 2#u8, 65#u8, 1#u8, 3#u8, 162#u8, + 0#u8, 97#u8, 114#u8, 1#u8, 97#u8, 114#u8, 4#u8, 246#u8, + 5#u8 +], by scalar_tac⟩ + +theorem truncated_refused : + decode.decode_canonical_action truncatedInput minimalLimits = ok (.Err error.CodecError.Malformed) := by + cbv + +def trailingByteInput : Slice Std.U8 := ⟨[ + 166#u8, 0#u8, 162#u8, 0#u8, 97#u8, 116#u8, 1#u8, 1#u8, + 1#u8, 97#u8, 109#u8, 2#u8, 65#u8, 1#u8, 3#u8, 162#u8, + 0#u8, 97#u8, 114#u8, 1#u8, 97#u8, 114#u8, 4#u8, 246#u8, + 5#u8, 128#u8, 0#u8 +], by scalar_tac⟩ + +theorem trailing_byte_refused : + decode.decode_canonical_action trailingByteInput minimalLimits = ok (.Err error.CodecError.Malformed) := by + cbv + +theorem action_byte_limit_refused : + decode.decode_canonical_action minimalInput { minimalLimits with action_bytes := 25#usize } = + ok (.Err error.CodecError.LimitExceeded) := by + cbv + +/-- The accepted input is exactly at the configured action-byte boundary. -/ +theorem action_byte_limit_exact : + decode.decode_canonical_action minimalInput { minimalLimits with action_bytes := 26#usize } = + ok (.Ok minimalAction) := by + cbv + +end Auths.Codec.Examples diff --git a/formal/Auths/Codec/Fields.lean b/formal/Auths/Codec/Fields.lean new file mode 100644 index 000000000..11f89fb7b --- /dev/null +++ b/formal/Auths/Codec/Fields.lean @@ -0,0 +1,286 @@ +import Auths.Codec.Payload +import Auths.Codec.Collection +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec +namespace Auths.Codec.Fields +open Cursor Payload Collection + +def keyAt (input : List Nat) (position expected : Nat) : + core.result.Result Unit error.CodecError × Nat := + let (value, next) := narrowHead input position 255 + let verdict := match value with + | none => .Err error.CodecError.Malformed + | some value => if value = expected then .Ok () else .Err error.CodecError.NonCanonical + (verdict, next) + +@[step] theorem key_exact (self : cbor.Decoder) (expected : Std.U8) : + decode.key self expected ⦃ actual => + (actual.1, actual.2.position.val) = keyAt (Refinement.byteList self.input.val) self.position.val expected.val ∧ + actual.2.input = self.input ⦄ := by + unfold decode.key + step with Cursor.u8_exact as ⟨value, next, meaning, inputSame⟩ + cases value with + | Err error => + simp [core.result.Result.map_err, BuiltinFnOnce, decode.decode_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, keyAt, ← meaning, Cursor.wordView, inputSame] + | Ok value => + simp only [core.result.Result.map_err, bind_tc_ok, core.result.Result.Insts.CoreOpsTry.branch] + by_cases equal : value = expected + · have sameValue := congrArg UScalar.val equal + simp [equal, sameValue, keyAt, ← meaning, Cursor.wordView, inputSame] + · have different : value.val ≠ expected.val := by + intro same + exact equal ((UScalar.eq_equiv _ _).mpr same) + simp [equal, different, keyAt, ← meaning, Cursor.wordView, inputSame] + +def mapAt (input : List Nat) (position expected : Nat) : + core.result.Result Unit error.CodecError × Nat := + let (length, next) := collectionAt input position 5 + let verdict := match length with + | some (some length) => if length = expected then .Ok () else .Err error.CodecError.Malformed + | _ => .Err error.CodecError.Malformed + (verdict, next) + +@[step] theorem map_exact (self : cbor.Decoder) (expected : Std.U64) : + decode.map self expected ⦃ actual => + (actual.1, actual.2.position.val) = mapAt (Refinement.byteList self.input.val) self.position.val expected.val ∧ + actual.2.input = self.input ⦄ := by + unfold decode.map + step with Collection.map_exact as ⟨value, next, meaning, inputSame⟩ + cases value with + | Err error => + simp [core.result.Result.unwrap_or, core.option.Option.Insts.CoreCmpPartialEqOption.eq, + _root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq, + mapAt, ← meaning, collectionView, inputSame] + | Ok value => + cases value with + | none => + simp [core.result.Result.unwrap_or, core.option.Option.Insts.CoreCmpPartialEqOption.eq, + _root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq, + mapAt, ← meaning, collectionView, inputSame] + | some value => + by_cases equal : value.val = expected.val <;> + simp [equal, core.result.Result.unwrap_or, core.option.Option.Insts.CoreCmpPartialEqOption.eq, + _root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq, core.cmp.PartialEqU64, + core.cmp.impls.PartialEqU64.eq, UScalar.eq_equiv, + mapAt, ← meaning, collectionView, inputSame] + +def codecBytesView (value : core.result.Result Str error.CodecError) : core.result.Result (List Nat) error.CodecError := + match value with + | .Err error => .Err error + | .Ok bytes => .Ok (Refinement.byteList bytes.val) + +def textAt (input : List Nat) (position : Nat) : core.result.Result (List Nat) error.CodecError × Nat := + let (bytes, next) := Payload.textAt input position + (match bytes with | some bytes => .Ok bytes | none => .Err error.CodecError.Malformed, next) + +@[step] theorem text_exact (self : cbor.Decoder) : + decode.text self ⦃ actual => + (codecBytesView actual.1, actual.2.position.val) = textAt (Refinement.byteList self.input.val) self.position.val ∧ + actual.2.input = self.input ⦄ := by + unfold decode.text + step with Payload.str_exact as ⟨value, next, meaning, inputSame⟩ + cases value <;> simp [textAt, ← meaning, Payload.bytesView, codecBytesView, inputSame] + +def nullAt (input : List Nat) (position : Nat) : core.result.Result Unit error.CodecError × Nat := + let (valid, next) := Cursor.nullAt input position + (if valid then .Ok () else .Err error.CodecError.Malformed, next) + +@[step] theorem null_exact (self : cbor.Decoder) : + decode.null self ⦃ actual => + (actual.1, actual.2.position.val) = nullAt (Refinement.byteList self.input.val) self.position.val ∧ + actual.2.input = self.input ⦄ := by + unfold decode.null + step with Cursor.null_exact as ⟨value, next, meaning, inputSame⟩ + cases value <;> + simp [core.result.Result.map_err, BuiltinFnOnce, decode.decode_error, + nullAt, ← meaning, Cursor.unitView, inputSame] + +def isNullAt (input : List Nat) (position : Nat) : core.result.Result Bool error.CodecError := + match Cursor.typeAt input position with + | .Err _ => .Err error.CodecError.Malformed + | .Ok .Null => .Ok true + | .Ok _ => .Ok false + +@[step] theorem is_null_exact (self : cbor.Decoder) : + decode.is_null self ⦃ actual => actual = isNullAt (Refinement.byteList self.input.val) self.position.val ⦄ := by + unfold decode.is_null + step with Cursor.datatype_exact as ⟨value, meaning⟩ + cases value with + | Err error => + simp [core.result.Result.map_err, BuiltinFnOnce, decode.decode_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, isNullAt, ← meaning] + | Ok kind => + cases kind <;> + simp [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, + cbor.Type.Insts.CoreCmpPartialEqType.eq, cbor.Type.read_discriminant, isNullAt, ← meaning] + + +def sizeView (value : core.result.Result Std.Usize error.CodecError) : core.result.Result Nat error.CodecError := + match value with + | .Err error => .Err error + | .Ok value => .Ok value.val + +def arrayAt (input : List Nat) (position maximum : Nat) : core.result.Result Nat error.CodecError × Nat := + let (length, next) := collectionAt input position 4 + let verdict := match length with + | some (some length) => if length ≤ maximum then .Ok length else .Err error.CodecError.LimitExceeded + | _ => .Err error.CodecError.Malformed + (verdict, next) + +private theorem size_cast (value : Std.U64) : + Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from value ⦃ actual => + match actual with + | .Ok size => size.val = value.val + | .Err _ => Usize.max < value.val ⦄ := by + unfold Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from core.num.tryFromUScalar + split <;> rename_i bound + · have inside : value.val < 2 ^ UScalarTy.Usize.numBits := by + simp only [UScalar.max] at bound + have positive : 0 < 2 ^ UScalarTy.Usize.numBits := by positivity + omega + simpa only [spec_ok] using UScalar.cast_val_mod_pow_of_inBounds_eq .Usize value inside + · simpa only [spec_ok, UScalar.max_USize_eq] using Nat.lt_of_not_ge bound + +@[step] theorem array_exact (self : cbor.Decoder) (maximum : Std.Usize) : + decode.array self maximum ⦃ actual => + (sizeView actual.1, actual.2.position.val) = arrayAt (Refinement.byteList self.input.val) self.position.val maximum.val ∧ + actual.2.input = self.input ⦄ := by + unfold decode.array + step with Collection.array_exact as ⟨value, next, meaning, inputSame⟩ + cases value with + | Err error => + simp [core.result.Result.map_err, BuiltinFnOnce, decode.decode_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, arrayAt, ← meaning, collectionView, sizeView, inputSame] + | Ok value => + simp only [core.result.Result.map_err, bind_tc_ok, core.result.Result.Insts.CoreOpsTry.branch] + cases value with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, arrayAt, ← meaning, collectionView, sizeView, inputSame] + | some argument => + simp only [core.option.Option.ok_or, bind_tc_ok, core.result.Result.Insts.CoreOpsTry.branch] + step with size_cast as ⟨converted, castMeaning⟩ + cases converted with + | Err error => + have tooLarge : ¬ argument.val ≤ maximum.val := by scalar_tac + simp [core.result.Result.map_err, BuiltinFnOnce, auths_codec.error.limit_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, arrayAt, ← meaning, collectionView, sizeView, tooLarge, inputSame] + | Ok length => + simp only at castMeaning + by_cases within : argument.val ≤ maximum.val + · have notGreater : ¬ maximum.val < argument.val := by omega + simp [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, + UScalar.lt_equiv, castMeaning, within, notGreater, + arrayAt, ← meaning, collectionView, sizeView, inputSame] + · have greater : maximum.val < argument.val := by omega + simp [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, + UScalar.lt_equiv, castMeaning, within, greater, + arrayAt, ← meaning, collectionView, sizeView, inputSame] + + +def vecView (value : core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) : + core.result.Result (List Nat) error.CodecError := + match value with + | .Err error => .Err error + | .Ok value => .Ok (Refinement.byteList value.val) + +def boundedBytesAt (input : List Nat) (position maximum : Nat) (nonempty : Bool) : + core.result.Result (List Nat) error.CodecError × Nat := + let (bytes, next) := payloadAt input position 2 + let verdict := match bytes with + | none => .Err error.CodecError.Malformed + | some bytes => + if maximum < bytes.length ∨ (nonempty = true ∧ bytes = []) then + .Err error.CodecError.LimitExceeded else .Ok bytes + (verdict, next) + +private theorem copy_bytes (bytes : Slice Std.U8) : + alloc.slice.Slice.to_vec core.clone.CloneU8 bytes ⦃ actual => actual.val = bytes.val ⦄ := by + apply spec_mono (alloc.slice.Slice.to_vec_spec core.clone.CloneU8 bytes (by intros; rfl)) + intro copied equal + simpa only [← equal] + +@[step] theorem bounded_bytes_exact (self : cbor.Decoder) (maximum : Std.Usize) (nonempty : Bool) : + decode.bounded_bytes self maximum nonempty ⦃ actual => + (vecView actual.1, actual.2.position.val) = + boundedBytesAt (Refinement.byteList self.input.val) self.position.val maximum.val nonempty ∧ + actual.2.input = self.input ⦄ := by + unfold decode.bounded_bytes + step with Payload.bytes_exact as ⟨value, next, meaning, inputSame⟩ + cases value with + | Err error => simp [boundedBytesAt, ← meaning, Payload.bytesView, vecView, inputSame] + | Ok bytes => + have bytesLength : (Refinement.byteList bytes.val).length = bytes.val.length := by simp [Refinement.byteList] + have bytesEmpty : Refinement.byteList bytes.val = [] ↔ bytes.val = [] := by simp [Refinement.byteList] + by_cases over : maximum.val < bytes.val.length + · simp [UScalar.lt_equiv, Slice.length, over, boundedBytesAt, ← meaning, + Payload.bytesView, vecView, bytesLength, inputSame] + · simp only [UScalar.lt_equiv, Slice.len_val, over, ↓reduceIte] + by_cases required : nonempty = true + · simp only [required, Bool.false_eq_true, ↓reduceIte] + step with core.slice.Slice.is_empty_spec as ⟨empty, emptyMeaning⟩ + by_cases noBytes : bytes.val = [] + · have isEmpty : empty = true := by simpa [noBytes, Slice.length] using emptyMeaning + simp [isEmpty, boundedBytesAt, ← meaning, Payload.bytesView, vecView, bytesLength, + over, bytesEmpty, noBytes, inputSame, required] <;> simp [Refinement.byteList] + · have notEmpty : empty = false := by simpa [Slice.length, List.length_eq_zero_iff, noBytes] using emptyMeaning + simp only [notEmpty, Bool.false_eq_true, ↓reduceIte] + step with copy_bytes as ⟨copied, copyMeaning⟩ + simp [boundedBytesAt, ← meaning, Payload.bytesView, vecView, bytesLength, + over, bytesEmpty, noBytes, copyMeaning, inputSame, required] + · simp only [required, Bool.false_eq_true, ↓reduceIte] + step with copy_bytes as ⟨copied, copyMeaning⟩ + simp [boundedBytesAt, ← meaning, Payload.bytesView, vecView, bytesLength, + over, copyMeaning, inputSame, required] + + +def digestView (value : core.result.Result (Array Std.U8 32#usize) error.CodecError) : + core.result.Result (List Nat) error.CodecError := + match value with + | .Err error => .Err error + | .Ok value => .Ok (Refinement.byteList value.val) + +def digestAt (input : List Nat) (position : Nat) : core.result.Result (List Nat) error.CodecError × Nat := + let (bytes, next) := payloadAt input position 2 + let verdict := match bytes with + | none => .Err error.CodecError.Malformed + | some bytes => if bytes.length = 32 then .Ok bytes else .Err error.CodecError.Malformed + (verdict, next) + +@[step] theorem digest_bytes_exact (self : cbor.Decoder) : + decode.digest_bytes self ⦃ actual => + (digestView actual.1, actual.2.position.val) = + digestAt (Refinement.byteList self.input.val) self.position.val ∧ + actual.2.input = self.input ⦄ := by + unfold decode.digest_bytes + step with Payload.bytes_exact as ⟨value, next, meaning, inputSame⟩ + cases value with + | Err error => simp [digestAt, ← meaning, Payload.bytesView, digestView, inputSame] + | Ok bytes => + have bytesLength : (Refinement.byteList bytes.val).length = bytes.val.length := by simp [Refinement.byteList] + step with core.array.TryFromArrayCopySlice.try_from.step as ⟨copied, copyMeaning⟩ + cases copied with + | Err error => + have wrongLength : bytes.val.length ≠ 32 := by + simpa only [Slice.length] using copyMeaning + simp [core.result.Result.map_err, BuiltinFnOnce, decode.decode_error, + digestAt, ← meaning, Payload.bytesView, digestView, bytesLength, wrongLength, inputSame] + | Ok digest => + have lengthEq : bytes.val.length = 32 := by + rw [← copyMeaning.1] + simpa using digest.property + simp [core.result.Result.map_err, digestAt, ← meaning, Payload.bytesView, + digestView, bytesLength, lengthEq, copyMeaning.1, inputSame] + +end Auths.Codec.Fields diff --git a/formal/Auths/Codec/Payload.lean b/formal/Auths/Codec/Payload.lean new file mode 100644 index 000000000..dbabd0372 --- /dev/null +++ b/formal/Auths/Codec/Payload.lean @@ -0,0 +1,207 @@ +import Auths.Codec.Cursor +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec +namespace Auths.Codec.Payload +open Cursor + +def payloadAt (input : List Nat) (position major : Nat) : Option (List Nat) × Nat := + let (length, next) := typedHead input position major + match length with + | none => (none, next) + | some length => + if next + length ≤ input.length then + (some ((input.drop next).take length), next + length) + else (none, next) + +def bytesView (value : core.result.Result (Slice Std.U8) cbor.Error) : Option (List Nat) := + match value with + | .Err _ => none + | .Ok value => some (Refinement.byteList value.val) + +private theorem size_cast (value : Std.U64) : + Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from value ⦃ actual => + match actual with + | .Ok size => size.val = value.val + | .Err _ => Usize.max < value.val ⦄ := by + unfold Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from core.num.tryFromUScalar + split <;> rename_i bound + · have inside : value.val < 2 ^ UScalarTy.Usize.numBits := by + simp only [UScalar.max] at bound + have positive : 0 < 2 ^ UScalarTy.Usize.numBits := by positivity + omega + simpa only [spec_ok] using UScalar.cast_val_mod_pow_of_inBounds_eq .Usize value inside + · simpa only [spec_ok, UScalar.max_USize_eq] using Nat.lt_of_not_ge bound + +private theorem malformed_map {T : Type} (value : core.result.Result T cbor.Error) : + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError cbor.Error) + value cbor.malformed = ok value := by + cases value <;> simp [core.result.Result.map_err, BuiltinFnOnce, cbor.malformed] + +private theorem range_get (input : Slice Std.U8) (start finish : Std.Usize) : + core.slice.Slice.get (core.slice.index.SliceIndexRangeUsizeSlice Std.U8) input + ⟨start, finish⟩ ⦃ actual => + (actual.map fun bytes => Refinement.byteList bytes.val) = + if start.val ≤ finish.val ∧ finish.val ≤ input.val.length then + some ((Refinement.byteList input.val).drop start.val |>.take (finish.val - start.val)) + else none ⦄ := by + simp only [core.slice.Slice.get, core.slice.index.SliceIndexRangeUsizeSlice, + core.slice.index.SliceIndexRangeUsizeSlice.get] + split <;> rename_i bounds + · simp only [UScalar.le_equiv, Slice.length] at bounds + simp [bounds, spec_ok, Refinement.byteList, List.slice] + · have absent : ¬ (start.val ≤ finish.val ∧ finish.val ≤ input.val.length) := by + simpa only [UScalar.le_equiv, Slice.length] using bounds + simp [absent, spec_ok] + +@[step] theorem payload_exact (self : cbor.Decoder) (major : Std.U8) : + cbor.Decoder.payload self major ⦃ actual => + (bytesView actual.1, actual.2.position.val) = + payloadAt (Refinement.byteList self.input.val) self.position.val major.val ∧ + actual.2.input = self.input ⦄ := by + have inputLength : (Refinement.byteList self.input.val).length = self.input.val.length := by + simp [Refinement.byteList] + unfold cbor.Decoder.payload + step with Cursor.head_exact as ⟨head, next, headMeaning, inputSame⟩ + cases head with + | Err error => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, payloadAt, ← headMeaning, wordView, bytesView, inputSame] + | Ok argument => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step with size_cast as ⟨converted, castMeaning⟩ + simp only [malformed_map, bind_tc_ok] + cases converted with + | Err error => + have tooLong : ¬ next.position.val + argument.val ≤ self.input.val.length := by + have bounded := self.input.property + omega + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, payloadAt, ← headMeaning, wordView, bytesView, inputSame, tooLong, inputLength] + | Ok length => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + have checked := Usize.checked_add_bv_spec next.position length + cases sum : Usize.checked_add next.position length with + | none => + simp only [sum] at checked + have tooLong : ¬ next.position.val + argument.val ≤ self.input.val.length := by + have bounded := self.input.property + simp only at castMeaning + omega + simp [sum, lift, core.option.Option.ok_or, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, payloadAt, ← headMeaning, wordView, bytesView, inputSame, tooLong, inputLength] + | some finish => + simp only [sum] at checked + have finishMeaning : finish.val = next.position.val + argument.val := by + simp only at castMeaning + omega + simp only [sum, lift, bind_tc_ok, core.option.Option.ok_or, + core.result.Result.Insts.CoreOpsTry.branch] + step with range_get as ⟨bytes, rangeMeaning⟩ + have ordered : next.position.val ≤ finish.val := by omega + cases bytes with + | none => + have tooLong : ¬ next.position.val + argument.val ≤ self.input.val.length := by + by_contra within + simp [ordered, finishMeaning, inputSame, within] at rangeMeaning + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, payloadAt, ← headMeaning, wordView, bytesView, inputSame, tooLong, inputLength] + | some bytes => + have within : next.position.val + argument.val ≤ self.input.val.length := by + by_contra outside + simp [finishMeaning, inputSame, outside] at rangeMeaning + have exactBytes : Refinement.byteList bytes.val = + ((Refinement.byteList self.input.val).drop next.position.val).take argument.val := by + simpa [ordered, finishMeaning, inputSame, within] using rangeMeaning + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + payloadAt, ← headMeaning, wordView, bytesView, inputSame, within, finishMeaning, exactBytes, inputLength] + +@[step] theorem bytes_exact (self : cbor.Decoder) : + cbor.Decoder.bytes self ⦃ actual => + (bytesView actual.1, actual.2.position.val) = + payloadAt (Refinement.byteList self.input.val) self.position.val 2 ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.bytes + simpa using payload_exact self 2#u8 + +/-- UTF-8 validity is the existing explicit standard-library leaf contract. +The Auths payload/cursor/branching algorithm is translated and proved here. -/ +def validUtf8 (bytes : List Nat) : Bool := + decide ((bytes.map UInt8.ofNat).toByteArray.IsValidUTF8) + +def textAt (input : List Nat) (position : Nat) : Option (List Nat) × Nat := + let (bytes, next) := payloadAt input position 3 + (bytes.filter validUtf8, next) + +@[step] theorem str_exact (self : cbor.Decoder) : + cbor.Decoder.str self ⦃ actual => + (bytesView actual.1, actual.2.position.val) = + textAt (Refinement.byteList self.input.val) self.position.val ∧ + actual.2.input = self.input ⦄ := by + unfold cbor.Decoder.str + step with payload_exact as ⟨payload, next, meaning, inputSame⟩ + cases payload with + | Err error => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, textAt, ← meaning, bytesView, inputSame] + | Ok bytes => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok, + core.str.converts.from_utf8] + have utf8Meaning : validUtf8 (Refinement.byteList bytes.val) = + decide ((Auths.Codec.StdModel.bytes bytes).IsValidUTF8) := by + simp [validUtf8, Refinement.byteList, Auths.Codec.StdModel.bytes, List.map_map, Function.comp_def] + by_cases valid : (Auths.Codec.StdModel.bytes bytes).IsValidUTF8 + all_goals simp [textAt, ← meaning, bytesView, Option.filter, utf8Meaning, valid, inputSame] + +/-- Accepted payloads identify the exact contiguous span and its bounds. -/ +private theorem accepted_span (input : List Nat) (position major : Nat) + (bytes : List Nat) (finish : Nat) + (accepted : payloadAt input position major = (some bytes, finish)) : + ∃ start length, typedHead input position major = (some length, start) ∧ + bytes = (input.drop start).take length ∧ finish = start + length ∧ + finish ≤ input.length ∧ bytes.length = length := by + cases headEq : typedHead input position major with + | mk length start => + cases length with + | none => simp [payloadAt, headEq] at accepted + | some length => + by_cases within : start + length ≤ input.length + · simp only [payloadAt, headEq, within, ↓reduceIte, Prod.mk.injEq, Option.some.injEq] at accepted + have bytesEq : bytes = (input.drop start).take length := accepted.1.symm + have finishEq : finish = start + length := accepted.2.symm + refine ⟨start, length, rfl, bytesEq, finishEq, ?_, ?_⟩ + · omega + · simp only [bytesEq, List.length_take, List.length_drop] + omega + · simp [payloadAt, headEq, within] at accepted + +@[step] theorem success_earns_span (self : cbor.Decoder) (major : Std.U8) : + cbor.Decoder.payload self major ⦃ actual => + actual.2.input = self.input ∧ + ∀ bytes, actual.1 = .Ok bytes → + ∃ start length, + typedHead (Refinement.byteList self.input.val) self.position.val major.val = (some length, start) ∧ + Refinement.byteList bytes.val = ((Refinement.byteList self.input.val).drop start).take length ∧ + actual.2.position.val = start + length ∧ + actual.2.position.val ≤ self.input.val.length ∧ bytes.val.length = length ⦄ := by + apply spec_mono (payload_exact self major) + rintro ⟨result, next⟩ ⟨meaning, preserved⟩ + refine ⟨preserved, ?_⟩ + intro bytes equal + change result = .Ok bytes at equal + subst result + have accepted : payloadAt (Refinement.byteList self.input.val) self.position.val major.val = + (some (Refinement.byteList bytes.val), next.position.val) := meaning.symm + obtain ⟨start, length, headEq, bytesEq, finishEq, within, sizeEq⟩ := + accepted_span _ _ _ _ _ accepted + exact ⟨start, length, headEq, bytesEq, finishEq, + by simpa [Refinement.byteList] using within, + by simpa [Refinement.byteList] using sizeEq⟩ + +end Auths.Codec.Payload diff --git a/formal/Auths/Codec/PrincipalConstructor.lean b/formal/Auths/Codec/PrincipalConstructor.lean new file mode 100644 index 000000000..e2cc9c956 --- /dev/null +++ b/formal/Auths/Codec/PrincipalConstructor.lean @@ -0,0 +1,107 @@ +import Auths.Codec.PrincipalScheme +import Auths.Codec.Constructors +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.PrincipalConstructor +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 +open Auths.Refinement.Identifier + +/-- The two extraction contexts expose the same transparent byte classifier. + This is a definitional bridge, not an assumed parser contract. -/ +private theorem classifier_same (input : Slice Std.U8) (position : Std.Usize) : + AuthsScopeCodec.auths_model.identifier.forbidden_identifier_at input position = + auths_model.identifier.forbidden_identifier_at input position := by + unfold AuthsScopeCodec.auths_model.identifier.forbidden_identifier_at + auths_model.identifier.forbidden_identifier_at + AuthsScopeCodec.auths_model.identifier.forbidden_three_byte_prefix + auths_model.identifier.forbidden_three_byte_prefix + rfl + +private theorem scan_suffix (remaining : List Std.U8) (input : Slice Std.U8) (position : Std.Usize) + (suffix : input.val.drop position.val = remaining) : + AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier_loop input position ⦃ actual => + actual = containsExcluded remaining ⦄ := by + induction remaining generalizing position with + | nil => + have finished : ¬ position < input.len := by + have size := congrArg List.length suffix + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + rw [AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier_loop.eq_def] + simp [finished, containsExcluded] + | cons head rest ih => + obtain ⟨guard, _⟩ := Auths.StatusSelection.indexed_head input position head rest suffix + obtain ⟨next, addition, nextValue, nextSuffix⟩ := Auths.StatusSelection.indexed_next input position head rest suffix + obtain ⟨excluded, checks, meaning⟩ := spec_imp_exists (forbidden_at_exact input position) + rw [AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier_loop.eq_def] + simp only [guard, ↓reduceIte, classifier_same, checks, bind_tc_ok] + have exactPrefix : excluded = excludedPrefix (head :: rest) := by simpa only [suffix] using meaning + cases found : excluded + · simp only [Bool.false_eq_true, ↓reduceIte, addition, bind_tc_ok] + simpa only [containsExcluded, ← exactPrefix, found, Bool.false_or] using ih next nextSuffix + · simp [containsExcluded, ← exactPrefix, found] + +/-- Complete result of the actual shared identifier scanner in the principal + extraction context, including empty, oversized and forbidden-byte cases. -/ +theorem bounded_identifier_exact (value : Str) (maximum : Std.Usize) : + AuthsScopeCodec.auths_model.identifier.bounded_identifier_valid value maximum ⦃ actual => + actual = (!value.val.isEmpty && decide (value.val.length ≤ maximum.val) && + !containsExcluded value.val) ⦄ := by + unfold AuthsScopeCodec.auths_model.identifier.bounded_identifier_valid + simp only [AuthsScopeCodec.core.str.Str.is_empty, AuthsScopeCodec.core.str.Str.len, + AuthsScopeCodec.core.str.Str.as_bytes, _root_.core.str.Str.is_empty, + _root_.core.str.Str.len, _root_.core.str.Str.as_bytes, bind_tc_ok] + by_cases empty : value.val.isEmpty = true + all_goals simp only [empty, Bool.false_eq_true, ↓reduceIte] + · simp + · by_cases fits : value.len ≤ maximum + all_goals simp only [fits, ↓reduceIte] + · unfold AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier + apply spec_bind (scan_suffix value.val value 0#usize (by simp)) + intro result meaning + simp [meaning, show value.val.length ≤ maximum.val by scalar_tac] + · simp [show ¬value.val.length ≤ maximum.val by scalar_tac] + +/-- The readable constructor policy combines UTF-8 length/scalar restrictions + with the independent principal-scheme grammar. -/ +def valid (value : String) : Bool := + Auths.Codec.Constructors.identifierDecision value 512 && + Auths.PrincipalScheme.Model.evaluate (value.toByteArray.toList.map UInt8.toNat) + +private theorem identifier_string (value : String) (maximum : Std.Usize) + (bounded : value.toByteArray.size ≤ U32.max) : + AuthsScopeCodec.auths_model.identifier.bounded_identifier_valid (toStr value bounded) maximum = + ok (Auths.Codec.Constructors.identifierDecision value maximum.val) := by + obtain ⟨result, evaluates, meaning⟩ := spec_imp_exists (bounded_identifier_exact (toStr value bounded) maximum) + have root := Auths.Refinement.Identifier.identifier_exact (toStr value bounded) maximum + have copied : auths_model.identifier.bounded_identifier_valid (toStr value bounded) maximum = + ok (Auths.Codec.Constructors.identifierDecision value maximum.val) := + Auths.Codec.Constructors.identifier_exact value maximum bounded + rw [copied, spec_ok] at root + rw [meaning, ← root] at evaluates + exact evaluates + +/-- Full accepted value and exact typed refusal for the shipping principal + constructor on every actual Rust string carrier. No success premise. -/ +theorem parse_exact (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + AuthsScopeCodec.auths_model.PrincipalId.parse (toStr value bounded) = + ok (if valid value then .Ok value else .Err AuthsScopeCodec.auths_model.ModelError.InvalidPrincipal) := by + unfold AuthsScopeCodec.auths_model.PrincipalId.parse + rw [identifier_string] + simp only [bind_tc_ok, UScalar.ofNatCore_val_eq] + obtain ⟨scheme, schemeEvaluates, schemeMeaning⟩ := spec_imp_exists + (Auths.PrincipalScheme.scheme_refines (toStr value bounded)) + have representation : (toStr value bounded).val.map (·.val) = + value.toByteArray.toList.map UInt8.toNat := by + unfold toStr + simp only [List.map_map] + rfl + rw [representation] at schemeMeaning + rw [schemeMeaning] at schemeEvaluates + split <;> simp_all [valid, bind_tc_ok, + Auths.Codec.StringRefinement.string_copy_exact] + all_goals split <;> rfl + +end Auths.PrincipalConstructor diff --git a/formal/Auths/Codec/PrincipalScheme.lean b/formal/Auths/Codec/PrincipalScheme.lean new file mode 100644 index 000000000..0de98e29e --- /dev/null +++ b/formal/Auths/Codec/PrincipalScheme.lean @@ -0,0 +1,123 @@ +import qualification.aeneas.generated.scope_codec.Funs +import Auths.Codec.PrincipalSchemeModel +import Auths.Verifier.StatusLeaves +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.PrincipalScheme +set_option maxHeartbeats 2000000 +local instance (byte : Nat) : Decidable (Model.lower byte) := inferInstanceAs (Decidable (_ ∧ _)) +local instance (byte : Nat) : Decidable (Model.allowed byte) := inferInstanceAs (Decidable (_ ∨ _)) + +theorem byte_allowed (byte : Std.U8) : + AuthsScopeCodec.auths_model.identifier.principal_scheme_byte_valid byte = ok (decide (Model.allowed byte.val)) := by + unfold AuthsScopeCodec.auths_model.identifier.principal_scheme_byte_valid + simp only [UScalar.le_equiv, UScalar.eq_equiv, UScalar.ofNatCore_val_eq] + split_ifs <;> simp_all [Model.allowed, Model.lower] + all_goals + apply Bool.eq_iff_iff.mpr + simp only [decide_eq_true_eq] + simp_all only [Bool.or_eq_true, Bool.and_eq_true, decide_eq_true_eq] + omega + +def finish (bytes : Slice Std.U8) (state : Std.Usize × Bool × Bool) : Bool := + state.2.1 && state.2.2 && decide (state.1.val < bytes.val.length) + +theorem stopped_invalid (bytes : Slice Std.U8) (position : Std.Usize) (found : Bool) : + AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop bytes position false found = ok (position, false, found) := by + rw [AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop.eq_def] + by_cases guard : position < bytes.len <;> simp [guard] + +theorem stopped_found (bytes : Slice Std.U8) (position : Std.Usize) : + AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop bytes position true true = ok (position, true, true) := by + rw [AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop.eq_def] + by_cases guard : position < bytes.len <;> simp [guard] + +theorem loop_tail (remaining : List Std.U8) (bytes : Slice Std.U8) (position : Std.Usize) + (suffix : bytes.val.drop position.val = remaining) : + AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop bytes position true false ⦃ actual => + finish bytes actual = Model.tailValid (remaining.map (·.val)) ⦄ := by + induction remaining generalizing position with + | nil => + have finished : ¬ position < bytes.len := by + have size := congrArg List.length suffix + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + rw [AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop.eq_def] + simp [finished, finish, Model.tailValid] + | cons head rest ih => + obtain ⟨guard, atHead⟩ := Auths.StatusSelection.indexed_head bytes position head rest suffix + obtain ⟨next, step, nextValue, nextSuffix⟩ := Auths.StatusSelection.indexed_next bytes position head rest suffix + have indexed : Slice.index_usize bytes position = ok head := atHead + rw [AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop.eq_def] + simp only [guard, ↓reduceIte, Bool.false_eq_true, indexed, bind_tc_ok] + by_cases colon : head.val = 58 + · have nativeColon : head = 58#u8 := by scalar_tac + simp only [nativeColon, ↓reduceIte, bind_tc_ok, step] + change AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop bytes next true true ⦃ actual => finish bytes actual = Model.tailValid (58 :: rest.map (·.val)) ⦄ + rw [stopped_found] + simp only [spec_ok] + have remainingSize := congrArg List.length nextSuffix + simp only [List.length_drop] at remainingSize + have inBounds : position.val < bytes.val.length := by + simpa only [UScalar.lt_equiv, Slice.len_val, Slice.length] using guard + have afterBound : next.val ≤ bytes.val.length := by omega + simp only [finish, Bool.true_and, Model.tailValid] + by_cases empty : rest = [] + · simp only [empty, List.map_nil, List.isEmpty_nil, Bool.not_true] + simp only [empty, List.length_nil] at remainingSize + have atEnd : ¬next.val < bytes.val.length := by omega + simp [atEnd] + · have positive : 0 < rest.length := List.length_pos_iff.mpr empty + have notEmpty : (rest.map (·.val)).isEmpty = false := by simpa using empty + have beforeEnd : next.val < bytes.val.length := by omega + simp [notEmpty, beforeEnd] + · have nativeColon : head ≠ 58#u8 := by scalar_tac + simp only [nativeColon, ↓reduceIte, byte_allowed, bind_tc_ok, step] + by_cases allowed : Model.allowed head.val + · simp only [allowed, decide_true] + change AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop bytes next true false ⦃ actual => finish bytes actual = Model.tailValid (head.val :: rest.map (·.val)) ⦄ + simpa only [List.map_cons, Model.tailValid, colon, ↓reduceIte, allowed, decide_true, Bool.true_and] using ih next nextSuffix + · simp only [allowed, decide_false] + change AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop bytes next false false ⦃ actual => finish bytes actual = Model.tailValid (head.val :: rest.map (·.val)) ⦄ + rw [stopped_invalid] + simp [spec_ok, finish, Model.tailValid, colon, allowed] + +theorem scheme_refines (value : Str) : + AuthsScopeCodec.auths_model.identifier.principal_scheme_valid value ⦃ actual => + actual = Model.evaluate (value.val.map (·.val)) ⦄ := by + unfold AuthsScopeCodec.auths_model.identifier.principal_scheme_valid + simp only [AuthsScopeCodec.core.str.Str.as_bytes, _root_.core.str.Str.as_bytes, bind_tc_ok] + by_cases short : value.len < 3#usize + · have small : (value.val.map (·.val)).length < 3 := by + simpa only [List.length_map, UScalar.lt_equiv, Slice.len_val, Slice.length, UScalar.ofNatCore_val_eq] using short + have refused : Model.evaluate (value.val.map (·.val)) = false := by + cases result : Model.evaluate (value.val.map (·.val)) with + | false => rfl + | true => + have minimum := Model.grammar_minimum _ ((Model.evaluate_iff_grammar _).mp result) + omega + simp [short, refused] + · simp only [short, ↓reduceIte] + cases values : value.val with + | nil => + have size : value.len.val = 0 := by simp [values] + have : value.len < 3#usize := by scalar_tac + contradiction + | cons first rest => + have indexed : Slice.index_usize value 0#usize = ok first := by simp [Slice.index_usize, values] + simp only [indexed, bind_tc_ok, UScalar.le_equiv, UScalar.ofNatCore_val_eq] + by_cases low : 97 ≤ first.val + · simp only [low, ↓reduceIte] + by_cases high : first.val ≤ 122 + · simp only [high, ↓reduceIte] + have loop := loop_tail rest value 1#usize (by simp [values]) + apply spec_bind loop + rintro ⟨position, valid, found⟩ meaning + cases valid <;> cases found <;> + simpa [finish, Model.evaluate, Model.lower, values, low, high, + UScalar.lt_equiv, Slice.len_val, Slice.length] using meaning + · simp [high, Model.evaluate, Model.lower] + · simp [low, Model.evaluate, Model.lower] + +end Auths.PrincipalScheme diff --git a/formal/Auths/Codec/PrincipalSchemeModel.lean b/formal/Auths/Codec/PrincipalSchemeModel.lean new file mode 100644 index 000000000..7de8af5c7 --- /dev/null +++ b/formal/Auths/Codec/PrincipalSchemeModel.lean @@ -0,0 +1,75 @@ +import Mathlib.Tactic +namespace Auths.PrincipalScheme.Model + +def lower (byte : Nat) : Prop := 97 ≤ byte ∧ byte ≤ 122 +def allowed (byte : Nat) : Prop := lower byte ∨ (48 ≤ byte ∧ byte ≤ 57) ∨ byte = 43 ∨ byte = 45 ∨ byte = 46 +local instance (byte : Nat) : Decidable (lower byte) := inferInstanceAs (Decidable (_ ∧ _)) +local instance (byte : Nat) : Decidable (allowed byte) := inferInstanceAs (Decidable (_ ∨ _)) + +def tailValid : List Nat → Bool + | [] => false + | byte :: rest => if byte = 58 then !rest.isEmpty else decide (allowed byte) && tailValid rest + +/-- Independent grammar: a possibly empty scheme tail, a colon and a + nonempty remainder. Every scheme-tail byte is permitted ASCII. -/ +def tailGrammar (values : List Nat) : Prop := + ∃ scheme remainder, values = scheme ++ 58 :: remainder ∧ remainder ≠ [] ∧ ∀ byte ∈ scheme, allowed byte + +theorem allowed_not_colon (byte : Nat) (permitted : allowed byte) : byte ≠ 58 := by + simp only [allowed, lower] at permitted + omega + +theorem tail_valid_iff (values : List Nat) : tailValid values = true ↔ tailGrammar values := by + induction values with + | nil => simp [tailValid, tailGrammar] + | cons byte rest ih => + by_cases colon : byte = 58 + · subst byte + have condition : (!rest.isEmpty) = true ↔ rest ≠ [] := by cases rest <;> simp + simp only [tailValid, ↓reduceIte, condition] + constructor + · intro nonempty; exact ⟨[], rest, rfl, nonempty, by simp⟩ + · rintro ⟨scheme, remainder, exactBytes, nonempty, permitted⟩ + cases scheme with + | nil => simpa using (List.cons.inj exactBytes).2.symm ▸ nonempty + | cons first tail => + have same : first = 58 := (List.cons.inj exactBytes).1.symm + exact False.elim ((allowed_not_colon first (permitted first (by simp))) same) + · simp only [tailValid, colon, ↓reduceIte, Bool.and_eq_true, decide_eq_true_eq, ih] + constructor + · rintro ⟨firstAllowed, scheme, remainder, exactBytes, nonempty, permitted⟩ + exact ⟨byte :: scheme, remainder, by simp [exactBytes], nonempty, by simpa using And.intro firstAllowed permitted⟩ + · rintro ⟨scheme, remainder, exactBytes, nonempty, permitted⟩ + cases scheme with + | nil => exact False.elim (colon (List.cons.inj exactBytes).1) + | cons first tail => + obtain ⟨same, suffix⟩ := List.cons.inj exactBytes + subst first + exact ⟨permitted byte (by simp), tail, remainder, suffix, nonempty, + fun item member => permitted item (by simp [member])⟩ + +def evaluate : List Nat → Bool + | [] => false + | first :: rest => decide (lower first) && tailValid rest + +/-- A lowercase ASCII initial letter and the independent scheme-tail grammar. -/ +def grammar (values : List Nat) : Prop := + ∃ first rest, values = first :: rest ∧ lower first ∧ tailGrammar rest + +theorem evaluate_iff_grammar (values : List Nat) : evaluate values = true ↔ grammar values := by + cases values with + | nil => simp [evaluate, grammar] + | cons first rest => simp [evaluate, grammar, tail_valid_iff] + +theorem grammar_minimum (values : List Nat) (valid : grammar values) : 3 ≤ values.length := by + rcases valid with ⟨first, rest, rfl, _, scheme, remainder, rfl, nonempty, _⟩ + have positive : 0 < remainder.length := List.length_pos_iff.mpr nonempty + simp only [List.length_cons, List.length_append] + omega + +theorem ordinary_scheme : evaluate [114, 97, 119, 58, 120] = true := rfl +theorem uppercase_initial_refused : evaluate [65, 58, 120] = false := rfl +theorem empty_remainder_refused : evaluate [97, 58] = false := rfl +theorem separator_in_remainder : evaluate [97, 58, 58] = true := rfl + +end Auths.PrincipalScheme.Model diff --git a/formal/Auths/Codec/Refinement.lean b/formal/Auths/Codec/Refinement.lean new file mode 100644 index 000000000..964ab8adc --- /dev/null +++ b/formal/Auths/Codec/Refinement.lean @@ -0,0 +1,349 @@ +import Auths.Codec.Semantics +import qualification.aeneas.generated.codec.Funs + +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP + +namespace Auths.Codec.Refinement + +open auths_codec + +set_option maxHeartbeats 2000000 + +def byteList (bytes : List Std.U8) : List Nat := bytes.map (·.val) + +def headView (head : cbor.Head) : Auths.Codec.Head := + ⟨head.major.val, head.argument.val⟩ + +@[step] theorem slice_get_exact (input : Slice Std.U8) (position : Std.Usize) : + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) + input position ⦃ result => result = input.val[position.val]? ⦄ := by + simp [core.slice.Slice.get, core.slice.index.Usize.get] + +theorem read_head_absent (input : Slice Std.U8) (position : Std.Usize) + (absent : input.val[position.val]? = none) : + cbor.read_head input position = ok (core.result.Result.Err ()) := by + simp [cbor.read_head, core.slice.Slice.get, core.slice.index.Usize.get, absent] + +@[step] theorem read_head_inline (input : Slice Std.U8) (position : Std.Usize) + (first : Std.U8) (present : input.val[position.val]? = some first) + (inline : first.val % 32 < 24) : + cbor.read_head input position ⦃ result => + ∃ head, result = core.result.Result.Ok head ∧ + head.major.val = first.val / 32 ∧ + head.argument.val = first.val % 32 ∧ + head.next.val = position.val + 1 ⦄ := by + have inBounds : position.val < input.val.length := by + exact List.getElem?_eq_some_iff.mp present |>.1 + have nextFits : position.val + 1 ≤ Usize.max := by + have := input.property + omega + unfold cbor.read_head + simp only [core.slice.Slice.get, core.slice.index.Usize.get, + Slice.getElem?_Usize_eq, present, bind_tc_ok] + step as ⟨additional, additionalEq⟩ + step as ⟨next, nextEq⟩ + have isInline : additional < 24#u8 := by scalar_tac + simp only [isInline, if_true] + simp only [lift, bind_tc_ok] + step as ⟨major, majorEq⟩ + exact ⟨_, rfl, majorEq, by simpa using additionalEq, nextEq⟩ + +@[step] theorem read_tail_safety (input : Slice Std.U8) (position : Std.Usize) + (remaining : Std.U8) (value : Std.U64) + (within : position.val ≤ input.val.length) : + cbor.read_tail input position remaining value ⦃ result => + match result with + | .Err _ => True + | .Ok (_, next) => next.val ≤ input.val.length ∧ + next.val = position.val + remaining.val ⦄ := by + unfold cbor.read_tail cbor.read_tail_loop + apply loop.spec_decr_nat + (measure := fun state => state.2.1.val) + (inv := fun state => state.1.val ≤ input.val.length ∧ + state.1.val + state.2.1.val = position.val + remaining.val) + · rintro ⟨current, left, accumulator⟩ ⟨currentBound, total⟩ + dsimp only at currentBound total + unfold cbor.read_tail_loop.body + dsimp only + split <;> rename_i nonzero + · simp only [core.slice.Slice.get, core.slice.index.Usize.get, + Slice.getElem?_Usize_eq, bind_tc_ok] + split + · simp [spec_ok] + · rename_i byte present + simp only [lift, bind_tc_ok] + split + · simp [spec_ok] + · split + · simp [spec_ok] + · have byteWithin : current.val < input.val.length := + List.getElem?_eq_some_iff.mp present |>.1 + have incrementFits : current.val + 1 ≤ Usize.max := by + have := input.property + omega + step as ⟨next, nextEq⟩ + step as ⟨leftNext, leftNextEq⟩ + exact ⟨by omega, by omega, by scalar_tac⟩ + · simp only [spec_ok] + exact ⟨currentBound, by scalar_tac⟩ + · exact ⟨within, rfl⟩ + +theorem byte_chunk_cons (input : Slice Std.U8) (position width : Nat) + (byte : Std.U8) (present : input.val[position]? = some byte) : + ((byteList input.val).drop position).take (width + 1) = + byte.val :: ((byteList input.val).drop (position + 1)).take width := by + have atByte := List.getElem?_eq_some_iff.mp present + have mappedBound : position < (byteList input.val).length := by + simpa [byteList] using atByte.1 + rw [List.drop_eq_getElem_cons mappedBound] + simp only [List.take_succ_cons, byteList, List.getElem_map, atByte.2] + +/-- Exact source-level left-to-right byte interpretation. The range premise +ensures that every intermediate checked arithmetic operation succeeds. -/ +@[step] theorem read_tail_exact (input : Slice Std.U8) (position : Std.Usize) + (remaining : Std.U8) (value : Std.U64) + (fits : position.val + remaining.val ≤ input.val.length) + (numericFits : accumulate value.val + (((byteList input.val).drop position.val).take remaining.val) ≤ U64.max) : + cbor.read_tail input position remaining value ⦃ result => + ∃ decoded next, result = .Ok (decoded, next) ∧ + decoded.val = accumulate value.val + (((byteList input.val).drop position.val).take remaining.val) ∧ + next.val = position.val + remaining.val ⦄ := by + let expected := accumulate value.val + (((byteList input.val).drop position.val).take remaining.val) + unfold cbor.read_tail cbor.read_tail_loop + apply loop.spec_decr_nat + (measure := fun state => state.2.1.val) + (inv := fun state => + state.1.val + state.2.1.val = position.val + remaining.val ∧ + accumulate state.2.2.val + (((byteList input.val).drop state.1.val).take state.2.1.val) = expected) + · rintro ⟨current, left, accumulator⟩ ⟨total, meaning⟩ + dsimp only at total meaning + unfold cbor.read_tail_loop.body + dsimp only + split <;> rename_i nonzero + · have positive : 0 < left.val := by scalar_tac + have currentWithin : current.val < input.val.length := by omega + have present : input.val[current.val]? = some input.val[current.val] := + List.getElem?_eq_getElem currentWithin + have chunk := byte_chunk_cons input current.val (left.val - 1) _ present + have leftEq : left.val - 1 + 1 = left.val := by omega + rw [leftEq] at chunk + rw [chunk, accumulate] at meaning + have stepBound := accumulate_ge_initial + (accumulator.val * 256 + input.val[current.val].val) + (((byteList input.val).drop (current.val + 1)).take (left.val - 1)) + have nextBound : accumulator.val * 256 + input.val[current.val].val ≤ U64.max := by + dsimp only [expected] at meaning + omega + simp only [core.slice.Slice.get, core.slice.index.Usize.get, + Slice.getElem?_Usize_eq, present, bind_tc_ok, lift] + have multiplied := U64.checked_mul_bv_spec accumulator 256#u64 + cases mulEq : U64.checked_mul accumulator 256#u64 with + | none => + rw [mulEq] at multiplied + simp at multiplied + omega + | some shifted => + rw [mulEq] at multiplied + obtain ⟨_, shiftedEq, _⟩ := multiplied + simp at shiftedEq + dsimp only + have added := U64.checked_add_bv_spec shifted + (core.convert.num.FromU64U8.from input.val[current.val]) + cases addEq : U64.checked_add shifted + (core.convert.num.FromU64U8.from input.val[current.val]) with + | none => + rw [addEq] at added + simp only [core.convert.num.FromU64U8.from_val_eq] at added + omega + | some nextValue => + rw [addEq] at added + obtain ⟨_, nextValueEq, _⟩ := added + simp only [core.convert.num.FromU64U8.from_val_eq] at nextValueEq + dsimp only + have incrementFits : current.val + 1 ≤ Usize.max := by + have := input.property + omega + step as ⟨next, nextEq⟩ + step as ⟨leftNext, leftNextEq⟩ + refine ⟨by omega, ?_, by scalar_tac⟩ + simpa only [nextEq, leftNextEq, nextValueEq, shiftedEq] using meaning + · have atEnd : left.val = 0 := by scalar_tac + simp only [spec_ok] + refine ⟨_, _, rfl, ?_, by omega⟩ + simpa only [atEnd, List.take_zero, accumulate] using meaning + · exact ⟨rfl, rfl⟩ + +theorem byteList_valid (bytes : List Std.U8) : BytesValid (byteList bytes) := by + intro byte member + obtain ⟨source, _, rfl⟩ := List.mem_map.mp member + scalar_tac + +/-- The complete success/error contract of a CBOR argument read. -/ +@[step] theorem read_tail_bounded (input : Slice Std.U8) (position : Std.Usize) + (remaining : Std.U8) (within : position.val ≤ input.val.length) + (width : remaining.val ≤ 8) : + cbor.read_tail input position remaining 0#u64 ⦃ result => + match result with + | .Err _ => input.val.length < position.val + remaining.val + | .Ok (decoded, next) => + position.val + remaining.val ≤ input.val.length ∧ + decoded.val = unsigned + (((byteList input.val).drop position.val).take remaining.val) ∧ + next.val = position.val + remaining.val ⦄ := by + by_cases fits : position.val + remaining.val ≤ input.val.length + · have chunkValid : BytesValid + (((byteList input.val).drop position.val).take remaining.val) := by + intro byte member + exact byteList_valid input.val byte + (List.mem_of_mem_drop (List.mem_of_mem_take member)) + have numericBound := unsigned_lt_power _ chunkValid + have lengthBound : + (((byteList input.val).drop position.val).take remaining.val).length ≤ 8 := by + exact Nat.le_trans (List.length_take_le ..) width + have powerBound := Nat.pow_le_pow_right (by decide : 0 < 256) lengthBound + have numericFits : accumulate (0#u64).val + (((byteList input.val).drop position.val).take remaining.val) ≤ U64.max := by + simp only [accumulate_eq] + simp + rw [U64.max_eq] + have powerEight : (256 : Nat) ^ 8 = 18446744073709551616 := by decide + rw [powerEight] at powerBound + omega + apply spec_mono (read_tail_exact input position remaining 0#u64 fits numericFits) + rintro _ ⟨decoded, next, rfl, decodedEq, nextEq⟩ + exact ⟨fits, by simpa [accumulate_eq] using decodedEq, nextEq⟩ + · apply spec_mono (read_tail_safety input position remaining 0#u64 within) + intro result safe + cases result with + | Err => omega + | Ok pair => + obtain ⟨decoded, next⟩ := pair + obtain ⟨nextWithin, nextEq⟩ := safe + omega + +def HeadRefines (input : Slice Std.U8) (position : Std.Usize) + (result : core.result.Result cbor.Head cbor.Error) : Prop := + match result with + | .Err _ => readHead ((byteList input.val).drop position.val) = none + | .Ok head => + readHead ((byteList input.val).drop position.val) = + some (headView head, (byteList input.val).drop head.next.val) ∧ + position.val < head.next.val ∧ head.next.val ≤ input.val.length ∧ + head.next.val ≤ position.val + 9 + +/-- Every translated head read is total and agrees with the independent byte +grammar, including all reserved tags and truncated extended arguments. -/ +@[step] theorem read_head_refines (input : Slice Std.U8) (position : Std.Usize) : + cbor.read_head input position ⦃ result => HeadRefines input position result ⦄ := by + cases present : input.val[position.val]? with + | none => + rw [read_head_absent input position present] + have beyond : input.val.length ≤ position.val := + List.getElem?_eq_none_iff.mp present + have empty : (byteList input.val).drop position.val = [] := by + apply List.drop_eq_nil_iff.mpr + simpa [byteList] using beyond + simp [spec_ok, HeadRefines, empty, readHead] + | some first => + have atByte := List.getElem?_eq_some_iff.mp present + have inBounds : position.val < input.val.length := atByte.1 + have mappedBound : position.val < (byteList input.val).length := by + simpa [byteList] using atByte.1 + have firstEq : (byteList input.val).drop position.val = + first.val :: (byteList input.val).drop (position.val + 1) := by + rw [List.drop_eq_getElem_cons mappedBound] + simp only [byteList, List.getElem_map, atByte.2] + have byteBound : first.val < 256 := by scalar_tac + have nextFits : position.val + 1 ≤ Usize.max := by + have := input.property + omega + by_cases inline : first.val % 32 < 24 + · apply spec_mono (read_head_inline input position first present inline) + rintro _ ⟨head, rfl, majorEq, argumentEq, nextEq⟩ + simp only [HeadRefines, firstEq, readHead, byteBound, if_true, inline, + headView, majorEq, argumentEq, nextEq] + exact ⟨trivial, by omega, by omega, by omega⟩ + · unfold cbor.read_head + simp only [core.slice.Slice.get, core.slice.index.Usize.get, + Slice.getElem?_Usize_eq, present, bind_tc_ok] + step as ⟨additional, additionalEq⟩ + step as ⟨start, startEq⟩ + have notInline : ¬ additional < 24#u8 := by scalar_tac + simp only [notInline, if_false] + split <;> rename_i tag + case h_5 => + rename_i unmatched ne24S ne25S ne26S + simp [UScalar.eq_equiv] at ne24S ne25S ne26S tag + change additional.val ≠ 24 at ne24S + change additional.val ≠ 25 at ne25S + change additional.val ≠ 26 at ne26S + change additional.val ≠ 27 at tag + have ne24 : first.val % 32 ≠ 24 := by scalar_tac + have ne25 : first.val % 32 ≠ 25 := by scalar_tac + have ne26 : first.val % 32 ≠ 26 := by scalar_tac + have ne27 : first.val % 32 ≠ 27 := by scalar_tac + simp [spec_ok, HeadRefines, firstEq, readHead, byteBound, inline, + ne24, ne25, ne26, ne27] + all_goals + first + | change 24 = first.val % 32 at additionalEq + | change 25 = first.val % 32 at additionalEq + | change 26 = first.val % 32 at additionalEq + | change 27 = first.val % 32 at additionalEq + step with read_tail_bounded as ⟨tail, tailSpec⟩ + cases tail with + | Err => + simp only [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + bind_tc_ok, spec_ok] + simp only [HeadRefines, firstEq, readHead, byteBound, if_true, inline, + if_false] + rw [← additionalEq] + dsimp only at tailSpec + simp [readArgument, byteList, List.length_drop, startEq] at * + omega + | Ok pair => + obtain ⟨decoded, next⟩ := pair + obtain ⟨fits, decodedEq, nextEq⟩ := tailSpec + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨major, majorEq⟩ + simp only [HeadRefines, firstEq, readHead, byteBound, if_true, inline, + if_false, headView, majorEq] + rw [← additionalEq] + simp only [startEq] at fits decodedEq nextEq + have chunkFits : + next.val - (position.val + 1) ≤ + ((byteList input.val).drop (position.val + 1)).length := by + simp only [byteList, List.length_drop, List.length_map] + omega + simp only [nextEq, Nat.add_sub_cancel_left] at chunkFits + simp only [byteList, List.length_map, List.length_drop] at chunkFits + simp [readArgument, byteList, chunkFits, decodedEq, nextEq, List.drop_drop] + omega + +theorem read_head_accepts_encoding (input : Slice Std.U8) (position : Std.Usize) + (head : Auths.Codec.Head) (tail : List Nat) (valid : head.Valid) + (encoding : (byteList input.val).drop position.val = encodeHead head ++ tail) : + cbor.read_head input position ⦃ result => + ∃ decoded, result = .Ok decoded ∧ headView decoded = head ∧ + (byteList input.val).drop decoded.next.val = tail ∧ + decoded.next.val ≤ input.val.length ⦄ := by + have grammar := readHead_encodeHead head valid tail + apply spec_mono (read_head_refines input position) + intro result refines + cases result with + | Err => + simp only [HeadRefines, encoding, grammar] at refines + contradiction + | Ok decoded => + obtain ⟨meaning, _, within, _⟩ := refines + rw [encoding, grammar] at meaning + obtain ⟨headEq, tailEq⟩ := Prod.mk.inj (Option.some.inj meaning) + exact ⟨decoded, rfl, headEq.symm, tailEq.symm, within⟩ + +end Auths.Codec.Refinement diff --git a/formal/Auths/Codec/ScopeConsequences.lean b/formal/Auths/Codec/ScopeConsequences.lean new file mode 100644 index 000000000..173ba78c2 --- /dev/null +++ b/formal/Auths/Codec/ScopeConsequences.lean @@ -0,0 +1,66 @@ +import Auths.Codec.ScopeConstructor +import Auths.Verifier.StatusAnchorExamples +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.ScopeConstructor + +/-- Independent domain equivalence for the expected complete typed result. -/ +theorem expected_success_iff (values : alloc.vec.Vec String) : + (∃ output, expectedConstructor values = .Ok output) ↔ Model.admitted values.val := by + unfold expectedConstructor + split_ifs with refused + · simp only [exists_false, false_iff] + intro admitted + rcases admitted with ⟨nonempty, bounded, unique⟩ + simp [List.isEmpty_iff, nonempty, Nat.not_lt.mpr bounded, unique] at refused + · have admitted : Model.admitted values.val := by + simpa [Model.admitted, Bool.or_eq_true, List.isEmpty_iff, not_or, not_not] using refused + exact ⟨fun _ => admitted, fun _ => ⟨sortedVector values, rfl⟩⟩ + +/-- Every successful constructed scope earns the ordering invariant consumed + by the native status selectors and preserves exactly the input set. -/ +theorem constructor_validity (values : alloc.vec.Vec String) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new values ⦃ result => + match result with + | .Ok output => Model.admitted values.val ∧ + Auths.StatusSelection.Search.Ordered output.val ∧ output.val.Perm values.val ∧ + output.val.length ≤ Model.maximum + | .Err error => error = .InvalidStatusSnapshot ∧ ¬Model.admitted values.val ⦄ := by + rw [constructor_refines] + simp only [spec_ok] + unfold expectedConstructor + split_ifs with refused + · simp only [true_and] + intro admitted + rcases admitted with ⟨nonempty, bounded, unique⟩ + simp [List.isEmpty_iff, nonempty, Nat.not_lt.mpr bounded, unique] at refused + · have admitted : Model.admitted values.val := by + simpa [Model.admitted, Bool.or_eq_true, List.isEmpty_iff, not_or, not_not] using refused + refine ⟨admitted, ?_, Model.sorted_perm values.val, ?_⟩ + · exact Auths.StatusSelection.ordered_of_pairwise _ (Model.sorted_pairwise values.val) + · simpa only [sortedVector, Model.sorted_length] using admitted.2.1 + +/-- Actual constructor success feeds the actual binary-search wrapper, with + membership in the original input list; the ordering condition is earned. -/ +theorem constructed_lookup (values : alloc.vec.Vec String) (target : String) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new values ⦃ result => + match result with + | .Ok output => AuthsStatusSelection.auths_model.StatusScopeAnchors.contains output target = + ok (values.val.contains target) + | .Err error => error = .InvalidStatusSnapshot ⦄ := by + rw [constructor_refines] + simp only [spec_ok] + unfold expectedConstructor + split_ifs + · rfl + · change AuthsStatusSelection.auths_model.StatusScopeAnchors.contains (sortedVector values) target = + ok (values.val.contains target) + have ordered : Auths.StatusSelection.Search.Ordered (sortedVector values).val := + Auths.StatusSelection.ordered_of_pairwise _ (Model.sorted_pairwise values.val) + rw [Auths.StatusSelection.Search.scope_contains _ target ordered] + apply congrArg Result.ok + apply Bool.eq_iff_iff.mpr + simp only [List.contains_iff_mem, sortedVector] + exact (Model.sorted_perm values.val).mem_iff + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeConstructor.lean b/formal/Auths/Codec/ScopeConstructor.lean new file mode 100644 index 000000000..f2abc0898 --- /dev/null +++ b/formal/Auths/Codec/ScopeConstructor.lean @@ -0,0 +1,56 @@ +import Auths.Codec.ScopeLoop +open Aeneas Aeneas.Std Result +open AuthsScopeCodec +namespace Auths.ScopeConstructor +set_option maxHeartbeats 2000000 + +def sortedVector (values : alloc.vec.Vec String) : alloc.vec.Vec String := + ⟨Model.sorted values.val, by rw [Model.sorted_length]; exact values.property⟩ + +def expectedConstructor (values : alloc.vec.Vec String) : + Aeneas.Std.core.result.Result (alloc.vec.Vec String) AuthsScopeCodec.auths_model.ModelError := + if values.val.isEmpty || Model.maximum < values.val.length || decide (¬values.val.Nodup) then + .Err .InvalidStatusSnapshot + else .Ok (sortedVector values) + +/-- Exact total source result, with independent list validity; no source + success, caller ordering or desired-output premise. -/ +theorem constructor_refines (values : alloc.vec.Vec String) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new values = ok (expectedConstructor values) := by + unfold AuthsScopeCodec.auths_model.StatusScopeAnchors.new + simp only [AuthsScopeCodec.alloc.vec.Vec.is_empty, _root_.alloc.vec.Vec.is_empty, bind_tc_ok] + by_cases empty : values.val.isEmpty = true + · simp [empty, expectedConstructor] + · simp only [empty] + have maximum : AuthsScopeCodec.auths_model.HARD_MAX_TRUST_ANCHORS.val = Model.maximum := by + simp [AuthsScopeCodec.auths_model.HARD_MAX_TRUST_ANCHORS, Model.maximum] + simp only [UScalar.lt_equiv, alloc.vec.Vec.len_val, alloc.vec.Vec.length, maximum] + by_cases oversized : Model.maximum < values.val.length + · simp [oversized, expectedConstructor, empty] + · simp only [oversized, Bool.false_eq_true, ↓reduceIte] + change (do + let sorted ← AuthsScopeCodec.alloc.slice.Slice.sort + AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpOrd (values : Slice String) + let duplicate ← AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop + (sorted : alloc.vec.Vec String) 1#usize false + let result ← if duplicate then ok (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot) + else ok (Aeneas.Std.core.result.Result.Ok (sorted : alloc.vec.Vec String)) + if duplicate then ok result else ok result) = ok (expectedConstructor values) + rw [anchor_sort] + simp only [bind_tc_ok] + have nonempty : (sortedVector values).val ≠ [] := by + have length := Model.sorted_length values.val + simp only [sortedVector] + intro absent + have zero := congrArg List.length absent + simp only [List.length_nil] at zero + have original : values.val = [] := List.length_eq_zero_iff.mp (length.symm.trans zero) + simp [original] at empty + have loop := duplicate_entry (sortedVector values) nonempty + unfold sortedVector at loop + rw [loop] + simp only [repeated_sorted, bind_tc_ok] + cases valid : decide (¬values.val.Nodup) <;> + simp [valid, expectedConstructor, empty, oversized, sortedVector] <;> rfl + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeDecodeExamples.lean b/formal/Auths/Codec/ScopeDecodeExamples.lean new file mode 100644 index 000000000..ca61f6c59 --- /dev/null +++ b/formal/Auths/Codec/ScopeDecodeExamples.lean @@ -0,0 +1,108 @@ +import Auths.Codec.ScopeConstructor +import Auths.Codec.Evaluation +import qualification.aeneas.generated.scope_codec.Funs +open Aeneas Aeneas.Std Result +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 +namespace Auths.ScopeConstructor.DecodeExamples +open AuthsScopeCodec + +def own : cbor.Decoder := ⟨⟨[161#u8, 0#u8, 0#u8], by scalar_tac⟩, 0#usize⟩ +def anyAnchor : cbor.Decoder := ⟨⟨[161#u8, 0#u8, 2#u8], by scalar_tac⟩, 0#usize⟩ +def unknown : cbor.Decoder := ⟨⟨[161#u8, 0#u8, 3#u8], by scalar_tac⟩, 0#usize⟩ +def truncated : cbor.Decoder := ⟨⟨[161#u8, 0#u8], by scalar_tac⟩, 0#usize⟩ + +theorem accepts_own (limits : auths_model.VerifierLimits) : + decode.status_scope own limits = ok (.Ok .OwnAnchor, {own with position := 3#usize}) := by + cbv + +theorem accepts_any (limits : auths_model.VerifierLimits) : + decode.status_scope anyAnchor limits = ok (.Ok .AnyAnchor, {anyAnchor with position := 3#usize}) := by + cbv + +theorem refuses_unknown_tag (limits : auths_model.VerifierLimits) : + decode.status_scope unknown limits = ok (.Err .Malformed, {unknown with position := 3#usize}) := by + cbv + +theorem refuses_truncation (limits : auths_model.VerifierLimits) : + decode.status_scope truncated limits = ok (.Err .Malformed, {truncated with position := 2#usize}) := by + cbv + +attribute [local cbv_eval] decode.status_scope_loop.eq_def + auths_model.StatusScopeAnchors.new_loop.eq_def + auths_model.identifier.contains_forbidden_identifier_loop.eq_def + +def listed : cbor.Decoder := ⟨⟨[162#u8, 0#u8, 1#u8, 1#u8, 129#u8, 104#u8, + 97#u8, 110#u8, 99#u8, 104#u8, 111#u8, 114#u8, 58#u8, 97#u8], by scalar_tac⟩, 0#usize⟩ +def emptyListed : cbor.Decoder := ⟨⟨[162#u8, 0#u8, 1#u8, 1#u8, 128#u8], by scalar_tac⟩, 0#usize⟩ +def invalidId : cbor.Decoder := ⟨⟨[162#u8, 0#u8, 1#u8, 1#u8, 129#u8, 96#u8], by scalar_tac⟩, 0#usize⟩ + +def limits : auths_model.VerifierLimits := { + bundle_bytes := 1#usize + action_bytes := 1#usize + context_bytes := 1#usize + grants := 1#usize + actions := 1#usize + plan_leaves := 1#usize + plan_depth := 1#usize + plan_branching := 1#usize + evidence := 1#usize + evidence_bytes := 1#usize + bindings := 1#usize + principal_status := 1#usize + grant_status := 1#usize + attachments := 1#usize + attachment_bytes := 1#usize + signatures := 1#usize + signature_bytes := 1#usize + permissions := 1#usize + audiences := 1#usize + extensions := 1#usize + extension_bytes := 1#usize + body_digests := 1#usize + binding_evidence := 1#usize + canonical_body_bytes := 1#usize + registry_entries := 1#usize + trust_anchors := 1024#usize + work_units := 1#u64 + approvals := 1#usize + approver_anchors := 1#usize + approval_requirements := 1#usize +} + +theorem accepts_listed : decode.status_scope listed limits = + ok (.Ok (.Anchors ⟨["anchor:a"], by scalar_tac⟩), {listed with position := 14#usize}) := by + cbv + +theorem refuses_empty_list : decode.status_scope emptyListed limits = + ok (.Err (.Model .InvalidStatusSnapshot), {emptyListed with position := 5#usize}) := by + cbv + +theorem refuses_invalid_id : decode.status_scope invalidId limits = + ok (.Err (.Model .InvalidRegistryId), {invalidId with position := 6#usize}) := by + cbv + +theorem refuses_collection_limit : decode.status_scope listed {limits with trust_anchors := 0#usize} = + ok (.Err .LimitExceeded, {listed with position := 5#usize}) := by + cbv + + +def unsortedListed : cbor.Decoder := ⟨⟨[162#u8, 0#u8, 1#u8, 1#u8, 130#u8, + 97#u8, 99#u8, 97#u8, 97#u8], by scalar_tac⟩, 0#usize⟩ +def duplicateListed : cbor.Decoder := ⟨⟨[162#u8, 0#u8, 1#u8, 1#u8, 130#u8, + 97#u8, 97#u8, 97#u8, 97#u8], by scalar_tac⟩, 0#usize⟩ + +/-- This internal field decoder sorts the list. Its caller remains responsible + for comparing re-encoded bytes before canonical object acceptance. -/ +theorem sorts_unsorted_list : decode.status_scope unsortedListed limits = + ok (.Ok (.Anchors ⟨["a", "c"], by scalar_tac⟩), + {unsortedListed with position := 9#usize}) := by + simp only [decode.status_scope, Auths.ScopeConstructor.constructor_refines] + cbv + +theorem refuses_duplicate_list : decode.status_scope duplicateListed limits = + ok (.Err (.Model .InvalidStatusSnapshot), {duplicateListed with position := 9#usize}) := by + simp only [decode.status_scope, Auths.ScopeConstructor.constructor_refines] + cbv + +end Auths.ScopeConstructor.DecodeExamples diff --git a/formal/Auths/Codec/ScopeDecodeSafety.lean b/formal/Auths/Codec/ScopeDecodeSafety.lean new file mode 100644 index 000000000..47bc0e18a --- /dev/null +++ b/formal/Auths/Codec/ScopeDecodeSafety.lean @@ -0,0 +1,57 @@ +import Auths.Codec.ScopeConsequences +import Mathlib.Tactic.CasesM +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.ScopeConstructor +open AuthsScopeCodec +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 + +def scopeValid (scope : auths_model.StatusScope) : Prop := + match scope with + | .OwnAnchor | .AnyAnchor => True + | .Anchors anchors => Model.admitted anchors.val ∧ Auths.StatusSelection.Search.Ordered anchors.val + +theorem constructed_scope_valid (values output : alloc.vec.Vec String) + (accepted : AuthsScopeCodec.auths_model.StatusScopeAnchors.new values = ok (.Ok output)) : + scopeValid (.Anchors output) := by + have contract := constructor_validity values + rw [accepted] at contract + simp only [spec_ok] at contract + rcases contract with ⟨admitted, ordered, permutation, bound⟩ + refine ⟨⟨?_, bound, permutation.nodup_iff.mpr admitted.2.2⟩, ordered⟩ + intro empty + have same := permutation.length_eq + have original : values.val = [] := List.length_eq_zero_iff.mp (by simpa [empty] using same.symm) + exact admitted.1 original + +theorem accepted_scope_valid (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) + (scope : auths_model.StatusScope) (next : cbor.Decoder) + (accepted : decode.status_scope decoder limits = ok (.Ok scope, next)) : scopeValid scope := by + unfold decode.status_scope at accepted + simp only [Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | casesm* _ ∧ _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, error.CodecError.Insts.CoreConvertFromModelError.from, Result.ok.injEq, core.result.Result.Ok.injEq, Prod.mk.injEq, reduceCtorEq] at accepted + | contradiction + all_goals + repeat' first + | casesm* core.result.Result core.convert.Infallible _ + | casesm* core.convert.Infallible + | simp_all (failIfUnchanged := true) only [Result.ok.injEq, reduceCtorEq] + all_goals subst scope + all_goals try trivial + all_goals + casesm* core.result.Result auths_model.StatusScopeAnchors auths_model.ModelError + all_goals simp_all only [Result.ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals apply constructed_scope_valid + all_goals assumption + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeDecodedUse.lean b/formal/Auths/Codec/ScopeDecodedUse.lean new file mode 100644 index 000000000..993b7ee1f --- /dev/null +++ b/formal/Auths/Codec/ScopeDecodedUse.lean @@ -0,0 +1,36 @@ +import Auths.Codec.ScopeDecodeSafety +open Aeneas Aeneas.Std Result +namespace Auths.ScopeConstructor + +/-- Fieldwise identity between two translations of the same Rust enum. The + listed-vector carrier is identical; no collection or decision changes. -/ +def nativeScope : AuthsScopeCodec.auths_model.StatusScope → AuthsStatusSelection.auths_model.StatusScope + | .OwnAnchor => .OwnAnchor + | .AnyAnchor => .AnyAnchor + | .Anchors anchors => .Anchors anchors + +theorem decoded_scope_ordered (decoder : AuthsScopeCodec.cbor.Decoder) + (limits : AuthsScopeCodec.auths_model.VerifierLimits) + (scope : AuthsScopeCodec.auths_model.StatusScope) (next : AuthsScopeCodec.cbor.Decoder) + (accepted : AuthsScopeCodec.decode.status_scope decoder limits = ok (.Ok scope, next)) : + Auths.StatusSelection.scopeOrdered (nativeScope scope) := by + have valid := accepted_scope_valid decoder limits scope next accepted + cases scope with + | OwnAnchor => trivial + | AnyAnchor => trivial + | Anchors anchors => exact valid.2 + +/-- Actual successful decoding supplies the invariant required by the actual + scope-coverage function. This is a success-path safety/composition theorem; + it does not assume an authorization or coverage decision. -/ +theorem decoded_scope_covers (decoder : AuthsScopeCodec.cbor.Decoder) + (limits : AuthsScopeCodec.auths_model.VerifierLimits) + (scope : AuthsScopeCodec.auths_model.StatusScope) (next : AuthsScopeCodec.cbor.Decoder) + (issuer : String) (anchor : AuthsStatusSelection.auths_model.TrustAnchor) + (accepted : AuthsScopeCodec.decode.status_scope decoder limits = ok (.Ok scope, next)) : + AuthsStatusSelection.auths_model.StatusScope.covers (nativeScope scope) issuer anchor = + ok (Auths.StatusSelection.Model.scopeCovers (Auths.StatusSelection.scopeView (nativeScope scope)) + issuer (.anchor anchor.id anchor.principal)) := + Auths.StatusSelection.scope_covers _ _ _ (decoded_scope_ordered decoder limits scope next accepted) + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeDuplicate.lean b/formal/Auths/Codec/ScopeDuplicate.lean new file mode 100644 index 000000000..06cb283bd --- /dev/null +++ b/formal/Auths/Codec/ScopeDuplicate.lean @@ -0,0 +1,48 @@ +import Auths.Codec.ScopeSort +import Mathlib.Data.List.Chain +namespace Auths.ScopeConstructor + +def repeated : List String → Bool + | [] => false + | first :: rest => match rest with + | [] => false + | second :: _ => first == second || repeated rest + +theorem repeated_false_chain (values : List String) : + repeated values = false ↔ values.IsChain (fun left right => left ≠ right) := by + induction values with + | nil => simp [repeated] + | cons first rest ih => + cases rest with + | nil => simp [repeated] + | cons second tail => + simp [repeated, List.isChain_cons_cons, ← ih] + +local instance : IsTrans String (fun left right => compare left right = .lt) where + trans _ _ _ := Std.TransCmp.lt_trans + +theorem repeated_false_iff_nodup (values : List String) (ordered : values.Pairwise Model.stringLE) : + repeated values = false ↔ values.Nodup := by + rw [repeated_false_chain] + constructor + · intro adjacent + have strict : values.IsChain (fun left right => compare left right = .lt) := by + rw [List.isChain_iff_getElem] at adjacent ⊢ + intro index within + have lower := List.pairwise_iff_getElem.mp ordered index (index + 1) (by omega) within (by omega) + have unequal := adjacent index within + have notEqual : compare values[index] values[index + 1] ≠ .eq := by + intro equal + exact unequal (Std.compare_eq_iff_eq.mp equal) + cases comparison : compare values[index] values[index + 1] <;> + simp_all [Model.stringLE] + have pairwise : values.Pairwise (fun left right => compare left right = .lt) := + List.isChain_iff_pairwise.mp strict + exact pairwise.imp (by + intro left right comparison equal + subst right + simp at comparison) + · intro nodup + exact nodup.isChain + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeExamples.lean b/formal/Auths/Codec/ScopeExamples.lean new file mode 100644 index 000000000..0974ea47e --- /dev/null +++ b/formal/Auths/Codec/ScopeExamples.lean @@ -0,0 +1,34 @@ +import Auths.Codec.ScopeConsequences +open Aeneas Aeneas.Std Result +namespace Auths.ScopeConstructor.Examples + +def pair : alloc.vec.Vec String := ⟨["anchor:c", "anchor:a"], by scalar_tac⟩ +def duplicate : alloc.vec.Vec String := ⟨["anchor:a", "anchor:a"], by scalar_tac⟩ +def empty : alloc.vec.Vec String := ⟨[], by scalar_tac⟩ + +theorem accepts_unsorted : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new pair = + ok (.Ok ⟨["anchor:a", "anchor:c"], by scalar_tac⟩) := by + rw [constructor_refines] + rfl + +theorem rejects_duplicate : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new duplicate = + ok (.Err .InvalidStatusSnapshot) := by + rw [constructor_refines] + rfl + +theorem rejects_empty : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new empty = + ok (.Err .InvalidStatusSnapshot) := by + rw [constructor_refines] + rfl + +theorem rejects_oversized (values : alloc.vec.Vec String) + (oversized : Model.maximum < values.val.length) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new values = + ok (.Err .InvalidStatusSnapshot) := by + rw [constructor_refines] + simp [expectedConstructor, oversized] + +end Auths.ScopeConstructor.Examples diff --git a/formal/Auths/Codec/ScopeLoop.lean b/formal/Auths/Codec/ScopeLoop.lean new file mode 100644 index 000000000..96e3cc854 --- /dev/null +++ b/formal/Auths/Codec/ScopeLoop.lean @@ -0,0 +1,72 @@ +import Auths.Codec.ScopeDuplicate +import Auths.Verifier.StatusLeaves +open Aeneas Aeneas.Std Result +open AuthsScopeCodec +namespace Auths.ScopeConstructor +set_option maxHeartbeats 2000000 + +theorem vector_index (values : alloc.vec.Vec String) (position : Std.Usize) (value : String) + (atIndex : values.val[position.val]? = some value) : + alloc.vec.Vec.index (core.slice.index.SliceIndexUsizeSlice String) values position = ok value := by + change Slice.index_usize values position = ok value + simp [Slice.index_usize, atIndex] + +theorem duplicate_stopped (values : alloc.vec.Vec String) (position : Std.Usize) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop values position true = ok true := by + rw [AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop.eq_def] + simp + +theorem duplicate_loop (values : alloc.vec.Vec String) (position : Std.Usize) + (previous : String) (rest : List String) + (positive : 0 < position.val) (remaining : values.val.drop position.val = rest) + (atPrevious : values.val[position.val - 1]? = some previous) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop values position false = ok (repeated (previous :: rest)) := by + induction rest generalizing position previous with + | nil => + have finished : ¬ position < alloc.vec.Vec.len values := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, alloc.vec.Vec.len_val, alloc.vec.Vec.length] + omega + rw [AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop.eq_def] + simp [finished, repeated] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := Auths.StatusSelection.indexed_head values position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := Auths.StatusSelection.indexed_next values position head tail remaining + obtain ⟨before, subtract, beforeValue, _⟩ := Aeneas.Std.WP.spec_imp_exists + (Usize.sub_spec (x := position) (y := 1#usize) (by simpa using Nat.succ_le_of_lt positive)) + have beforeIndex : values.val[before.val]? = some previous := by simpa [beforeValue] using atPrevious + have within : position.val < values.val.length := by + simpa only [UScalar.lt_equiv, Slice.len_val] using guard + have headValue : values.val[position.val] = head := by + have split := List.drop_eq_getElem_cons within + rw [remaining] at split + exact (List.cons.inj split).1.symm + have headOption : values.val[position.val]? = some head := by + rw [List.getElem?_eq_getElem within, headValue] + have nextPrevious : values.val[next.val - 1]? = some head := by simpa [nextValue] using headOption + rw [AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop.eq_def] + simp only [alloc.vec.Vec.len, guard, ↓reduceIte, subtract, bind_tc_ok, + vector_index values before previous beforeIndex, vector_index values position head headOption, + AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq, + AuthsScopeCodec.alloc.string.String.Insts.CoreCmpPartialEqString.eq, + _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq, step] + cases matched : (previous == head) with + | true => simp [duplicate_stopped, repeated, matched] + | false => + simpa [repeated, matched] using ih next head (by omega) nextRemaining nextPrevious + +theorem duplicate_entry (values : alloc.vec.Vec String) (nonempty : values.val ≠ []) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop values 1#usize false = ok (repeated values.val) := by + cases equation : values.val with + | nil => contradiction + | cons previous rest => + simpa only [equation] using duplicate_loop values 1#usize previous rest (by simp) (by simp [equation]) (by simp [equation]) + +theorem repeated_sorted (values : List String) : repeated (Model.sorted values) = decide (¬values.Nodup) := by + have meaning : repeated (Model.sorted values) = false ↔ values.Nodup := + (repeated_false_iff_nodup (Model.sorted values) (Model.sorted_pairwise values)).trans + (Model.sorted_perm values).nodup_iff + cases result : repeated (Model.sorted values) <;> simp_all + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeModel.lean b/formal/Auths/Codec/ScopeModel.lean new file mode 100644 index 000000000..a17c8319f --- /dev/null +++ b/formal/Auths/Codec/ScopeModel.lean @@ -0,0 +1,34 @@ +import Mathlib.Data.List.Sort +import Mathlib.Tactic +namespace Auths.ScopeConstructor.Model + +abbrev stringLE (left right : String) : Prop := (compare left right).isLE = true + +local instance : Std.Total stringLE where + total left right := by + cases comparison : compare left right with + | lt => exact Or.inl (by simp [stringLE, comparison]) + | eq => exact Or.inl (by simp [stringLE, comparison]) + | gt => exact Or.inr (by simp [stringLE, Std.OrientedCmp.lt_of_gt comparison]) +local instance : IsTrans String stringLE where + trans _ _ _ left right := Std.TransOrd.isLE_trans left right + +def sorted (values : List String) : List String := values.insertionSort stringLE + +theorem sorted_pairwise (values : List String) : (sorted values).Pairwise stringLE := + List.pairwise_insertionSort stringLE values + +theorem sorted_perm (values : List String) : (sorted values).Perm values := + List.perm_insertionSort stringLE values + +theorem sorted_length (values : List String) : (sorted values).length = values.length := + List.length_insertionSort stringLE values + +def maximum : Nat := 1024 + +def admitted (values : List String) : Prop := values ≠ [] ∧ values.length ≤ maximum ∧ values.Nodup + +def construct (values : List String) : Option (List String) := + if values.isEmpty || maximum < values.length || decide (¬values.Nodup) then none else some (sorted values) + +end Auths.ScopeConstructor.Model diff --git a/formal/Auths/Codec/ScopeSelectors.lean b/formal/Auths/Codec/ScopeSelectors.lean new file mode 100644 index 000000000..c0b9edbbe --- /dev/null +++ b/formal/Auths/Codec/ScopeSelectors.lean @@ -0,0 +1,74 @@ +import Auths.Codec.ScopeConsequences +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.ScopeConstructor +open Auths.StatusSelection + +def listedRules (anchors : alloc.vec.Vec String) + (rules : alloc.vec.Vec AuthsStatusSelection.auths_model.StatusTrustRule) : + alloc.vec.Vec AuthsStatusSelection.auths_model.StatusTrustRule := + ⟨rules.val.map (fun rule => {rule with scope := .Anchors anchors}), by + simpa only [List.length_map] using rules.property⟩ + +theorem listed_rules_ordered (anchors : alloc.vec.Vec String) + (rules : alloc.vec.Vec AuthsStatusSelection.auths_model.StatusTrustRule) + (ordered : Search.Ordered anchors.val) : rulesOrdered (listedRules anchors rules).val := by + intro rule member + obtain ⟨original, _, equal⟩ := List.mem_map.mp member + subst rule + exact ordered + +/-- A successful actual constructor earns all ordering obligations for the + actual principal port, for arbitrary rules, evidence and status views. + This statement covers assigning the constructed list to every rule. -/ +theorem constructed_principal_selection (values : alloc.vec.Vec String) + (implementation : AuthsStatusSelection.ExactStatusMethod) + (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (subject : String) (view : AuthsStatusSelection.auths_model.StatusView) (now : Std.U64) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new values ⦃ result => + match result with + | .Ok output => + let constructed := {snapshot with trust := listedRules output snapshot.trust} + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation policy constructed subject view now ⦃ actual => + ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluate implementation.id (policyView policy) constructed.observed_at.val + constructed.valid_until.val (constructed.trust.val.map ruleView) + (constructed.statements.val.map principalView) subject (viewView view) now.val ⦄ + | .Err error => error = .InvalidStatusSnapshot ⦄ := by + apply spec_mono (constructor_validity values) + intro result validity + cases result with + | Ok output => + exact principal_method_all_views implementation policy _ subject view now + (listed_rules_ordered output snapshot.trust validity.2.1) + | Err error => exact validity.1 + +/-- The analogous constructor-to-port result for grant status. -/ +theorem constructed_grant_selection (values : alloc.vec.Vec String) + (implementation : AuthsStatusSelection.ExactStatusMethod) + (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (subject : AuthsStatusSelection.auths_model.GrantId) + (view : AuthsStatusSelection.auths_model.StatusView) (now : Std.U64) : + AuthsScopeCodec.auths_model.StatusScopeAnchors.new values ⦃ result => + match result with + | .Ok output => + let constructed := {snapshot with trust := listedRules output snapshot.trust} + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant + implementation policy constructed subject view now ⦃ actual => + ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluate implementation.id (policyView policy) constructed.observed_at.val + constructed.valid_until.val (constructed.trust.val.map ruleView) + (constructed.statements.val.map grantView) subject (viewView view) now.val ⦄ + | .Err error => error = .InvalidStatusSnapshot ⦄ := by + apply spec_mono (constructor_validity values) + intro result validity + cases result with + | Ok output => + exact grant_method_all_views implementation policy _ subject view now + (listed_rules_ordered output snapshot.trust validity.2.1) + | Err error => exact validity.1 + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeSort.lean b/formal/Auths/Codec/ScopeSort.lean new file mode 100644 index 000000000..41b779e7e --- /dev/null +++ b/formal/Auths/Codec/ScopeSort.lean @@ -0,0 +1,47 @@ +import qualification.aeneas.generated.scope_codec.Funs +import Auths.Codec.ScopeModel +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.ScopeConstructor +open Auths.Codec.StdModel +open AuthsScopeCodec + +theorem anchor_comparison (left right : String) : + AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp left right = ok (compare left right) := rfl + +theorem identity_key_call {T : Type} (value : T) : + (@AuthsScopeCodec.identityKey T).call_mut () value = ok (value, ()) := rfl + +theorem identity_insert (order : Aeneas.Std.core.cmp.Ord String) + (comparison : ∀ left right, order.cmp left right = ok (compare left right)) + (item : String) (values : List String) : + insertKeyValues AuthsScopeCodec.identityKey order () item values = + ok ⟨values.orderedInsert Model.stringLE item, List.orderedInsert_length Model.stringLE values item⟩ := by + induction values with + | nil => rfl + | cons first rest ih => + rw [insertKeyValues_cons] + simp only [identity_key_call, comparison, bind_tc_ok] + cases ordering : compare item first <;> + simp [ordering, List.orderedInsert_cons, Model.stringLE, ih] + +theorem identity_sort (order : Aeneas.Std.core.cmp.Ord String) + (comparison : ∀ left right, order.cmp left right = ok (compare left right)) + (values : List String) : + sortKeyValues AuthsScopeCodec.identityKey order () values = + ok ⟨Model.sorted values, Model.sorted_length values⟩ := by + induction values with + | nil => rfl + | cons first rest ih => + rw [sortKeyValues_cons, ih] + simp only [bind_tc_ok, identity_insert order comparison] + rfl + +theorem anchor_sort (values : Slice String) : + AuthsScopeCodec.alloc.slice.Slice.sort AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpOrd values = + ok ⟨Model.sorted values.val, by rw [Model.sorted_length]; exact values.property⟩ := by + unfold AuthsScopeCodec.alloc.slice.Slice.sort + rw [sort_by_key_values, identity_sort _ anchor_comparison] + rfl + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeTrustCollection.lean b/formal/Auths/Codec/ScopeTrustCollection.lean new file mode 100644 index 000000000..46b2bc847 --- /dev/null +++ b/formal/Auths/Codec/ScopeTrustCollection.lean @@ -0,0 +1,92 @@ +import Auths.Codec.ScopeTrustSafety +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.ScopeConstructor +open AuthsScopeCodec +set_option maxHeartbeats 4000000 +set_option maxRecDepth 4096 + +theorem failed_trust_loop (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) + (length : Std.Usize) (rules : alloc.vec.Vec auths_model.StatusTrustRule) + (position : Std.Usize) (error : error.CodecError) : + decode.status_trust_loop decoder limits length rules position (some error) = + ok (decoder.input, decoder.position, rules, some error) := by + rw [decode.status_trust_loop.eq_def] + by_cases guard : position < length <;> simp [guard, core.option.Option.is_none] + +/-- Every successful finite collection loop retains valid accumulated scopes; + errors cannot turn a partially decoded collection into successful output. -/ +theorem trust_loop_valid (remaining : Nat) (decoder : cbor.Decoder) + (limits : auths_model.VerifierLimits) (length position : Std.Usize) + (rules output : alloc.vec.Vec auths_model.StatusTrustRule) + (input : Slice Std.U8) (cursor : Std.Usize) + (measure : length.val - position.val = remaining) (valid : trustValid rules.val) + (returned : decode.status_trust_loop decoder limits length rules position none = + ok (input, cursor, output, none)) : trustValid output.val := by + induction remaining using Nat.strong_induction_on generalizing decoder position rules with + | h remaining ih => + rw [decode.status_trust_loop.eq_def] at returned + by_cases guard : position < length + · simp only [guard, ↓reduceIte, core.option.Option.is_none, Option.isNone] at returned + have fits : position.val + 1 ≤ Usize.max := by + have bound : length.val ≤ Usize.max := by scalar_tac + have before : position.val < length.val := by simpa only [UScalar.lt_equiv] using guard + omega + obtain ⟨next, addition, nextValue⟩ := spec_imp_exists + (Usize.add_spec (x := position) (y := 1#usize) (by simpa using fits)) + have decreases : length.val - next.val < remaining := by + have before : position.val < length.val := by simpa only [UScalar.lt_equiv] using guard + simp only [UScalar.ofNatCore_val_eq] at nextValue + omega + cases parsed : decode.status_trust_rule decoder limits with + | fail error => simp [parsed, bind_tc_fail] at returned + | div => simp [parsed, bind_tc_div] at returned + | ok result => + rcases result with ⟨result, nextDecoder⟩ + cases result with + | Err error => + simp [parsed, bind_tc_ok, addition, failed_trust_loop] at returned + | Ok rule => + have ruleValid := accepted_rule_valid decoder limits rule nextDecoder parsed + cases pushed : alloc.vec.Vec.push rules rule with + | fail error => simp [parsed, pushed, bind_tc_ok, bind_tc_fail] at returned + | div => simp [parsed, pushed, bind_tc_ok, bind_tc_div] at returned + | ok accumulated => + apply ih (length.val - next.val) decreases nextDecoder next accumulated rfl + (valid_push rules rule valid ruleValid accumulated pushed) + simpa [parsed, pushed, addition] using returned + · simp only [guard, ↓reduceIte, Result.ok.injEq, Prod.mk.injEq] at returned + rcases returned with ⟨_, _, same, _⟩ + simpa only [← same] using valid + +/-- Every successful actual status-trust decode returns rules whose listed + scopes satisfy the actual status selector's ordering invariant. -/ +theorem accepted_trust_valid (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) + (rules : alloc.vec.Vec auths_model.StatusTrustRule) (next : cbor.Decoder) + (accepted : decode.status_trust decoder limits = ok (.Ok rules, next)) : trustValid rules.val := by + unfold decode.status_trust at accepted + simp only [Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | casesm* _ ∧ _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, Result.ok.injEq, core.result.Result.Ok.injEq, + Prod.mk.injEq, reduceCtorEq] at accepted + | contradiction + all_goals + repeat' first + | casesm* core.result.Result core.convert.Infallible _ + | casesm* core.convert.Infallible + | simp_all (failIfUnchanged := true) only [Result.ok.injEq, reduceCtorEq] + all_goals subst rules + all_goals + have emptyValid : ∀ (capacity : Std.Usize), trustValid (alloc.vec.Vec.with_capacity auths_model.StatusTrustRule capacity).val := by + intro capacity rule included + simp [alloc.vec.Vec.with_capacity] at included + exact trust_loop_valid _ _ _ _ _ _ _ _ _ rfl (emptyValid _) (by assumption) + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeTrustSafety.lean b/formal/Auths/Codec/ScopeTrustSafety.lean new file mode 100644 index 000000000..dbec0186f --- /dev/null +++ b/formal/Auths/Codec/ScopeTrustSafety.lean @@ -0,0 +1,86 @@ +import Auths.Codec.ScopeDecodedUse +import Mathlib.Tactic.CasesM +open Aeneas Aeneas.Std Result +namespace Auths.ScopeConstructor +open AuthsScopeCodec +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 + +def trustValid (rules : List auths_model.StatusTrustRule) : Prop := + ∀ rule ∈ rules, scopeValid rule.scope + +private theorem decodedScopeResult (d : cbor.Decoder) (l : auths_model.VerifierLimits) + (r : core.result.Result auths_model.StatusScope error.CodecError) (n : cbor.Decoder) + (h : decode.status_scope d l = ok (r, n)) : + match r with | .Ok scope => scopeValid scope | .Err _ => True := by + cases r with + | Ok scope => exact accepted_scope_valid d l scope n h + | Err _ => trivial + +/-- Every actual successfully decoded trust rule carries a constructor-valid + scope. This is a structural safety fact, not evidence authentication. -/ +theorem accepted_rule_valid (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) + (rule : auths_model.StatusTrustRule) (next : cbor.Decoder) + (accepted : decode.status_trust_rule decoder limits = ok (.Ok rule, next)) : + scopeValid rule.scope := by + unfold decode.status_trust_rule auths_model.StatusTrustRule.new at accepted + simp only [Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | casesm* _ ∧ _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, Result.ok.injEq, core.result.Result.Ok.injEq, + Prod.mk.injEq, reduceCtorEq] at accepted + | contradiction + all_goals try have scopeSafety := decodedScopeResult _ _ _ _ (by assumption) + all_goals + repeat' first + | casesm* core.result.Result core.convert.Infallible _ + | casesm* core.convert.Infallible + | casesm* core.result.Result auths_model.StatusScope error.CodecError + | simp_all (failIfUnchanged := true) only [Result.ok.injEq, core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals subst rule + all_goals simpa only using scopeSafety + +/-- A fieldwise identity between the same Rust trust-rule representation in + two extraction contexts. Scope, issuer, method and sequence are preserved. -/ +def nativeRule (rule : auths_model.StatusTrustRule) : AuthsStatusSelection.auths_model.StatusTrustRule := + {method := rule.method, issuer := rule.issuer, sequence_floor := rule.sequence_floor, + scope := nativeScope rule.scope} + +theorem valid_rule_ordered (rule : auths_model.StatusTrustRule) (valid : scopeValid rule.scope) : + Auths.StatusSelection.scopeOrdered (nativeRule rule).scope := by + cases scope : rule.scope <;> simp_all [nativeRule, nativeScope, scopeValid, Auths.StatusSelection.scopeOrdered] + +theorem valid_trust_ordered (rules : List auths_model.StatusTrustRule) (valid : trustValid rules) : + Auths.StatusSelection.rulesOrdered (rules.map nativeRule) := by + intro rule member + obtain ⟨original, included, rfl⟩ := List.mem_map.mp member + exact valid_rule_ordered original (valid original included) + +theorem pushed_values (rules : alloc.vec.Vec auths_model.StatusTrustRule) + (rule : auths_model.StatusTrustRule) (output : alloc.vec.Vec auths_model.StatusTrustRule) + (pushed : alloc.vec.Vec.push rules rule = ok output) : output.val = rules.val ++ [rule] := by + unfold alloc.vec.Vec.push at pushed + dsimp only at pushed + split at pushed + · cases pushed + simp + · contradiction + +theorem valid_push (rules : alloc.vec.Vec auths_model.StatusTrustRule) + (rule : auths_model.StatusTrustRule) (valid : trustValid rules.val) (nextValid : scopeValid rule.scope) + (output : alloc.vec.Vec auths_model.StatusTrustRule) + (pushed : alloc.vec.Vec.push rules rule = ok output) : trustValid output.val := by + rw [pushed_values rules rule output pushed] + intro item included + rcases List.mem_append.mp included with previous | added + · exact valid item previous + · simp only [List.mem_singleton] at added + simpa only [added] using nextValid + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/ScopeTrustSelectors.lean b/formal/Auths/Codec/ScopeTrustSelectors.lean new file mode 100644 index 000000000..9229ab337 --- /dev/null +++ b/formal/Auths/Codec/ScopeTrustSelectors.lean @@ -0,0 +1,55 @@ +import Auths.Codec.ScopeTrustCollection +open Aeneas Aeneas.Std Result +namespace Auths.ScopeConstructor + +def nativeRules (rules : alloc.vec.Vec AuthsScopeCodec.auths_model.StatusTrustRule) : + alloc.vec.Vec AuthsStatusSelection.auths_model.StatusTrustRule := + ⟨rules.val.map nativeRule, by simpa only [List.length_map] using rules.property⟩ + +/-- The actual complete trust-field decoder supplies every rule's scope + invariant to the actual principal status port. Remaining snapshot fields + and all status views stay arbitrary. Evidence authenticity is separate. -/ +theorem decoded_trust_principal + (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits) + (rules : alloc.vec.Vec AuthsScopeCodec.auths_model.StatusTrustRule) (next : AuthsScopeCodec.cbor.Decoder) + (implementation : AuthsStatusSelection.ExactStatusMethod) + (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (subject : String) (view : AuthsStatusSelection.auths_model.StatusView) (now : Std.U64) + (decoded : AuthsScopeCodec.decode.status_trust decoder limits = ok (.Ok rules, next)) : + let constructed := {snapshot with trust := nativeRules rules} + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation policy constructed subject view now ⦃ actual => + ∃ evaluation, actual = .Ok evaluation ∧ Auths.StatusSelection.evaluationView evaluation = + Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy) + constructed.observed_at.val constructed.valid_until.val + (constructed.trust.val.map Auths.StatusSelection.ruleView) + (constructed.statements.val.map Auths.StatusSelection.principalView) + subject (Auths.StatusSelection.viewView view) now.val ⦄ := + Auths.StatusSelection.principal_method_all_views implementation policy _ subject view now + (valid_trust_ordered rules.val (accepted_trust_valid decoder limits rules next decoded)) + +/-- The same decoder-earned rule invariants compose with the actual grant + status port, preserving the complete decision and freshness horizon. -/ +theorem decoded_trust_grant + (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits) + (rules : alloc.vec.Vec AuthsScopeCodec.auths_model.StatusTrustRule) (next : AuthsScopeCodec.cbor.Decoder) + (implementation : AuthsStatusSelection.ExactStatusMethod) + (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (subject : AuthsStatusSelection.auths_model.GrantId) + (view : AuthsStatusSelection.auths_model.StatusView) (now : Std.U64) + (decoded : AuthsScopeCodec.decode.status_trust decoder limits = ok (.Ok rules, next)) : + let constructed := {snapshot with trust := nativeRules rules} + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant + implementation policy constructed subject view now ⦃ actual => + ∃ evaluation, actual = .Ok evaluation ∧ Auths.StatusSelection.evaluationView evaluation = + Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy) + constructed.observed_at.val constructed.valid_until.val + (constructed.trust.val.map Auths.StatusSelection.ruleView) + (constructed.statements.val.map Auths.StatusSelection.grantView) + subject (Auths.StatusSelection.viewView view) now.val ⦄ := + Auths.StatusSelection.grant_method_all_views implementation policy _ subject view now + (valid_trust_ordered rules.val (accepted_trust_valid decoder limits rules next decoded)) + +end Auths.ScopeConstructor diff --git a/formal/Auths/Codec/Semantics.lean b/formal/Auths/Codec/Semantics.lean new file mode 100644 index 000000000..eb558dfb2 --- /dev/null +++ b/formal/Auths/Codec/Semantics.lean @@ -0,0 +1,223 @@ +import Std.Tactic + +/-! +# Definite CBOR head semantics + +These definitions describe the byte grammar independently of the Rust +cursor. A head is only a major tag and an unsigned argument; interpreting +that argument as a length or a protocol field belongs to the object decoder. +The raw parser permits wider integer arguments, just like the shipping +reader. Canonical object acceptance additionally compares the complete +encoding with the input. +-/ + +namespace Auths.Codec + +structure Head where + major : Nat + argument : Nat + deriving DecidableEq, Repr + +def Head.Valid (head : Head) : Prop := + head.major < 8 ∧ head.argument < 2 ^ 64 + +def BytesValid (bytes : List Nat) : Prop := + ∀ byte ∈ bytes, byte < 256 + +/-- Fixed-width big-endian digits, most significant first. -/ +def bigEndian : Nat → Nat → List Nat + | 0, _ => [] + | width + 1, value => bigEndian width (value / 256) ++ [value % 256] + +/-- The positional value of big-endian digits. -/ +def unsigned : List Nat → Nat + | [] => 0 + | byte :: rest => byte * 256 ^ rest.length + unsigned rest + +/-- Left-to-right positional interpretation, with an explicit initial value. -/ +def accumulate : Nat → List Nat → Nat + | value, [] => value + | value, byte :: rest => accumulate (value * 256 + byte) rest + +theorem accumulate_ge_initial (value : Nat) (bytes : List Nat) : + value ≤ accumulate value bytes := by + induction bytes generalizing value with + | nil => exact Nat.le_refl _ + | cons byte rest ih => + exact Nat.le_trans (by omega) (ih (value * 256 + byte)) + +theorem accumulate_eq (value : Nat) (bytes : List Nat) : + accumulate value bytes = value * 256 ^ bytes.length + unsigned bytes := by + induction bytes generalizing value with + | nil => simp [accumulate, unsigned] + | cons byte rest ih => + simp only [accumulate, ih, unsigned, List.length_cons, Nat.pow_succ] + simp [Nat.add_mul, Nat.mul_assoc, Nat.mul_comm, Nat.add_assoc] + +def argumentWidth (value : Nat) : Nat := + if value < 24 then 0 + else if value < 256 then 1 + else if value < 65536 then 2 + else if value < 4294967296 then 4 + else 8 + +def additionalTag (value : Nat) : Nat := + if value < 24 then value + else if value < 256 then 24 + else if value < 65536 then 25 + else if value < 4294967296 then 26 + else 27 + +def encodeHead (head : Head) : List Nat := + (head.major * 32 + additionalTag head.argument) :: + bigEndian (argumentWidth head.argument) head.argument + +def readArgument (width : Nat) (bytes : List Nat) : Option (Nat × List Nat) := + if width ≤ bytes.length then + some (unsigned (bytes.take width), bytes.drop width) + else none + +def readHead : List Nat → Option (Head × List Nat) + | [] => none + | first :: rest => + if first < 256 then + let additional := first % 32 + let major := first / 32 + if additional < 24 then some (⟨major, additional⟩, rest) + else + let argument := + if additional = 24 then readArgument 1 rest + else if additional = 25 then readArgument 2 rest + else if additional = 26 then readArgument 4 rest + else if additional = 27 then readArgument 8 rest + else none + argument.map fun (value, tail) => (⟨major, value⟩, tail) + else none + +theorem bigEndian_length (width value : Nat) : + (bigEndian width value).length = width := by + induction width generalizing value with + | zero => rfl + | succ width ih => simp [bigEndian, ih] + +theorem bigEndian_bytes_valid (width value : Nat) : + BytesValid (bigEndian width value) := by + induction width generalizing value with + | zero => simp [BytesValid, bigEndian] + | succ width ih => + simp only [bigEndian, BytesValid, List.mem_append, List.mem_singleton] + intro byte member + rcases member with member | rfl + · exact ih _ _ member + · exact Nat.mod_lt _ (by decide) + +theorem unsigned_append_singleton (bytes : List Nat) (byte : Nat) : + unsigned (bytes ++ [byte]) = unsigned bytes * 256 + byte := by + induction bytes with + | nil => simp [unsigned] + | cons first rest ih => + simp only [List.cons_append, unsigned, List.length_append, List.length_singleton, + Nat.pow_succ, ih] + simp [Nat.add_mul, Nat.mul_assoc, Nat.add_assoc] + +theorem unsigned_lt_power (bytes : List Nat) (valid : BytesValid bytes) : + unsigned bytes < 256 ^ bytes.length := by + induction bytes with + | nil => simp [unsigned] + | cons byte rest ih => + have digit : byte ≤ 255 := by + have := valid byte (by simp) + omega + have restValid : BytesValid rest := by + intro value member + exact valid value (by simp [member]) + have tailBound := ih restValid + have scaled := Nat.mul_le_mul_right (256 ^ rest.length) digit + simp only [unsigned, List.length_cons, Nat.pow_succ] + omega + +theorem unsigned_take_drop_succ (bytes : List Nat) (position width : Nat) + (fits : position + (width + 1) ≤ bytes.length) : + unsigned ((bytes.drop position).take (width + 1)) = + bytes[position]'(by omega) * 256 ^ width + + unsigned ((bytes.drop (position + 1)).take width) := by + have atByte : position < bytes.length := by omega + have restFits : width ≤ (bytes.drop (position + 1)).length := by + simp only [List.length_drop] + omega + calc + _ = unsigned (bytes[position] :: (bytes.drop (position + 1)).take width) := by + apply congrArg unsigned + rw [List.drop_eq_getElem_cons atByte] + rfl + _ = _ := by + rw [unsigned, List.length_take, Nat.min_eq_left restFits] + +theorem unsigned_bigEndian (width value : Nat) (fits : value < 256 ^ width) : + unsigned (bigEndian width value) = value := by + induction width generalizing value with + | zero => + have : value = 0 := by simpa using fits + simp [this, bigEndian, unsigned] + | succ width ih => + have smaller : value / 256 < 256 ^ width := by + apply (Nat.div_lt_iff_lt_mul (by decide : 0 < 256)).2 + simpa [Nat.pow_succ, Nat.mul_comm] using fits + rw [bigEndian, unsigned_append_singleton, ih _ smaller] + omega + +theorem readArgument_bigEndian (width value : Nat) + (fits : value < 256 ^ width) (tail : List Nat) : + readArgument width (bigEndian width value ++ tail) = some (value, tail) := by + simp [readArgument, bigEndian_length, unsigned_bigEndian _ _ fits] + +theorem encodeHead_length_le_nine (head : Head) : + (encodeHead head).length ≤ 9 := by + simp only [encodeHead, List.length_cons, bigEndian_length, argumentWidth] + split <;> (try split) <;> (try split) <;> (try split) <;> omega + +theorem readHead_inline (major value : Nat) (tail : List Nat) + (tagBound : major < 8) (inline : value < 24) : + readHead ((major * 32 + value) :: tail) = some (⟨major, value⟩, tail) := by + have firstBound : major * 32 + value < 256 := by omega + have div : (major * 32 + value) / 32 = major := by omega + have mod : (major * 32 + value) % 32 = value := by omega + simp [readHead, firstBound, div, mod, inline] + +theorem readHead_extended (major tag width value : Nat) (tail : List Nat) + (tagBound : major < 8) + (widthTag : (tag = 24 ∧ width = 1) ∨ (tag = 25 ∧ width = 2) ∨ + (tag = 26 ∧ width = 4) ∨ (tag = 27 ∧ width = 8)) + (fits : value < 256 ^ width) : + readHead ((major * 32 + tag) :: (bigEndian width value ++ tail)) = + some (⟨major, value⟩, tail) := by + have tagLt : tag < 32 := by omega + have firstBound : major * 32 + tag < 256 := by omega + have div : (major * 32 + tag) / 32 = major := by omega + have mod : (major * 32 + tag) % 32 = tag := by omega + rcases widthTag with ⟨rfl, rfl⟩ | ⟨rfl, rfl⟩ | ⟨rfl, rfl⟩ | ⟨rfl, rfl⟩ <;> + simp [readHead, firstBound, div, mod, readArgument_bigEndian _ _ fits] + +theorem readHead_encodeHead (head : Head) (valid : head.Valid) (tail : List Nat) : + readHead (encodeHead head ++ tail) = some (head, tail) := by + rcases head with ⟨major, value⟩ + rcases valid with ⟨tagBound, valueBound⟩ + by_cases inline : value < 24 + · simpa [encodeHead, argumentWidth, additionalTag, inline, bigEndian] using + readHead_inline major value tail tagBound inline + · by_cases one : value < 256 + · simpa [encodeHead, argumentWidth, additionalTag, inline, one] using + readHead_extended major 24 1 value tail tagBound (Or.inl ⟨rfl, rfl⟩) one + · by_cases two : value < 65536 + · simpa [encodeHead, argumentWidth, additionalTag, inline, one, two] using + readHead_extended major 25 2 value tail tagBound + (Or.inr (Or.inl ⟨rfl, rfl⟩)) two + · by_cases four : value < 4294967296 + · simpa [encodeHead, argumentWidth, additionalTag, inline, one, two, four] using + readHead_extended major 26 4 value tail tagBound + (Or.inr (Or.inr (Or.inl ⟨rfl, rfl⟩))) four + · simpa [encodeHead, argumentWidth, additionalTag, inline, one, two, four] using + readHead_extended major 27 8 value tail tagBound + (Or.inr (Or.inr (Or.inr ⟨rfl, rfl⟩))) valueBound + +end Auths.Codec diff --git a/formal/Auths/Codec/String.lean b/formal/Auths/Codec/String.lean new file mode 100644 index 000000000..9cc21a427 --- /dev/null +++ b/formal/Auths/Codec/String.lean @@ -0,0 +1,37 @@ +import qualification.aeneas.generated.codec.FunsExternal +import Auths.Model.IdentifierString +open Aeneas Aeneas.Std Result +namespace Auths.Codec.StringRefinement + +theorem byte_array_round_trip (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + Auths.Codec.StdModel.bytes (toStr value bounded) = value.toByteArray := by + apply ByteArray.ext + apply _root_.Array.toList_inj.mp + unfold Auths.Codec.StdModel.bytes toStr + simp only [List.toList_data_toByteArray, List.map_map] + rw [← Auths.Model.Identifier.byte_array_list] + change value.toByteArray.toList.map (fun byte => UInt8.ofNat byte.toNat) = + value.toByteArray.toList + simp only [UInt8.ofNat_toNat, List.map_id'] + +theorem string_copy_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + alloc.string.String.Insts.CoreConvertFromShared0Str.from (toStr value bounded) = ok value := by + unfold alloc.string.String.Insts.CoreConvertFromShared0Str.from + rw [byte_array_round_trip] + simp only [String.fromUTF8?, dif_pos value.isValidUTF8] + rfl + +theorem string_borrow_exact (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + alloc.string.String.Insts.CoreOpsDerefDerefStr.deref value = ok (toStr value bounded) := by + simp only [alloc.string.String.Insts.CoreOpsDerefDerefStr.deref, dif_pos bounded] + +theorem utf8_accepts_string (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + core.str.converts.from_utf8 (toStr value bounded) = ok (.Ok (toStr value bounded)) := by + simp only [core.str.converts.from_utf8, byte_array_round_trip, + if_pos value.isValidUTF8] + +end Auths.Codec.StringRefinement diff --git a/formal/Auths/Composition/Bounds.lean b/formal/Auths/Composition/Bounds.lean new file mode 100644 index 000000000..1d1af86b1 --- /dev/null +++ b/formal/Auths/Composition/Bounds.lean @@ -0,0 +1,106 @@ +import Auths.Composition.Work +open Auths.Composition.PlanModel Auths.Composition.Work +namespace Auths.Composition.Bounds +mutual + def depth {R : Type} : Plan R → Nat + | .proof _ => 1 + | .allOf members | .anyOf members | .kOfN _ members => 1 + memberDepth members + termination_by plan => sizeOf plan + def memberDepth {R : Type} : List (Plan R) → Nat + | [] => 0 + | head :: tail => max (depth head) (memberDepth tail) + termination_by members => sizeOf members +end +mutual + def proper {R : Type} : Plan R → Prop + | .proof _ => True + | .allOf members | .anyOf members | .kOfN _ members => members ≠ [] ∧ membersProper members + termination_by plan => sizeOf plan + def membersProper {R : Type} : List (Plan R) → Prop + | [] => True + | head :: tail => proper head ∧ membersProper tail + termination_by members => sizeOf members +end + +def NodeBound {R : Type} (plan : Plan R) : Prop := + proper plan → 1 ≤ (leaves plan).length ∧ nodes plan ≤ depth plan * (leaves plan).length + +def MembersBound {R : Type} (members : List (Plan R)) : Prop := + membersProper members → + memberNodes members ≤ memberDepth members * (memberLeaves members).length ∧ + (members ≠ [] → 1 ≤ (memberLeaves members).length) + +theorem node_bound {R : Type} (plan : Plan R) : NodeBound plan := by + refine Plan.rec + (motive_1 := fun plan => NodeBound plan) + (motive_2 := fun members => MembersBound members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference valid + simp [leaves, nodes, depth] + · intro members correct valid + simp only [proper] at valid + obtain ⟨nonempty, valid⟩ := valid + obtain ⟨bound, positive⟩ := correct valid + have positive := positive nonempty + simp only [leaves, nodes, depth] + exact ⟨positive, by nlinarith⟩ + · intro members correct valid + simp only [proper] at valid + obtain ⟨nonempty, valid⟩ := valid + obtain ⟨bound, positive⟩ := correct valid + have positive := positive nonempty + simp only [leaves, nodes, depth] + exact ⟨positive, by nlinarith⟩ + · intro required members correct valid + simp only [proper] at valid + obtain ⟨nonempty, valid⟩ := valid + obtain ⟨bound, positive⟩ := correct valid + have positive := positive nonempty + simp only [leaves, nodes, depth] + exact ⟨positive, by nlinarith⟩ + · intro valid + simp [memberNodes, memberDepth, memberLeaves] + · intro head tail headCorrect tailCorrect valid + simp only [membersProper] at valid + obtain ⟨headValid, tailValid⟩ := valid + obtain ⟨headPositive, headBound⟩ := headCorrect headValid + obtain ⟨tailBound, tailPositive⟩ := tailCorrect tailValid + simp only [memberNodes, memberDepth, memberLeaves, List.length_append] + constructor + · have headMax := Nat.mul_le_mul_right (leaves head).length + (Nat.le_max_left (depth head) (memberDepth tail)) + have tailMax := Nat.mul_le_mul_right (memberLeaves tail).length + (Nat.le_max_right (depth head) (memberDepth tail)) + nlinarith + · intro nonempty + omega + +theorem bounded_events {R : Type} (plan : Plan R) + (valid : proper plan) (depthBound : depth plan ≤ 16) (leavesBound : (leaves plan).length ≤ 128) : + nodes plan ≤ 2048 := by + have bound := (node_bound plan valid).2 + nlinarith + +open Aeneas Aeneas.Std auths_composition + +theorem source_bounded_events {B : Type} + (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) + (nativeObserver : core.ops.function.FnMut Nat EvaluationEvent Unit) + (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) + (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = Result.ok (modelBranch state reference)) + (observerContract : ∀ count event, + nativeObserver.call_mut count event = Result.ok ((), count + 1)) + (plan : auths_model.AuthorizationPlan) (state : B) (count : Nat) + (valid : proper (viewPlan plan)) (depthBound : depth (viewPlan plan) ≤ 16) + (leavesBound : (leaves (viewPlan plan)).length ≤ 128) : + ∃ outcome next finalCount, + evaluate_node nativeBranch nativeObserver plan state count = Result.ok (outcome, next, finalCount) ∧ + finalCount ≤ count + 2048 := by + obtain ⟨outcome, next, exactCount⟩ := Auths.Composition.Work.source_event_count + nativeBranch modelBranch branchContract nativeObserver observerContract plan state count + refine ⟨outcome, next, count + nodes (viewPlan plan), exactCount, ?_⟩ + have bound := bounded_events (viewPlan plan) valid depthBound leavesBound + omega + +end Auths.Composition.Bounds diff --git a/formal/Auths/Composition/Collect.lean b/formal/Auths/Composition/Collect.lean new file mode 100644 index 000000000..ed6df8fdd --- /dev/null +++ b/formal/Auths/Composition/Collect.lean @@ -0,0 +1,49 @@ +import Auths.Composition.SetModel +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open auths_composition +namespace Auths.Composition.Collect + +@[step] theorem push_exact (state : auths_composition.alloc.vec.Vec auths_model.ProofRef) (value : auths_model.ProofRef) + (room : state.size < Usize.max) : + auths_composition.alloc.vec.Vec.push state value ⦃ updated => + updated.elements.toList = state.elements.toList ++ [value] ⦄ := by + have baseRoom : state.toBase.val.length < Usize.max := by + simpa only [auths_composition.alloc.vec.Vec.toBase, auths_composition.alloc.vec.SizedList.length] using room + unfold auths_composition.alloc.vec.Vec.push + apply spec_bind (Aeneas.Std.alloc.vec.Vec.push_spec state.toBase value baseRoom) + intro result exactValues + simpa only [spec_ok, auths_composition.alloc.vec.Vec.ofBase, auths_composition.alloc.vec.SizedList.toList_ofList, + auths_composition.alloc.vec.Vec.toBase] using exactValues + +theorem collect_exact (remaining : List auths_model.ProofRef) + (iterator : alloc.collections.btree.set.IntoIter auths_model.ProofRef Global) + (state : auths_composition.alloc.vec.Vec auths_model.ProofRef) + (same : iterator.values = remaining) + (room : state.size + remaining.length ≤ Usize.max) : + auths_model.AuthorizationPlan.validate_loop iterator state ⦃ updated => + updated.elements.toList = state.elements.toList ++ remaining ⦄ := by + cases iterator with + | mk values bound => + dsimp only at same + subst values + induction remaining generalizing state with + | nil => + rw [auths_model.AuthorizationPlan.validate_loop.eq_def] + simp [alloc.collections.btree.set.IntoIter.Insts.CoreIterTraitsIteratorIterator.next] + | cons head tail ih => + have canPush : state.size < Usize.max := by + simp only [List.length_cons] at room + omega + rw [auths_model.AuthorizationPlan.validate_loop.eq_def] + simp only [alloc.collections.btree.set.IntoIter.Insts.CoreIterTraitsIteratorIterator.next, + bind_tc_ok] + step as ⟨updated, updatedValues⟩ + have updatedSize : updated.size = state.size + 1 := by + have size := congrArg List.length updatedValues + simpa only [auths_composition.alloc.vec.SizedList.length, List.length_append, List.length_singleton] using size + apply spec_mono (ih updated + (by simp only [List.length_cons] at room; omega) + (by simp only [List.length_cons] at bound; omega)) + intro final exactValues + simpa only [updatedValues, List.append_assoc, List.singleton_append] using exactValues +end Auths.Composition.Collect diff --git a/formal/Auths/Composition/Diagnostics.lean b/formal/Auths/Composition/Diagnostics.lean new file mode 100644 index 000000000..34f98834b --- /dev/null +++ b/formal/Auths/Composition/Diagnostics.lean @@ -0,0 +1,164 @@ +import qualification.aeneas.generated.composition.Types +import Mathlib.Tactic +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_composition + +namespace Auths.Composition.Model +set_option maxHeartbeats 4000000 +set_option maxRecDepth 4096 +/- Stable V1 code bytes are the independent lexical diagnostic contract. +The native catalog parity gate also checks the production string getter. -/ +def denialRank : auths_composition.auths_model.DenialReason → Nat + | .ActionBodyMismatch => 0 + | .ActionConstraintMismatch => 1 + | .ActionOutsideValidity => 2 + | .AmbiguousTerminalGrant => 3 + | .ApprovalThresholdNotMet => 4 + | .AttachmentDigestMismatch => 5 + | .AttachmentLengthMismatch => 6 + | .AttachmentMissing => 7 + | .AudienceMismatch => 8 + | .AuthorizationPlanInvalid => 9 + | .BrokenGrantChain => 10 + | .BudgetCeilingExceeded => 11 + | .ChallengeMismatch => 12 + | .CompositionRequirementNotMet => 13 + | .CriticalExtensionUnknown => 14 + | .DelegationExpanded => 15 + | .DigestMismatch => 16 + | .DuplicateAttachment => 17 + | .DuplicateObject => 18 + | .GrantRevoked => 19 + | .InvalidSignature => 20 + | .LocalPolicyDenied => 21 + | .MalformedProof => 22 + | .MissingReference => 23 + | .NonCanonicalProof => 24 + | .ObservationConditionFalse => 25 + | .ObservationRequirementDropped => 26 + | .ObserverInAuthorityChain => 27 + | .OpaqueAttachmentNotAllowed => 28 + | .PermissionNotGranted => 29 + | .PlanActionMismatch => 30 + | .PrincipalMethodMismatch => 31 + | .PrincipalRevoked => 32 + | .ReferenceCycle => 33 + | .RegistryManifestMismatch => 34 + | .ResourceLimitExceeded => 35 + | .ResourceNamespaceMismatch => 36 + | .SignatureSuiteMismatch => 37 + | .StatusIssuerUntrusted => 38 + | .StatusMethodMismatch => 39 + | .StatusSequenceRollback => 40 + | .UntrustedRoot => 41 + | .UnusedCriticalAttachment => 42 + | .UnusedCriticalEvidence => 43 + | .VerificationMethodMismatch => 44 + | .VerifierConfigurationMismatch => 45 + +def denialCode : auths_composition.auths_model.DenialReason → List Nat + | .ActionBodyMismatch => [97, 99, 116, 105, 111, 110, 45, 98, 111, 100, 121, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .ActionConstraintMismatch => [97, 99, 116, 105, 111, 110, 45, 99, 111, 110, 115, 116, 114, 97, 105, 110, 116, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .ActionOutsideValidity => [97, 99, 116, 105, 111, 110, 45, 111, 117, 116, 115, 105, 100, 101, 45, 118, 97, 108, 105, 100, 105, 116, 121] + | .AmbiguousTerminalGrant => [97, 109, 98, 105, 103, 117, 111, 117, 115, 45, 116, 101, 114, 109, 105, 110, 97, 108, 45, 103, 114, 97, 110, 116] + | .ApprovalThresholdNotMet => [97, 112, 112, 114, 111, 118, 97, 108, 45, 116, 104, 114, 101, 115, 104, 111, 108, 100, 45, 110, 111, 116, 45, 109, 101, 116] + | .AttachmentDigestMismatch => [97, 116, 116, 97, 99, 104, 109, 101, 110, 116, 45, 100, 105, 103, 101, 115, 116, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .AttachmentLengthMismatch => [97, 116, 116, 97, 99, 104, 109, 101, 110, 116, 45, 108, 101, 110, 103, 116, 104, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .AttachmentMissing => [97, 116, 116, 97, 99, 104, 109, 101, 110, 116, 45, 109, 105, 115, 115, 105, 110, 103] + | .AudienceMismatch => [97, 117, 100, 105, 101, 110, 99, 101, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .AuthorizationPlanInvalid => [97, 117, 116, 104, 111, 114, 105, 122, 97, 116, 105, 111, 110, 45, 112, 108, 97, 110, 45, 105, 110, 118, 97, 108, 105, 100] + | .BrokenGrantChain => [98, 114, 111, 107, 101, 110, 45, 103, 114, 97, 110, 116, 45, 99, 104, 97, 105, 110] + | .BudgetCeilingExceeded => [98, 117, 100, 103, 101, 116, 45, 99, 101, 105, 108, 105, 110, 103, 45, 101, 120, 99, 101, 101, 100, 101, 100] + | .ChallengeMismatch => [99, 104, 97, 108, 108, 101, 110, 103, 101, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .CompositionRequirementNotMet => [99, 111, 109, 112, 111, 115, 105, 116, 105, 111, 110, 45, 114, 101, 113, 117, 105, 114, 101, 109, 101, 110, 116, 45, 110, 111, 116, 45, 109, 101, 116] + | .CriticalExtensionUnknown => [99, 114, 105, 116, 105, 99, 97, 108, 45, 101, 120, 116, 101, 110, 115, 105, 111, 110, 45, 117, 110, 107, 110, 111, 119, 110] + | .DelegationExpanded => [100, 101, 108, 101, 103, 97, 116, 105, 111, 110, 45, 101, 120, 112, 97, 110, 100, 101, 100] + | .DigestMismatch => [100, 105, 103, 101, 115, 116, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .DuplicateAttachment => [100, 117, 112, 108, 105, 99, 97, 116, 101, 45, 97, 116, 116, 97, 99, 104, 109, 101, 110, 116] + | .DuplicateObject => [100, 117, 112, 108, 105, 99, 97, 116, 101, 45, 111, 98, 106, 101, 99, 116] + | .GrantRevoked => [103, 114, 97, 110, 116, 45, 114, 101, 118, 111, 107, 101, 100] + | .InvalidSignature => [105, 110, 118, 97, 108, 105, 100, 45, 115, 105, 103, 110, 97, 116, 117, 114, 101] + | .LocalPolicyDenied => [108, 111, 99, 97, 108, 45, 112, 111, 108, 105, 99, 121, 45, 100, 101, 110, 105, 101, 100] + | .MalformedProof => [109, 97, 108, 102, 111, 114, 109, 101, 100, 45, 112, 114, 111, 111, 102] + | .MissingReference => [109, 105, 115, 115, 105, 110, 103, 45, 114, 101, 102, 101, 114, 101, 110, 99, 101] + | .NonCanonicalProof => [110, 111, 110, 45, 99, 97, 110, 111, 110, 105, 99, 97, 108, 45, 112, 114, 111, 111, 102] + | .ObservationConditionFalse => [111, 98, 115, 101, 114, 118, 97, 116, 105, 111, 110, 45, 99, 111, 110, 100, 105, 116, 105, 111, 110, 45, 102, 97, 108, 115, 101] + | .ObservationRequirementDropped => [111, 98, 115, 101, 114, 118, 97, 116, 105, 111, 110, 45, 114, 101, 113, 117, 105, 114, 101, 109, 101, 110, 116, 45, 100, 114, 111, 112, 112, 101, 100] + | .ObserverInAuthorityChain => [111, 98, 115, 101, 114, 118, 101, 114, 45, 105, 110, 45, 97, 117, 116, 104, 111, 114, 105, 116, 121, 45, 99, 104, 97, 105, 110] + | .OpaqueAttachmentNotAllowed => [111, 112, 97, 113, 117, 101, 45, 97, 116, 116, 97, 99, 104, 109, 101, 110, 116, 45, 110, 111, 116, 45, 97, 108, 108, 111, 119, 101, 100] + | .PermissionNotGranted => [112, 101, 114, 109, 105, 115, 115, 105, 111, 110, 45, 110, 111, 116, 45, 103, 114, 97, 110, 116, 101, 100] + | .PlanActionMismatch => [112, 108, 97, 110, 45, 97, 99, 116, 105, 111, 110, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .PrincipalMethodMismatch => [112, 114, 105, 110, 99, 105, 112, 97, 108, 45, 109, 101, 116, 104, 111, 100, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .PrincipalRevoked => [112, 114, 105, 110, 99, 105, 112, 97, 108, 45, 114, 101, 118, 111, 107, 101, 100] + | .ReferenceCycle => [114, 101, 102, 101, 114, 101, 110, 99, 101, 45, 99, 121, 99, 108, 101] + | .RegistryManifestMismatch => [114, 101, 103, 105, 115, 116, 114, 121, 45, 109, 97, 110, 105, 102, 101, 115, 116, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .ResourceLimitExceeded => [114, 101, 115, 111, 117, 114, 99, 101, 45, 108, 105, 109, 105, 116, 45, 101, 120, 99, 101, 101, 100, 101, 100] + | .ResourceNamespaceMismatch => [114, 101, 115, 111, 117, 114, 99, 101, 45, 110, 97, 109, 101, 115, 112, 97, 99, 101, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .SignatureSuiteMismatch => [115, 105, 103, 110, 97, 116, 117, 114, 101, 45, 115, 117, 105, 116, 101, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .StatusIssuerUntrusted => [115, 116, 97, 116, 117, 115, 45, 105, 115, 115, 117, 101, 114, 45, 117, 110, 116, 114, 117, 115, 116, 101, 100] + | .StatusMethodMismatch => [115, 116, 97, 116, 117, 115, 45, 109, 101, 116, 104, 111, 100, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .StatusSequenceRollback => [115, 116, 97, 116, 117, 115, 45, 115, 101, 113, 117, 101, 110, 99, 101, 45, 114, 111, 108, 108, 98, 97, 99, 107] + | .UntrustedRoot => [117, 110, 116, 114, 117, 115, 116, 101, 100, 45, 114, 111, 111, 116] + | .UnusedCriticalAttachment => [117, 110, 117, 115, 101, 100, 45, 99, 114, 105, 116, 105, 99, 97, 108, 45, 97, 116, 116, 97, 99, 104, 109, 101, 110, 116] + | .UnusedCriticalEvidence => [117, 110, 117, 115, 101, 100, 45, 99, 114, 105, 116, 105, 99, 97, 108, 45, 101, 118, 105, 100, 101, 110, 99, 101] + | .VerificationMethodMismatch => [118, 101, 114, 105, 102, 105, 99, 97, 116, 105, 111, 110, 45, 109, 101, 116, 104, 111, 100, 45, 109, 105, 115, 109, 97, 116, 99, 104] + | .VerifierConfigurationMismatch => [118, 101, 114, 105, 102, 105, 101, 114, 45, 99, 111, 110, 102, 105, 103, 117, 114, 97, 116, 105, 111, 110, 45, 109, 105, 115, 109, 97, 116, 99, 104] + +def requirementRank : auths_composition.auths_model.Requirement → Nat + | .ApprovalUnavailable => 0 + | .AssuranceRequirementNotMet => 1 + | .ExternalFactUnavailable => 2 + | .HistoricalStateUnavailable => 3 + | .MissingGrantStatus => 4 + | .MissingPrincipalEvidence => 5 + | .MissingPrincipalStatus => 6 + | .ObservationActionFactUnavailable => 7 + | .ObservationMissing => 8 + | .StaleStatus => 9 + | .UnsupportedAssuranceClaim => 10 + | .UnsupportedBudgetAlgebra => 11 + | .UnsupportedCriticalExtension => 12 + | .UnsupportedEvidenceType => 13 + | .UnsupportedPrincipalMethod => 14 + | .UnsupportedProfile => 15 + | .UnsupportedProfilePolicy => 16 + | .UnsupportedProtocol => 17 + | .UnsupportedResourceMatcher => 18 + | .UnsupportedSignatureSuite => 19 + | .UnsupportedStatusMethod => 20 + +def requirementCode : auths_composition.auths_model.Requirement → List Nat + | .ApprovalUnavailable => [97, 112, 112, 114, 111, 118, 97, 108, 45, 117, 110, 97, 118, 97, 105, 108, 97, 98, 108, 101] + | .AssuranceRequirementNotMet => [97, 115, 115, 117, 114, 97, 110, 99, 101, 45, 114, 101, 113, 117, 105, 114, 101, 109, 101, 110, 116, 45, 110, 111, 116, 45, 109, 101, 116] + | .ExternalFactUnavailable => [101, 120, 116, 101, 114, 110, 97, 108, 45, 102, 97, 99, 116, 45, 117, 110, 97, 118, 97, 105, 108, 97, 98, 108, 101] + | .HistoricalStateUnavailable => [104, 105, 115, 116, 111, 114, 105, 99, 97, 108, 45, 115, 116, 97, 116, 101, 45, 117, 110, 97, 118, 97, 105, 108, 97, 98, 108, 101] + | .MissingGrantStatus => [109, 105, 115, 115, 105, 110, 103, 45, 103, 114, 97, 110, 116, 45, 115, 116, 97, 116, 117, 115] + | .MissingPrincipalEvidence => [109, 105, 115, 115, 105, 110, 103, 45, 112, 114, 105, 110, 99, 105, 112, 97, 108, 45, 101, 118, 105, 100, 101, 110, 99, 101] + | .MissingPrincipalStatus => [109, 105, 115, 115, 105, 110, 103, 45, 112, 114, 105, 110, 99, 105, 112, 97, 108, 45, 115, 116, 97, 116, 117, 115] + | .ObservationActionFactUnavailable => [111, 98, 115, 101, 114, 118, 97, 116, 105, 111, 110, 45, 97, 99, 116, 105, 111, 110, 45, 102, 97, 99, 116, 45, 117, 110, 97, 118, 97, 105, 108, 97, 98, 108, 101] + | .ObservationMissing => [111, 98, 115, 101, 114, 118, 97, 116, 105, 111, 110, 45, 109, 105, 115, 115, 105, 110, 103] + | .StaleStatus => [115, 116, 97, 108, 101, 45, 115, 116, 97, 116, 117, 115] + | .UnsupportedAssuranceClaim => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 97, 115, 115, 117, 114, 97, 110, 99, 101, 45, 99, 108, 97, 105, 109] + | .UnsupportedBudgetAlgebra => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 98, 117, 100, 103, 101, 116, 45, 97, 108, 103, 101, 98, 114, 97] + | .UnsupportedCriticalExtension => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 99, 114, 105, 116, 105, 99, 97, 108, 45, 101, 120, 116, 101, 110, 115, 105, 111, 110] + | .UnsupportedEvidenceType => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 101, 118, 105, 100, 101, 110, 99, 101, 45, 116, 121, 112, 101] + | .UnsupportedPrincipalMethod => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 112, 114, 105, 110, 99, 105, 112, 97, 108, 45, 109, 101, 116, 104, 111, 100] + | .UnsupportedProfile => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 112, 114, 111, 102, 105, 108, 101] + | .UnsupportedProfilePolicy => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 112, 114, 111, 102, 105, 108, 101, 45, 112, 111, 108, 105, 99, 121] + | .UnsupportedProtocol => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 112, 114, 111, 116, 111, 99, 111, 108] + | .UnsupportedResourceMatcher => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 114, 101, 115, 111, 117, 114, 99, 101, 45, 109, 97, 116, 99, 104, 101, 114] + | .UnsupportedSignatureSuite => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 115, 105, 103, 110, 97, 116, 117, 114, 101, 45, 115, 117, 105, 116, 101] + | .UnsupportedStatusMethod => [117, 110, 115, 117, 112, 112, 111, 114, 116, 101, 100, 45, 115, 116, 97, 116, 117, 115, 45, 109, 101, 116, 104, 111, 100] + +theorem denial_rank_lexical (left right : auths_composition.auths_model.DenialReason) : + denialRank left < denialRank right ↔ List.Lex (· < ·) (denialCode left) (denialCode right) := by + cases hl : left <;> cases hr : right <;> decide + +theorem requirement_rank_lexical (left right : auths_composition.auths_model.Requirement) : + requirementRank left < requirementRank right ↔ + List.Lex (· < ·) (requirementCode left) (requirementCode right) := by + cases hl : left <;> cases hr : right <;> decide + + +end Auths.Composition.Model diff --git a/formal/Auths/Composition/Examples.lean b/formal/Auths/Composition/Examples.lean new file mode 100644 index 000000000..1c08882bf --- /dev/null +++ b/formal/Auths/Composition/Examples.lean @@ -0,0 +1,61 @@ +import Auths.Composition.Refinement +import Auths.Codec.Evaluation +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +open auths_composition +set_option cbv.warning false +set_option maxRecDepth 4096 +namespace Auths.Composition.Examples + +-- A kernel-proved equality avoids evaluating the opaque platform word width. +attribute [local cbv_eval] Auths.Composition.Refinement.threshold_exact + +-- These execute the shipping summary operations over explicit child outcomes. +-- Plan validation, recursive traversal and callback/event correspondence are +-- separate obligations; these examples do not assert a complete verifier. +def decideChildren (all : Bool) (required : Std.U16) (children : List BranchOutcome) : + Result BranchOutcome := do + let state ← Auths.Composition.Refinement.sourceFold + ⟨0#usize, 0#usize, none, none⟩ children + if all then summary.all state else summary.threshold state required + +theorem all_positive : decideChildren true 2#u16 [.Authorized, .Authorized] = ok .Authorized := by + cbv + +theorem all_denial_before_missing : decideChildren true 2#u16 + [.Indeterminate .StaleStatus, .Denied .InvalidSignature] = ok (.Denied .InvalidSignature) := by + cbv + +theorem all_smallest_code : decideChildren true 3#u16 + [.Denied .InvalidSignature, .StructurallyInvalid .ActionBodyMismatch, .Denied .MissingReference] = + ok (.Denied .ActionBodyMismatch) := by + cbv + +theorem any_positive_overrides_invalid : decideChildren false 1#u16 + [.StructurallyInvalid .MissingReference, .Authorized] = ok .Authorized := by + cbv + +theorem any_missing_before_denial : decideChildren false 1#u16 + [.Denied .InvalidSignature, .Indeterminate .StaleStatus] = ok (.Indeterminate .StaleStatus) := by + cbv + +theorem any_smallest_requirement : decideChildren false 1#u16 + [.Indeterminate .StaleStatus, .Indeterminate .ApprovalUnavailable] = + ok (.Indeterminate .ApprovalUnavailable) := by + cbv + +theorem threshold_lower_bound : decideChildren false 1#u16 + [.Authorized, .Indeterminate .StaleStatus, .Denied .InvalidSignature] = ok .Authorized := by + cbv + +theorem threshold_reachable : decideChildren false 2#u16 + [.Authorized, .Indeterminate .StaleStatus, .Denied .InvalidSignature] = + ok (.Indeterminate .StaleStatus) := by + cbv + +theorem threshold_impossible : decideChildren false 3#u16 + [.Authorized, .Indeterminate .StaleStatus, .Denied .InvalidSignature] = + ok (.Denied .InvalidSignature) := by + cbv + +end Auths.Composition.Examples diff --git a/formal/Auths/Composition/Facade.lean b/formal/Auths/Composition/Facade.lean new file mode 100644 index 000000000..d5d1475c4 --- /dev/null +++ b/formal/Auths/Composition/Facade.lean @@ -0,0 +1,63 @@ +import Auths.Composition.ValidationContract +open Aeneas Aeneas.Std Result +open auths_composition Auths.Composition.PlanModel Auths.Composition.ValidationModel Auths.Composition.ValidationRefinement +namespace Auths.Composition.Facade + +def eventOutcome {R : Type} : Event R → BranchOutcome + | .proof _ outcome => outcome + | .aggregate _ _ _ _ outcome => outcome + +theorem event_outcome_exact : + EvaluationEvent.outcome = (fun event => ok (eventOutcome (eventView event))) := by + funext event + cases event <;> rfl + +theorem observer_mut_exact {B : Type} + (branch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) + (state : auths_composition.evaluate.closure B) (event : EvaluationEvent) : + auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut + branch state event = ok state := rfl + +theorem observer_once_exact {B : Type} + (branch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) + (state : auths_composition.evaluate.closure B) (event : EvaluationEvent) : + auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple.call_once + branch state event = ok () := rfl + +theorem evaluate_refines {B : Type} + (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) + (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) + (branchContract : ∀ state reference, nativeBranch.call_mut state reference = ok (modelBranch state reference)) + (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (bounded : LimitsBounded limits) (state : B) : + auths_composition.evaluate nativeBranch plan limits state = + let expected := Auths.Composition.ValidationPublic.evaluateChecked modelBranch + (fun (observer : Unit) _ => observer) (sourceLimits limits) (viewPlan plan) state () + ok (expected.1, expected.2.1) := by + unfold auths_composition.evaluate + have observerContract : ∀ observer event, + (auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple nativeBranch).call_mut observer event = + ok ((), observer) := by intro observer event; rfl + rw [Auths.Composition.ValidationPublic.public_evaluator_refines nativeBranch + (auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple nativeBranch) + modelBranch (fun (observer : Unit) _ => observer) branchContract observerContract plan limits bounded state ()] + simp only [bind_tc_ok] + cases expected : Auths.Composition.ValidationPublic.evaluateChecked modelBranch + (fun (observer : Unit) _ => observer) (sourceLimits limits) (viewPlan plan) state () with + | mk result states => cases states; rfl + +/-- Structural refusal needs no premise about branch correctness or termination. -/ +theorem invalid_plan_preserves_callback {B : Type} + (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) + (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (bounded : LimitsBounded limits) + (invalid : ¬ Valid (sourceLimits limits) (viewPlan plan)) (state : B) : + auths_composition.evaluate nativeBranch plan limits state = + ok (.Err .AuthorizationPlanInvalid, state) := by + unfold auths_composition.evaluate + rw [Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks nativeBranch + (auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple nativeBranch) + plan limits bounded invalid state ()] + rfl + +end Auths.Composition.Facade diff --git a/formal/Auths/Composition/FacadeExamples.lean b/formal/Auths/Composition/FacadeExamples.lean new file mode 100644 index 000000000..db5cef2b8 --- /dev/null +++ b/formal/Auths/Composition/FacadeExamples.lean @@ -0,0 +1,26 @@ +import Auths.Composition.Facade +import Auths.Composition.ValidationExamples +open Aeneas Aeneas.Std Result +open auths_composition Auths.Composition.PlanExamples Auths.Composition.ValidationExamples +set_option cbv.warning false +set_option maxRecDepth 16384 +set_option maxHeartbeats 2000000 +namespace Auths.Composition.FacadeExamples + +theorem conjunction_authorizes : auths_composition.evaluate branch twoLeaves limits 0 = + ok (.Ok .Authorized, 2) := by + rw [Auths.Composition.Facade.evaluate_refines branch (fun count _ => (.Authorized, count + 1)) + (by intro count reference; rfl) twoLeaves limits limits_bounded] + cbv + +theorem duplicate_refused : auths_composition.evaluate branch duplicate limits 5 = + ok (.Err .AuthorizationPlanInvalid, 5) := + Auths.Composition.Facade.invalid_plan_preserves_callback branch duplicate limits limits_bounded duplicate_invalid 5 + +theorem threshold_indeterminate : auths_composition.evaluate mixedBranch + (.mk (.KOfN 2#u16 threeMembers)) limits 0 = + ok (.Ok (.Indeterminate .ExternalFactUnavailable), 3) := by + rw [Auths.Composition.Facade.evaluate_refines mixedBranch (fun count _ => (mixedOutcome count, count + 1)) + (by intro count reference; rfl) (.mk (.KOfN 2#u16 threeMembers)) limits limits_bounded] + cbv +end Auths.Composition.FacadeExamples diff --git a/formal/Auths/Composition/IteratorFacts.lean b/formal/Auths/Composition/IteratorFacts.lean new file mode 100644 index 000000000..ff74148e8 --- /dev/null +++ b/formal/Auths/Composition/IteratorFacts.lean @@ -0,0 +1,38 @@ +import Auths.Composition.ValidationLeaves +open Aeneas Aeneas.Std Result +namespace Auths.Composition.IteratorFacts + +theorem next_nil {T : Type} (iterator : core.slice.iter.Iter T) + (empty : iterator.slice.val.drop iterator.i = []) : + core.slice.iter.IteratorSliceIter.next iterator = ok (none, iterator) := by + have finished : iterator.slice.val.length ≤ iterator.i := by + have size := congrArg List.length empty + simp only [List.length_drop, List.length_nil] at size + omega + have stop : ¬ iterator.i < iterator.slice.len := by + simpa only [Slice.len_val] using Nat.not_lt.mpr finished + unfold core.slice.iter.IteratorSliceIter.next + rw [dif_neg stop] + +theorem next_cons {T : Type} (iterator : core.slice.iter.Iter T) (head : T) (tail : List T) + (remaining : iterator.slice.val.drop iterator.i = head :: tail) : + ∃ next, core.slice.iter.IteratorSliceIter.next iterator = ok (some head, next) ∧ + next.slice.val.drop next.i = tail := by + have within : iterator.i < iterator.slice.val.length := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_cons] at size + omega + have atHead : iterator.slice.val[iterator.i] = head := by + have split := List.drop_eq_getElem_cons within + rw [remaining] at split + exact (List.cons.inj split).1.symm + have guard : iterator.i < iterator.slice.len := by + simpa only [Slice.len_val] using within + refine ⟨{ iterator with i := iterator.i + 1 }, ?_, ?_⟩ + · unfold core.slice.iter.IteratorSliceIter.next + rw [dif_pos guard] + exact congrArg (fun value : T => ok (some value, { iterator with i := iterator.i + 1 })) atHead + · have drop := congrArg (List.drop 1) remaining + simpa [List.drop_drop, Nat.add_comm] using drop + +end Auths.Composition.IteratorFacts diff --git a/formal/Auths/Composition/Model.lean b/formal/Auths/Composition/Model.lean new file mode 100644 index 000000000..b103a6706 --- /dev/null +++ b/formal/Auths/Composition/Model.lean @@ -0,0 +1,151 @@ +import Auths.Composition.Diagnostics + +open auths_composition +namespace Auths.Composition.Model + +def retainMinimum {α : Type} (rank : α → Nat) (previous : Option α) (candidate : α) : Option α := + match previous with + | none => some candidate + | some previous => if rank candidate < rank previous then some candidate else some previous + +structure Summary where + authorized : Nat + indeterminate : Nat + denial : Option auths_composition.auths_model.DenialReason + requirement : Option auths_composition.auths_model.Requirement + +def record (state : Summary) : BranchOutcome → Summary + | .Authorized => { state with authorized := state.authorized + 1 } + | .Denied reason | .StructurallyInvalid reason => + { state with denial := retainMinimum denialRank state.denial reason } + | .Indeterminate requirement => + ⟨state.authorized, state.indeterminate + 1, state.denial, + retainMinimum requirementRank state.requirement requirement⟩ + +def allOutcome (state : Summary) : BranchOutcome := + match state.denial, state.requirement with + | some reason, _ => .Denied reason + | none, some requirement => .Indeterminate requirement + | none, none => .Authorized + +def thresholdOutcome (required : Nat) (state : Summary) : BranchOutcome := + if required ≤ state.authorized then .Authorized + else if required ≤ state.authorized + state.indeterminate then + .Indeterminate (state.requirement.getD .ExternalFactUnavailable) + else .Denied (state.denial.getD .AuthorizationPlanInvalid) + + +def empty : Summary := ⟨0, 0, none, none⟩ + +def summarize (outcomes : List BranchOutcome) : Summary := outcomes.foldl record empty + +def authorizedCount (outcomes : List BranchOutcome) : Nat := + outcomes.countP fun | .Authorized => true | _ => false + +def indeterminateCount (outcomes : List BranchOutcome) : Nat := + outcomes.countP fun | .Indeterminate _ => true | _ => false + +def denialOf : BranchOutcome → Option auths_composition.auths_model.DenialReason + | .Denied reason | .StructurallyInvalid reason => some reason + | _ => none + +def requirementOf : BranchOutcome → Option auths_composition.auths_model.Requirement + | .Indeterminate requirement => some requirement + | _ => none + +def Least {α : Type} (rank : α → Nat) (inputs : List α) : Option α → Prop + | none => inputs = [] + | some value => value ∈ inputs ∧ ∀ candidate ∈ inputs, rank value ≤ rank candidate + +theorem retain_minimum_least {α : Type} (rank : α → Nat) (inputs : List α) + (previous : Option α) (candidate : α) (least : Least rank inputs previous) : + Least rank (inputs ++ [candidate]) (retainMinimum rank previous candidate) := by + cases previous with + | none => simp_all [Least, retainMinimum] + | some previous => + simp only [Least] at least + simp only [retainMinimum] + split <;> rename_i before + · simp only [Least, List.mem_append, List.mem_singleton] + constructor + · exact Or.inr trivial + · intro value present + rcases present with present | rfl + · have bound := least.2 value present + omega + · omega + · simp only [Least, List.mem_append, List.mem_singleton] + constructor + · exact Or.inl least.1 + · intro value present + rcases present with present | rfl + · exact least.2 value present + · omega + +def Matches (state : Summary) (outcomes : List BranchOutcome) : Prop := + state.authorized = authorizedCount outcomes ∧ + state.indeterminate = indeterminateCount outcomes ∧ + Least denialRank (outcomes.filterMap denialOf) state.denial ∧ + Least requirementRank (outcomes.filterMap requirementOf) state.requirement + +theorem record_matches (state : Summary) (outcomes : List BranchOutcome) + (outcome : BranchOutcome) (invariant : Matches state outcomes) : + Matches (record state outcome) (outcomes ++ [outcome]) := by + rcases invariant with ⟨authorized, indeterminate, denial, requirement⟩ + have denialNext (candidate : auths_composition.auths_model.DenialReason) := + retain_minimum_least denialRank (outcomes.filterMap denialOf) state.denial candidate denial + have requirementNext (candidate : auths_composition.auths_model.Requirement) := + retain_minimum_least requirementRank (outcomes.filterMap requirementOf) state.requirement candidate requirement + cases h : outcome <;> + simp_all [Matches, record, authorizedCount, indeterminateCount, denialOf, + requirementOf, List.countP_append] + +theorem summarize_matches (outcomes : List BranchOutcome) : + Matches (summarize outcomes) outcomes := by + induction outcomes using List.reverseRecOn with + | nil => simp [Matches, summarize, empty, authorizedCount, indeterminateCount, Least] + | append_singleton previous outcome ih => + simpa [summarize, List.foldl_append] using record_matches _ _ outcome ih + +theorem threshold_authorized_iff (required : Nat) (state : Summary) : + thresholdOutcome required state = .Authorized ↔ required ≤ state.authorized := by + unfold thresholdOutcome + split <;> (try split) <;> simp_all + +theorem all_authorized_iff (state : Summary) : + allOutcome state = .Authorized ↔ state.denial = none ∧ state.requirement = none := by + cases hd : state.denial <;> cases hi : state.requirement <;> + simp [allOutcome, hd, hi] + +theorem least_none_iff_empty {α : Type} (rank : α → Nat) (inputs : List α) + (selected : Option α) (least : Least rank inputs selected) : + selected = none ↔ inputs = [] := by + cases selected with + | none => simp_all [Least] + | some value => + simp only [Least] at least + constructor + · intro impossible + cases impossible + · intro empty + simp [empty] at least + +theorem all_children_authorize_iff (outcomes : List BranchOutcome) : + allOutcome (summarize outcomes) = .Authorized ↔ + ∀ outcome ∈ outcomes, outcome = .Authorized := by + have invariant := summarize_matches outcomes + rw [all_authorized_iff, + least_none_iff_empty denialRank _ _ invariant.2.2.1, + least_none_iff_empty requirementRank _ _ invariant.2.2.2] + clear invariant + induction outcomes with + | nil => simp + | cons outcome remaining ih => + cases h : outcome <;> simp_all [denialOf, requirementOf] + +theorem threshold_children_authorize_iff (required : Nat) (outcomes : List BranchOutcome) : + thresholdOutcome required (summarize outcomes) = .Authorized ↔ + required ≤ authorizedCount outcomes := by + rw [threshold_authorized_iff, (summarize_matches outcomes).1] + +end Auths.Composition.Model diff --git a/formal/Auths/Composition/Order.lean b/formal/Auths/Composition/Order.lean new file mode 100644 index 000000000..f98a5d085 --- /dev/null +++ b/formal/Auths/Composition/Order.lean @@ -0,0 +1,111 @@ +import qualification.aeneas.generated.composition.Funs +import Mathlib.Data.List.Lex +open Aeneas Aeneas.Std Result +namespace Auths.Composition.Order + +abbrev listComparison {T : Type} := @Array.Insts.CoreCmpOrd.compareValues T + +theorem array_comparison {T : Type} {N : Std.Usize} (order : core.cmp.Ord T) + (left right : Array T N) : + Array.Insts.CoreCmpOrd.cmp order left right = listComparison order left.val right.val := by + rfl + +theorem byte_comparison (left right : Std.U8) : + core.cmp.OrdU8.cmp left right = ok (compare left.val right.val) := rfl + +theorem bytes_comparison (left right : List Std.U8) : + listComparison core.cmp.OrdU8 left right = + ok (List.compareLex compare (left.map UScalar.val) (right.map UScalar.val)) := by + unfold listComparison + induction left generalizing right with + | nil => cases right <;> rfl + | cons head tail ih => + cases right with + | nil => rfl + | cons other rest => + rw [Array.Insts.CoreCmpOrd.compareValues_cons_cons, byte_comparison] + simp only [bind_tc_ok, List.map_cons] + cases comparison : compare head.val other.val <;> + simp [comparison, ih, List.compareLex] + +def referenceKey (reference : auths_composition.auths_model.ProofRef) : List Nat := + reference.val.map UScalar.val + +theorem reference_key_injective : Function.Injective referenceKey := by + intro left right same + apply Subtype.ext + apply (List.map_injective_iff.mpr (show Function.Injective (fun byte : Std.U8 => byte.val) from by + intro first second equal + scalar_tac)) + exact same + +instance referenceDecidableEq : DecidableEq auths_composition.auths_model.ProofRef := + fun left right => decidable_of_iff (referenceKey left = referenceKey right) + reference_key_injective.eq_iff + +theorem reference_comparison (left right : auths_composition.auths_model.ProofRef) : + auths_composition.auths_model.ProofRef.Insts.CoreCmpOrd.cmp left right = + ok (List.compareLex compare (referenceKey left) (referenceKey right)) := by + unfold auths_composition.auths_model.ProofRef.Insts.CoreCmpOrd.cmp + auths_composition.auths_model.Digest.Insts.CoreCmpOrd.cmp + rw [array_comparison] + exact bytes_comparison left.val right.val + +theorem nat_lists_lt (left right : List Nat) : + List.compareLex compare left right = .lt ↔ left < right := by + induction left generalizing right with + | nil => cases right <;> simp [List.compareLex] + | cons head tail ih => + cases right with + | nil => simp [List.compareLex] + | cons other rest => + rw [List.compareLex_cons_cons, List.cons_lt_cons_iff] + cases comparison : compare head other with + | lt => + have less := compare_lt_iff_lt.mp comparison + simp [less] + | eq => + have same := compare_eq_iff_eq.mp comparison + subst other + simpa using ih rest + | gt => + have more := compare_gt_iff_gt.mp comparison + have notLess := not_lt_of_gt more + have different := ne_of_gt more + simp [notLess, different] + +theorem nat_lists_eq (left right : List Nat) : + List.compareLex compare left right = .eq ↔ left = right := by + induction left generalizing right with + | nil => cases right <;> simp [List.compareLex] + | cons head tail ih => + cases right with + | nil => simp [List.compareLex] + | cons other rest => + rw [List.compareLex_cons_cons, Ordering.then_eq_eq] + simp [ih] + +theorem nat_lists_gt (left right : List Nat) : + List.compareLex compare left right = .gt ↔ right < left := by + induction left generalizing right with + | nil => cases right <;> simp [List.compareLex] + | cons head tail ih => + cases right with + | nil => simp [List.compareLex] + | cons other rest => + rw [List.compareLex_cons_cons, List.cons_lt_cons_iff] + cases comparison : compare head other with + | lt => + have less := compare_lt_iff_lt.mp comparison + have notMore := not_lt_of_gt less + have different := ne_of_gt less + simp [notMore, different] + | eq => + have same := compare_eq_iff_eq.mp comparison + subst other + simpa using ih rest + | gt => + have more := compare_gt_iff_gt.mp comparison + simp [more] + +end Auths.Composition.Order diff --git a/formal/Auths/Composition/Plan.lean b/formal/Auths/Composition/Plan.lean new file mode 100644 index 000000000..24102e4d8 --- /dev/null +++ b/formal/Auths/Composition/Plan.lean @@ -0,0 +1,92 @@ +import Auths.Composition.Refinement +open Aeneas Aeneas.Std Result +open auths_composition +namespace Auths.Composition.PlanModel +open Auths.Composition.Model + +inductive Plan (Reference : Type) where + | proof (reference : Reference) + | allOf (members : List (Plan Reference)) + | anyOf (members : List (Plan Reference)) + | kOfN (required : Nat) (members : List (Plan Reference)) + +inductive Event (Reference : Type) where + | proof (reference : Reference) (outcome : BranchOutcome) + | aggregate (children required authorized indeterminate : Nat) (outcome : BranchOutcome) + +def eventView : EvaluationEvent → Event auths_model.ProofRef + | .Proof reference outcome => .proof reference outcome + | .Aggregate children required authorized indeterminate outcome => + .aggregate children.val required.val authorized.val indeterminate.val outcome + +mutual + def viewPlan (plan : auths_model.AuthorizationPlan) : Plan auths_model.ProofRef := + match plan with + | .mk node => viewNode node + termination_by sizeOf plan + + def viewNode (node : auths_model.AuthorizationPlanNode) : Plan auths_model.ProofRef := + match node with + | .Proof reference => .proof reference + | .AllOf members => .allOf (viewMembers members) + | .AnyOf members => .anyOf (viewMembers members) + | .KOfN required members => .kOfN required.val (viewMembers members) + termination_by sizeOf node + + def viewMembers (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) : + List (Plan auths_model.ProofRef) := + match members with + | .mk _ elements _ => viewElements elements + termination_by sizeOf members + + def viewElements {n : Nat} (elements : auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan n) : + List (Plan auths_model.ProofRef) := + match elements with + | .nil => [] + | .cons head tail => viewPlan head :: viewElements tail + termination_by sizeOf elements +end + +mutual + def evaluate {Reference B O : Type} + (branch : B → Reference → BranchOutcome × B) + (observe : O → Event Reference → O) + (plan : Plan Reference) (state : B) (observer : O) : BranchOutcome × B × O := + match plan with + | .proof reference => + let (outcome, next) := branch state reference + (outcome, next, observe observer (.proof reference outcome)) + | .allOf members => + let (outcomes, next, observed) := evaluateChildren branch observe members state observer + let summary := summarize outcomes + let outcome := allOutcome summary + (outcome, next, observe observed (.aggregate members.length (min 65535 members.length) + summary.authorized summary.indeterminate outcome)) + | .anyOf members => + let (outcomes, next, observed) := evaluateChildren branch observe members state observer + let summary := summarize outcomes + let outcome := thresholdOutcome 1 summary + (outcome, next, observe observed (.aggregate members.length 1 + summary.authorized summary.indeterminate outcome)) + | .kOfN required members => + let (outcomes, next, observed) := evaluateChildren branch observe members state observer + let summary := summarize outcomes + let outcome := thresholdOutcome required summary + (outcome, next, observe observed (.aggregate members.length required + summary.authorized summary.indeterminate outcome)) + termination_by sizeOf plan + + def evaluateChildren {Reference B O : Type} + (branch : B → Reference → BranchOutcome × B) + (observe : O → Event Reference → O) + (members : List (Plan Reference)) (state : B) (observer : O) : List BranchOutcome × B × O := + match members with + | [] => ([], state, observer) + | first :: remaining => + let (outcome, next, observed) := evaluate branch observe first state observer + let (outcomes, final, finalObserver) := evaluateChildren branch observe remaining next observed + (outcome :: outcomes, final, finalObserver) + termination_by sizeOf members +end + +end Auths.Composition.PlanModel diff --git a/formal/Auths/Composition/PlanExamples.lean b/formal/Auths/Composition/PlanExamples.lean new file mode 100644 index 000000000..1ec5fdb54 --- /dev/null +++ b/formal/Auths/Composition/PlanExamples.lean @@ -0,0 +1,83 @@ +import Auths.Composition.Refinement +import Auths.Codec.Evaluation +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +open auths_composition +set_option cbv.warning false +set_option maxRecDepth 16384 +set_option maxHeartbeats 2000000 +namespace Auths.Composition.PlanExamples + +def branch : core.ops.function.FnMut Nat auths_model.ProofRef BranchOutcome where + FnOnceInst := ⟨fun _ _ => ok .Authorized⟩ + call_mut := fun count _ => ok (.Authorized, count + 1) + +def observer : core.ops.function.FnMut Nat EvaluationEvent Unit where + FnOnceInst := ⟨fun _ _ => ok ()⟩ + call_mut := fun count _ => ok ((), count + 1) + +def reference (tag : Std.U8) : auths_model.ProofRef := + ⟨List.replicate 32 tag, by simp⟩ + +def leaf (tag : Std.U8) : auths_model.AuthorizationPlan := + .mk (.Proof (reference tag)) + +def twoLeaves : auths_model.AuthorizationPlan := + .mk (.AllOf (auths_composition.alloc.vec.Vec.ofBase + ⟨[leaf 1#u8, leaf 2#u8], by scalar_tac⟩)) + +attribute [local cbv_eval] Auths.Composition.Refinement.threshold_exact +attribute [local cbv_eval] evaluate_node.eq_def evaluate_members.eq_def evaluate_members_loop.eq_def + +theorem two_leaf_conjunction : evaluate_node branch observer twoLeaves 0 0 = + ok (.Authorized, 2, 3) := by + cbv + +def mixedOutcome : Nat → BranchOutcome + | 0 => .Denied .PermissionNotGranted + | 1 => .Authorized + | _ => .Indeterminate .ExternalFactUnavailable + +def mixedBranch : core.ops.function.FnMut Nat auths_model.ProofRef BranchOutcome where + FnOnceInst := ⟨fun count _ => ok (mixedOutcome count)⟩ + call_mut := fun count _ => ok (mixedOutcome count, count + 1) + +def events : core.ops.function.FnMut (List EvaluationEvent) EvaluationEvent Unit where + FnOnceInst := ⟨fun _ _ => ok ()⟩ + call_mut := fun trace event => ok ((), trace ++ [event]) + +def threeMembers : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan := + auths_composition.alloc.vec.Vec.ofBase + ⟨[leaf 1#u8, leaf 2#u8, leaf 3#u8], by scalar_tac⟩ + +def mixedLeaves : List EvaluationEvent := + [.Proof (reference 1#u8) (.Denied .PermissionNotGranted), + .Proof (reference 2#u8) .Authorized, + .Proof (reference 3#u8) (.Indeterminate .ExternalFactUnavailable)] + +theorem all_visits_after_denial : + evaluate_node mixedBranch events (.mk (.AllOf threeMembers)) 0 [] = + ok (.Denied .PermissionNotGranted, 3, + mixedLeaves ++ [.Aggregate 3#usize 3#u16 1#usize 1#usize (.Denied .PermissionNotGranted)]) := by + cbv + +theorem any_visits_after_authorization : + evaluate_node mixedBranch events (.mk (.AnyOf threeMembers)) 0 [] = + ok (.Authorized, 3, + mixedLeaves ++ [.Aggregate 3#usize 1#u16 1#usize 1#usize .Authorized]) := by + cbv + +theorem threshold_indeterminate : + evaluate_node mixedBranch events (.mk (.KOfN 2#u16 threeMembers)) 0 [] = + ok (.Indeterminate .ExternalFactUnavailable, 3, + mixedLeaves ++ [.Aggregate 3#usize 2#u16 1#usize 1#usize + (.Indeterminate .ExternalFactUnavailable)]) := by + cbv + +theorem threshold_refused : + evaluate_node mixedBranch events (.mk (.KOfN 3#u16 threeMembers)) 0 [] = + ok (.Denied .PermissionNotGranted, 3, + mixedLeaves ++ [.Aggregate 3#usize 3#u16 1#usize 1#usize (.Denied .PermissionNotGranted)]) := by + cbv + +end Auths.Composition.PlanExamples diff --git a/formal/Auths/Composition/Refinement.lean b/formal/Auths/Composition/Refinement.lean new file mode 100644 index 000000000..e14da5285 --- /dev/null +++ b/formal/Auths/Composition/Refinement.lean @@ -0,0 +1,154 @@ +import Auths.Composition.Model +import qualification.aeneas.generated.composition.Funs + +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_composition +open Auths.Composition.Model +namespace Auths.Composition.Refinement +set_option maxHeartbeats 2000000 + +def view (state : auths_composition.summary.Summary) : Summary := + ⟨state.authorized.val, state.indeterminate.val, state.denial, state.requirement⟩ + +@[step] theorem denial_order_exact (value : auths_composition.auths_model.DenialReason) : + auths_composition.auths_model.DenialReason.code_order value ⦃ result => result.val = denialRank value ⦄ := by + cases h : value <;> simp [auths_composition.auths_model.DenialReason.code_order, denialRank, spec_ok] + +@[step] theorem denial_precedes_exact (left right : auths_composition.auths_model.DenialReason) : + auths_composition.auths_model.DenialReason.code_precedes left right + ⦃ result => result = decide (denialRank left < denialRank right) ⦄ := by + unfold auths_composition.auths_model.DenialReason.code_precedes + step as ⟨l, hl⟩ + step as ⟨r, hr⟩ + simp [UScalar.lt_equiv, hl, hr] + +@[step] theorem requirement_order_exact (value : auths_composition.auths_model.Requirement) : + auths_composition.auths_model.Requirement.code_order value ⦃ result => result.val = requirementRank value ⦄ := by + cases h : value <;> simp [auths_composition.auths_model.Requirement.code_order, requirementRank, spec_ok] + +@[step] theorem requirement_precedes_exact (left right : auths_composition.auths_model.Requirement) : + auths_composition.auths_model.Requirement.code_precedes left right + ⦃ result => result = decide (requirementRank left < requirementRank right) ⦄ := by + unfold auths_composition.auths_model.Requirement.code_precedes + step as ⟨l, hl⟩ + step as ⟨r, hr⟩ + simp [UScalar.lt_equiv, hl, hr] + +@[step] theorem push_exact (state : auths_composition.summary.Summary) (outcome : BranchOutcome) + (authorizedFits : state.authorized.val + 1 ≤ Usize.max) + (indeterminateFits : state.indeterminate.val + 1 ≤ Usize.max) : + auths_composition.summary.push state outcome + ⦃ result => view result = record (view state) outcome ⦄ := by + cases h : outcome with + | Authorized => + unfold auths_composition.summary.push + step as ⟨next, nextEq⟩ + simp [view, record, nextEq] + | Denied reason | StructurallyInvalid reason => + unfold auths_composition.summary.push + cases h : state.denial with + | none => simp [h, spec_ok, view, record, retainMinimum] + | some previous => + step as ⟨before, beforeEq⟩ + simp only [beforeEq] + split <;> simp_all [spec_ok, view, record, retainMinimum] + | Indeterminate requirement => + unfold auths_composition.summary.push + step as ⟨next, nextEq⟩ + cases h : state.requirement with + | none => simp [h, spec_ok, view, record, retainMinimum, nextEq] + | some previous => + step as ⟨before, beforeEq⟩ + simp only [beforeEq] + split <;> simp_all [spec_ok, view, record, retainMinimum] + +theorem all_exact (state : auths_composition.summary.Summary) : + auths_composition.summary.all state = ok (allOutcome (view state)) := by + cases hd : state.denial <;> cases hi : state.requirement <;> + simp [auths_composition.summary.all, allOutcome, view, hd, hi] + +theorem saturating_add_exact (left right : Std.Usize) : + (core.num.Usize.saturating_add left right).val = min Usize.max (left.val + right.val) := by + simp only [core.num.Usize.saturating_add, UScalar.saturating_add, UScalar.val, + BitVec.toNat_ofNat, UScalar.max_USize_eq] + apply Nat.mod_eq_of_lt + have maximum : Usize.max < 2 ^ UScalarTy.Usize.numBits := by + simp only [Usize.max, Usize.numBits] + exact Nat.sub_lt (Nat.two_pow_pos _) (by decide) + exact Nat.lt_of_le_of_lt (Nat.min_le_left _ _) maximum + +theorem threshold_exact (state : auths_composition.summary.Summary) (required : Std.U16) : + auths_composition.summary.threshold state required = + ok (thresholdOutcome required.val (view state)) := by + have requiredBound : required.val ≤ Usize.max := by scalar_tac + unfold auths_composition.summary.threshold evaluate_threshold_counts + auths_composition.auths_algebra_kernel.generated.threshold_counts + simp only [lift, bind_tc_ok, UScalar.le_equiv, + core.convert.num.FromUsizeU16.from_val_eq, saturating_add_exact] + by_cases authorized : required.val ≤ state.authorized.val + · simp [authorized, thresholdOutcome, view] + · by_cases possible : required.val ≤ state.authorized.val + state.indeterminate.val + · have saturated : required.val ≤ min Usize.max + (state.authorized.val + state.indeterminate.val) := Nat.le_min.mpr ⟨requiredBound, possible⟩ + cases h : state.requirement <;> + simp [authorized, possible, saturated, thresholdOutcome, view, h] + · have saturated : ¬ required.val ≤ min Usize.max + (state.authorized.val + state.indeterminate.val) := by omega + cases h : state.denial <;> + simp [authorized, possible, saturated, thresholdOutcome, view, h] + + +theorem denial_precedes_lexical (left right : auths_composition.auths_model.DenialReason) : + auths_composition.auths_model.DenialReason.code_precedes left right = + ok (decide (List.Lex (· < ·) (denialCode left) (denialCode right))) := by + obtain ⟨result, evaluates, meaning⟩ := spec_imp_exists (denial_precedes_exact left right) + simpa only [meaning, denial_rank_lexical] using evaluates + +theorem requirement_precedes_lexical (left right : auths_composition.auths_model.Requirement) : + auths_composition.auths_model.Requirement.code_precedes left right = + ok (decide (List.Lex (· < ·) (requirementCode left) (requirementCode right))) := by + obtain ⟨result, evaluates, meaning⟩ := spec_imp_exists (requirement_precedes_exact left right) + simpa only [meaning, requirement_rank_lexical] using evaluates + +theorem threshold_authorized_exact (state : auths_composition.summary.Summary) (required : Std.U16) : + auths_composition.summary.threshold state required = ok .Authorized ↔ + required.val ≤ state.authorized.val := by + rw [threshold_exact] + simpa only [Result.ok.injEq, view] using threshold_authorized_iff required.val (view state) + +def sourceFold (state : auths_composition.summary.Summary) : + List BranchOutcome → Result auths_composition.summary.Summary + | [] => ok state + | outcome :: remaining => do + let next ← auths_composition.summary.push state outcome + sourceFold next remaining + +theorem source_fold_exact (state : auths_composition.summary.Summary) (outcomes : List BranchOutcome) + (authorizedFits : state.authorized.val + outcomes.length ≤ Usize.max) + (indeterminateFits : state.indeterminate.val + outcomes.length ≤ Usize.max) : + sourceFold state outcomes + ⦃ result => view result = outcomes.foldl record (view state) ⦄ := by + induction outcomes generalizing state with + | nil => simp [sourceFold] + | cons outcome remaining ih => + simp only [sourceFold] + have authorizedStep : state.authorized.val + 1 ≤ Usize.max := by + simp only [List.length_cons] at authorizedFits + omega + have indeterminateStep : state.indeterminate.val + 1 ≤ Usize.max := by + simp only [List.length_cons] at indeterminateFits + omega + step as ⟨next, nextEq⟩ + have authorizedNext : next.authorized.val + remaining.length ≤ Usize.max := by + have counts := congrArg Summary.authorized nextEq + cases h : outcome <;> simp_all [view, record] <;> omega + have indeterminateNext : next.indeterminate.val + remaining.length ≤ Usize.max := by + have counts := congrArg Summary.indeterminate nextEq + cases h : outcome <;> simp_all [view, record] <;> omega + have continuation := ih next authorizedNext indeterminateNext + apply spec_mono continuation + intro result meaning + simpa only [List.foldl_cons, nextEq] using meaning + +end Auths.Composition.Refinement diff --git a/formal/Auths/Composition/SetModel.lean b/formal/Auths/Composition/SetModel.lean new file mode 100644 index 000000000..d9d3fa5bc --- /dev/null +++ b/formal/Auths/Composition/SetModel.lean @@ -0,0 +1,112 @@ +import Auths.Composition.Order +open Aeneas Aeneas.Std Result +open auths_composition Auths.Composition.Order +namespace Auths.Composition.SetModel +abbrev Reference := auths_model.ProofRef +abbrev referenceOrder := auths_model.ProofRef.Insts.CoreCmpOrd + +def Before (left right : Reference) : Prop := referenceKey left < referenceKey right + +theorem order_comparison (left right : Reference) : + referenceOrder.cmp left right = ok (List.compareLex compare (referenceKey left) (referenceKey right)) := + reference_comparison left right + +theorem insert_values (value : Reference) (values : List Reference) + (ordered : values.Pairwise Before) : + ∃ added updated, + alloc.collections.btree.set.insertValues referenceOrder value values = ok (added, updated) ∧ + updated.Pairwise Before ∧ + (∀ item, item ∈ updated ↔ item = value ∨ item ∈ values) ∧ + (added = true ↔ value ∉ values) ∧ + updated.length = values.length + (if added then 1 else 0) := by + induction values with + | nil => + refine ⟨true, [value], rfl, ?_, ?_, ?_, ?_⟩ <;> simp [Before] + | cons head tail ih => + obtain ⟨headLess, tailOrdered⟩ := List.pairwise_cons.mp ordered + have meaning := order_comparison value head + cases comparison : List.compareLex compare (referenceKey value) (referenceKey head) with + | lt => + have less : Before value head := (nat_lists_lt _ _).mp comparison + have absent : value ∉ head :: tail := by + intro member + rcases List.mem_cons.mp member with same | member + · subst value; exact (lt_irrefl (referenceKey head)) less + · exact (lt_asymm less) (headLess value member) + refine ⟨true, value :: head :: tail, ?_, ?_, ?_, ?_, ?_⟩ + · rw [alloc.collections.btree.set.insertValues, meaning, comparison] + rfl + · apply List.pairwise_cons.mpr + refine ⟨?_, ordered⟩ + intro item member + rcases List.mem_cons.mp member with same | member + · subst item; exact less + · exact lt_trans less (headLess item member) + · intro item; simp + · simp [absent] + · simp + | eq => + have same : value = head := reference_key_injective ((nat_lists_eq _ _).mp comparison) + subst value + refine ⟨false, head :: tail, ?_, ordered, ?_, ?_, ?_⟩ + · rw [alloc.collections.btree.set.insertValues, meaning, comparison] + rfl + · intro item; simp only [List.mem_cons]; tauto + · simp + · simp + | gt => + have more : Before head value := (nat_lists_gt _ _).mp comparison + have different : value ≠ head := by + intro same + subst value + exact (lt_irrefl (referenceKey head)) more + obtain ⟨added, updated, executes, sorted, members, fresh, size⟩ := ih tailOrdered + refine ⟨added, head :: updated, ?_, ?_, ?_, ?_, ?_⟩ + · rw [alloc.collections.btree.set.insertValues, meaning, comparison] + simp only [bind_tc_ok] + rw [executes] + rfl + · apply List.pairwise_cons.mpr + refine ⟨?_, sorted⟩ + intro item member + rcases (members item).mp member with same | member + · subst item; exact more + · exact headLess item member + · intro item + simp only [List.mem_cons, members] + tauto + · simpa [different] using fresh + · simp only [List.length_cons] + omega + +theorem ordered_nodup (values : List Reference) (ordered : values.Pairwise Before) : values.Nodup := by + induction values with + | nil => simp + | cons head tail ih => + obtain ⟨headLess, tailOrdered⟩ := List.pairwise_cons.mp ordered + apply List.nodup_cons.mpr + refine ⟨?_, ih tailOrdered⟩ + intro member + exact (lt_irrefl (referenceKey head)) (headLess head member) + +theorem insert_set (allocator : core.clone.Clone Global) + (value : Reference) (state : alloc.collections.btree.set.BTreeSet Reference Global) + (ordered : state.values.Pairwise Before) (room : state.values.length < Usize.max) : + ∃ added updated, + alloc.collections.btree.set.BTreeSet.insert allocator referenceOrder state value = ok (added, updated) ∧ + updated.values.Pairwise Before ∧ + (∀ item, item ∈ updated.values ↔ item = value ∨ item ∈ state.values) ∧ + (added = true ↔ value ∉ state.values) ∧ + updated.values.length = state.values.length + (if added then 1 else 0) := by + obtain ⟨added, values, executes, sorted, members, fresh, size⟩ := insert_values value state.values ordered + have growth : values.length ≤ state.values.length + 1 := by + rw [size] + split <;> omega + have bound : values.length ≤ Usize.max := by omega + refine ⟨added, ⟨values, bound⟩, ?_, sorted, members, fresh, size⟩ + unfold alloc.collections.btree.set.BTreeSet.insert + rw [executes] + simp only [uncurry, Bind.bind, Aeneas.Std.bind] + rw [dif_pos bound] + +end Auths.Composition.SetModel diff --git a/formal/Auths/Composition/Traversal.lean b/formal/Auths/Composition/Traversal.lean new file mode 100644 index 000000000..7c42bef25 --- /dev/null +++ b/formal/Auths/Composition/Traversal.lean @@ -0,0 +1,306 @@ +import Auths.Composition.Plan +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_composition +open Auths.Composition.Model Auths.Composition.Refinement Auths.Composition.PlanModel +namespace Auths.Composition.Traversal +set_option maxHeartbeats 2000000 + +theorem view_elements_length {n : Nat} + (elements : auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan n) : + (viewElements elements).length = n := by + induction elements with + | nil => simp [viewElements] + | cons head tail ih => simp [viewElements, ih] + +theorem view_members_length (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) : + (viewMembers members).length = members.size := by + cases members + simp [viewMembers, view_elements_length] + +def u16Count (count : Std.Usize) : Result Std.U16 := do + let converted ← U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from count + core.result.Result.unwrap_or converted core.num.U16.MAX + +@[step] theorem u16_count_exact (count : Std.Usize) : + u16Count count ⦃ result => result.val = min 65535 count.val ⦄ := by + unfold u16Count U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + core.num.tryFromUScalar core.result.Result.unwrap_or + split <;> rename_i within + · have bound : count.val ≤ 65535 := by simpa [U16.max_eq] using within + simp [UScalar.cast_val_eq, Nat.min_eq_right bound] + omega + · have above : 65535 < count.val := by simpa [U16.max_eq] using within + simp [core.num.U16.MAX, U16.rMax, Nat.min_eq_left (Nat.le_of_lt above)] + +@[step] theorem summary_default_exact : + summary.Summary.Insts.CoreDefaultDefault.default ⦃ state => view state = empty ⦄ := by + simp only [summary.Summary.Insts.CoreDefaultDefault.default, + core.option.Option.Insts.CoreDefaultDefault.default, bind_tc_ok, + core.default.DefaultUsize.default, view, empty, spec_ok, + Summary.mk.injEq, and_true, and_self] + change (0 : BitVec UScalarTy.Usize.numBits).toNat = 0 + rfl + +theorem eq_of_spec {α : Type} (program : Result α) (expected : α) + (contract : program ⦃ result => result = expected ⦄) : program = ok expected := by + obtain ⟨result, evaluates, meaning⟩ := spec_imp_exists contract + simpa only [meaning] using evaluates + +theorem count_bind {α : Type} (count : Std.Usize) (next : Std.U16 → Result α) : + (do let converted ← U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from count + let value ← core.result.Result.unwrap_or converted core.num.U16.MAX + next value) = (do let value ← u16Count count; next value) := by + simp only [u16Count, bind_assoc_eq] + +section +variable {B O : Type} +variable (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) +variable (nativeObserver : core.ops.function.FnMut O EvaluationEvent Unit) +variable (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) +variable (modelObserver : O → Event auths_model.ProofRef → O) +variable (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = ok (modelBranch state reference)) +variable (observerContract : ∀ state event, + nativeObserver.call_mut state event = ok ((), modelObserver state (eventView event))) + +theorem children_count (members : List (Plan auths_model.ProofRef)) (state : B) (observer : O) : + (evaluateChildren modelBranch modelObserver members state observer).1.length = members.length := by + induction members generalizing state observer with + | nil => simp [evaluateChildren] + | cons head tail ih => + generalize expected : Auths.Composition.PlanModel.evaluate modelBranch modelObserver head state observer = child + rcases child with ⟨outcome, next, observed⟩ + simp [evaluateChildren, expected, ih] + +include branchContract observerContract + +theorem proof_leaf_exact (reference : auths_model.ProofRef) (state : B) (observer : O) : + evaluate_node nativeBranch nativeObserver (.mk (.Proof reference)) state observer = + ok (Auths.Composition.PlanModel.evaluate modelBranch modelObserver (.proof reference) state observer) := by + rw [evaluate_node.eq_def] + simp only [auths_model.AuthorizationPlan.as_ref, auths_model.AuthorizationPlan._0, + bind_tc_ok, branchContract] + cases outcome : modelBranch state reference with + | mk result next => + simp [outcome, observerContract, Auths.Composition.PlanModel.evaluate, eventView] + +def NodeCorrect (plan : auths_model.AuthorizationPlan) : Prop := + ∀ state observer, + evaluate_node nativeBranch nativeObserver plan state observer = + ok (Auths.Composition.PlanModel.evaluate modelBranch modelObserver (viewPlan plan) state observer) + +def ElementsCorrect {n : Nat} + (elements : auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan n) : Prop := + ∀ (members : Slice auths_model.AuthorizationPlan) (index : Std.Usize) + (branch : B) (observer : O) (state : summary.Summary), + members.val.drop index.val = elements.toList → + state.authorized.val + n ≤ Usize.max → + state.indeterminate.val + n ≤ Usize.max → + evaluate_members_loop nativeBranch nativeObserver members branch observer state index + ⦃ result => + let expected := evaluateChildren modelBranch modelObserver (viewElements elements) branch observer + (view result.1, result.2.1, result.2.2) = + (expected.1.foldl record (view state), expected.2.1, expected.2.2) ⦄ + +omit branchContract observerContract in + theorem nil_correct : ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver + (auths_composition.alloc.vec.SizedList.nil : + auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan 0) := by + intro members index branch observer state remaining authorizedFits indeterminateFits + have endOfInput : members.val.length ≤ index.val := by + have length := congrArg List.length remaining + simp only [auths_composition.alloc.vec.SizedList.toList, List.length_drop, List.length_nil] at length + omega + have stop : ¬ index < members.len := by + simpa only [UScalar.lt_equiv, Slice.len_val, Nat.not_lt] using endOfInput + rw [evaluate_members_loop.eq_def] + simp [stop, viewElements, evaluateChildren] + +omit branchContract observerContract in + theorem cons_correct {n : Nat} (head : auths_model.AuthorizationPlan) + (tail : auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan n) + (headCorrect : NodeCorrect nativeBranch nativeObserver modelBranch modelObserver head) + (tailCorrect : ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver tail) : + ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver (.cons head tail) := by + intro members index branch observer state remaining authorizedFits indeterminateFits + simp only [auths_composition.alloc.vec.SizedList.toList] at remaining + have within : index.val < members.val.length := by + have length := congrArg List.length remaining + simp only [List.length_drop, List.length_cons, + auths_composition.alloc.vec.SizedList.length] at length + omega + have atHead : members.val[index.val] = head := by + have split := List.drop_eq_getElem_cons within + rw [remaining] at split + exact (List.cons.inj split).1.symm + have guard : index < members.len := by + simpa only [UScalar.lt_equiv, Slice.len_val] using within + rw [evaluate_members_loop.eq_def] + simp only [guard, ↓reduceIte] + step as ⟨found, foundEq⟩ + have same : found = head := foundEq.trans atHead + rw [same] + unfold NodeCorrect at headCorrect + rw [headCorrect branch observer] + generalize expected : Auths.Composition.PlanModel.evaluate modelBranch modelObserver (viewPlan head) branch observer = child + rcases child with ⟨outcome, nextBranch, nextObserver⟩ + simp only [bind_tc_ok] + have authorizedStep : state.authorized.val + 1 ≤ Usize.max := by omega + have indeterminateStep : state.indeterminate.val + 1 ≤ Usize.max := by omega + step as ⟨nextState, nextEq⟩ + have incrementFits : index.val + 1 ≤ Usize.max := by + have := members.property + omega + step as ⟨nextIndex, nextIndexEq⟩ + have remainingTail : members.val.drop nextIndex.val = tail.toList := by + rw [nextIndexEq] + have drop := congrArg (List.drop 1) remaining + simpa [List.drop_drop, Nat.add_comm] using drop + have authorizedNext : nextState.authorized.val + n ≤ Usize.max := by + have count := congrArg Summary.authorized nextEq + cases h : outcome <;> simp_all [view, record] <;> omega + have indeterminateNext : nextState.indeterminate.val + n ≤ Usize.max := by + have count := congrArg Summary.indeterminate nextEq + cases h : outcome <;> simp_all [view, record] <;> omega + have continuation := tailCorrect members nextIndex nextBranch nextObserver nextState + remainingTail authorizedNext indeterminateNext + apply spec_mono continuation + intro actual meaning + simpa only [viewElements, evaluateChildren, expected, List.foldl_cons, nextEq, Prod.mk.injEq] using meaning + +omit branchContract observerContract in + @[step] theorem members_exact (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver members.elements) + (branch : B) (observer : O) : + evaluate_members nativeBranch nativeObserver (auths_composition.alloc.vec.Vec.deref members) branch observer + ⦃ result => + let expected := evaluateChildren modelBranch modelObserver (viewMembers members) branch observer + (view result.1, result.2.1, result.2.2) = + (summarize expected.1, expected.2.1, expected.2.2) ⦄ := by + rw [evaluate_members.eq_def] + step as ⟨initial, initialEq⟩ + have remaining : + (auths_composition.alloc.vec.Vec.deref members).val.drop (0#usize).val = members.elements.toList := by + simp [auths_composition.alloc.vec.Vec.deref, auths_composition.alloc.vec.Vec.toBase, + Aeneas.Std.alloc.vec.Vec.deref] + have authorizedFits : initial.authorized.val + members.size ≤ Usize.max := by + have count := congrArg Summary.authorized initialEq + simp only [view, empty] at count + simpa only [count, Nat.zero_add] using members.bound + have indeterminateFits : initial.indeterminate.val + members.size ≤ Usize.max := by + have count := congrArg Summary.indeterminate initialEq + simp only [view, empty] at count + simpa only [count, Nat.zero_add] using members.bound + have continuation := correct _ 0#usize branch observer initial remaining authorizedFits indeterminateFits + apply spec_mono continuation + intro actual meaning + have mapped : viewElements members.elements = viewMembers members := by + cases members + simp [viewMembers] + simpa only [mapped, initialEq, summarize, Prod.mk.injEq] using meaning + +omit branchContract in +theorem all_node_exact (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver members.elements) : + NodeCorrect nativeBranch nativeObserver modelBranch modelObserver (.mk (.AllOf members)) := by + intro branch observer + apply eq_of_spec + rw [evaluate_node.eq_def] + simp only [auths_model.AuthorizationPlan.as_ref, auths_model.AuthorizationPlan._0, bind_tc_ok] + step as ⟨state, nextBranch, nextObserver, agreement⟩ + rename_i branchEq observerEq + rw [count_bind] + step as ⟨required, requiredEq⟩ + rw [all_exact, agreement] + simp only [bind_tc_ok, observe_aggregate, observerContract] + have authorizedEq := congrArg Summary.authorized agreement + have indeterminateEq := congrArg Summary.indeterminate agreement + simp only [view] at authorizedEq indeterminateEq + simp only [viewPlan, viewNode, Auths.Composition.PlanModel.evaluate, branchEq, observerEq, + eventView, authorizedEq, indeterminateEq, requiredEq, Slice.len_val, Slice.length, + auths_composition.alloc.vec.Vec.deref_exact, + auths_composition.alloc.vec.SizedList.length, view_members_length] + dsimp only [Bind.bind, Aeneas.Std.bind] + rfl + + +omit branchContract in +theorem any_node_exact (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver members.elements) : + NodeCorrect nativeBranch nativeObserver modelBranch modelObserver (.mk (.AnyOf members)) := by + intro branch observer + apply eq_of_spec + rw [evaluate_node.eq_def] + simp only [auths_model.AuthorizationPlan.as_ref, auths_model.AuthorizationPlan._0, bind_tc_ok] + step as ⟨state, nextBranch, nextObserver, agreement⟩ + rename_i branchEq observerEq + rw [threshold_exact, agreement] + simp only [bind_tc_ok, observe_aggregate, observerContract] + have authorizedEq := congrArg Summary.authorized agreement + have indeterminateEq := congrArg Summary.indeterminate agreement + simp only [view] at authorizedEq indeterminateEq + simp only [viewPlan, viewNode, Auths.Composition.PlanModel.evaluate, branchEq, observerEq, + eventView, authorizedEq, indeterminateEq, Slice.len_val, Slice.length, + auths_composition.alloc.vec.Vec.deref_exact, + auths_composition.alloc.vec.SizedList.length, view_members_length] + dsimp only [Bind.bind, Aeneas.Std.bind] + rfl + + +omit branchContract in +theorem threshold_node_exact (required : Std.U16) (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver members.elements) : + NodeCorrect nativeBranch nativeObserver modelBranch modelObserver (.mk (.KOfN required members)) := by + intro branch observer + apply eq_of_spec + rw [evaluate_node.eq_def] + simp only [auths_model.AuthorizationPlan.as_ref, auths_model.AuthorizationPlan._0, bind_tc_ok] + step as ⟨state, nextBranch, nextObserver, agreement⟩ + rename_i branchEq observerEq + rw [threshold_exact, agreement] + simp only [bind_tc_ok, observe_aggregate, observerContract] + have authorizedEq := congrArg Summary.authorized agreement + have indeterminateEq := congrArg Summary.indeterminate agreement + simp only [view] at authorizedEq indeterminateEq + simp only [viewPlan, viewNode, Auths.Composition.PlanModel.evaluate, branchEq, observerEq, + eventView, authorizedEq, indeterminateEq, Slice.len_val, Slice.length, + auths_composition.alloc.vec.Vec.deref_exact, + auths_composition.alloc.vec.SizedList.length, view_members_length] + dsimp only [Bind.bind, Aeneas.Std.bind] + rfl + +theorem all_nodes_correct (plan : auths_model.AuthorizationPlan) : + NodeCorrect nativeBranch nativeObserver modelBranch modelObserver plan := by + refine auths_model.AuthorizationPlan.rec + (motive_1 := fun plan => NodeCorrect nativeBranch nativeObserver modelBranch modelObserver plan) + (motive_2 := fun node => NodeCorrect nativeBranch nativeObserver modelBranch modelObserver (.mk node)) + (motive_3 := fun members => ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver members.elements) + (motive_4 := fun _ elements => ElementsCorrect nativeBranch nativeObserver modelBranch modelObserver elements) + ?_ ?_ ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro node correct + exact correct + · intro reference branch observer + simpa only [viewPlan, viewNode] using + proof_leaf_exact nativeBranch nativeObserver modelBranch modelObserver + branchContract observerContract reference branch observer + · intro members correct + exact all_node_exact nativeBranch nativeObserver modelBranch modelObserver observerContract members correct + · intro members correct + exact any_node_exact nativeBranch nativeObserver modelBranch modelObserver observerContract members correct + · intro required members correct + exact threshold_node_exact nativeBranch nativeObserver modelBranch modelObserver observerContract required members correct + · intro size elements bound correct + exact correct + · exact nil_correct nativeBranch nativeObserver modelBranch modelObserver + · intro size head tail headCorrect tailCorrect + exact cons_correct nativeBranch nativeObserver modelBranch modelObserver head tail headCorrect tailCorrect + +theorem evaluator_refines (plan : auths_model.AuthorizationPlan) (branch : B) (observer : O) : + evaluate_node nativeBranch nativeObserver plan branch observer = + ok (Auths.Composition.PlanModel.evaluate modelBranch modelObserver (viewPlan plan) branch observer) := by + exact all_nodes_correct nativeBranch nativeObserver modelBranch modelObserver + branchContract observerContract plan branch observer + +end +end Auths.Composition.Traversal diff --git a/formal/Auths/Composition/ValidationCapacity.lean b/formal/Auths/Composition/ValidationCapacity.lean new file mode 100644 index 000000000..fea455b5a --- /dev/null +++ b/formal/Auths/Composition/ValidationCapacity.lean @@ -0,0 +1,70 @@ +import Auths.Composition.ValidationModel +open Auths.Composition.PlanModel Auths.Composition.ValidationModel +namespace Auths.Composition.ValidationCapacity +variable {R : Type} [DecidableEq R] + +def NodeCapacity (plan : Plan R) : Prop := + ∀ limits depth (state next : State R), state.seen.card ≤ limits.leaves → + checkPlan limits depth plan state = .ok next → next.seen.card ≤ limits.leaves + +def ChildCapacity (members : List (Plan R)) : Prop := + ∀ limits depth (state next : State R), state.seen.card ≤ limits.leaves → + checkChildren limits depth members state = .ok next → next.seen.card ≤ limits.leaves + +theorem checker_preserves_capacity (plan : Plan R) : NodeCapacity plan := by + refine Plan.rec + (motive_1 := fun plan => NodeCapacity plan) + (motive_2 := fun members => ChildCapacity members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference limits depth state next capacity evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · cases evaluates + dsimp only at * + omega + · intro members correct limits depth state next capacity evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · exact correct limits (depth + 1) { state with maximumDepth := max state.maximumDepth depth } next capacity evaluates + · intro members correct limits depth state next capacity evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · exact correct limits (depth + 1) { state with maximumDepth := max state.maximumDepth depth } next capacity evaluates + · intro required members correct limits depth state next capacity evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · exact correct limits (depth + 1) { state with maximumDepth := max state.maximumDepth depth } next capacity evaluates + · intro limits depth state next capacity evaluates + simp only [checkChildren, Except.ok.injEq] at evaluates + cases evaluates + exact capacity + · intro head tail headCorrect tailCorrect limits depth state next capacity evaluates + simp only [checkChildren, Bind.bind, Except.bind] at evaluates + cases first : checkPlan limits depth head state with + | error reason => simp [first] at evaluates + | ok intermediate => + have middleCapacity := headCorrect limits depth state intermediate capacity first + simp only [first] at evaluates + exact tailCorrect limits depth intermediate next middleCapacity evaluates + +end Auths.Composition.ValidationCapacity diff --git a/formal/Auths/Composition/ValidationComplete.lean b/formal/Auths/Composition/ValidationComplete.lean new file mode 100644 index 000000000..178140b19 --- /dev/null +++ b/formal/Auths/Composition/ValidationComplete.lean @@ -0,0 +1,111 @@ +import Auths.Composition.ValidationShape +open Auths.Composition.PlanModel Auths.Composition.ValidationModel Auths.Composition.Bounds +open Auths.Composition.Work Auths.Composition.ValidationProgress +namespace Auths.Composition.ValidationComplete +variable {R : Type} [DecidableEq R] +set_option maxHeartbeats 2000000 + +def Fits (limits : Limits) (level : Nat) (plan : Plan R) (state : State R) : Prop := + operatorsValid limits plan ∧ level + depth plan ≤ limits.depth + 1 ∧ + (leaves plan).Nodup ∧ (∀ item ∈ leaves plan, item ∉ state.seen) ∧ + state.seen.card + (leaves plan).length ≤ limits.leaves + +def ChildrenFit (limits : Limits) (level : Nat) (members : List (Plan R)) (state : State R) : Prop := + childrenValid limits members ∧ (members ≠ [] → level + memberDepth members ≤ limits.depth + 1) ∧ + (memberLeaves members).Nodup ∧ (∀ item ∈ memberLeaves members, item ∉ state.seen) ∧ + state.seen.card + (memberLeaves members).length ≤ limits.leaves + +def NodeComplete (plan : Plan R) : Prop := + ∀ limits level (state : State R), Fits limits level plan state → + ∃ next, checkPlan limits level plan state = .ok next + +def ChildrenComplete (members : List (Plan R)) : Prop := + ∀ limits level (state : State R), ChildrenFit limits level members state → + ∃ next, checkChildren limits level members state = .ok next + +theorem checker_complete (plan : Plan R) : NodeComplete plan := by + refine Plan.rec + (motive_1 := fun plan => NodeComplete plan) + (motive_2 := fun members => ChildrenComplete members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference limits level state fits + obtain ⟨valid, depthBound, unique, fresh, capacity⟩ := fits + simp only [depth, leaves, List.length_singleton] at depthBound fresh capacity + have within : ¬ level > limits.depth := by omega + have absent : reference ∉ state.seen := fresh reference (by simp) + exact ⟨{ seen := insert reference state.seen, maximumDepth := max state.maximumDepth level }, + by simp [checkPlan, enter, within, Bind.bind, Except.bind, absent]; omega⟩ + · intro members correct limits level state fits + obtain ⟨valid, depthBound, unique, fresh, capacity⟩ := fits + simp only [operatorsValid] at valid + obtain ⟨nonempty, width, children⟩ := valid + simp only [depth] at depthBound + have within : ¬ level > limits.depth := by omega + have childFits : ChildrenFit limits (level + 1) members + { state with maximumDepth := max state.maximumDepth level } := by + exact ⟨children, by intro _; omega, by simpa only [leaves] using unique, + by simpa only [leaves] using fresh, by simpa only [leaves] using capacity⟩ + obtain ⟨next, executes⟩ := correct limits (level + 1) _ childFits + refine ⟨next, ?_⟩ + simpa [checkPlan, enter, within, Bind.bind, Except.bind, nonempty, Nat.not_lt.mpr width] using executes + · intro members correct limits level state fits + obtain ⟨valid, depthBound, unique, fresh, capacity⟩ := fits + simp only [operatorsValid] at valid + obtain ⟨nonempty, width, children⟩ := valid + simp only [depth] at depthBound + have within : ¬ level > limits.depth := by omega + have childFits : ChildrenFit limits (level + 1) members + { state with maximumDepth := max state.maximumDepth level } := by + exact ⟨children, by intro _; omega, by simpa only [leaves] using unique, + by simpa only [leaves] using fresh, by simpa only [leaves] using capacity⟩ + obtain ⟨next, executes⟩ := correct limits (level + 1) _ childFits + refine ⟨next, ?_⟩ + simpa [checkPlan, enter, within, Bind.bind, Except.bind, nonempty, Nat.not_lt.mpr width] using executes + · intro required members correct limits level state fits + obtain ⟨valid, depthBound, unique, fresh, capacity⟩ := fits + simp only [operatorsValid] at valid + obtain ⟨positive, feasible, width, children⟩ := valid + have nonempty : members ≠ [] := by intro empty; simp [empty] at feasible; omega + simp only [depth] at depthBound + have within : ¬ level > limits.depth := by omega + have childFits : ChildrenFit limits (level + 1) members + { state with maximumDepth := max state.maximumDepth level } := by + exact ⟨children, by intro _; omega, by simpa only [leaves] using unique, + by simpa only [leaves] using fresh, by simpa only [leaves] using capacity⟩ + obtain ⟨next, executes⟩ := correct limits (level + 1) _ childFits + refine ⟨next, ?_⟩ + simpa [checkPlan, enter, within, Bind.bind, Except.bind, nonempty, + Nat.ne_of_gt positive, Nat.not_lt.mpr feasible, Nat.not_lt.mpr width] using executes + · intro limits level state fits + exact ⟨state, by simp [checkChildren]⟩ + · intro head tail headCorrect tailCorrect limits level state fits + obtain ⟨valid, depthBound, unique, fresh, capacity⟩ := fits + simp only [childrenValid] at valid + simp only [memberLeaves, List.length_append] at unique fresh capacity + obtain ⟨headUnique, tailUnique, cross⟩ := List.nodup_append.mp unique + have wholeDepth := depthBound (by simp) + simp only [memberDepth] at wholeDepth + have headFits : Fits limits level head state := by + refine ⟨valid.1, by omega, headUnique, ?_, by omega⟩ + intro item member + exact fresh item (List.mem_append_left _ member) + obtain ⟨middle, headRuns⟩ := headCorrect limits level state headFits + have progress := checker_progress head limits level state middle headRuns + have middleCard := progress_card state.seen middle.seen (leaves head) progress + have tailFits : ChildrenFit limits level tail middle := by + refine ⟨valid.2, by intro _; omega, tailUnique, ?_, by omega⟩ + intro item member old + rw [progress.2.2] at old + rcases Finset.mem_union.mp old with original | inHead + · exact fresh item (List.mem_append_right _ member) original + · exact cross item (List.mem_toFinset.mp inHead) item member rfl + obtain ⟨next, tailRuns⟩ := tailCorrect limits level middle tailFits + exact ⟨next, by simp [checkChildren, Bind.bind, Except.bind, headRuns, tailRuns]⟩ + +theorem valid_is_accepted (limits : Limits) (plan : Plan R) (valid : Valid limits plan) : + ∃ next, checkPlan limits 1 plan rootState = .ok next := by + apply checker_complete plan limits 1 rootState + obtain ⟨operators, depthBound, unique, size⟩ := valid + exact ⟨operators, by omega, unique, by simp [rootState], by simpa [rootState] using size⟩ + +end Auths.Composition.ValidationComplete diff --git a/formal/Auths/Composition/ValidationContract.lean b/formal/Auths/Composition/ValidationContract.lean new file mode 100644 index 000000000..d1c80ea14 --- /dev/null +++ b/formal/Auths/Composition/ValidationContract.lean @@ -0,0 +1,94 @@ +import Auths.Composition.ValidationPublic +import Auths.Composition.ValidationSoundness +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open auths_composition Auths.Composition.PlanModel Auths.Composition.ValidationModel +open Auths.Composition.ValidationRefinement Auths.Composition.ValidationPublic +namespace Auths.Composition.ValidationContract + +theorem source_accepts_iff_valid (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) : + (∃ shape, auths_model.AuthorizationPlan.validate plan limits = ok (.Ok shape)) ↔ + Valid (sourceLimits limits) (viewPlan plan) := by + obtain ⟨native, nativeEq, meaning⟩ := spec_imp_exists (validator_refines plan limits bounded) + cases checked : checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState with + | error reason => + have invalid : ¬ Valid (sourceLimits limits) (viewPlan plan) := by + intro valid + obtain ⟨next, accepted⟩ := Auths.Composition.ValidationComplete.valid_is_accepted _ _ valid + simp [checked] at accepted + cases reason <;> simp only [checked, ShapeCorresponds] at meaning + · subst native + simp [nativeEq, invalid] + · subst native + simp [nativeEq, invalid] + | ok next => + have valid := Auths.Composition.ValidationSoundness.accepted_is_valid _ _ next checked + simp only [checked, ShapeCorresponds] at meaning + obtain ⟨shape, same, _⟩ := meaning + subst native + exact ⟨fun _ => valid, fun _ => ⟨shape, nativeEq⟩⟩ + +section +variable {B O : Type} +variable (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) +variable (nativeObserver : core.ops.function.FnMut O EvaluationEvent Unit) +variable (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) +variable (modelObserver : O → Event auths_model.ProofRef → O) +variable (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = ok (modelBranch state reference)) +variable (observerContract : ∀ state event, + nativeObserver.call_mut state event = ok ((), modelObserver state (eventView event))) + +include branchContract observerContract in +/-- Every independently valid bounded plan reaches the public three-valued + evaluator and preserves its exact result, callback state, and event state. -/ +theorem valid_public_evaluator_refines (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (valid : Valid (sourceLimits limits) (viewPlan plan)) (state : B) (observer : O) : + evaluate_observed nativeBranch nativeObserver plan limits state observer = + let expected := Auths.Composition.PlanModel.evaluate modelBranch modelObserver (viewPlan plan) state observer + ok (.Ok expected.1, expected.2.1, expected.2.2) := by + obtain ⟨shape, nativeEq⟩ := (source_accepts_iff_valid plan limits bounded).mpr valid + exact Auths.Composition.Wrapper.validated_refines nativeBranch nativeObserver modelBranch modelObserver + branchContract observerContract plan limits state observer shape nativeEq + +/-- Invalid structure is refused before either callback, regardless of their + implementations; there is no callback-totality premise for this result. -/ +theorem invalid_plan_preserves_callbacks (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (invalid : ¬ Valid (sourceLimits limits) (viewPlan plan)) (state : B) (observer : O) : + evaluate_observed nativeBranch nativeObserver plan limits state observer = + ok (.Err .AuthorizationPlanInvalid, state, observer) := by + cases checked : checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState with + | ok next => exact False.elim (invalid (Auths.Composition.ValidationSoundness.accepted_is_valid _ _ next checked)) + | error reason => + exact rejected_plan_preserves_callbacks nativeBranch nativeObserver plan limits bounded + state observer reason checked +end + + +theorem public_event_bound {B : Type} + (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) + (nativeObserver : core.ops.function.FnMut Nat EvaluationEvent Unit) + (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) + (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = ok (modelBranch state reference)) + (observerContract : ∀ count event, + nativeObserver.call_mut count event = ok ((), count + 1)) + (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (bounded : LimitsBounded limits) (valid : Valid (sourceLimits limits) (viewPlan plan)) + (state : B) (count : Nat) : + ∃ outcome next finalCount, + evaluate_observed nativeBranch nativeObserver plan limits state count = + ok (.Ok outcome, next, finalCount) ∧ finalCount ≤ count + 2048 := by + obtain ⟨shape, validated⟩ := (source_accepts_iff_valid plan limits bounded).mpr valid + obtain ⟨outcome, next, exactCount⟩ := Auths.Composition.Work.source_event_count + nativeBranch modelBranch branchContract nativeObserver observerContract plan state count + refine ⟨outcome, next, count + Auths.Composition.Work.nodes (viewPlan plan), ?_, ?_⟩ + · simp only [evaluate_observed, validated, bind_tc_ok, exactCount] + rfl + · have bound := Auths.Composition.ValidationSoundness.valid_has_bounded_events + (sourceLimits limits) (viewPlan plan) valid bounded.2.1 bounded.1 + omega + +end Auths.Composition.ValidationContract diff --git a/formal/Auths/Composition/ValidationExamples.lean b/formal/Auths/Composition/ValidationExamples.lean new file mode 100644 index 000000000..bf72daa13 --- /dev/null +++ b/formal/Auths/Composition/ValidationExamples.lean @@ -0,0 +1,110 @@ +import Auths.Composition.ValidationContract +import Auths.Composition.PlanExamples +open Aeneas Aeneas.Std Result +open auths_composition Auths.Composition.PlanModel Auths.Composition.ValidationModel +open Auths.Composition.ValidationRefinement Auths.Composition.ValidationContract +open Auths.Composition.PlanExamples +namespace Auths.Composition.ValidationExamples +set_option cbv.warning false +set_option maxRecDepth 16384 +set_option maxHeartbeats 2000000 + +def limits : auths_model.VerifierLimits where + bundle_bytes := 1#usize + action_bytes := 1#usize + context_bytes := 1#usize + grants := 1#usize + actions := 1#usize + plan_leaves := 128#usize + plan_depth := 16#usize + plan_branching := 128#usize + evidence := 1#usize + evidence_bytes := 1#usize + bindings := 1#usize + principal_status := 1#usize + grant_status := 1#usize + attachments := 1#usize + attachment_bytes := 1#usize + signatures := 1#usize + signature_bytes := 1#usize + permissions := 1#usize + audiences := 1#usize + extensions := 1#usize + extension_bytes := 1#usize + body_digests := 1#usize + binding_evidence := 1#usize + canonical_body_bytes := 1#usize + registry_entries := 1#usize + trust_anchors := 1#usize + work_units := 10000#u64 + approvals := 1#usize + approver_anchors := 1#usize + approval_requirements := 1#usize + +theorem limits_bounded : LimitsBounded limits := by unfold LimitsBounded; decide + +theorem conjunction_valid : Valid (sourceLimits limits) (viewPlan twoLeaves) := by cbv; simp; decide + +/-- Exercises public validation and the actual evaluator, with two distinct + references and all three resulting postorder events. -/ +theorem public_conjunction : evaluate_observed branch observer twoLeaves limits 0 0 = + ok (.Ok .Authorized, 2, 3) := by + obtain ⟨shape, validated⟩ := (source_accepts_iff_valid twoLeaves limits limits_bounded).mpr conjunction_valid + simp only [evaluate_observed, validated, bind_tc_ok, two_leaf_conjunction] + rfl + +def duplicate : auths_model.AuthorizationPlan := + .mk (.AllOf (auths_composition.alloc.vec.Vec.ofBase + ⟨[leaf 1#u8, leaf 1#u8], by scalar_tac⟩)) + +theorem duplicate_invalid : ¬ Valid (sourceLimits limits) (viewPlan duplicate) := by cbv; simp + +theorem duplicate_refused : evaluate_observed branch observer duplicate limits 5 9 = + ok (.Err .AuthorizationPlanInvalid, 5, 9) := + invalid_plan_preserves_callbacks branch observer duplicate limits limits_bounded duplicate_invalid 5 9 + +def impossibleThreshold : auths_model.AuthorizationPlan := .mk (.KOfN 0#u16 threeMembers) + +theorem zero_threshold_invalid : ¬ Valid (sourceLimits limits) (viewPlan impossibleThreshold) := by cbv + +theorem zero_threshold_refused : evaluate_observed mixedBranch events impossibleThreshold limits 4 [] = + ok (.Err .AuthorizationPlanInvalid, 4, []) := + invalid_plan_preserves_callbacks mixedBranch events impossibleThreshold limits limits_bounded + zero_threshold_invalid 4 [] + +theorem empty_invalid : ¬ Valid (sourceLimits limits) + (viewPlan (.mk (.AnyOf (auths_composition.alloc.vec.Vec.ofBase ⟨[], by scalar_tac⟩)))) := by cbv + +theorem mixed_threshold_valid : Valid (sourceLimits limits) (viewPlan (.mk (.KOfN 2#u16 threeMembers))) := by cbv; simp; decide + +theorem public_threshold_indeterminate : + evaluate_observed mixedBranch events (.mk (.KOfN 2#u16 threeMembers)) limits 0 [] = + ok (.Ok (.Indeterminate .ExternalFactUnavailable), 3, + mixedLeaves ++ [.Aggregate 3#usize 2#u16 1#usize 1#usize + (.Indeterminate .ExternalFactUnavailable)]) := by + obtain ⟨shape, validated⟩ := (source_accepts_iff_valid _ limits limits_bounded).mpr mixed_threshold_valid + simp only [evaluate_observed, validated, bind_tc_ok, threshold_indeterminate] + rfl + + +def narrow : auths_model.VerifierLimits := { limits with plan_branching := 1#usize } + +theorem narrow_bounded : LimitsBounded narrow := by unfold LimitsBounded; decide + +theorem narrow_invalid : ¬ Valid (sourceLimits narrow) (viewPlan twoLeaves) := by cbv; simp + +theorem narrow_refused : evaluate_observed branch observer twoLeaves narrow 5 9 = + ok (.Err .AuthorizationPlanInvalid, 5, 9) := + invalid_plan_preserves_callbacks branch observer twoLeaves narrow narrow_bounded narrow_invalid 5 9 + +def shallow : auths_model.VerifierLimits := { limits with plan_depth := 1#usize } + +theorem shallow_bounded : LimitsBounded shallow := by unfold LimitsBounded; decide + +theorem shallow_invalid : ¬ Valid (sourceLimits shallow) (viewPlan twoLeaves) := by cbv; simp + +theorem shallow_refused : evaluate_observed branch observer twoLeaves shallow 5 9 = + ok (.Err .AuthorizationPlanInvalid, 5, 9) := + invalid_plan_preserves_callbacks branch observer twoLeaves shallow shallow_bounded shallow_invalid 5 9 + +end Auths.Composition.ValidationExamples diff --git a/formal/Auths/Composition/ValidationLeaves.lean b/formal/Auths/Composition/ValidationLeaves.lean new file mode 100644 index 000000000..78d07d1ad --- /dev/null +++ b/formal/Auths/Composition/ValidationLeaves.lean @@ -0,0 +1,75 @@ +import Auths.Composition.ValidationModel +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open auths_composition Auths.Composition.SetModel Auths.Composition.ValidationModel +namespace Auths.Composition.ValidationLeaves + +@[step] theorem word_max_exact (left right : Std.Usize) : + auths_composition.core.cmp.Ord.max.default core.cmp.OrdUsize left right ⦃ result => + result.val = max left.val right.val ⦄ := by + unfold auths_composition.core.cmp.Ord.max.default + simp only [core.cmp.impls.PartialOrdUsize.lt, liftFun2, bind_tc_ok] + split <;> simp_all [spec_ok, Nat.max_def] + +def viewState (refs : alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) + (maximumDepth : Std.Usize) : State auths_model.ProofRef := + ⟨refs.values.toFinset, maximumDepth.val⟩ + +def Corresponds (expected : Except ShapeError (State auths_model.ProofRef)) + (actual : core.result.Result Unit auths_model.ModelError × + alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global × Std.Usize) : Prop := + match expected with + | .error .tooLarge => actual.1 = .Err .PlanLimitExceeded + | .error .invalidOperator => actual.1 = .Err .InvalidPlan + | .ok next => actual.1 = .Ok () ∧ actual.2.1.values.Pairwise Before ∧ + viewState actual.2.1 actual.2.2 = next + +theorem proof_leaf_exact (reference : auths_model.ProofRef) (depth maximum : Std.Usize) + (limits : auths_model.VerifierLimits) + (refs : alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) + (ordered : refs.values.Pairwise Before) (room : refs.values.length < Usize.max) : + auths_model.AuthorizationPlan.validate.walk (.mk (.Proof reference)) depth limits refs maximum + ⦃ result => Corresponds + (checkPlan (sourceLimits limits) depth.val (.proof reference) (viewState refs maximum)) result ⦄ := by + rw [auths_model.AuthorizationPlan.validate.walk.eq_def] + simp only [auths_model.AuthorizationPlan._0] + by_cases tooDeep : depth > limits.plan_depth + · have tooDeepNat : depth.val > limits.plan_depth.val := by + simpa only [UScalar.lt_equiv] using tooDeep + simp [tooDeep, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, tooDeepNat] + · have within : ¬ depth.val > limits.plan_depth.val := by + simpa only [UScalar.lt_equiv] using tooDeep + simp only [tooDeep, ite_false] + step as ⟨updatedMaximum, maximumEq⟩ + obtain ⟨added, updated, executes, sorted, members, fresh, size⟩ := + insert_set core.core.clone.CloneGlobal reference refs ordered room + rw [executes] + simp only [bind_tc_ok, uncurry] + cases added with + | false => + have present : reference ∈ refs.values := by + by_contra absent + have impossible := fresh.mpr absent + contradiction + simp [Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, within, viewState, present] + | true => + rw [if_pos rfl] + have absent : reference ∉ refs.values := fresh.mp rfl + have setEq : updated.values.toFinset = insert reference refs.values.toFinset := by + ext item + simp only [List.mem_toFinset, Finset.mem_insert] + exact members item + have countEq : (insert reference refs.values.toFinset).card = updated.values.length := by + rw [← setEq] + exact List.toFinset_card_of_nodup (ordered_nodup updated.values sorted) + unfold alloc.collections.btree.set.BTreeSet.len + simp only [bind_tc_ok] + split <;> rename_i capacity + · have excess : updated.values.length > limits.plan_leaves.val := by + simpa only [UScalar.lt_equiv, Usize.ofNatCore_val_eq] using capacity + simp [Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, within, viewState, absent, countEq, excess] + · have fits : ¬ updated.values.length > limits.plan_leaves.val := by + simpa only [UScalar.lt_equiv, Usize.ofNatCore_val_eq] using capacity + simp [Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, within, viewState, absent, countEq, fits, + sorted, setEq, maximumEq] + +end Auths.Composition.ValidationLeaves diff --git a/formal/Auths/Composition/ValidationModel.lean b/formal/Auths/Composition/ValidationModel.lean new file mode 100644 index 000000000..d7597851c --- /dev/null +++ b/formal/Auths/Composition/ValidationModel.lean @@ -0,0 +1,84 @@ +import Auths.Composition.Bounds +import Auths.Composition.SetModel +import Auths.Composition.Collect +open Auths.Composition.PlanModel +namespace Auths.Composition.ValidationModel + +structure Limits where + leaves : Nat + depth : Nat + children : Nat + +structure State (R : Type) where + seen : Finset R + maximumDepth : Nat + +inductive ShapeError where + | invalidOperator + | tooLarge + deriving DecidableEq + +def enter {R : Type} (limits : Limits) (depth : Nat) (state : State R) : + Except ShapeError (State R) := + if depth > limits.depth then .error .tooLarge + else .ok { state with maximumDepth := max state.maximumDepth depth } + +mutual + def checkPlan {R : Type} [DecidableEq R] (limits : Limits) (depth : Nat) + (plan : Plan R) (state : State R) : Except ShapeError (State R) := do + let state ← enter limits depth state + match plan with + | .proof reference => + if reference ∈ state.seen then .error .tooLarge + else + let next := { state with seen := insert reference state.seen } + if next.seen.card > limits.leaves then .error .tooLarge else .ok next + | .allOf members | .anyOf members => + if members.isEmpty then .error .invalidOperator + else if members.length > limits.children then .error .tooLarge + else checkChildren limits (depth + 1) members state + | .kOfN required members => + if required = 0 ∨ required > members.length ∨ members.isEmpty then .error .invalidOperator + else if members.length > limits.children then .error .tooLarge + else checkChildren limits (depth + 1) members state + termination_by sizeOf plan + + def checkChildren {R : Type} [DecidableEq R] (limits : Limits) (depth : Nat) + (members : List (Plan R)) (state : State R) : Except ShapeError (State R) := do + match members with + | [] => .ok state + | head :: tail => + let next ← checkPlan limits depth head state + checkChildren limits depth tail next + termination_by sizeOf members +end + +mutual + def operatorsValid {R : Type} (limits : Limits) : Plan R → Prop + | .proof _ => True + | .allOf members | .anyOf members => + members ≠ [] ∧ members.length ≤ limits.children ∧ childrenValid limits members + | .kOfN required members => + 0 < required ∧ required ≤ members.length ∧ + members.length ≤ limits.children ∧ childrenValid limits members + termination_by plan => sizeOf plan + + def childrenValid {R : Type} (limits : Limits) : List (Plan R) → Prop + | [] => True + | head :: tail => operatorsValid limits head ∧ childrenValid limits tail + termination_by members => sizeOf members +end + +/-- Independent structural contract, expressed without a verifier result. -/ +def Valid {R : Type} (limits : Limits) (plan : Plan R) : Prop := + operatorsValid limits plan ∧ + Auths.Composition.Bounds.depth plan ≤ limits.depth ∧ + (Auths.Composition.Work.leaves plan).Nodup ∧ + (Auths.Composition.Work.leaves plan).length ≤ limits.leaves + +def rootState {R : Type} : State R := ⟨∅, 0⟩ + +def sourceLimits (limits : auths_composition.auths_model.VerifierLimits) : Limits := + ⟨limits.plan_leaves.val, limits.plan_depth.val, limits.plan_branching.val⟩ + +end Auths.Composition.ValidationModel diff --git a/formal/Auths/Composition/ValidationProgress.lean b/formal/Auths/Composition/ValidationProgress.lean new file mode 100644 index 000000000..d25fd7bab --- /dev/null +++ b/formal/Auths/Composition/ValidationProgress.lean @@ -0,0 +1,112 @@ +import Auths.Composition.ValidationCapacity +open Auths.Composition.PlanModel Auths.Composition.ValidationModel Auths.Composition.Work +namespace Auths.Composition.ValidationProgress +variable {R : Type} [DecidableEq R] + +/-- No reference is reused, and the result is exactly the original set extended + by the plan's leaves. This relation does not mention the checker. -/ +def Progress (before : Finset R) (references : List R) (after : Finset R) : Prop := + references.Nodup ∧ (∀ item ∈ references, item ∉ before) ∧ after = before ∪ references.toFinset + +theorem progress_nil (seen : Finset R) : Progress seen [] seen := by simp [Progress] + +theorem progress_one (seen : Finset R) (reference : R) (fresh : reference ∉ seen) : + Progress seen [reference] (insert reference seen) := by + refine ⟨by simp, by simpa using fresh, ?_⟩ + ext item + simp + +theorem progress_append (before middle after : Finset R) (left right : List R) + (first : Progress before left middle) (second : Progress middle right after) : + Progress before (left ++ right) after := by + obtain ⟨leftUnique, leftFresh, middleEq⟩ := first + obtain ⟨rightUnique, rightFresh, afterEq⟩ := second + have cross : List.Disjoint left right := by + rw [List.disjoint_left] + intro item inLeft inRight + exact rightFresh item inRight (by simp [middleEq, inLeft]) + refine ⟨List.nodup_append.mpr ⟨leftUnique, rightUnique, by + intro a inLeft b inRight same + subst b + exact (List.disjoint_left.mp cross) inLeft inRight⟩, ?_, ?_⟩ + · intro item member + rcases List.mem_append.mp member with inLeft | inRight + · exact leftFresh item inLeft + · intro old + exact rightFresh item inRight (by simp [middleEq, old]) + · simp [afterEq, middleEq, List.toFinset_append, Finset.union_assoc] + +theorem progress_card (before after : Finset R) (references : List R) + (meaning : Progress before references after) : after.card = before.card + references.length := by + obtain ⟨unique, fresh, same⟩ := meaning + have disjoint : Disjoint before references.toFinset := by + rw [Finset.disjoint_left] + intro item old new + exact fresh item (List.mem_toFinset.mp new) old + rw [same, Finset.card_union_of_disjoint disjoint, List.toFinset_card_of_nodup unique] + +def NodeProgress (plan : Plan R) : Prop := + ∀ limits depth (state next : State R), checkPlan limits depth plan state = .ok next → + Progress state.seen (leaves plan) next.seen + +def ChildrenProgress (members : List (Plan R)) : Prop := + ∀ limits depth (state next : State R), checkChildren limits depth members state = .ok next → + Progress state.seen (memberLeaves members) next.seen + +theorem checker_progress (plan : Plan R) : NodeProgress plan := by + refine Plan.rec + (motive_1 := fun plan => NodeProgress plan) + (motive_2 := fun members => ChildrenProgress members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference limits depth state next evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · rename_i fresh + split at evaluates + · contradiction + · cases evaluates + simpa only [leaves] using progress_one state.seen reference fresh + · intro members correct limits depth state next evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · simpa only [leaves] using correct limits (depth + 1) { state with maximumDepth := max state.maximumDepth depth } next evaluates + · intro members correct limits depth state next evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · simpa only [leaves] using correct limits (depth + 1) { state with maximumDepth := max state.maximumDepth depth } next evaluates + · intro required members correct limits depth state next evaluates + by_cases deep : depth > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · split at evaluates + · contradiction + · simpa only [leaves] using correct limits (depth + 1) { state with maximumDepth := max state.maximumDepth depth } next evaluates + · intro limits depth state next evaluates + simp only [checkChildren, Except.ok.injEq] at evaluates + cases evaluates + simpa only [memberLeaves] using progress_nil state.seen + · intro head tail headCorrect tailCorrect limits depth state next evaluates + simp only [checkChildren, Bind.bind, Except.bind] at evaluates + cases first : checkPlan limits depth head state with + | error reason => simp [first] at evaluates + | ok middle => + simp only [first] at evaluates + simpa only [memberLeaves] using progress_append state.seen middle.seen next.seen (leaves head) (memberLeaves tail) + (headCorrect limits depth state middle first) (tailCorrect limits depth middle next evaluates) + +end Auths.Composition.ValidationProgress diff --git a/formal/Auths/Composition/ValidationPublic.lean b/formal/Auths/Composition/ValidationPublic.lean new file mode 100644 index 000000000..4d79ec7c8 --- /dev/null +++ b/formal/Auths/Composition/ValidationPublic.lean @@ -0,0 +1,148 @@ +import Auths.Composition.ValidationRefinement +import Auths.Composition.Wrapper +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open auths_composition Auths.Composition.PlanModel Auths.Composition.ValidationModel +open Auths.Composition.ValidationLeaves Auths.Composition.SetModel Auths.Composition.ValidationRefinement +namespace Auths.Composition.ValidationPublic +set_option maxHeartbeats 2000000 + +/-- The returned carrier preserves the independently computed set and depth. + Pairwise ordering makes the returned sequence canonical as well. -/ +def ShapeCorresponds (expected : Except ShapeError (State auths_model.ProofRef)) + (actual : core.result.Result auths_model.PlanShape auths_model.ModelError) : Prop := + match expected with + | .error .tooLarge => actual = .Err .PlanLimitExceeded + | .error .invalidOperator => actual = .Err .InvalidPlan + | .ok next => ∃ shape, actual = .Ok shape ∧ + shape.leaves.elements.toList.Pairwise Before ∧ + shape.leaves.elements.toList.toFinset = next.seen ∧ + shape.maximum_depth.val = next.maximumDepth + +theorem validator_refines (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) : + auths_model.AuthorizationPlan.validate plan limits ⦃ result => ShapeCorresponds + (checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState) result ⦄ := by + rw [auths_model.AuthorizationPlan.validate.eq_def] + simp only [alloc.collections.btree.set.BTreeSetTGlobal.new, bind_tc_ok] + let initial : NativeSet := ⟨[], by simp⟩ + have initialGood : GoodSet limits initial := by simp [GoodSet, initial] + have run := walk_refines plan limits bounded 1#usize 0#usize initial (by decide) initialGood + apply spec_bind run + intro actual meaning + rcases actual with ⟨outcome, refs, maximum⟩ + change Corresponds (checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState) + (outcome, refs, maximum) at meaning + cases expected : checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState with + | error reason => + cases reason with + | tooLarge => + simp only [expected, Corresponds] at meaning + rw [meaning] + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, ShapeCorresponds] + | invalidOperator => + simp only [expected, Corresponds] at meaning + rw [meaning] + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, ShapeCorresponds] + | ok next => + simp only [expected, Corresponds] at meaning + obtain ⟨nativeOk, sorted, stateEq⟩ := meaning + rw [nativeOk] + simp only [core.result.Result.Insts.CoreOpsTry.branch, + alloc.collections.btree.set.BTreeSet.len, bind_tc_ok, + alloc.collections.btree.set.BTreeSet.Insts.CoreIterTraitsCollectIntoIteratorTIntoIter.into_iter] + let initialLeaves := auths_composition.alloc.vec.Vec.with_capacity auths_model.ProofRef + (Usize.ofNatCore refs.values.length (by have bound := refs.bound; scalar_tac)) + have capacity : initialLeaves.size + refs.values.length ≤ Usize.max := by + change 0 + refs.values.length ≤ Usize.max + simpa only [Nat.zero_add] using refs.bound + have collect := Auths.Composition.Collect.collect_exact refs.values + ⟨refs.values, refs.bound⟩ initialLeaves rfl capacity + apply spec_bind collect + intro leaves exactValues + have sequence : leaves.elements.toList = refs.values := by + simpa only [initialLeaves, auths_composition.alloc.vec.Vec.with_capacity, + auths_composition.alloc.vec.Vec.ofBase, Aeneas.Std.alloc.vec.Vec.with_capacity, + auths_composition.alloc.vec.SizedList.toList_ofList, List.nil_append] using exactValues + simp only [spec_ok, ShapeCorresponds] + refine ⟨⟨leaves, maximum⟩, rfl, ?_, ?_, ?_⟩ + · simpa only [sequence] using sorted + · exact sequence ▸ congrArg State.seen stateEq + · exact congrArg State.maximumDepth stateEq + + +def evaluateChecked {B O : Type} + (branch : B → auths_model.ProofRef → BranchOutcome × B) + (observe : O → Event auths_model.ProofRef → O) + (limits : Limits) (plan : Plan auths_model.ProofRef) (state : B) (observer : O) : + core.result.Result BranchOutcome auths_model.DenialReason × B × O := + match checkPlan limits 1 plan rootState with + | .error _ => (.Err .AuthorizationPlanInvalid, state, observer) + | .ok _ => + let next := Auths.Composition.PlanModel.evaluate branch observe plan state observer + (.Ok next.1, next.2.1, next.2.2) + +section +variable {B O : Type} +variable (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) +variable (nativeObserver : core.ops.function.FnMut O EvaluationEvent Unit) +variable (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) +variable (modelObserver : O → Event auths_model.ProofRef → O) +variable (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = ok (modelBranch state reference)) +variable (observerContract : ∀ state event, + nativeObserver.call_mut state event = ok ((), modelObserver state (eventView event))) + +include branchContract observerContract in +/-- The complete public composition wrapper, including its actual validator, + agrees with the independent checker and three-valued evaluator. -/ +theorem public_evaluator_refines (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (state : B) (observer : O) : + evaluate_observed nativeBranch nativeObserver plan limits state observer = + ok (evaluateChecked modelBranch modelObserver (sourceLimits limits) (viewPlan plan) state observer) := by + obtain ⟨validated, nativeEq, meaning⟩ := spec_imp_exists (validator_refines plan limits bounded) + cases checked : checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState with + | error reason => + cases reason with + | tooLarge => + simp only [checked, ShapeCorresponds] at meaning + subst validated + rw [Auths.Composition.Wrapper.validation_refusal nativeBranch nativeObserver plan limits state observer + .PlanLimitExceeded nativeEq] + simp only [evaluateChecked, checked] + | invalidOperator => + simp only [checked, ShapeCorresponds] at meaning + subst validated + rw [Auths.Composition.Wrapper.validation_refusal nativeBranch nativeObserver plan limits state observer + .InvalidPlan nativeEq] + simp only [evaluateChecked, checked] + | ok next => + simp only [checked, ShapeCorresponds] at meaning + obtain ⟨shape, same, sorted, refs, maximum⟩ := meaning + subst validated + rw [Auths.Composition.Wrapper.validated_refines nativeBranch nativeObserver modelBranch modelObserver + branchContract observerContract plan limits state observer shape nativeEq] + simp only [evaluateChecked, checked] + +/-- A rejected structural plan cannot mutate either callback state. -/ +theorem rejected_plan_preserves_callbacks (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (state : B) (observer : O) (reason : ShapeError) + (rejected : checkPlan (sourceLimits limits) 1 (viewPlan plan) rootState = .error reason) : + evaluate_observed nativeBranch nativeObserver plan limits state observer = + ok (.Err .AuthorizationPlanInvalid, state, observer) := by + obtain ⟨validated, nativeEq, meaning⟩ := spec_imp_exists (validator_refines plan limits bounded) + cases reason <;> simp only [rejected, ShapeCorresponds] at meaning + · subst validated + exact Auths.Composition.Wrapper.validation_refusal nativeBranch nativeObserver plan limits state observer + .InvalidPlan nativeEq + · subst validated + exact Auths.Composition.Wrapper.validation_refusal nativeBranch nativeObserver plan limits state observer + .PlanLimitExceeded nativeEq +end + +end Auths.Composition.ValidationPublic diff --git a/formal/Auths/Composition/ValidationRefinement.lean b/formal/Auths/Composition/ValidationRefinement.lean new file mode 100644 index 000000000..f549659f6 --- /dev/null +++ b/formal/Auths/Composition/ValidationRefinement.lean @@ -0,0 +1,287 @@ +import Auths.Composition.ValidationLeaves +import Auths.Composition.ValidationCapacity +import Auths.Composition.IteratorFacts +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open auths_composition Auths.Composition.PlanModel Auths.Composition.ValidationModel +open Auths.Composition.ValidationLeaves Auths.Composition.SetModel +namespace Auths.Composition.ValidationRefinement +set_option maxHeartbeats 2000000 + +abbrev NativeSet := alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global + +def LimitsBounded (limits : auths_model.VerifierLimits) : Prop := + limits.plan_leaves.val ≤ 128 ∧ limits.plan_depth.val ≤ 16 ∧ limits.plan_branching.val ≤ 128 + +def GoodSet (limits : auths_model.VerifierLimits) (refs : NativeSet) : Prop := + refs.values.Pairwise Before ∧ refs.values.length ≤ limits.plan_leaves.val + +theorem room_for_leaf (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (refs : NativeSet) (good : GoodSet limits refs) : refs.values.length < Usize.max := by + have width : 128 < Usize.max := by scalar_tac + obtain ⟨leaves, depth, children⟩ := bounded + obtain ⟨ordered, size⟩ := good + omega + +theorem card_view (refs : NativeSet) (maximum : Std.Usize) (ordered : refs.values.Pairwise Before) : + (viewState refs maximum).seen.card = refs.values.length := + List.toFinset_card_of_nodup (ordered_nodup refs.values ordered) + +@[step] theorem child_depth_exact (depth : Std.Usize) (bounded : depth.val ≤ 16) : + depth + 1#usize ⦃ next => next.val = depth.val + 1 ⦄ := by + step as ⟨next, exactValue⟩ + exact exactValue + +/-- Exact checking result under explicit protocol-sized deployment limits. -/ +def NodeCorrect (plan : auths_model.AuthorizationPlan) : Prop := + ∀ (limits : auths_model.VerifierLimits), LimitsBounded limits → + ∀ (depth maximum : Std.Usize) (refs : NativeSet), depth.val ≤ 17 → GoodSet limits refs → + auths_model.AuthorizationPlan.validate.walk plan depth limits refs maximum + ⦃ result => Corresponds + (checkPlan (sourceLimits limits) depth.val (viewPlan plan) (viewState refs maximum)) result ⦄ + +def ElementsCorrect {n : Nat} + (elements : auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan n) : Prop := + ∀ (limits : auths_model.VerifierLimits), LimitsBounded limits → + ∀ (depth maximum : Std.Usize) (refs : NativeSet), depth.val ≤ 16 → GoodSet limits refs → + ∀ (iterator : core.slice.iter.Iter auths_model.AuthorizationPlan), + iterator.slice.val.drop iterator.i = elements.toList → + auths_model.AuthorizationPlan.validate.walk_members_loop iterator depth limits refs maximum + ⦃ result => Corresponds + (checkChildren (sourceLimits limits) (depth.val + 1) (viewElements elements) + (viewState refs maximum)) result ⦄ + +theorem nil_correct : ElementsCorrect + (auths_composition.alloc.vec.SizedList.nil : + auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan 0) := by + intro limits bounded depth maximum refs depthBound good iterator remaining + rw [auths_model.AuthorizationPlan.validate.walk_members_loop.eq_def, + Auths.Composition.IteratorFacts.next_nil iterator remaining] + simp only [bind_tc_ok, viewElements, checkChildren, Corresponds] + exact ⟨rfl, good.1, rfl⟩ + +theorem cons_correct {n : Nat} (head : auths_model.AuthorizationPlan) + (tail : auths_composition.alloc.vec.SizedList auths_model.AuthorizationPlan n) + (headCorrect : NodeCorrect head) (tailCorrect : ElementsCorrect tail) : + ElementsCorrect (.cons head tail) := by + intro limits bounded depth maximum refs depthBound good iterator remaining + simp only [auths_composition.alloc.vec.SizedList.toList] at remaining + obtain ⟨nextIterator, nextEq, remainingTail⟩ := + Auths.Composition.IteratorFacts.next_cons iterator head tail.toList remaining + rw [auths_model.AuthorizationPlan.validate.walk_members_loop.eq_def, nextEq] + simp only [bind_tc_ok] + step as ⟨childDepth, childDepthEq⟩ + have headRuns := headCorrect limits bounded childDepth maximum refs (by omega) good + rw [childDepthEq] at headRuns + apply spec_bind headRuns + intro result meaning + rcases result with ⟨outcome, nextRefs, nextMaximum⟩ + cases checked : checkPlan (sourceLimits limits) (depth.val + 1) (viewPlan head) (viewState refs maximum) with + | error reason => + cases reason with + | tooLarge => + simp only [Corresponds, checked] at meaning + rw [meaning] + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, Corresponds, viewElements, checkChildren, + Bind.bind, Except.bind, checked] + | invalidOperator => + simp only [Corresponds, checked] at meaning + rw [meaning] + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, Corresponds, viewElements, checkChildren, + Bind.bind, Except.bind, checked] + | ok nextState => + simp only [Corresponds, checked] at meaning + obtain ⟨nativeOk, sorted, stateEq⟩ := meaning + rw [nativeOk] + simp only [core.result.Result.Insts.CoreOpsTry.branch] + have oldCapacity : (viewState refs maximum).seen.card ≤ (sourceLimits limits).leaves := by + rw [card_view refs maximum good.1] + exact good.2 + have nextCapacity := Auths.Composition.ValidationCapacity.checker_preserves_capacity (viewPlan head) + (sourceLimits limits) (depth.val + 1) (viewState refs maximum) nextState oldCapacity checked + have actualCard := congrArg (fun value : State auths_model.ProofRef => value.seen.card) stateEq + rw [card_view nextRefs nextMaximum sorted] at actualCard + have newGood : GoodSet limits nextRefs := ⟨sorted, by simpa only [actualCard, sourceLimits] using nextCapacity⟩ + have continuation := tailCorrect limits bounded depth nextMaximum nextRefs depthBound newGood + nextIterator remainingTail + apply spec_mono continuation + intro actual conclusion + simpa only [viewElements, checkChildren, Bind.bind, Except.bind, checked, stateEq] using conclusion + +@[step] theorem members_exact + (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect members.elements) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (depth maximum : Std.Usize) (refs : NativeSet) (depthBound : depth.val ≤ 16) + (good : GoodSet limits refs) : + auths_model.AuthorizationPlan.validate.walk_members members.deref depth limits refs maximum + ⦃ result => Corresponds + (checkChildren (sourceLimits limits) (depth.val + 1) (viewMembers members) + (viewState refs maximum)) result ⦄ := by + rw [auths_model.AuthorizationPlan.validate.walk_members.eq_def] + simp only [SharedSlice.Insts.CoreIterTraitsCollectIntoIteratorSharedIter.into_iter, + bind_tc_ok] + have viewEq : viewMembers members = viewElements members.elements := by cases members; simp [viewMembers] + rw [viewEq] + apply correct limits bounded depth maximum refs depthBound good + simp only [List.drop_zero, auths_composition.alloc.vec.Vec.deref_exact] + + +theorem view_members_empty (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) : + members.elements.toList.isEmpty = (viewMembers members).isEmpty := by + have lengthEq := Auths.Composition.Traversal.view_members_length members + have sourceLength : members.elements.toList.length = members.size := by + exact members.elements.length + apply Bool.eq_iff_iff.mpr + simp only [List.isEmpty_iff_length_eq_zero] + omega + +theorem members_len (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) : + (auths_composition.alloc.vec.Vec.len members).val = (viewMembers members).length := by + rw [Auths.Composition.Traversal.view_members_length] + simp [auths_composition.alloc.vec.Vec.len, auths_composition.alloc.vec.Vec.toBase, auths_composition.alloc.vec.SizedList.length] + +theorem all_node_exact (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect members.elements) : NodeCorrect (.mk (.AllOf members)) := by + intro limits bounded depth maximum refs depthBound good + rw [auths_model.AuthorizationPlan.validate.walk.eq_def] + simp only [auths_model.AuthorizationPlan._0] + by_cases tooDeep : depth > limits.plan_depth + · have excessive : depth.val > limits.plan_depth.val := by + simpa only [UScalar.lt_equiv] using tooDeep + simp [tooDeep, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, excessive] + · have within : ¬ depth.val > limits.plan_depth.val := by + simpa only [UScalar.lt_equiv] using tooDeep + simp only [tooDeep, ite_false] + step as ⟨updatedMaximum, maximumEq⟩ + simp only [auths_composition.alloc.vec.Vec.is_empty, bind_tc_ok, view_members_empty] + by_cases empty : (viewMembers members).isEmpty + · simp [empty, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, within] + · simp only [empty, Bool.false_eq_true, ite_false] + by_cases tooWide : auths_composition.alloc.vec.Vec.len members > limits.plan_branching + · have excessive : (viewMembers members).length > limits.plan_branching.val := by + simpa only [UScalar.lt_equiv, members_len] using tooWide + simp [tooWide, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, within, empty, excessive] + · have width : ¬ (viewMembers members).length > limits.plan_branching.val := by + simpa only [UScalar.lt_equiv, members_len] using tooWide + simp only [tooWide, ite_false] + have parentBound : depth.val ≤ 16 := by have := bounded.2.1; omega + have run := members_exact members correct limits bounded depth updatedMaximum refs parentBound good + apply spec_bind run + intro actual meaning + rcases actual with ⟨outcome, nextRefs, nextMaximum⟩ + cases outcome <;> simpa [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, Corresponds, checkPlan, enter, Except.bind, Bind.bind, + sourceLimits, viewPlan, viewNode, within, empty, width, viewState, maximumEq] using meaning + + +theorem any_node_exact (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect members.elements) : NodeCorrect (.mk (.AnyOf members)) := by + intro limits bounded depth maximum refs depthBound good + have nativeEq : auths_model.AuthorizationPlan.validate.walk (.mk (.AnyOf members)) depth limits refs maximum = + auths_model.AuthorizationPlan.validate.walk (.mk (.AllOf members)) depth limits refs maximum := by + rw [auths_model.AuthorizationPlan.validate.walk.eq_def, + auths_model.AuthorizationPlan.validate.walk.eq_def] + rfl + rw [nativeEq] + simpa only [viewPlan, viewNode, checkPlan] using + all_node_exact members correct limits bounded depth maximum refs depthBound good + + +theorem threshold_node_exact (required : Std.U16) + (members : auths_composition.alloc.vec.Vec auths_model.AuthorizationPlan) + (correct : ElementsCorrect members.elements) : NodeCorrect (.mk (.KOfN required members)) := by + intro limits bounded depth maximum refs depthBound good + rw [auths_model.AuthorizationPlan.validate.walk.eq_def] + simp only [auths_model.AuthorizationPlan._0] + by_cases tooDeep : depth > limits.plan_depth + · have excessive : depth.val > limits.plan_depth.val := by + simpa only [UScalar.lt_equiv] using tooDeep + simp [tooDeep, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, excessive] + · have within : ¬ depth.val > limits.plan_depth.val := by + simpa only [UScalar.lt_equiv] using tooDeep + simp only [tooDeep, ite_false] + step as ⟨updatedMaximum, maximumEq⟩ + by_cases zero : required = 0#u16 + · have zeroNat : required.val = 0 := by rw [zero]; rfl + simp [zero, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, within] + · have nonzero : required.val ≠ 0 := by exact fun eq => zero (UScalar.eq_of_val_eq eq) + simp only [zero, ite_false] + simp only [lift, bind_tc_ok] + have convertedEq : (core.convert.num.FromUsizeU16.from required).val = required.val := core.convert.num.FromUsizeU16.from_val_eq required + by_cases impossible : core.convert.num.FromUsizeU16.from required > auths_composition.alloc.vec.Vec.len members + · have excessive : required.val > (viewMembers members).length := by + simpa only [UScalar.lt_equiv, members_len, convertedEq] using impossible + simp [impossible, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, within, excessive] + · have feasible : ¬ required.val > (viewMembers members).length := by + simpa only [UScalar.lt_equiv, members_len, convertedEq] using impossible + simp only [impossible, ite_false, auths_composition.alloc.vec.Vec.is_empty, + bind_tc_ok, view_members_empty] + by_cases empty : (viewMembers members).isEmpty + · simp [empty, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, within] + · simp only [empty, Bool.false_eq_true, ite_false] + by_cases tooWide : auths_composition.alloc.vec.Vec.len members > limits.plan_branching + · have excessive : (viewMembers members).length > limits.plan_branching.val := by + simpa only [UScalar.lt_equiv, members_len] using tooWide + simp [tooWide, Corresponds, checkPlan, enter, Except.bind, Bind.bind, sourceLimits, + viewPlan, viewNode, within, empty, excessive, nonzero, feasible] + · have width : ¬ (viewMembers members).length > limits.plan_branching.val := by + simpa only [UScalar.lt_equiv, members_len] using tooWide + simp only [tooWide, ite_false] + have parentBound : depth.val ≤ 16 := by have := bounded.2.1; omega + have run := members_exact members correct limits bounded depth updatedMaximum refs parentBound good + apply spec_bind run + intro actual meaning + rcases actual with ⟨outcome, nextRefs, nextMaximum⟩ + cases outcome <;> simpa [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, Corresponds, checkPlan, enter, Except.bind, Bind.bind, + sourceLimits, viewPlan, viewNode, within, empty, width, nonzero, feasible, + viewState, maximumEq] using meaning + + +theorem all_nodes_correct (plan : auths_model.AuthorizationPlan) : NodeCorrect plan := by + refine auths_model.AuthorizationPlan.rec + (motive_1 := fun plan => NodeCorrect plan) + (motive_2 := fun node => NodeCorrect (.mk node)) + (motive_3 := fun members => ElementsCorrect members.elements) + (motive_4 := fun _ elements => ElementsCorrect elements) + ?_ ?_ ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro node correct + exact correct + · intro reference limits bounded depth maximum refs depthBound good + simpa only [viewPlan, viewNode] using + proof_leaf_exact reference depth maximum limits refs good.1 (room_for_leaf limits bounded refs good) + · intro members correct + exact all_node_exact members correct + · intro members correct + exact any_node_exact members correct + · intro required members correct + exact threshold_node_exact required members correct + · intro size elements bound correct + exact correct + · exact nil_correct + · intro size head tail headCorrect tailCorrect + exact cons_correct head tail headCorrect tailCorrect + +theorem walk_refines (plan : auths_model.AuthorizationPlan) + (limits : auths_model.VerifierLimits) (bounded : LimitsBounded limits) + (depth maximum : Std.Usize) (refs : NativeSet) (depthBound : depth.val ≤ 17) + (good : GoodSet limits refs) : + auths_model.AuthorizationPlan.validate.walk plan depth limits refs maximum + ⦃ result => Corresponds + (checkPlan (sourceLimits limits) depth.val (viewPlan plan) (viewState refs maximum)) result ⦄ := + all_nodes_correct plan limits bounded depth maximum refs depthBound good + +end Auths.Composition.ValidationRefinement diff --git a/formal/Auths/Composition/ValidationShape.lean b/formal/Auths/Composition/ValidationShape.lean new file mode 100644 index 000000000..ffdcdae5b --- /dev/null +++ b/formal/Auths/Composition/ValidationShape.lean @@ -0,0 +1,95 @@ +import Auths.Composition.ValidationProgress +open Auths.Composition.PlanModel Auths.Composition.ValidationModel Auths.Composition.Bounds +namespace Auths.Composition.ValidationShape +variable {R : Type} [DecidableEq R] + +def NodeShape (plan : Plan R) : Prop := + ∀ limits level (state next : State R), checkPlan limits level plan state = .ok next → + operatorsValid limits plan ∧ level + depth plan ≤ limits.depth + 1 + +def ChildrenShape (members : List (Plan R)) : Prop := + ∀ limits level (state next : State R), checkChildren limits level members state = .ok next → + childrenValid limits members ∧ (members ≠ [] → level + memberDepth members ≤ limits.depth + 1) + +theorem checker_shape (plan : Plan R) : NodeShape plan := by + refine Plan.rec + (motive_1 := fun plan => NodeShape plan) + (motive_2 := fun members => ChildrenShape members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference limits level state next evaluates + by_cases deep : level > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp [operatorsValid, depth] + omega + · intro members correct limits level state next evaluates + by_cases deep : level > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · rename_i nonempty + split at evaluates + · contradiction + · rename_i width + have nonempty : members ≠ [] := by simpa using nonempty + obtain ⟨valid, depthBound⟩ := correct limits (level + 1) + { state with maximumDepth := max state.maximumDepth level } next evaluates + refine ⟨by simpa [operatorsValid] using And.intro nonempty (And.intro (Nat.le_of_not_gt width) valid), ?_⟩ + have := depthBound nonempty + simp only [depth] + omega + · intro members correct limits level state next evaluates + by_cases deep : level > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · rename_i nonempty + split at evaluates + · contradiction + · rename_i width + have nonempty : members ≠ [] := by simpa using nonempty + obtain ⟨valid, depthBound⟩ := correct limits (level + 1) + { state with maximumDepth := max state.maximumDepth level } next evaluates + refine ⟨by simpa [operatorsValid] using And.intro nonempty (And.intro (Nat.le_of_not_gt width) valid), ?_⟩ + have := depthBound nonempty + simp only [depth] + omega + · intro required members correct limits level state next evaluates + by_cases deep : level > limits.depth + · simp [checkPlan, enter, deep, Bind.bind, Except.bind] at evaluates + · simp only [checkPlan, enter, deep, ite_false, Bind.bind, Except.bind] at evaluates + split at evaluates + · contradiction + · rename_i threshold + have thresholdFacts : required ≠ 0 ∧ required ≤ members.length ∧ members ≠ [] := by + simpa only [not_or, List.isEmpty_iff, Nat.not_lt] using threshold + split at evaluates + · contradiction + · rename_i width + obtain ⟨valid, depthBound⟩ := correct limits (level + 1) + { state with maximumDepth := max state.maximumDepth level } next evaluates + refine ⟨by simp only [operatorsValid]; exact ⟨by omega, thresholdFacts.2.1, Nat.le_of_not_gt width, valid⟩, ?_⟩ + have := depthBound thresholdFacts.2.2 + simp only [depth] + omega + · intro limits level state next evaluates + simp [childrenValid] + · intro head tail headCorrect tailCorrect limits level state next evaluates + simp only [checkChildren, Bind.bind, Except.bind] at evaluates + cases first : checkPlan limits level head state with + | error reason => simp [first] at evaluates + | ok middle => + simp only [first] at evaluates + obtain ⟨headValid, headDepth⟩ := headCorrect limits level state middle first + obtain ⟨tailValid, tailDepth⟩ := tailCorrect limits level middle next evaluates + refine ⟨by simpa only [childrenValid] using And.intro headValid tailValid, ?_⟩ + intro nonempty + by_cases empty : tail = [] + · simp only [empty, memberDepth, Nat.max_zero] + exact headDepth + · have := tailDepth empty + simp only [memberDepth] + omega + +end Auths.Composition.ValidationShape diff --git a/formal/Auths/Composition/ValidationSoundness.lean b/formal/Auths/Composition/ValidationSoundness.lean new file mode 100644 index 000000000..7a58d0fe0 --- /dev/null +++ b/formal/Auths/Composition/ValidationSoundness.lean @@ -0,0 +1,53 @@ +import Auths.Composition.ValidationComplete +open Auths.Composition.PlanModel Auths.Composition.ValidationModel Auths.Composition.Bounds +open Auths.Composition.Work Auths.Composition.ValidationProgress Auths.Composition.ValidationShape +namespace Auths.Composition.ValidationSoundness +variable {R : Type} [DecidableEq R] + +theorem accepted_is_valid (limits : Limits) (plan : Plan R) (next : State R) + (accepted : checkPlan limits 1 plan rootState = .ok next) : Valid limits plan := by + obtain ⟨operators, depthBound⟩ := checker_shape plan limits 1 rootState next accepted + have progress := checker_progress plan limits 1 rootState next accepted + have capacity := Auths.Composition.ValidationCapacity.checker_preserves_capacity plan limits 1 rootState next + (by simp [rootState]) accepted + have card := progress_card (rootState : State R).seen next.seen (leaves plan) progress + refine ⟨operators, by omega, progress.1, ?_⟩ + simp only [rootState, Finset.card_empty, Nat.zero_add] at card + omega + +theorem accepted_iff_valid (limits : Limits) (plan : Plan R) : + (∃ next, checkPlan limits 1 plan rootState = .ok next) ↔ Valid limits plan := by + constructor + · rintro ⟨next, accepted⟩ + exact accepted_is_valid limits plan next accepted + · exact Auths.Composition.ValidationComplete.valid_is_accepted limits plan + +omit [DecidableEq R] in +theorem operators_are_proper (limits : Limits) (plan : Plan R) : operatorsValid limits plan → proper plan := by + refine Plan.rec + (motive_1 := fun plan => operatorsValid limits plan → proper plan) + (motive_2 := fun members => childrenValid limits members → membersProper members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · simp [operatorsValid, proper] + · intro members correct valid + simp only [operatorsValid] at valid + simpa only [proper] using And.intro valid.1 (correct valid.2.2) + · intro members correct valid + simp only [operatorsValid] at valid + simpa only [proper] using And.intro valid.1 (correct valid.2.2) + · intro required members correct valid + simp only [operatorsValid] at valid + have nonempty : members ≠ [] := by intro empty; simp [empty] at valid; omega + simpa only [proper] using And.intro nonempty (correct valid.2.2.2) + · simp [childrenValid, membersProper] + · intro head tail headCorrect tailCorrect valid + simp only [childrenValid] at valid + simpa only [membersProper] using And.intro (headCorrect valid.1) (tailCorrect valid.2) + +omit [DecidableEq R] in +theorem valid_has_bounded_events (limits : Limits) (plan : Plan R) (valid : Valid limits plan) + (depthBound : limits.depth ≤ 16) (leavesBound : limits.leaves ≤ 128) : nodes plan ≤ 2048 := by + exact bounded_events plan (operators_are_proper limits plan valid.1) + (by have := valid.2.1; omega) (by have := valid.2.2.2; omega) + +end Auths.Composition.ValidationSoundness diff --git a/formal/Auths/Composition/Work.lean b/formal/Auths/Composition/Work.lean new file mode 100644 index 000000000..c48247691 --- /dev/null +++ b/formal/Auths/Composition/Work.lean @@ -0,0 +1,160 @@ +import Auths.Composition.Traversal +open Aeneas Aeneas.Std +open auths_composition +open Auths.Composition.PlanModel +namespace Auths.Composition.Work + +mutual + def nodes {R : Type} : Plan R → Nat + | .proof _ => 1 + | .allOf members | .anyOf members | .kOfN _ members => 1 + memberNodes members + termination_by plan => sizeOf plan + def memberNodes {R : Type} : List (Plan R) → Nat + | [] => 0 + | head :: tail => nodes head + memberNodes tail + termination_by members => sizeOf members +end + +def countEvent {R : Type} (count : Nat) (_ : Event R) : Nat := count + 1 + +section +variable {R B : Type} (branch : B → R → BranchOutcome × B) + +def NodeCountCorrect (plan : Plan R) : Prop := + ∀ state count, (Auths.Composition.PlanModel.evaluate branch countEvent plan state count).2.2 = count + nodes plan + +def MemberCountCorrect (members : List (Plan R)) : Prop := + ∀ state count, (evaluateChildren branch countEvent members state count).2.2 = count + memberNodes members + +theorem event_count (plan : Plan R) : NodeCountCorrect branch plan := by + refine Plan.rec + (motive_1 := fun plan => NodeCountCorrect branch plan) + (motive_2 := fun members => MemberCountCorrect branch members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference state count + simp [Auths.Composition.PlanModel.evaluate, countEvent, nodes] + · intro members correct state count + simp only [Auths.Composition.PlanModel.evaluate, countEvent, nodes] + have counted := correct state count + rw [counted] + omega + · intro members correct state count + simp only [Auths.Composition.PlanModel.evaluate, countEvent, nodes] + have counted := correct state count + rw [counted] + omega + · intro required members correct state count + simp only [Auths.Composition.PlanModel.evaluate, countEvent, nodes] + have counted := correct state count + rw [counted] + omega + · intro state count + simp [evaluateChildren, memberNodes] + · intro head tail headCorrect tailCorrect state count + generalize childEq : Auths.Composition.PlanModel.evaluate branch countEvent head state count = child + rcases child with ⟨outcome, next, counted⟩ + have headCount := headCorrect state count + rw [childEq] at headCount + have tailCount := tailCorrect next counted + simp only [evaluateChildren, childEq, memberNodes] + rw [tailCount] + dsimp only at headCount + rw [headCount] + omega + +end + +mutual + def leaves {R : Type} : Plan R → List R + | .proof reference => [reference] + | .allOf members | .anyOf members | .kOfN _ members => memberLeaves members + termination_by plan => sizeOf plan + def memberLeaves {R : Type} : List (Plan R) → List R + | [] => [] + | head :: tail => leaves head ++ memberLeaves tail + termination_by members => sizeOf members +end + +def recordLeaf {R : Type} (trace : List R) : Event R → List R + | .proof reference _ => trace ++ [reference] + | .aggregate _ _ _ _ _ => trace + +section +variable {R B : Type} (branch : B → R → BranchOutcome × B) + +def NodeOrderCorrect (plan : Plan R) : Prop := + ∀ state trace, (Auths.Composition.PlanModel.evaluate branch recordLeaf plan state trace).2.2 = trace ++ leaves plan + +def MemberOrderCorrect (members : List (Plan R)) : Prop := + ∀ state trace, (evaluateChildren branch recordLeaf members state trace).2.2 = trace ++ memberLeaves members + +theorem leaf_order (plan : Plan R) : NodeOrderCorrect branch plan := by + refine Plan.rec + (motive_1 := fun plan => NodeOrderCorrect branch plan) + (motive_2 := fun members => MemberOrderCorrect branch members) + ?_ ?_ ?_ ?_ ?_ ?_ plan + · intro reference state trace + simp [Auths.Composition.PlanModel.evaluate, recordLeaf, leaves] + · intro members correct state trace + simp only [Auths.Composition.PlanModel.evaluate, recordLeaf, leaves] + exact correct state trace + · intro members correct state trace + simp only [Auths.Composition.PlanModel.evaluate, recordLeaf, leaves] + exact correct state trace + · intro required members correct state trace + simp only [Auths.Composition.PlanModel.evaluate, recordLeaf, leaves] + exact correct state trace + · intro state trace + simp [evaluateChildren, memberLeaves] + · intro head tail headCorrect tailCorrect state trace + generalize childEq : Auths.Composition.PlanModel.evaluate branch recordLeaf head state trace = child + rcases child with ⟨outcome, next, observed⟩ + have headOrder := headCorrect state trace + rw [childEq] at headOrder + have tailOrder := tailCorrect next observed + simp only [evaluateChildren, childEq, memberLeaves] + rw [tailOrder] + dsimp only at headOrder + rw [headOrder, List.append_assoc] + +end +section +variable {B : Type} +variable (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) +variable (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) +variable (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) + +include branchContract + +theorem source_event_count + (nativeObserver : core.ops.function.FnMut Nat EvaluationEvent Unit) + (observerContract : ∀ count event, + nativeObserver.call_mut count event = Aeneas.Std.Result.ok ((), count + 1)) + (plan : auths_model.AuthorizationPlan) (state : B) (count : Nat) : + ∃ outcome next, evaluate_node nativeBranch nativeObserver plan state count = + Aeneas.Std.Result.ok (outcome, next, count + nodes (viewPlan plan)) := by + let expected := Auths.Composition.PlanModel.evaluate modelBranch countEvent (viewPlan plan) state count + refine ⟨expected.1, expected.2.1, ?_⟩ + have counted := event_count modelBranch (viewPlan plan) state count + rw [← counted] + exact Auths.Composition.Traversal.evaluator_refines nativeBranch nativeObserver modelBranch countEvent + branchContract observerContract plan state count + +theorem source_leaf_order + (nativeObserver : core.ops.function.FnMut (List auths_model.ProofRef) EvaluationEvent Unit) + (observerContract : ∀ trace event, + nativeObserver.call_mut trace event = Aeneas.Std.Result.ok ((), recordLeaf trace (eventView event))) + (plan : auths_model.AuthorizationPlan) (state : B) (trace : List auths_model.ProofRef) : + ∃ outcome next, evaluate_node nativeBranch nativeObserver plan state trace = + Aeneas.Std.Result.ok (outcome, next, trace ++ leaves (viewPlan plan)) := by + let expected := Auths.Composition.PlanModel.evaluate modelBranch recordLeaf (viewPlan plan) state trace + refine ⟨expected.1, expected.2.1, ?_⟩ + have ordered := leaf_order modelBranch (viewPlan plan) state trace + rw [← ordered] + exact Auths.Composition.Traversal.evaluator_refines nativeBranch nativeObserver modelBranch recordLeaf + branchContract observerContract plan state trace + +end + +end Auths.Composition.Work diff --git a/formal/Auths/Composition/Wrapper.lean b/formal/Auths/Composition/Wrapper.lean new file mode 100644 index 000000000..fe06586e9 --- /dev/null +++ b/formal/Auths/Composition/Wrapper.lean @@ -0,0 +1,59 @@ +import Auths.Composition.Traversal +open Aeneas Aeneas.Std Result +open auths_composition +namespace Auths.Composition.Wrapper + +section +variable {B O : Type} +variable (nativeBranch : core.ops.function.FnMut B auths_model.ProofRef BranchOutcome) +variable (nativeObserver : core.ops.function.FnMut O EvaluationEvent Unit) + +theorem validation_refusal (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (branch : B) (observer : O) (reason : auths_model.ModelError) + (refused : auths_model.AuthorizationPlan.validate plan limits = ok (.Err reason)) : + evaluate_observed nativeBranch nativeObserver plan limits branch observer = + ok (.Err .AuthorizationPlanInvalid, branch, observer) := by + simp [evaluate_observed, refused] + + +theorem evaluated_has_validated_plan + (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (branch finalBranch : B) (observer finalObserver : O) (outcome : BranchOutcome) + (evaluated : evaluate_observed nativeBranch nativeObserver plan limits branch observer = + ok (.Ok outcome, finalBranch, finalObserver)) : + ∃ shape, auths_model.AuthorizationPlan.validate plan limits = ok (.Ok shape) := by + cases validation : auths_model.AuthorizationPlan.validate plan limits with + | fail error => simp [evaluate_observed, validation] at evaluated + | div => simp [evaluate_observed, validation] at evaluated + | ok result => + cases result with + | Ok shape => exact ⟨shape, rfl⟩ + | Err reason => + rw [validation_refusal nativeBranch nativeObserver plan limits branch observer reason validation] at evaluated + simp at evaluated + +variable (modelBranch : B → auths_model.ProofRef → BranchOutcome × B) +variable (modelObserver : O → Auths.Composition.PlanModel.Event auths_model.ProofRef → O) +variable (branchContract : ∀ state reference, + nativeBranch.call_mut state reference = ok (modelBranch state reference)) +variable (observerContract : ∀ state event, + nativeObserver.call_mut state event = ok ((), modelObserver state (Auths.Composition.PlanModel.eventView event))) +include branchContract observerContract + +theorem validated_refines (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (branch : B) (observer : O) (shape : auths_model.PlanShape) + (validated : auths_model.AuthorizationPlan.validate plan limits = ok (.Ok shape)) : + evaluate_observed nativeBranch nativeObserver plan limits branch observer = + let expected := Auths.Composition.PlanModel.evaluate modelBranch modelObserver + (Auths.Composition.PlanModel.viewPlan plan) branch observer + ok (.Ok expected.1, expected.2.1, expected.2.2) := by + simp only [evaluate_observed, validated, bind_tc_ok] + rw [Auths.Composition.Traversal.evaluator_refines nativeBranch nativeObserver modelBranch modelObserver + branchContract observerContract plan branch observer] + simp only [bind_tc_ok] + cases result : Auths.Composition.PlanModel.evaluate modelBranch modelObserver + (Auths.Composition.PlanModel.viewPlan plan) branch observer with + | mk outcome states => cases states; rfl + +end +end Auths.Composition.Wrapper diff --git a/formal/Auths/Crypto/BufferAllocation.lean b/formal/Auths/Crypto/BufferAllocation.lean new file mode 100644 index 000000000..26d819093 --- /dev/null +++ b/formal/Auths/Crypto/BufferAllocation.lean @@ -0,0 +1,73 @@ +import qualification.aeneas.generated.codec.Funs +import Mathlib.Tactic.CasesM + +open Aeneas Aeneas.Std Result +open auths_codec +namespace Auths.Crypto.BufferAllocation + +/-- The signed pointer-size restriction imposed by Rust Vec, independently +of the preceding unsigned length arithmetic. Physical memory is external. -/ +abbrev Fits (capacity : Std.Usize) : Prop := (capacity.val : Int) ≤ Isize.max + +theorem signed_bounds_iff (capacity : Std.Usize) : + IScalar.inBounds .Isize capacity.val ↔ Fits capacity := by + have lower : -((2 : Int) ^ (IScalarTy.Isize.numBits - 1)) ≤ 0 := by + have : 0 ≤ (2 : Int) ^ (IScalarTy.Isize.numBits - 1) := by positivity + omega + simp only [IScalar.inBounds, Fits, Isize.max, Isize.numBits] + omega + +theorem buffer_refines (capacity : Std.Usize) : + hash.preimage_buffer capacity = + ok (if Fits capacity then .Ok (alloc.vec.Vec.new Std.U8) else .Err .LimitExceeded) := by + unfold hash.preimage_buffer Isize.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + have conversion := IScalar.tryMkOpt_eq .Isize capacity.val + cases converted : IScalar.tryMkOpt .Isize capacity.val with + | none => + simp only [converted] at conversion + have refused : ¬ Fits capacity := fun fits => conversion ((signed_bounds_iff capacity).mpr fits) + simp [converted, refused, core.result.Result.map_err, error.limit_error, BuiltinFnOnce, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from] + | some signed => + simp only [converted] at conversion + have fits : Fits capacity := (signed_bounds_iff capacity).mp conversion.2 + simp [converted, fits, core.result.Result.map_err, error.limit_error, BuiltinFnOnce, + core.result.Result.Insts.CoreOpsTry.branch, alloc.vec.Vec.with_capacity] + +theorem accepted_empty (capacity : Std.Usize) (output : alloc.vec.Vec Std.U8) + (accepted : hash.preimage_buffer capacity = ok (.Ok output)) : output.val = [] := by + rw [buffer_refines] at accepted + split at accepted + · have same : alloc.vec.Vec.new Std.U8 = output := by simpa using accepted + subst output + rfl + · simp at accepted + +theorem accepted_capacity_fits (capacity : Std.Usize) (output : alloc.vec.Vec Std.U8) + (accepted : hash.preimage_buffer capacity = ok (.Ok output)) : Fits capacity := by + rw [buffer_refines] at accepted + split at accepted + · assumption + · simp at accepted + +theorem fits_conservative (capacity : Std.Usize) (small : capacity.val ≤ 2147483647) : + Fits capacity := by + have lower := IScalar.cMax_le_rMax .Isize + rw [IScalar.rMax_eq_max, IScalar.max_ISize_eq] at lower + norm_num [IScalar.cMax, IScalar.rMax, I32.rMax] at lower + omega + +-- Kernel witnesses can reduce a small literal without expanding the opaque +-- platform-width definition. The large branch retains the exact native limit. +theorem buffer_conservative_model (capacity : Std.Usize) : + hash.preimage_buffer capacity = ok ( + if capacity.val ≤ 2147483647 then .Ok (alloc.vec.Vec.new Std.U8) + else if Fits capacity then .Ok (alloc.vec.Vec.new Std.U8) else .Err .LimitExceeded) := by + rw [buffer_refines] + by_cases small : capacity.val ≤ 2147483647 + · simp [small, fits_conservative capacity small] + · simp [small] + +end Auths.Crypto.BufferAllocation diff --git a/formal/Auths/Crypto/CommitmentExamples.lean b/formal/Auths/Crypto/CommitmentExamples.lean new file mode 100644 index 000000000..8801a02ae --- /dev/null +++ b/formal/Auths/Crypto/CommitmentExamples.lean @@ -0,0 +1,55 @@ +import Auths.Crypto.CommitmentRefinement +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +open auths_codec +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 +namespace Auths.Crypto.CommitmentExamples + +def emptyDomain : Str := ⟨[], by scalar_tac⟩ +def tooLongDomain : Str := ⟨List.replicate 129 97#u8, by scalar_tac⟩ +def sampleDomain : Str := ⟨[100#u8, 101#u8, 109#u8, 111#u8], by scalar_tac⟩ +def payload : Slice Std.U8 := ⟨[0#u8, 255#u8], by scalar_tac⟩ + +def applicationOutput : alloc.vec.Vec Std.U8 := ⟨[ + 65#u8, 85#u8, 84#u8, 72#u8, 83#u8, 45#u8, 67#u8, 79#u8, + 77#u8, 77#u8, 73#u8, 84#u8, 77#u8, 69#u8, 78#u8, 84#u8, + 0#u8, 1#u8, 0#u8, 4#u8, 100#u8, 101#u8, 109#u8, 111#u8, + 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 2#u8, 0#u8, 255#u8 +], by scalar_tac⟩ + +def tagByte : hash.IdentifierType → Std.U8 + | .Grant => 1#u8 | .Action => 2#u8 | .Plan => 3#u8 | .Evidence => 4#u8 + | .PrincipalStatus => 5#u8 | .GrantStatus => 6#u8 | .Context => 9#u8 + | .ObservationRequirement => 11#u8 | .ApprovalRequirement => 12#u8 + +def identifierOutput (kind : hash.IdentifierType) : alloc.vec.Vec Std.U8 := ⟨[ + 65#u8, 85#u8, 84#u8, 72#u8, 83#u8, 45#u8, 73#u8, 68#u8, + 0#u8, 1#u8, 0#u8, tagByte kind, + 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 2#u8, 0#u8, 255#u8 +], by scalar_tac⟩ + +theorem empty_domain_refused (bytes : Slice Std.U8) : + hash.commitment_preimage emptyDomain bytes = ok (.Err .LimitExceeded) := by + cbv + +theorem oversized_domain_refused (bytes : Slice Std.U8) : + hash.commitment_preimage tooLongDomain bytes = ok (.Err .LimitExceeded) := by + cbv + +theorem application_sample_admitted : ∃ output, + hash.commitment_preimage sampleDomain payload = ok (.Ok output) := by + refine ⟨applicationOutput, ?_⟩ + unfold hash.commitment_preimage + simp only [BufferAllocation.buffer_conservative_model] + cbv + +theorem every_identifier_tag_admitted (kind : hash.IdentifierType) : ∃ output, + hash.identifier_preimage kind payload = ok (.Ok output) := by + refine ⟨identifierOutput kind, ?_⟩ + unfold hash.identifier_preimage + simp only [BufferAllocation.buffer_conservative_model, CommitmentRefinement.identifier_tag_word] + cases kind <;> cbv + +end Auths.Crypto.CommitmentExamples diff --git a/formal/Auths/Crypto/CommitmentFrames.lean b/formal/Auths/Crypto/CommitmentFrames.lean new file mode 100644 index 000000000..bedcab32c --- /dev/null +++ b/formal/Auths/Crypto/CommitmentFrames.lean @@ -0,0 +1,81 @@ +import Auths.Crypto.Framing +open Auths.Codec +namespace Auths.Crypto.CommitmentFrames +structure Application where + domain : List Nat + payload : List Nat + deriving DecidableEq +structure Identifier where + kind : Nat + payload : List Nat + deriving DecidableEq + +def Application.Valid (frame : Application) : Prop := + 0 < frame.domain.length ∧ frame.domain.length ≤ 128 ∧ + frame.payload.length < 18446744073709551616 ∧ BytesValid frame.domain ∧ BytesValid frame.payload + +def Identifier.Valid (frame : Identifier) : Prop := + frame.kind < 65536 ∧ frame.payload.length < 18446744073709551616 ∧ BytesValid frame.payload + +def application (frame : Application) : List Nat := + [65, 85, 84, 72, 83, 45, 67, 79, 77, 77, 73, 84, 77, 69, 78, 84, 0, 1] ++ + bigEndian 2 frame.domain.length ++ frame.domain ++ + bigEndian 8 frame.payload.length ++ frame.payload + +def identifier (frame : Identifier) : List Nat := + [65, 85, 84, 72, 83, 45, 73, 68, 0, 1] ++ bigEndian 2 frame.kind ++ + bigEndian 8 frame.payload.length ++ frame.payload + +theorem application_length (frame : Application) : + (application frame).length = 28 + frame.domain.length + frame.payload.length := by + simp [application, bigEndian_length] + omega + +theorem identifier_length (frame : Identifier) : + (identifier frame).length = 20 + frame.payload.length := by + simp [identifier, bigEndian_length] + omega + +theorem application_unambiguous (left right : Application) + (leftValid : left.Valid) (rightValid : right.Valid) + (same : application left = application right) : left = right := by + have rest : bigEndian 2 left.domain.length ++ (left.domain ++ + (bigEndian 8 left.payload.length ++ left.payload)) = + bigEndian 2 right.domain.length ++ (right.domain ++ + (bigEndian 8 right.payload.length ++ right.payload)) := by + simpa only [application, List.append_assoc, List.cons_append, List.nil_append, + List.cons.injEq, true_and] using same + obtain ⟨lengthBytes, rest⟩ := List.append_inj rest (by simp [bigEndian_length]) + have lengths : left.domain.length = right.domain.length := + Framing.endian_injective 2 _ _ (by have := leftValid.2.1; omega) + (by have := rightValid.2.1; omega) lengthBytes + obtain ⟨domains, rest⟩ := List.append_inj rest lengths + obtain ⟨_, payloads⟩ := List.append_inj rest (by simp [bigEndian_length]) + cases left; cases right + simp_all + +theorem identifier_unambiguous (left right : Identifier) + (leftValid : left.Valid) (rightValid : right.Valid) + (same : identifier left = identifier right) : left = right := by + have rest : bigEndian 2 left.kind ++ (bigEndian 8 left.payload.length ++ left.payload) = + bigEndian 2 right.kind ++ (bigEndian 8 right.payload.length ++ right.payload) := by + simpa only [identifier, List.append_assoc, List.cons_append, List.nil_append, + List.cons.injEq, true_and] using same + obtain ⟨kindBytes, rest⟩ := List.append_inj rest (by simp [bigEndian_length]) + have kinds := Framing.endian_injective 2 left.kind right.kind leftValid.1 rightValid.1 kindBytes + obtain ⟨_, payloads⟩ := List.append_inj rest (by simp [bigEndian_length]) + cases left; cases right + simp_all + +theorem application_identifier_separate (left : Application) (right : Identifier) : + application left ≠ identifier right := by + simp [application, identifier, List.append_assoc] + +theorem signing_application_separate (left : Framing.Frame) (right : Application) : + Framing.encode left ≠ application right := by + simp [Framing.encode, application, List.append_assoc] + +theorem signing_identifier_separate (left : Framing.Frame) (right : Identifier) : + Framing.encode left ≠ identifier right := by + simp [Framing.encode, identifier, List.append_assoc] +end Auths.Crypto.CommitmentFrames diff --git a/formal/Auths/Crypto/CommitmentRefinement.lean b/formal/Auths/Crypto/CommitmentRefinement.lean new file mode 100644 index 000000000..e0adc4954 --- /dev/null +++ b/formal/Auths/Crypto/CommitmentRefinement.lean @@ -0,0 +1,170 @@ +import Auths.Crypto.Refinement +import Auths.Crypto.CommitmentFrames + +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec Auths.Crypto.Endian Auths.Crypto.Refinement +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 + +namespace Auths.Crypto.CommitmentRefinement + +def applicationFrame (domain : Str) (payload : Slice Std.U8) : CommitmentFrames.Application := + ⟨domain.val.map UScalar.val, payload.val.map UScalar.val⟩ + +def identifierTag : hash.IdentifierType → Nat + | .Grant => 1 | .Action => 2 | .Plan => 3 | .Evidence => 4 + | .PrincipalStatus => 5 | .GrantStatus => 6 | .Context => 9 + | .ObservationRequirement => 11 | .ApprovalRequirement => 12 + +def identifierFrame (kind : hash.IdentifierType) (payload : Slice Std.U8) : CommitmentFrames.Identifier := + ⟨identifierTag kind, payload.val.map UScalar.val⟩ + +@[cbv_eval] theorem identifier_tag_word (kind : hash.IdentifierType) : + IScalar.hcast .U16 (read_discriminant kind) = + match kind with + | .Grant => 1#u16 + | .Action => 2#u16 + | .Plan => 3#u16 + | .Evidence => 4#u16 + | .PrincipalStatus => 5#u16 + | .GrantStatus => 6#u16 + | .Context => 9#u16 + | .ObservationRequirement => 11#u16 + | .ApprovalRequirement => 12#u16 + := by + have discriminant (kind : hash.IdentifierType) : + (read_discriminant kind).val = (match kind with + | .Grant => 1 + | .Action => 2 + | .Plan => 3 + | .Evidence => 4 + | .PrincipalStatus => 5 + | .GrantStatus => 6 + | .Context => 9 + | .ObservationRequirement => 11 + | .ApprovalRequirement => 12 + : Int) := by + cases kind <;> simp [read_discriminant, instDiscriminantIdentifierTypeIsize, + hash.IdentifierType.read_discriminant, IScalar.ofInt, IScalar.ofInt_val_eq] + cases kind + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.Grant) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.Action) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.Plan) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.Evidence) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.PrincipalStatus) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.GrantStatus) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.Context) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.ObservationRequirement) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.IdentifierType.ApprovalRequirement) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + +theorem application_preimage_exact (domain : Str) (payload : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : hash.commitment_preimage domain payload = ok (.Ok output)) : + output.val.map UScalar.val = CommitmentFrames.application (applicationFrame domain payload) := by + unfold hash.commitment_preimage at accepted + simp only [BufferAllocation.buffer_refines, core.str.Str.len, core.str.Str.as_bytes, + core.option.Option.and_then, + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + error.limit_error, BuiltinFnOnce, core.result.Result.map_err, core.option.Option.ok_or, + Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output + all_goals casesm* core.result.Result (UScalar _) _ + all_goals split_ifs at * + all_goals simp_all only [lift, core.result.Result.Insts.CoreOpsTry.branch, + Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward append_result_exact) + (add safe forward conversion_value) + (add norm simp [applicationFrame, CommitmentFrames.application, List.map_append, + be16_exact, be64_exact, hash.COMMITMENT_PREFIX, auths_model.PROTOCOL_V1, + alloc.vec.Vec.with_capacity, alloc.vec.Vec.new]) + +theorem identifier_preimage_exact (kind : hash.IdentifierType) (payload : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : hash.identifier_preimage kind payload = ok (.Ok output)) : + output.val.map UScalar.val = CommitmentFrames.identifier (identifierFrame kind payload) := by + unfold hash.identifier_preimage at accepted + simp only [BufferAllocation.buffer_refines, + core.option.Option.and_then, + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + error.limit_error, BuiltinFnOnce, core.result.Result.map_err, core.option.Option.ok_or, + Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output + all_goals casesm* core.result.Result (UScalar _) _ + all_goals split_ifs at * + all_goals simp_all only [lift, core.result.Result.Insts.CoreOpsTry.branch, + Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward append_result_exact) + (add safe forward conversion_value) + (add norm simp [identifierFrame, CommitmentFrames.identifier, List.map_append, + be16_exact, be64_exact, hash.IDENTIFIER_PREFIX, auths_model.PROTOCOL_V1, + alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, identifier_tag_word, identifierTag]) + +end Auths.Crypto.CommitmentRefinement diff --git a/formal/Auths/Crypto/CommitmentValidity.lean b/formal/Auths/Crypto/CommitmentValidity.lean new file mode 100644 index 000000000..3b15bfe17 --- /dev/null +++ b/formal/Auths/Crypto/CommitmentValidity.lean @@ -0,0 +1,154 @@ +import Auths.Crypto.CommitmentRefinement +open Aeneas Aeneas.Std Result +open auths_codec Auths.Crypto.Refinement Auths.Crypto.CommitmentRefinement +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 +namespace Auths.Crypto.CommitmentValidity + +theorem application_frame_valid_from_bounds (domain : Str) (payload : Slice Std.U8) + (nonempty : 0 < domain.val.length) (bounded : domain.val.length ≤ 128) + (payloadLength : Std.U64) + (converted : core.num.tryFromUScalar .U64 (Slice.len payload) = ok (.Ok payloadLength)) : + (applicationFrame domain payload).Valid := by + have bound := conversion_bound (Slice.len payload) payloadLength converted + refine ⟨?_, ?_, ?_, byte_values_valid _, byte_values_valid _⟩ + · simpa only [applicationFrame, List.length_map] using nonempty + · simpa only [applicationFrame, List.length_map] using bounded + · simpa only [applicationFrame, List.length_map, Slice.len_val, Slice.length, + UScalarTy.numBits, Nat.reducePow] using bound + +theorem identifier_frame_valid_from_conversion (kind : hash.IdentifierType) + (payload : Slice Std.U8) (payloadLength : Std.U64) + (converted : core.num.tryFromUScalar .U64 (Slice.len payload) = ok (.Ok payloadLength)) : + (identifierFrame kind payload).Valid := by + have bound := conversion_bound (Slice.len payload) payloadLength converted + refine ⟨?_, ?_, byte_values_valid _⟩ + · cases kind <;> simp [identifierFrame, identifierTag] + · simpa only [identifierFrame, List.length_map, Slice.len_val, Slice.length, + UScalarTy.numBits, Nat.reducePow] using bound + +theorem application_accepted_frame_valid (domain : Str) (payload : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : hash.commitment_preimage domain payload = ok (.Ok output)) : + (applicationFrame domain payload).Valid := by + unfold hash.commitment_preimage at accepted + simp only [BufferAllocation.buffer_refines, core.str.Str.len, core.str.Str.as_bytes, + core.option.Option.and_then, + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + error.limit_error, BuiltinFnOnce, core.result.Result.map_err, core.option.Option.ok_or, + Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output + all_goals casesm* core.result.Result (UScalar _) _ + all_goals split_ifs at * + all_goals simp_all only [lift, core.result.Result.Insts.CoreOpsTry.branch, + Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward conversion_bound) + (add safe apply byte_values_valid) + (add norm simp [CommitmentFrames.Application.Valid, applicationFrame, + core.slice.Slice.is_empty, Slice.len_val, Slice.length, + hash.MAX_COMMITMENT_DOMAIN_BYTES, List.length_map, List.length_pos_iff]) + +theorem identifier_accepted_frame_valid (kind : hash.IdentifierType) (payload : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : hash.identifier_preimage kind payload = ok (.Ok output)) : + (identifierFrame kind payload).Valid := by + unfold hash.identifier_preimage at accepted + simp only [BufferAllocation.buffer_refines, + core.option.Option.and_then, + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + error.limit_error, BuiltinFnOnce, core.result.Result.map_err, core.option.Option.ok_or, + Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output + all_goals casesm* core.result.Result (UScalar _) _ + all_goals split_ifs at * + all_goals simp_all only [lift, core.result.Result.Insts.CoreOpsTry.branch, + Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward identifier_frame_valid_from_conversion) + +theorem identifier_tag_injective : Function.Injective identifierTag := by + intro left right same + cases left <;> cases right <;> simp_all [identifierTag] + +theorem accepted_application_inputs_bind + (leftDomain rightDomain : Str) (leftPayload rightPayload : Slice Std.U8) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftAccepted : hash.commitment_preimage leftDomain leftPayload = ok (.Ok leftOutput)) + (rightAccepted : hash.commitment_preimage rightDomain rightPayload = ok (.Ok rightOutput)) + (same : leftOutput.val = rightOutput.val) : + leftDomain = rightDomain ∧ leftPayload = rightPayload := by + have frames := CommitmentFrames.application_unambiguous _ _ + (application_accepted_frame_valid _ _ _ leftAccepted) + (application_accepted_frame_valid _ _ _ rightAccepted) + ((application_preimage_exact _ _ _ leftAccepted).symm.trans + ((congrArg (fun bytes : List Std.U8 => bytes.map UScalar.val) same).trans + (application_preimage_exact _ _ _ rightAccepted))) + constructor + · apply Subtype.ext + exact byte_values_injective (congrArg CommitmentFrames.Application.domain frames) + · apply Subtype.ext + exact byte_values_injective (congrArg CommitmentFrames.Application.payload frames) + +theorem accepted_identifier_inputs_bind + (leftKind rightKind : hash.IdentifierType) (leftPayload rightPayload : Slice Std.U8) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftAccepted : hash.identifier_preimage leftKind leftPayload = ok (.Ok leftOutput)) + (rightAccepted : hash.identifier_preimage rightKind rightPayload = ok (.Ok rightOutput)) + (same : leftOutput.val = rightOutput.val) : + leftKind = rightKind ∧ leftPayload = rightPayload := by + have frames := CommitmentFrames.identifier_unambiguous _ _ + (identifier_accepted_frame_valid _ _ _ leftAccepted) + (identifier_accepted_frame_valid _ _ _ rightAccepted) + ((identifier_preimage_exact _ _ _ leftAccepted).symm.trans + ((congrArg (fun bytes : List Std.U8 => bytes.map UScalar.val) same).trans + (identifier_preimage_exact _ _ _ rightAccepted))) + constructor + · exact identifier_tag_injective (congrArg CommitmentFrames.Identifier.kind frames) + · apply Subtype.ext + exact byte_values_injective (congrArg CommitmentFrames.Identifier.payload frames) + +theorem application_output_length (domain : Str) (payload : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : hash.commitment_preimage domain payload = ok (.Ok output)) : + output.val.length = 28 + domain.val.length + payload.val.length := by + have length := congrArg List.length (application_preimage_exact _ _ _ accepted) + simpa only [List.length_map, CommitmentFrames.application_length, applicationFrame] using length + +theorem identifier_output_length (kind : hash.IdentifierType) (payload : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : hash.identifier_preimage kind payload = ok (.Ok output)) : + output.val.length = 20 + payload.val.length := by + have length := congrArg List.length (identifier_preimage_exact _ _ _ accepted) + simpa only [List.length_map, CommitmentFrames.identifier_length, identifierFrame] using length + +end Auths.Crypto.CommitmentValidity diff --git a/formal/Auths/Crypto/Encoding/Byte.lean b/formal/Auths/Crypto/Encoding/Byte.lean new file mode 100644 index 000000000..78e87a0ca --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Byte.lean @@ -0,0 +1,21 @@ +import Aeneas +import Mathlib.Tactic.IntervalCases +open Aeneas Aeneas.Std +namespace Auths.Crypto.Encoding.Byte + +theorem lower_seven (byte : Std.U8) : (byte &&& 127#u8).val = byte.val % 128 := by + rw [UScalar.val_and] + change byte.val &&& 127 = byte.val % 128 + exact Nat.and_two_pow_sub_one_eq_mod byte.val 7 + +/-- All 256 cases are checked by the kernel; there is no native-evaluation axiom. -/ +theorem sign_bit (byte : Std.U8) : + ((byte &&& 128#u8) != 0#u8) = decide (128 ≤ byte.val) := by + apply Bool.eq_iff_iff.mpr + simp only [bne_iff_ne, ne_eq, UScalar.eq_equiv, UScalar.val_and, decide_eq_true_eq] + change ¬ (byte.val &&& 128 = 0) ↔ 128 ≤ byte.val + have bounded : byte.val < 256 := by scalar_tac + generalize byte.val = value at * + interval_cases value <;> decide + +end Auths.Crypto.Encoding.Byte diff --git a/formal/Auths/Crypto/Encoding/Coordinate.lean b/formal/Auths/Crypto/Encoding/Coordinate.lean new file mode 100644 index 000000000..a088d0094 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Coordinate.lean @@ -0,0 +1,53 @@ +import Auths.Crypto.Encoding.Digits +namespace Auths.Crypto.Encoding.Coordinate +set_option maxHeartbeats 2000000 + +def prime : Nat := 2 ^ 255 - 19 + +def upperMaximum : Nat := 128 * 256 ^ 30 - 1 + +theorem prime_frame : prime = 256 * upperMaximum + 237 := by decide + +theorem upper_bound (middle top : Nat) (middleBound : middle < 256 ^ 30) (topBound : top < 128) : + middle + 256 ^ 30 * top ≤ upperMaximum := by + norm_num only [upperMaximum, Nat.reducePow, Nat.reduceMul, Nat.reduceSub] at * + omega + +theorem upper_maximum_iff (middle top : Nat) (middleBound : middle < 256 ^ 30) : + middle + 256 ^ 30 * top = upperMaximum ↔ middle = 256 ^ 30 - 1 ∧ top = 127 := by + norm_num only [upperMaximum, Nat.reducePow, Nat.reduceMul, Nat.reduceSub] at * + omega + +theorem upper_zero_iff (middle top : Nat) : + middle + 256 ^ 30 * top = 0 ↔ middle = 0 ∧ top = 0 := by + norm_num only [Nat.reducePow] + omega + +theorem field_iff (first upper : Nat) (firstBound : first < 256) (upperBound : upper ≤ upperMaximum) : + first + 256 * upper < prime ↔ ¬ (upper = upperMaximum ∧ 237 ≤ first) := by + rw [prime_frame] + omega + +theorem identity_iff (first upper : Nat) (firstBound : first < 256) : + first + 256 * upper = 1 ↔ first = 1 ∧ upper = 0 := by omega + +theorem order_two_iff (first upper : Nat) (firstBound : first < 256) : + first + 256 * upper = prime - 1 ↔ first = 236 ∧ upper = upperMaximum := by + rw [prime_frame] + omega + +/-- RFC 8032's field range and negative-zero restrictions, independently + stated on the decoded ordinate and the sign bit. Curve validity is separate. -/ +def Encoding (ordinate : Nat) (negative : Prop) : Prop := + ordinate < prime ∧ (negative → ordinate ≠ 1 ∧ ordinate ≠ prime - 1) + +theorem encoding_criterion (first upper : Nat) (negative : Prop) + (firstBound : first < 256) (upperBound : upper ≤ upperMaximum) : + Encoding (first + 256 * upper) negative ↔ + ¬ (upper = upperMaximum ∧ 237 ≤ first) ∧ + ¬ (negative ∧ ((upper = 0 ∧ first = 1) ∨ (upper = upperMaximum ∧ first = 236))) := by + simp only [Encoding, ne_eq, field_iff first upper firstBound upperBound, + identity_iff first upper firstBound, order_two_iff first upper firstBound] + tauto + +end Auths.Crypto.Encoding.Coordinate diff --git a/formal/Auths/Crypto/Encoding/Digits.lean b/formal/Auths/Crypto/Encoding/Digits.lean new file mode 100644 index 000000000..fb86e36a9 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Digits.lean @@ -0,0 +1,38 @@ +import Aeneas +import Mathlib.Data.Nat.Digits.Defs +namespace Auths.Crypto.Encoding.Digits +set_option maxHeartbeats 2000000 + +theorem maximum_digits (length : Nat) : + Nat.ofDigits 256 (List.replicate length 255) = 256 ^ length - 1 := by + induction length with + | zero => simp + | succ length ih => + have positive : 0 < 256 ^ length := Nat.pow_pos (by decide) + simp only [List.replicate_succ, Nat.ofDigits_cons, ih, Nat.pow_succ] + omega + +theorem value_bound (digits : List Nat) (bounded : ∀ byte ∈ digits, byte < 256) : + Nat.ofDigits 256 digits < 256 ^ digits.length := + Nat.ofDigits_lt_base_pow_length (by decide) bounded + +theorem maximum_iff (digits : List Nat) (bounded : ∀ byte ∈ digits, byte < 256) : + Nat.ofDigits 256 digits = 256 ^ digits.length - 1 ↔ + digits = List.replicate digits.length 255 := by + rw [← maximum_digits] + constructor + · exact Nat.ofDigits_inj_of_len_eq (by decide) (by simp) bounded + (by intro byte member; simp only [List.mem_replicate] at member; omega) + · exact congrArg (Nat.ofDigits 256) + + +theorem zero_iff (digits : List Nat) (bounded : ∀ byte ∈ digits, byte < 256) : + Nat.ofDigits 256 digits = 0 ↔ digits = List.replicate digits.length 0 := by + nth_rw 1 [← Nat.ofDigits_replicate_zero (b := 256) (k := digits.length)] + constructor + · exact Nat.ofDigits_inj_of_len_eq (by decide) (by simp) bounded + (by intro byte member; simp only [List.mem_replicate] at member; omega) + · exact congrArg (Nat.ofDigits 256) + + +end Auths.Crypto.Encoding.Digits diff --git a/formal/Auths/Crypto/Encoding/Ed25519.lean b/formal/Auths/Crypto/Encoding/Ed25519.lean new file mode 100644 index 000000000..3b8a2bece --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Ed25519.lean @@ -0,0 +1,41 @@ +import Auths.Crypto.Encoding.RootFlags +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open Auths.Crypto.Encoding.Encoded Auths.Crypto.Encoding.Coordinate Auths.Crypto.Encoding.RootFlags +namespace Auths.Crypto.Encoding.Ed25519 +set_option maxHeartbeats 2000000 + +theorem guard_refines (input : Input) : + auths_signature_core.ed25519_point_encoding_is_canonical input = ok (decide (Encoding input)) := by + suffices contract : auths_signature_core.ed25519_point_encoding_is_canonical input + ⦃ result => result = decide (Encoding input) ⦄ by + obtain ⟨result, executes, rfl⟩ := spec_imp_exists contract + exact executes + unfold auths_signature_core.ed25519_point_encoding_is_canonical + rw [read_last] + simp only [lift, bind_tc_ok] + apply spec_bind (root_flags input) + rintro ⟨maximum, zero⟩ ⟨maximumMeaning, zeroMeaning⟩ + simp only [uncurry, read_first, read_last, lift, bind_tc_ok, Auths.Crypto.Encoding.Byte.sign_bit] + have firstBound : (first input).val < 256 := by scalar_tac + have topBound : topValue input < 128 := Nat.mod_lt _ (by decide) + have upperBound : upperValue input ≤ upperMaximum := + Auths.Crypto.Encoding.Coordinate.upper_bound (middleValue input) (topValue input) + (middle_bound input) topBound + have semantic : Encoding input ↔ + ¬ (maximum = true ∧ 237 ≤ (first input).val) ∧ + ¬ (128 ≤ (last input).val ∧ ((zero = true ∧ (first input).val = 1) ∨ + (maximum = true ∧ (first input).val = 236))) := by + unfold Auths.Crypto.Encoding.Encoded.Encoding + rw [ordinate_frame, Auths.Crypto.Encoding.Coordinate.encoding_criterion _ _ _ firstBound upperBound] + rw [← maximumMeaning, ← zeroMeaning] + have v237 : (237#u8).val = 237 := by scalar_tac + have v236 : (236#u8).val = 236 := by scalar_tac + have v1 : (1#u8).val = 1 := by scalar_tac + cases maximum <;> cases zero <;> + simp only [Bool.false_eq_true, ↓reduceIte] + all_goals + repeat' first + | split + | simp_all (failIfUnchanged := true) [spec_ok, UScalar.eq_equiv, UScalar.le_equiv] + +end Auths.Crypto.Encoding.Ed25519 diff --git a/formal/Auths/Crypto/Encoding/Encoded.lean b/formal/Auths/Crypto/Encoding/Encoded.lean new file mode 100644 index 000000000..b79886c49 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Encoded.lean @@ -0,0 +1,61 @@ +import Auths.Crypto.Encoding.Flags +import Auths.Crypto.Encoding.Byte +import Auths.Crypto.Encoding.Coordinate +open Aeneas Aeneas.Std +namespace Auths.Crypto.Encoding.Encoded +abbrev Input := Array Std.U8 32#usize + +theorem input_length (input : Input) : input.val.length = 32 := by + have bound := input.property + scalar_tac + +def first (input : Input) : Std.U8 := input.val[0]'(by rw [input_length]; decide) +def last (input : Input) : Std.U8 := input.val[31]'(by rw [input_length]; decide) +def middle (input : Input) : List Std.U8 := (input.val.drop 1).take 30 + +theorem middle_length (input : Input) : (middle input).length = 30 := by + simp [middle] + +theorem input_decomposes (input : Input) : input.val = first input :: middle input ++ [last input] := by + have initial : input.val.take 31 = first input :: middle input := by + cases values : input.val with + | nil => have bound := input_length input; simp [values] at bound + | cons head tail => simp [first, middle, values] + have final : input.val.drop 31 = [last input] := by + rw [List.drop_eq_getElem_cons (by rw [input_length]; decide)] + have stop : input.val.drop 32 = [] := List.drop_eq_nil_iff.mpr (by have := input_length input; omega) + simp only [last, stop] + calc + input.val = input.val.take 31 ++ input.val.drop 31 := (List.take_append_drop 31 input.val).symm + _ = first input :: middle input ++ [last input] := by rw [initial, final] + +def middleValue (input : Input) : Nat := Nat.ofDigits 256 ((middle input).map UScalar.val) +def topValue (input : Input) : Nat := (last input).val % 128 +def upperValue (input : Input) : Nat := middleValue input + 256 ^ 30 * topValue input + +def ordinate (input : Input) : Nat := + Nat.ofDigits 256 ((first input).val :: ((middle input).map UScalar.val ++ [topValue input])) + +def Encoding (input : Input) : Prop := + Auths.Crypto.Encoding.Coordinate.Encoding (ordinate input) (128 ≤ (last input).val) + +instance (input : Input) : Decidable (Encoding input) := inferInstanceAs + (Decidable (ordinate input < Auths.Crypto.Encoding.Coordinate.prime ∧ + (128 ≤ (last input).val → ordinate input ≠ 1 ∧ ordinate input ≠ Auths.Crypto.Encoding.Coordinate.prime - 1))) + +theorem middle_bound (input : Input) : middleValue input < 256 ^ 30 := by + have bounded : ∀ byte ∈ (middle input).map UScalar.val, byte < 256 := by + intro byte member + rcases List.mem_map.mp member with ⟨value, present, rfl⟩ + scalar_tac + simpa only [List.length_map, middle_length, middleValue] using + Auths.Crypto.Encoding.Digits.value_bound ((middle input).map UScalar.val) bounded + +theorem ordinate_frame (input : Input) : ordinate input = (first input).val + 256 * upperValue input := by + unfold ordinate + rw [Nat.ofDigits_cons, Nat.ofDigits_append, Nat.ofDigits_singleton] + rw [List.length_map, middle_length] + rfl + + +end Auths.Crypto.Encoding.Encoded diff --git a/formal/Auths/Crypto/Encoding/Examples.lean b/formal/Auths/Crypto/Encoding/Examples.lean new file mode 100644 index 000000000..47f21cbe6 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Examples.lean @@ -0,0 +1,51 @@ +import Auths.Crypto.Encoding.Ed25519 +import Auths.Crypto.Encoding.P256 +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 + +namespace Auths.Crypto.Encoding.Examples + +-- These are public encoding witnesses. Curve membership and signatures are separate. +def rfcPublicKey : Encoded.Input := ⟨[215#u8, 90#u8, 152#u8, 1#u8, 130#u8, 177#u8, 10#u8, 183#u8, 213#u8, 75#u8, 254#u8, 211#u8, 201#u8, 100#u8, 7#u8, 58#u8, 14#u8, 225#u8, 114#u8, 243#u8, 218#u8, 166#u8, 35#u8, 37#u8, 175#u8, 2#u8, 26#u8, 104#u8, 247#u8, 7#u8, 81#u8, 26#u8], by scalar_tac⟩ + +def noncanonicalField : Encoded.Input := ⟨[240#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 127#u8], by scalar_tac⟩ + +def negativeZero : Encoded.Input := ⟨[1#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 128#u8], by scalar_tac⟩ + +def canonicalIdentity : Encoded.Input := ⟨[1#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8], by scalar_tac⟩ + +theorem rfc_key_encoding_accepted : auths_signature_core.ed25519_point_encoding_is_canonical rfcPublicKey = ok true := by + rw [Ed25519.guard_refines] + cbv + +theorem field_alias_refused : auths_signature_core.ed25519_point_encoding_is_canonical noncanonicalField = ok false := by + rw [Ed25519.guard_refines] + cbv + +theorem negative_zero_refused : auths_signature_core.ed25519_point_encoding_is_canonical negativeZero = ok false := by + rw [Ed25519.guard_refines] + cbv + +theorem canonical_identity_encoding_accepted : auths_signature_core.ed25519_point_encoding_is_canonical canonicalIdentity = ok true := by + rw [Ed25519.guard_refines] + cbv + +theorem compressed_form_accepted : auths_signature_core.p256_key_encoding_is_canonical + (⟨[2#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8], by scalar_tac⟩ : Slice Std.U8) = ok true := by + rw [P256.guard_refines] + cbv + +theorem uncompressed_tag_refused : auths_signature_core.p256_key_encoding_is_canonical + (⟨[4#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8], by scalar_tac⟩ : Slice Std.U8) = ok false := by + rw [P256.guard_refines] + cbv + +theorem short_compressed_refused : auths_signature_core.p256_key_encoding_is_canonical + (⟨[2#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8], by scalar_tac⟩ : Slice Std.U8) = ok false := by + rw [P256.guard_refines] + cbv + +end Auths.Crypto.Encoding.Examples diff --git a/formal/Auths/Crypto/Encoding/Flags.lean b/formal/Auths/Crypto/Encoding/Flags.lean new file mode 100644 index 000000000..624c7e994 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Flags.lean @@ -0,0 +1,68 @@ +import Auths.Crypto.Encoding.Scan +import Auths.Crypto.Encoding.Digits +open Aeneas Aeneas.Std +namespace Auths.Crypto.Encoding.Flags +open Auths.Crypto.Encoding.Scan Auths.Crypto.Encoding.Digits + +theorem scan_flags (bytes : List Std.U8) (maximum zero : Bool) : + scan bytes maximum zero = + (maximum && bytes.all (fun byte => decide (byte = 255#u8)), + zero && bytes.all (fun byte => decide (byte = 0#u8))) := by + induction bytes generalizing maximum zero with + | nil => simp [scan] + | cons head tail ih => + change scan tail (maximum && decide (head = 255#u8)) (zero && decide (head = 0#u8)) = _ + rw [ih] + simp only [List.all_cons, Bool.and_assoc] + +theorem all_maximum (bytes : List Std.U8) : + bytes.all (fun byte => decide (byte = 255#u8)) = true ↔ + bytes.map UScalar.val = List.replicate bytes.length 255 := by + simp only [List.all_eq_true, decide_eq_true_eq, List.eq_replicate_iff, List.length_map, true_and] + constructor + · intro all byte member + rcases List.mem_map.mp member with ⟨value, present, same⟩ + have native := all value present + subst value + exact same.symm + · intro all byte member + have numeric := all byte.val (List.mem_map.mpr ⟨byte, member, rfl⟩) + scalar_tac + +theorem all_zero (bytes : List Std.U8) : + bytes.all (fun byte => decide (byte = 0#u8)) = true ↔ + bytes.map UScalar.val = List.replicate bytes.length 0 := by + simp only [List.all_eq_true, decide_eq_true_eq, List.eq_replicate_iff, List.length_map, true_and] + constructor + · intro all byte member + rcases List.mem_map.mp member with ⟨value, present, same⟩ + have native := all value present + subst value + exact same.symm + · intro all byte member + have numeric := all byte.val (List.mem_map.mpr ⟨byte, member, rfl⟩) + scalar_tac + +theorem maximum_value (bytes : List Std.U8) : + bytes.all (fun byte => decide (byte = 255#u8)) = true ↔ + Nat.ofDigits 256 (bytes.map UScalar.val) = 256 ^ bytes.length - 1 := by + have bounded : ∀ byte ∈ bytes.map UScalar.val, byte < 256 := by + intro byte member + rcases List.mem_map.mp member with ⟨value, present, rfl⟩ + scalar_tac + rw [all_maximum bytes] + simpa only [List.length_map] using + (Auths.Crypto.Encoding.Digits.maximum_iff (bytes.map UScalar.val) bounded).symm + +theorem zero_value (bytes : List Std.U8) : + bytes.all (fun byte => decide (byte = 0#u8)) = true ↔ + Nat.ofDigits 256 (bytes.map UScalar.val) = 0 := by + have bounded : ∀ byte ∈ bytes.map UScalar.val, byte < 256 := by + intro byte member + rcases List.mem_map.mp member with ⟨value, present, rfl⟩ + scalar_tac + rw [all_zero bytes] + simpa only [List.length_map] using + (Auths.Crypto.Encoding.Digits.zero_iff (bytes.map UScalar.val) bounded).symm + +end Auths.Crypto.Encoding.Flags diff --git a/formal/Auths/Crypto/Encoding/P256.lean b/formal/Auths/Crypto/Encoding/P256.lean new file mode 100644 index 000000000..937baa308 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/P256.lean @@ -0,0 +1,37 @@ +import qualification.aeneas.generated.signature.Funs +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.Encoding.P256 + +def Encoding (bytes : List Nat) : Prop := + bytes.length = 33 ∧ (bytes.head? = some 2 ∨ bytes.head? = some 3) + +instance (bytes : List Nat) : Decidable (Encoding bytes) := inferInstanceAs + (Decidable (bytes.length = 33 ∧ (bytes.head? = some 2 ∨ bytes.head? = some 3))) + +theorem guard_refines (input : Slice Std.U8) : + auths_signature_core.p256_key_encoding_is_canonical input = + ok (decide (Encoding (input.val.map UScalar.val))) := by + suffices h : auths_signature_core.p256_key_encoding_is_canonical input + ⦃ result => result = decide (Encoding (input.val.map UScalar.val)) ⦄ by + obtain ⟨result, executes, rfl⟩ := spec_imp_exists h + exact executes + unfold auths_signature_core.p256_key_encoding_is_canonical + simp only [auths_signature_core.P256_KEY_LEN] + by_cases sized : input.val.length = 33 + · have sizeEq : Slice.len input = 33#usize := by scalar_tac + simp only [sizeEq, bne_self_eq_false, Bool.false_eq_true, ite_false] + step as ⟨first, firstEq⟩ + have two : (first = 2#u8) ↔ first.val = 2 := by scalar_tac + have three : (first = 3#u8) ↔ first.val = 3 := by scalar_tac + have headEq : (input.val.map UScalar.val).head? = some first.val := by + cases values : input.val with + | nil => simp [values] at sized + | cons head tail => + have firstIsHead : first = head := by simpa only [values, List.getElem_cons_zero] using firstEq + simp [firstIsHead] + simp only [Encoding, List.length_map, sized, headEq, Option.some.injEq, true_and] + split <;> simp_all + · have sizeNe : Slice.len input ≠ 33#usize := by scalar_tac + simp [sizeNe, spec_ok, Encoding, sized] + +end Auths.Crypto.Encoding.P256 diff --git a/formal/Auths/Crypto/Encoding/RootFlags.lean b/formal/Auths/Crypto/Encoding/RootFlags.lean new file mode 100644 index 000000000..cfe7485cf --- /dev/null +++ b/formal/Auths/Crypto/Encoding/RootFlags.lean @@ -0,0 +1,40 @@ +import Auths.Crypto.Encoding.Encoded +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open Auths.Crypto.Encoding.Encoded Auths.Crypto.Encoding.Coordinate +namespace Auths.Crypto.Encoding.RootFlags + +theorem read_first (input : Input) : Array.index_usize input 0#usize = ok (first input) := by + obtain ⟨byte, executes, same⟩ := spec_imp_exists (Array.index_usize_spec input 0#usize (by scalar_tac)) + have index : (0#usize).val = 0 := by scalar_tac + simpa only [same, first, index] using executes + +theorem read_last (input : Input) : Array.index_usize input 31#usize = ok (last input) := by + obtain ⟨byte, executes, same⟩ := spec_imp_exists (Array.index_usize_spec input 31#usize (by scalar_tac)) + have index : (31#usize).val = 31 := by scalar_tac + simpa only [same, last, index] using executes + +theorem root_flags (input : Input) : + auths_signature_core.ed25519_point_encoding_is_canonical_loop + ⟨1#usize, 31#usize⟩ input + (decide ((last input &&& 127#u8) = 127#u8)) (decide ((last input &&& 127#u8) = 0#u8)) + ⦃ result => (result.1 = true ↔ upperValue input = upperMaximum) ∧ + (result.2 = true ↔ upperValue input = 0) ⦄ := by + have run := Auths.Crypto.Encoding.Scan.loop_refines input 30 ⟨1#usize, 31#usize⟩ + (decide ((last input &&& 127#u8) = 127#u8)) (decide ((last input &&& 127#u8) = 0#u8)) + (by scalar_tac) (by scalar_tac) + apply spec_mono run + intro result meaning + change result = Auths.Crypto.Encoding.Scan.scan (middle input) _ _ at meaning + rw [meaning, Auths.Crypto.Encoding.Flags.scan_flags] + simp only [Bool.and_eq_true, decide_eq_true_eq, Auths.Crypto.Encoding.Flags.maximum_value, + Auths.Crypto.Encoding.Flags.zero_value, middle_length] + have value127 : (127#u8).val = 127 := by scalar_tac + have value0 : (0#u8).val = 0 := by scalar_tac + simp only [UScalar.eq_equiv, Auths.Crypto.Encoding.Byte.lower_seven, value127, value0] + constructor + · simpa only [upperValue, middleValue, topValue, and_comm] using + (upper_maximum_iff (middleValue input) (topValue input) (middle_bound input)).symm + · simpa only [upperValue, middleValue, topValue, and_comm] using + (upper_zero_iff (middleValue input) (topValue input)).symm + +end Auths.Crypto.Encoding.RootFlags diff --git a/formal/Auths/Crypto/Encoding/Scan.lean b/formal/Auths/Crypto/Encoding/Scan.lean new file mode 100644 index 000000000..38db5b6d9 --- /dev/null +++ b/formal/Auths/Crypto/Encoding/Scan.lean @@ -0,0 +1,43 @@ +import qualification.aeneas.generated.signature.Funs +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.Encoding.Scan + +def update (state : Bool × Bool) (byte : Std.U8) : Bool × Bool := + (state.1 && decide (byte = 255#u8), state.2 && decide (byte = 0#u8)) + +def scan (bytes : List Std.U8) (maximum zero : Bool) : Bool × Bool := + bytes.foldl update (maximum, zero) + +theorem loop_refines (encoded : Array Std.U8 32#usize) (remaining : Nat) + (range : core.ops.range.Range Std.Usize) (maximum zero : Bool) + (bounded : range.end.val ≤ 31) (count : range.start.val + remaining = range.end.val) : + auths_signature_core.ed25519_point_encoding_is_canonical_loop range encoded maximum zero + ⦃ result => result = scan ((encoded.val.drop range.start.val).take remaining) maximum zero ⦄ := by + induction remaining generalizing range maximum zero with + | zero => + rw [auths_signature_core.ed25519_point_encoding_is_canonical_loop.eq_def] + have stop : range.end.val ≤ range.start.val := by omega + apply spec_bind (core.iter.range.IteratorRange.next_Usize_none_spec range stop) + rintro ⟨option, next⟩ ⟨noneEq, same⟩ + simp only [noneEq, uncurry, spec_ok, List.take_zero, scan, List.foldl_nil] + | succ remaining ih => + rw [auths_signature_core.ed25519_point_encoding_is_canonical_loop.eq_def] + have advances : range.start.val < range.end.val := by omega + apply spec_bind (core.iter.range.IteratorRange.next_Usize_some_spec range advances) + rintro ⟨option, next⟩ ⟨someEq, nextStart, nextEnd⟩ + simp only [someEq] + have arraySize : encoded.val.length = 32 := by have bound := encoded.property; scalar_tac + step as ⟨byte, byteEq⟩ + have nextBound : next.end.val ≤ 31 := by rw [nextEnd]; exact bounded + have nextCount : next.start.val + remaining = next.end.val := by rw [nextEnd]; omega + have executes := ih next (maximum && decide (byte = 255#u8)) + (zero && decide (byte = 0#u8)) nextBound nextCount + apply spec_mono executes + intro result meaning + have first : (encoded.val.drop range.start.val).take (remaining + 1) = + encoded.val[range.start.val] :: (encoded.val.drop (range.start.val + 1)).take remaining := by + rw [List.drop_eq_getElem_cons (by omega)] + rfl + simpa only [first, scan, List.foldl_cons, update, byteEq, nextStart] using meaning + +end Auths.Crypto.Encoding.Scan diff --git a/formal/Auths/Crypto/Endian.lean b/formal/Auths/Crypto/Endian.lean new file mode 100644 index 000000000..d1f370cf0 --- /dev/null +++ b/formal/Auths/Crypto/Endian.lean @@ -0,0 +1,35 @@ +import Aeneas +import Auths.Codec.Semantics +open Aeneas Aeneas.Std Result +open Auths.Codec +set_option maxHeartbeats 2000000 +namespace Auths.Crypto.Endian + +theorem be16_exact (value : Std.U16) : + (core.num.U16.to_be_bytes value).val.map (·.val) = bigEndian 2 value.val := by + simp only [core.num.U16.to_be_bytes, BitVec.toBEBytes, BitVec.toLEBytes, + UScalarTy.numBits, bigEndian, UScalar.val, List.map_map, + gt_iff_lt, Nat.reduceLT, Nat.reduceSub, ↓reduceIte, + List.reverse_cons, List.reverse_nil, List.nil_append, List.append_nil, + List.map_cons, List.map_nil, List.cons_append, + BitVec.toNat_setWidth, BitVec.toNat_ushiftRight, Nat.shiftRight_eq_div_pow] + simp only [Nat.reducePow, Nat.mod_mod] + + +theorem be64_exact (value : Std.U64) : + (core.num.U64.to_be_bytes value).val.map (·.val) = bigEndian 8 value.val := by + have bound : value.bv.toNat < 18446744073709551616 := value.bv.isLt + simp only [core.num.U64.to_be_bytes, List.map_map, UScalar.val, Function.comp_apply] + change (@BitVec.toBEBytes 64 value.bv).map (fun byte => byte.toNat) = + bigEndian 8 value.bv.toNat + simp only [BitVec.toBEBytes, BitVec.toLEBytes, + bigEndian, gt_iff_lt, Nat.reduceLT, Nat.reduceSub, ↓reduceIte, + List.reverse_cons, List.reverse_nil, List.nil_append, List.append_nil, + List.map_cons, List.map_nil, List.cons_append, + BitVec.toNat_setWidth, BitVec.toNat_ushiftRight, Nat.shiftRight_eq_div_pow] + simp only [Nat.reducePow, Nat.mod_mod] + simp only [List.cons.injEq, and_true] + omega + + +end Auths.Crypto.Endian diff --git a/formal/Auths/Crypto/Examples.lean b/formal/Auths/Crypto/Examples.lean new file mode 100644 index 000000000..f3b01ddd4 --- /dev/null +++ b/formal/Auths/Crypto/Examples.lean @@ -0,0 +1,38 @@ +import Auths.Crypto.Refinement +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +open auths_codec +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 + +namespace Auths.Crypto.Examples + +-- Opaque unsigned bytes: these establish framing, not signature authorization. +def minimalPreimage : alloc.vec.Vec Std.U8 := ⟨[ + 65#u8, 85#u8, 84#u8, 72#u8, 83#u8, 0#u8, 1#u8, 0#u8, + 1#u8, 0#u8, 1#u8, 116#u8, 0#u8, 1#u8, 0#u8, 0#u8, + 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 1#u8, 1#u8 +], by scalar_tac⟩ + +theorem minimal_preimage_exact : hash.signing_preimage .Grant + (toStr "t" (by change 1 ≤ U32.max; scalar_tac)) 1#u16 + (⟨[1#u8], by scalar_tac⟩ : Slice Std.U8) = ok (.Ok minimalPreimage) := by + unfold hash.signing_preimage + simp only [Auths.Crypto.Refinement.object_tag, BufferAllocation.buffer_conservative_model] + cbv + +def unicodePreimage : alloc.vec.Vec Std.U8 := ⟨[ + 65#u8, 85#u8, 84#u8, 72#u8, 83#u8, 0#u8, 1#u8, 0#u8, + 10#u8, 0#u8, 2#u8, 206#u8, 187#u8, 255#u8, 255#u8, 0#u8, + 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 1#u8, 1#u8 +], by scalar_tac⟩ + +theorem unicode_preimage_exact : hash.signing_preimage .Approval + (toStr "λ" (by change 2 ≤ U32.max; scalar_tac)) 65535#u16 + (⟨[1#u8], by scalar_tac⟩ : Slice Std.U8) = ok (.Ok unicodePreimage) := by + unfold hash.signing_preimage + simp only [Auths.Crypto.Refinement.object_tag, BufferAllocation.buffer_conservative_model] + cbv + +end Auths.Crypto.Examples diff --git a/formal/Auths/Crypto/Framing.lean b/formal/Auths/Crypto/Framing.lean new file mode 100644 index 000000000..626b303bd --- /dev/null +++ b/formal/Auths/Crypto/Framing.lean @@ -0,0 +1,70 @@ +import Auths.Codec.Semantics +open Auths.Codec +namespace Auths.Crypto.Framing + +structure Frame where + objectTag : Nat + profile : List Nat + profileVersion : Nat + statement : List Nat + deriving DecidableEq + +def Frame.Valid (frame : Frame) : Prop := + frame.objectTag < 65536 ∧ frame.profile.length < 65536 ∧ + frame.profileVersion < 65536 ∧ frame.statement.length < 18446744073709551616 ∧ + BytesValid frame.profile ∧ BytesValid frame.statement + +/-- The protocol's signing frame, independently described as natural-number bytes. -/ +def encode (frame : Frame) : List Nat := + [65, 85, 84, 72, 83, 0, 1] ++ + bigEndian 2 frame.objectTag ++ bigEndian 2 frame.profile.length ++ frame.profile ++ + bigEndian 2 frame.profileVersion ++ bigEndian 8 frame.statement.length ++ frame.statement + +theorem length_exact (frame : Frame) : + (encode frame).length = 21 + frame.profile.length + frame.statement.length := by + simp [encode, bigEndian_length] + omega + +theorem endian_injective (width left right : Nat) + (leftBound : left < 256 ^ width) (rightBound : right < 256 ^ width) + (same : bigEndian width left = bigEndian width right) : left = right := by + have := congrArg unsigned same + simpa only [unsigned_bigEndian width left leftBound, + unsigned_bigEndian width right rightBound] using this + +/-- Equal signing bytes have equal framed inputs. No hash property is assumed. -/ +theorem framing_is_unambiguous (left right : Frame) + (leftValid : left.Valid) (rightValid : right.Valid) + (same : encode left = encode right) : left = right := by + have rest : + bigEndian 2 left.objectTag ++ + (bigEndian 2 left.profile.length ++ (left.profile ++ + (bigEndian 2 left.profileVersion ++ (bigEndian 8 left.statement.length ++ left.statement)))) = + bigEndian 2 right.objectTag ++ + (bigEndian 2 right.profile.length ++ (right.profile ++ + (bigEndian 2 right.profileVersion ++ (bigEndian 8 right.statement.length ++ right.statement)))) := by + simpa only [encode, List.append_assoc, List.cons_append, List.nil_append, + List.cons.injEq, true_and] using same + obtain ⟨tagBytes, rest⟩ := List.append_inj rest (by simp [bigEndian_length]) + have tags := endian_injective 2 left.objectTag right.objectTag + leftValid.1 rightValid.1 tagBytes + obtain ⟨profileLengths, rest⟩ := List.append_inj rest (by simp [bigEndian_length]) + have lengths := endian_injective 2 left.profile.length right.profile.length + leftValid.2.1 rightValid.2.1 profileLengths + obtain ⟨profiles, rest⟩ := List.append_inj rest lengths + obtain ⟨versionBytes, rest⟩ := List.append_inj rest (by simp [bigEndian_length]) + have versions := endian_injective 2 left.profileVersion right.profileVersion + leftValid.2.2.1 rightValid.2.2.1 versionBytes + obtain ⟨_, statements⟩ := List.append_inj rest (by simp [bigEndian_length]) + cases left + cases right + simp_all + +/-- Distinct registered object tags cannot share signing bytes, regardless of payload. -/ +theorem different_tags_separate (left right : Frame) + (leftValid : left.Valid) (rightValid : right.Valid) + (different : left.objectTag ≠ right.objectTag) : encode left ≠ encode right := by + intro same + exact different (congrArg Frame.objectTag (framing_is_unambiguous left right leftValid rightValid same)) + +end Auths.Crypto.Framing diff --git a/formal/Auths/Crypto/FramingTotality.lean b/formal/Auths/Crypto/FramingTotality.lean new file mode 100644 index 000000000..4e5185acb --- /dev/null +++ b/formal/Auths/Crypto/FramingTotality.lean @@ -0,0 +1,503 @@ +import Auths.Crypto.CommitmentValidity +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec Auths.Crypto.Refinement Auths.Crypto.CommitmentRefinement +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 +namespace Auths.Crypto.FramingTotality + +@[step] theorem convert_total {source target : UScalarTy} (value : UScalar source) : + core.num.tryFromUScalar target value ⦃ result => + match result with + | .Ok converted => converted.val = value.val + | .Err _ => UScalar.max target < value.val ⦄ := by + unfold core.num.tryFromUScalar + split + · rename_i fits + simp only [spec_ok] + have contract := UScalar.cast_inBounds_spec target value fits + simpa only [lift, spec_ok] using contract + · simp only [spec_ok] + omega + +@[step] theorem append_total (left : alloc.vec.Vec Std.U8) (right : Slice Std.U8) + (fits : left.val.length + right.val.length ≤ Usize.max) : + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 left right ⦃ output => + output.val = left.val ++ right.val ⦄ := by + rw [Auths.Codec.Evaluation.append_bytes] + split + · simp [spec_ok] + · simp [fits, spec_ok] + +@[step] theorem buffer_total (capacity : Std.Usize) : + hash.preimage_buffer capacity ⦃ result => match result with + | .Ok output => output.val = [] ∧ BufferAllocation.Fits capacity + | .Err reason => reason = .LimitExceeded ∧ ¬ BufferAllocation.Fits capacity ⦄ := by + rw [BufferAllocation.buffer_refines] + split <;> simp_all [spec_ok, alloc.vec.Vec.new] + +def IdentifierAdmissible (payload : Slice Std.U8) : Prop := + payload.val.length ≤ U64.max ∧ 20 + payload.val.length ≤ Usize.max ∧ + (20 + payload.val.length : Int) ≤ Isize.max + +def IdentifierResult (payload : Slice Std.U8) + (result : core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) : Prop := + match result with + | .Ok _ => IdentifierAdmissible payload + | .Err reason => reason = .LimitExceeded ∧ ¬ IdentifierAdmissible payload + +theorem identifier_total (kind : hash.IdentifierType) (payload : Slice Std.U8) : + hash.identifier_preimage kind payload ⦃ result => IdentifierResult payload result ⦄ := by + unfold hash.identifier_preimage + simp only [U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from] + step as ⟨converted, convertedMeaning⟩ + cases converted with + | Err conversionError => + simp only at convertedMeaning + have refuses : ¬ IdentifierAdmissible payload := by + intro admitted + have tooLong : U64.max < payload.val.length := by + simpa only [Slice.len_val, Slice.length, UScalar.max_UScalarTy_U64_eq] using convertedMeaning + exact Nat.not_le_of_lt tooLong admitted.1 + simp [core.result.Result.map_err, BuiltinFnOnce, error.limit_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, IdentifierResult, refuses] + | Ok length => + simp only [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, + bind_tc_ok] + step as ⟨four, fourEq⟩ + step as ⟨twelve, twelveEq⟩ + step as ⟨base, baseMeaning⟩ + cases base with + | none => + simp [core.option.Option.and_then, core.option.Option.ok_or, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, bind_tc_ok, spec_ok, IdentifierResult, IdentifierAdmissible] + simp only [hash.IDENTIFIER_PREFIX, Slice.len_val, Slice.length] at baseMeaning + scalar_tac + | some base => + simp only [core.option.Option.and_then, + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + bind_tc_ok] + have capacityMeaning := Usize.checked_add_bv_spec base (Slice.len payload) + generalize capacityEq : Usize.checked_add base (Slice.len payload) = capacity at * + cases capacity with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, bind_tc_ok, spec_ok, IdentifierResult, IdentifierAdmissible] + simp [hash.IDENTIFIER_PREFIX, Slice.len_val, Slice.length] at baseMeaning capacityMeaning + scalar_tac + | some capacity => + simp only [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + bind_tc_ok] + step as ⟨buffer, bufferMeaning⟩ + cases buffer with + | Err reason => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, bind_tc_ok, spec_ok, IdentifierResult, IdentifierAdmissible] + simp [hash.IDENTIFIER_PREFIX, Slice.len_val, Slice.length, BufferAllocation.Fits] at baseMeaning capacityMeaning bufferMeaning + scalar_tac + | Ok buffer => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + simp only [Option.some.injEq] at baseMeaning capacityMeaning + simp only at bufferMeaning + have overall : 20 + payload.val.length ≤ Usize.max := by + simp [hash.IDENTIFIER_PREFIX, Slice.len_val, Slice.length] at baseMeaning capacityMeaning + scalar_tac + step as ⟨out1, out1Meaning⟩ + simp only [lift, bind_tc_ok, identifier_tag_word] + have out1Length : out1.val.length = 8 := by + simp [out1Meaning, bufferMeaning.1, hash.IDENTIFIER_PREFIX] + step as ⟨out2, out2Meaning⟩ + have out2Length : out2.val.length = 10 := by + simp [out2Meaning, out1Length] + step as ⟨out3, out3Meaning⟩ + have out3Length : out3.val.length = 12 := by + simp [out3Meaning, out2Length] + step as ⟨out4, out4Meaning⟩ + have out4Length : out4.val.length = 20 := by + simp [out4Meaning, out3Length] + step as ⟨out5, out5Meaning⟩ + simp only [spec_ok, IdentifierResult, IdentifierAdmissible] + simp [hash.IDENTIFIER_PREFIX, Slice.len_val, Slice.length, + BufferAllocation.Fits, UScalar.max_UScalarTy_U64_eq] at baseMeaning capacityMeaning bufferMeaning convertedMeaning + constructor + · scalar_tac + · exact ⟨overall, by omega⟩ + +theorem identifier_accepts_iff (kind : hash.IdentifierType) (payload : Slice Std.U8) : + (∃ output, hash.identifier_preimage kind payload = ok (.Ok output)) ↔ + IdentifierAdmissible payload := by + obtain ⟨result, evaluated, classified⟩ := spec_imp_exists (identifier_total kind payload) + cases result with + | Ok output => + constructor + · intro _; exact classified + · intro _; exact ⟨output, evaluated⟩ + | Err reason => + constructor + · rintro ⟨output, accepted⟩ + have impossible := evaluated.symm.trans accepted + cases impossible + · intro admitted + exact False.elim (classified.2 admitted) + +theorem identifier_refuses_iff (kind : hash.IdentifierType) (payload : Slice Std.U8) : + hash.identifier_preimage kind payload = ok (.Err error.CodecError.LimitExceeded) ↔ + ¬ IdentifierAdmissible payload := by + obtain ⟨result, evaluated, classified⟩ := spec_imp_exists (identifier_total kind payload) + cases result with + | Ok output => + constructor + · intro refused + have impossible := evaluated.symm.trans refused + cases impossible + · intro outside; exact False.elim (outside classified) + | Err reason => + constructor + · intro _; exact classified.2 + · intro _ + have exactReason : reason = .LimitExceeded := classified.1 + simpa only [exactReason] using evaluated + +def ApplicationAdmissible (domain : Str) (payload : Slice Std.U8) : Prop := + 0 < domain.val.length ∧ domain.val.length ≤ 128 ∧ payload.val.length ≤ U64.max ∧ + 28 + domain.val.length + payload.val.length ≤ Usize.max ∧ + (28 + domain.val.length + payload.val.length : Int) ≤ Isize.max + +def ApplicationResult (domain : Str) (payload : Slice Std.U8) + (result : core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) : Prop := + match result with + | .Ok _ => ApplicationAdmissible domain payload + | .Err reason => reason = .LimitExceeded ∧ ¬ ApplicationAdmissible domain payload + +theorem application_total (domain : Str) (payload : Slice Std.U8) : + hash.commitment_preimage domain payload ⦃ result => ApplicationResult domain payload result ⦄ := by + unfold hash.commitment_preimage + simp only [core.str.Str.as_bytes, core.slice.Slice.is_empty, bind_tc_ok] + split + · rename_i empty + simp only [spec_ok, ApplicationResult, ApplicationAdmissible] + have emptyLength : domain.val.length = 0 := by simpa [Slice.length] using empty + simp [emptyLength] + · rename_i nonempty + split + · rename_i oversized + simp only [spec_ok, ApplicationResult, ApplicationAdmissible] + simp [hash.MAX_COMMITMENT_DOMAIN_BYTES, Slice.len_val, Slice.length] at oversized + scalar_tac + · rename_i bounded + simp only [U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from] + step as ⟨domainLength, domainMeaning⟩ + cases domainLength with + | Err conversionError => + simp only at domainMeaning + simp [hash.MAX_COMMITMENT_DOMAIN_BYTES, Slice.len_val, Slice.length] at bounded + scalar_tac + | Ok domainLength => + simp only [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from] + have domainPositive : 0 < domain.val.length := by + change ¬ decide (domain.val.length = 0) = true at nonempty + have notZero : domain.val.length ≠ 0 := by simpa using nonempty + omega + have domainBound : domain.val.length ≤ 128 := by + simp [hash.MAX_COMMITMENT_DOMAIN_BYTES, Slice.len_val, Slice.length] at bounded + scalar_tac + step as ⟨converted, convertedMeaning⟩ + cases converted with + | Err conversionError => + simp only at convertedMeaning + have refuses : ¬ ApplicationAdmissible domain payload := by + intro admitted + have tooLong : U64.max < payload.val.length := by + simpa only [Slice.len_val, Slice.length, UScalar.max_UScalarTy_U64_eq] using convertedMeaning + exact Nat.not_le_of_lt tooLong admitted.2.2.1 + simp [core.result.Result.map_err, BuiltinFnOnce, error.limit_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, ApplicationResult, refuses] + | Ok length => + simp only [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨four, fourEq⟩ + step as ⟨twelve, twelveEq⟩ + step as ⟨base, baseMeaning⟩ + cases base with + | none => + simp [core.option.Option.and_then, core.option.Option.ok_or, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, ApplicationResult, ApplicationAdmissible] + simp [hash.COMMITMENT_PREFIX, Slice.len_val, Slice.length] at baseMeaning + scalar_tac + | some base => + simp only [core.option.Option.and_then, + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + bind_tc_ok] + have domainCapacityMeaning := Usize.checked_add_bv_spec base (Slice.len domain) + generalize domainCapacityEq : Usize.checked_add base (Slice.len domain) = domainCapacity at * + cases domainCapacity with + | none => + simp [core.option.Option.and_then, core.option.Option.ok_or, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, ApplicationResult, ApplicationAdmissible] + simp [hash.COMMITMENT_PREFIX, Slice.len_val, Slice.length] at baseMeaning domainCapacityMeaning + scalar_tac + | some domainCapacity => + simp only [core.option.Option.and_then, + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize, + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once, + bind_tc_ok] + have capacityMeaning := Usize.checked_add_bv_spec domainCapacity (Slice.len payload) + generalize capacityEq : Usize.checked_add domainCapacity (Slice.len payload) = capacity at * + cases capacity with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, ApplicationResult, ApplicationAdmissible] + simp [hash.COMMITMENT_PREFIX, Slice.len_val, Slice.length] at baseMeaning domainCapacityMeaning capacityMeaning + scalar_tac + | some capacity => + simp only [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨buffer, bufferMeaning⟩ + cases buffer with + | Err reason => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, ApplicationResult, ApplicationAdmissible] + simp [hash.COMMITMENT_PREFIX, Slice.len_val, Slice.length, BufferAllocation.Fits] at baseMeaning domainCapacityMeaning capacityMeaning bufferMeaning + scalar_tac + | Ok buffer => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + simp only at bufferMeaning + have overall : 28 + domain.val.length + payload.val.length ≤ Usize.max := by + simp [hash.COMMITMENT_PREFIX, Slice.len_val, Slice.length] at baseMeaning domainCapacityMeaning capacityMeaning + scalar_tac + step as ⟨out1, out1Meaning⟩ + simp only [lift, bind_tc_ok] + have out1Length : out1.val.length = 16 := by + simp [out1Meaning, bufferMeaning.1, hash.COMMITMENT_PREFIX] + step as ⟨out2, out2Meaning⟩ + have out2Length : out2.val.length = 18 := by simp [out2Meaning, out1Length] + step as ⟨out3, out3Meaning⟩ + have out3Length : out3.val.length = 20 := by simp [out3Meaning, out2Length] + step as ⟨out4, out4Meaning⟩ + have out4Length : out4.val.length = 20 + domain.val.length := by simp [out4Meaning, out3Length] + step as ⟨out5, out5Meaning⟩ + · scalar_tac + · have out5Length : out5.val.length = 28 + domain.val.length := by simp [out5Meaning, out4Length]; omega + step as ⟨out6, out6Meaning⟩ + simp only [spec_ok, ApplicationResult, ApplicationAdmissible] + simp [hash.COMMITMENT_PREFIX, Slice.len_val, Slice.length, BufferAllocation.Fits] at baseMeaning domainCapacityMeaning capacityMeaning bufferMeaning convertedMeaning + refine ⟨domainPositive, domainBound, ?_, overall, ?_⟩ + · scalar_tac + · omega + + +theorem application_accepts_iff (domain : Str) (payload : Slice Std.U8) : + (∃ output, hash.commitment_preimage domain payload = ok (.Ok output)) ↔ + ApplicationAdmissible domain payload := by + obtain ⟨result, evaluated, classified⟩ := spec_imp_exists (application_total domain payload) + cases result with + | Ok output => + constructor + · intro _; exact classified + · intro _; exact ⟨output, evaluated⟩ + | Err reason => + constructor + · rintro ⟨output, accepted⟩ + have impossible := evaluated.symm.trans accepted + cases impossible + · intro admitted + exact False.elim (classified.2 admitted) + +theorem application_refuses_iff (domain : Str) (payload : Slice Std.U8) : + hash.commitment_preimage domain payload = ok (.Err error.CodecError.LimitExceeded) ↔ + ¬ ApplicationAdmissible domain payload := by + obtain ⟨result, evaluated, classified⟩ := spec_imp_exists (application_total domain payload) + cases result with + | Ok output => + constructor + · intro refused + have impossible := evaluated.symm.trans refused + cases impossible + · intro outside; exact False.elim (outside classified) + | Err reason => + constructor + · intro _; exact classified.2 + · intro _ + have exactReason : reason = .LimitExceeded := classified.1 + simpa only [exactReason] using evaluated + + +def SigningAdmissible (profile : Str) (payload : Slice Std.U8) : Prop := + profile.val.length ≤ U16.max ∧ payload.val.length ≤ U64.max ∧ + 21 + profile.val.length + payload.val.length ≤ Usize.max ∧ + (21 + profile.val.length + payload.val.length : Int) ≤ Isize.max + +def SigningResult (profile : Str) (payload : Slice Std.U8) + (result : core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) : Prop := + match result with + | .Ok _ => SigningAdmissible profile payload + | .Err reason => reason = .LimitExceeded ∧ ¬ SigningAdmissible profile payload + +theorem signing_total (kind : hash.ObjectType) (profile : Str) (version : Std.U16) + (payload : Slice Std.U8) : + hash.signing_preimage kind profile version payload ⦃ result => SigningResult profile payload result ⦄ := by + unfold hash.signing_preimage + simp only [core.str.Str.len, bind_tc_ok, + U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from] + step as ⟨profileLength, profileMeaning⟩ + cases profileLength with + | Err conversionError => + simp only at profileMeaning + have refuses : ¬ SigningAdmissible profile payload := by + intro admitted + have tooLong : U16.max < profile.val.length := by + simpa only [Slice.len_val, Slice.length, UScalar.max_UScalarTy_U16_eq] using profileMeaning + exact Nat.not_le_of_lt tooLong admitted.1 + simp [core.result.Result.map_err, BuiltinFnOnce, error.limit_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, SigningResult, refuses] + | Ok profileLength => + simp only [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from] + step as ⟨converted, convertedMeaning⟩ + cases converted with + | Err conversionError => + simp only at convertedMeaning + have refuses : ¬ SigningAdmissible profile payload := by + intro admitted + have tooLong : U64.max < payload.val.length := by + simpa only [Slice.len_val, Slice.length, UScalar.max_UScalarTy_U64_eq] using convertedMeaning + exact Nat.not_le_of_lt tooLong admitted.2.1 + simp [core.result.Result.map_err, BuiltinFnOnce, error.limit_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, SigningResult, refuses] + | Ok length => + simp only [core.result.Result.map_err, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨four, fourEq⟩ + step as ⟨six, sixEq⟩ + step as ⟨eight, eightEq⟩ + step as ⟨sixteen, sixteenEq⟩ + step as ⟨base, baseMeaning⟩ + cases base with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, SigningResult, SigningAdmissible] + simp [hash.SIGNING_PREFIX, Slice.len_val, Slice.length] at baseMeaning + scalar_tac + | some base => + simp only [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨profileCapacity, profileCapacityMeaning⟩ + cases profileCapacity with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, SigningResult, SigningAdmissible] + simp [hash.SIGNING_PREFIX, Slice.len_val, Slice.length] at baseMeaning profileCapacityMeaning + scalar_tac + | some profileCapacity => + simp only [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨capacity, capacityMeaning⟩ + cases capacity with + | none => + simp [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, SigningResult, SigningAdmissible] + simp [hash.SIGNING_PREFIX, Slice.len_val, Slice.length] at baseMeaning profileCapacityMeaning capacityMeaning + scalar_tac + | some capacity => + simp only [core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + step as ⟨buffer, bufferMeaning⟩ + cases buffer with + | Err reason => + simp [core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, spec_ok, SigningResult, SigningAdmissible] + simp [hash.SIGNING_PREFIX, Slice.len_val, Slice.length, BufferAllocation.Fits] at baseMeaning profileCapacityMeaning capacityMeaning bufferMeaning + scalar_tac + | Ok buffer => + simp only [core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + simp only at bufferMeaning + have overall : 21 + profile.val.length + payload.val.length ≤ Usize.max := by + simp [hash.SIGNING_PREFIX, Slice.len_val, Slice.length] at baseMeaning profileCapacityMeaning capacityMeaning + scalar_tac + step as ⟨out1, out1Meaning⟩ + simp only [lift, bind_tc_ok, object_tag] + have out1Length : out1.val.length = 5 := by simp [out1Meaning, bufferMeaning.1, hash.SIGNING_PREFIX] + step as ⟨out2, out2Meaning⟩ + have out2Length : out2.val.length = 7 := by simp [out2Meaning, out1Length] + step as ⟨out3, out3Meaning⟩ + have out3Length : out3.val.length = 9 := by simp [out3Meaning, out2Length] + step as ⟨out4, out4Meaning⟩ + · scalar_tac + · have out4Length : out4.val.length = 11 := by simp [out4Meaning, out3Length] + simp only [core.str.Str.as_bytes, bind_tc_ok] + step as ⟨out5, out5Meaning⟩ + have out5Length : out5.val.length = 11 + profile.val.length := by simp [out5Meaning, out4Length] + step as ⟨out6, out6Meaning⟩ + · scalar_tac + · have out6Length : out6.val.length = 13 + profile.val.length := by simp [out6Meaning, out5Length]; omega + step as ⟨out7, out7Meaning⟩ + · scalar_tac + · have out7Length : out7.val.length = 21 + profile.val.length := by simp [out7Meaning, out6Length]; omega + step as ⟨out8, out8Meaning⟩ + simp only [spec_ok, SigningResult, SigningAdmissible] + simp [hash.SIGNING_PREFIX, Slice.len_val, Slice.length, BufferAllocation.Fits] at baseMeaning profileCapacityMeaning capacityMeaning bufferMeaning profileMeaning convertedMeaning + refine ⟨?_, ?_, overall, ?_⟩ + · scalar_tac + · scalar_tac + · omega + + +theorem signing_accepts_iff (kind : hash.ObjectType) (profile : Str) (version : Std.U16) + (payload : Slice Std.U8) : + (∃ output, hash.signing_preimage kind profile version payload = ok (.Ok output)) ↔ + SigningAdmissible profile payload := by + obtain ⟨result, evaluated, classified⟩ := spec_imp_exists (signing_total kind profile version payload) + cases result with + | Ok output => + constructor + · intro _; exact classified + · intro _; exact ⟨output, evaluated⟩ + | Err reason => + constructor + · rintro ⟨output, accepted⟩ + have impossible := evaluated.symm.trans accepted + cases impossible + · intro admitted + exact False.elim (classified.2 admitted) + +theorem signing_refuses_iff (kind : hash.ObjectType) (profile : Str) (version : Std.U16) + (payload : Slice Std.U8) : + hash.signing_preimage kind profile version payload = ok (.Err error.CodecError.LimitExceeded) ↔ + ¬ SigningAdmissible profile payload := by + obtain ⟨result, evaluated, classified⟩ := spec_imp_exists (signing_total kind profile version payload) + cases result with + | Ok output => + constructor + · intro refused + have impossible := evaluated.symm.trans refused + cases impossible + · intro outside; exact False.elim (outside classified) + | Err reason => + constructor + · intro _; exact classified.2 + · intro _ + have exactReason : reason = .LimitExceeded := classified.1 + simpa only [exactReason] using evaluated + + + +end Auths.Crypto.FramingTotality diff --git a/formal/Auths/Crypto/NativeContract.lean b/formal/Auths/Crypto/NativeContract.lean new file mode 100644 index 000000000..25d083c06 --- /dev/null +++ b/formal/Auths/Crypto/NativeContract.lean @@ -0,0 +1,119 @@ +import Auths.Crypto.Strict.Examples + +open Aeneas Aeneas.Std Result +open auths_signature_core + +namespace Auths.Crypto.Native + +def decoded {K E : Type} : core.result.Result K E → Option K + | .Ok key => some key + | .Err _ => none + +def authenticated {E : Type} : core.result.Result Unit E → Bool + | .Ok _ => true + | .Err _ => false + +/-- Contracts for foreign calls only. Auths' key/R forms, widths and weak-point +guards are proved source decisions, outside these premises. -/ +structure Ed25519Contract [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) + (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) : Prop where + decode_exact : ∀ bytes, ∃ output, + P.decode bytes = ok output ∧ decoded output = decode bytes.val + signature_exact : ∀ bytes, P.signatureFromBytes bytes = ok (signatureValue bytes.val) + equation_exact : ∀ (key : P.Key) (message : Slice Std.U8) (bytes : Array Std.U8 64#usize), ∃ output, + P.verifyStrict key message (signatureValue bytes.val) = ok output ∧ + authenticated output = equation key message.val bytes.val + +theorem decode_leaf_refines [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) + (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Ed25519Contract decode signatureValue equation) + (bytes : Array Std.U8 32#usize) : + decode_ed25519_point bytes = ok (decode bytes.val) := by + obtain ⟨output, exactCall, exactValue⟩ := contract.decode_exact bytes + simp only [decode_ed25519_point, ed25519_dalek.verifying.VerifyingKey.from_bytes, exactCall, + bind_tc_ok, core.result.Result.ok] + exact congrArg Result.ok exactValue + +theorem equation_leaf_refines [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) + (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Ed25519Contract decode signatureValue equation) + (key : P.Key) (message : Slice Std.U8) (bytes : Array Std.U8 64#usize) : + verify_ed25519_equation key message bytes = ok (equation key message.val bytes.val) := by + obtain ⟨output, exactCall, exactValue⟩ := contract.equation_exact key message bytes + simp only [verify_ed25519_equation, ed25519.Signature.from_bytes, contract.signature_exact, + bind_tc_ok, ed25519_dalek.verifying.VerifyingKey.verify_strict, exactCall] + cases output <;> simp_all [authenticated, core.result.Result.is_ok] + +theorem public_verify_accepts_iff [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) + (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Ed25519Contract decode signatureValue equation) + (bytes message signature : Slice Std.U8) : + verify_ed25519 bytes message signature = ok (.Ok ()) ↔ + Strict.Acceptance.EdAccepts decode equation bytes.val message.val signature.val := by + have decodeCall : ∀ array, + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once () array = + ok (decode array.val) := by + intro array + exact decode_leaf_refines decode signatureValue equation contract array + have verifyCall : ∀ key message signature, + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool.call_once + () (key, message, signature) = ok (equation key message.val signature.val) := by + intro key message signature + exact equation_leaf_refines decode signatureValue equation contract key message signature + exact Strict.SourceAcceptance.ed_source_accepts_iff + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool + () () decode equation decodeCall verifyCall bytes message signature + +theorem public_verify_refines [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) + (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Ed25519Contract decode signatureValue equation) + (bytes message signature : Slice Std.U8) : + verify_ed25519 bytes message signature = + ok (Strict.SuiteModel.sourceEd (Strict.SuiteModel.edVerify decode equation + bytes.val message.val signature.val)) := by + exact Strict.SuiteRefinement.verify_ed25519_refines + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool + () () decode equation + (decode_leaf_refines decode signatureValue equation contract) + (equation_leaf_refines decode signatureValue equation contract) + bytes message signature + +theorem public_validate_refines [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) + (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Ed25519Contract decode signatureValue equation) + (bytes : Slice Std.U8) : + validate_ed25519_key bytes = + ok (Strict.SuiteModel.sourceEd ((Strict.SuiteModel.edKey decode bytes.val).map (fun _ => ()))) := by + have decodeCall : ∀ array, + decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once + () array = ok (decode array.val) := by + intro array + exact decode_leaf_refines decode signatureValue equation contract array + have keyExact := Strict.SuiteRefinement.decode_ed25519_refines + decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + () decode decodeCall bytes + change (do let key ← decode_ed25519_key bytes + core.result.Result.map + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple key ()) = _ + change decode_ed25519_key bytes = _ at keyExact + rw [keyExact] + cases keyResult : Strict.SuiteModel.edKey decode bytes.val <;> + simp [Strict.SuiteModel.sourceEd, Except.map, core.result.Result.map, + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple, + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple.call_once] + +end Auths.Crypto.Native diff --git a/formal/Auths/Crypto/NativeExamples.lean b/formal/Auths/Crypto/NativeExamples.lean new file mode 100644 index 000000000..843d4261d --- /dev/null +++ b/formal/Auths/Crypto/NativeExamples.lean @@ -0,0 +1,65 @@ +import Auths.Crypto.NativeContract +import Lean.Elab.Tactic.Cbv + +open Aeneas Aeneas.Std Result +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 + +namespace Auths.Crypto.NativeExamples + +def key : Slice Std.U8 := ⟨Encoding.Examples.rfcPublicKey.val, by + have := Encoding.Encoded.input_length Encoding.Examples.rfcPublicKey + scalar_tac⟩ +def signature : Slice Std.U8 := ⟨Strict.Examples.publicR.val, by + have := LowScan.input_length Strict.Examples.publicR + scalar_tac⟩ +def message : Slice Std.U8 := ⟨[42#u8], by scalar_tac⟩ +def changedMessage : Slice Std.U8 := ⟨[43#u8], by scalar_tac⟩ +def empty : Slice Std.U8 := ⟨[], by scalar_tac⟩ + +-- An explicit call-binding witness, deliberately not a cryptographic instance. +-- It accepts only the stated message and exact signature bytes. No global +-- instance is installed, and these examples make no authenticity claim. +def equation (_key : Unit) (message bytes : List Std.U8) : Bool := + message == [42#u8] && bytes == signature.val + +@[reducible] def forwardingPrimitive : Ed25519Primitives where + Key := Unit + Signature := List Std.U8 + Error := Unit + decode := fun _ => ok (.Ok ()) + signatureFromBytes := fun bytes => ok bytes.val + verifyStrict := fun key message bytes => + ok (if equation key message.val bytes then .Ok () else .Err ()) + +theorem forwarding_contract : + Native.Ed25519Contract (P := forwardingPrimitive) (fun _ => some ()) id equation := by + refine Native.Ed25519Contract.mk (P := forwardingPrimitive) ?_ ?_ ?_ + · intro bytes + exact ⟨.Ok (), rfl, rfl⟩ + · intro bytes + rfl + · intro key message bytes + refine ⟨if equation key message.val bytes.val then .Ok () else .Err (), rfl, ?_⟩ + split <;> simp_all [Native.authenticated] + +theorem public_call_forwards_exact_bytes : + auths_signature_core.verify_ed25519 (primitives := forwardingPrimitive) + key message signature = ok (.Ok ()) := by + rw [Native.public_verify_refines (P := forwardingPrimitive) (fun _ => some ()) id equation forwarding_contract] + cbv + +theorem changed_message_is_refused : + auths_signature_core.verify_ed25519 (primitives := forwardingPrimitive) + key changedMessage signature = ok (.Err .VerificationFailed) := by + rw [Native.public_verify_refines (P := forwardingPrimitive) (fun _ => some ()) id equation forwarding_contract] + cbv + +theorem malformed_key_refused_without_primitive_contract [P : Ed25519Primitives] + (message signature : Slice Std.U8) : + auths_signature_core.verify_ed25519 (primitives := P) empty message signature = + ok (.Err .InvalidKey) := by + cbv + +end Auths.Crypto.NativeExamples diff --git a/formal/Auths/Crypto/NativePrimitives.lean b/formal/Auths/Crypto/NativePrimitives.lean new file mode 100644 index 000000000..33d2bb821 --- /dev/null +++ b/formal/Auths/Crypto/NativePrimitives.lean @@ -0,0 +1,18 @@ +import Aeneas + +open Aeneas Aeneas.Std Result + +namespace Auths.Crypto + +/-- Explicit implementation parameter for the three foreign Ed25519 library +calls. There is deliberately no instance: every public-wrapper claim must +quantify over an implementation and state its primitive contracts. -/ +class Ed25519Primitives where + Key : Type + Signature : Type + Error : Type + decode : Array Std.U8 32#usize → Result (core.result.Result Key Error) + signatureFromBytes : Array Std.U8 64#usize → Result Signature + verifyStrict : Key → Slice Std.U8 → Signature → Result (core.result.Result Unit Error) + +end Auths.Crypto diff --git a/formal/Auths/Crypto/P256Encoding.lean b/formal/Auths/Crypto/P256Encoding.lean new file mode 100644 index 000000000..6b85f32c0 --- /dev/null +++ b/formal/Auths/Crypto/P256Encoding.lean @@ -0,0 +1,33 @@ +import qualification.aeneas.generated.p256.Funs +import Auths.Crypto.Encoding.P256 +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.P256Encoding +abbrev Encoding := Auths.Crypto.Encoding.P256.Encoding + +theorem guard_refines (input : Slice Std.U8) : + AuthsNativeP256.p256_key_encoding_is_canonical input = + ok (decide (Encoding (input.val.map UScalar.val))) := by + suffices h : AuthsNativeP256.p256_key_encoding_is_canonical input + ⦃ result => result = decide (Encoding (input.val.map UScalar.val)) ⦄ by + obtain ⟨result, executes, rfl⟩ := spec_imp_exists h + exact executes + unfold AuthsNativeP256.p256_key_encoding_is_canonical + simp only [AuthsNativeP256.P256_KEY_LEN, AuthsNativeP256.core.qualified_p256_fun_decls_20, bind_tc_ok] + by_cases sized : input.val.length = 33 + · have sizeEq : Slice.len input = 33#usize := by scalar_tac + simp only [sizeEq, bne_self_eq_false, Bool.false_eq_true, ite_false] + step as ⟨first, firstEq⟩ + have two : (first = 2#u8) ↔ first.val = 2 := by scalar_tac + have three : (first = 3#u8) ↔ first.val = 3 := by scalar_tac + have headEq : (input.val.map UScalar.val).head? = some first.val := by + cases values : input.val with + | nil => simp [values] at sized + | cons head tail => + have firstIsHead : first = head := by simpa only [values, List.getElem_cons_zero] using firstEq + simp [firstIsHead] + simp only [Encoding, Auths.Crypto.Encoding.P256.Encoding, List.length_map, sized, headEq, Option.some.injEq, true_and] + split <;> simp_all + · have sizeNe : Slice.len input ≠ 33#usize := by scalar_tac + simp [sizeNe, spec_ok, Encoding, Auths.Crypto.Encoding.P256.Encoding, sized] + +end Auths.Crypto.P256Encoding diff --git a/formal/Auths/Crypto/P256Examples.lean b/formal/Auths/Crypto/P256Examples.lean new file mode 100644 index 000000000..099381a33 --- /dev/null +++ b/formal/Auths/Crypto/P256Examples.lean @@ -0,0 +1,79 @@ +import Auths.Crypto.P256Native +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 +namespace Auths.Crypto.P256Examples + +def key : Slice Std.U8 := ⟨2#u8 :: List.replicate 32 0#u8, by scalar_tac⟩ +def changedKey : Slice Std.U8 := ⟨3#u8 :: List.replicate 32 0#u8, by scalar_tac⟩ +def signature : Slice Std.U8 := ⟨List.replicate 63 0#u8 ++ [1#u8], by scalar_tac⟩ +def changedSignature : Slice Std.U8 := ⟨1#u8 :: List.replicate 62 0#u8 ++ [1#u8], by scalar_tac⟩ +def message : Slice Std.U8 := ⟨[42#u8], by scalar_tac⟩ +def changedMessage : Slice Std.U8 := ⟨[43#u8], by scalar_tac⟩ +def empty : Slice Std.U8 := ⟨[], by scalar_tac⟩ + +-- Explicit forwarding mock only: these form witnesses are not P-256 signatures +-- and do not establish curve membership, primitive correctness or authenticity. +def equation (point text scalar : List Std.U8) : Bool := + point == key.val && text == message.val && scalar == signature.val + +@[reducible] def forwardingPrimitive : P256Primitives where + Key := List Std.U8 + Signature := List Std.U8 + Error := Unit + decode := fun bytes => ok (.Ok bytes.val) + parse := fun bytes => ok (.Ok bytes.val) + verify := fun point text scalar => + ok (if equation point text.val scalar then .Ok () else .Err ()) + +theorem forwarding_contract : P256Native.Contract (P := forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) equation := by + refine P256Native.Contract.mk (P := forwardingPrimitive) ?_ ?_ ?_ + · intro bytes; rfl + · intro bytes; rfl + · intro point text scalar + change (do + let result ← ok (if equation point text.val scalar then .Ok () else .Err ()) + ok (P256Native.resultIsOk result)) = ok (equation point text.val scalar) + split <;> simp_all [P256Native.resultIsOk] + +theorem public_call_forwards_exact_bytes : + AuthsNativeP256.verify_p256_sha256 (primitive := forwardingPrimitive) + key message signature = ok (.Ok ()) := by + rw [P256Native.public_verify_refines (P := forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) equation forwarding_contract] + cbv + +theorem changed_message_is_refused : + AuthsNativeP256.verify_p256_sha256 (primitive := forwardingPrimitive) + key changedMessage signature = ok (.Err .VerificationFailed) := by + rw [P256Native.public_verify_refines (P := forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) equation forwarding_contract] + cbv + +theorem changed_key_is_refused : + AuthsNativeP256.verify_p256_sha256 (primitive := forwardingPrimitive) + changedKey message signature = ok (.Err .VerificationFailed) := by + rw [P256Native.public_verify_refines (P := forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) equation forwarding_contract] + cbv + +theorem changed_signature_is_refused : + AuthsNativeP256.verify_p256_sha256 (primitive := forwardingPrimitive) + key message changedSignature = ok (.Err .VerificationFailed) := by + rw [P256Native.public_verify_refines (P := forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) equation forwarding_contract] + cbv + +theorem malformed_key_refused_without_primitive_contract [P : P256Primitives] + (message signature : Slice Std.U8) : + AuthsNativeP256.verify_p256_sha256 (primitive := P) empty message signature = + ok (.Err .InvalidKey) := by + unfold AuthsNativeP256.verify_p256_sha256 AuthsNativeP256.verify_p256_sha256_with + AuthsNativeP256.decode_p256_key_with + rw [P256Encoding.guard_refines] + cbv + +end Auths.Crypto.P256Examples diff --git a/formal/Auths/Crypto/P256LowContract.lean b/formal/Auths/Crypto/P256LowContract.lean new file mode 100644 index 000000000..e0313c9c1 --- /dev/null +++ b/formal/Auths/Crypto/P256LowContract.lean @@ -0,0 +1,34 @@ +import Auths.Crypto.P256LowScan +import Auths.Crypto.Strict.LowContract +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.P256LowContract + +abbrev order := Auths.Crypto.LowContract.order + +theorem half_order_exact : ByteLex.value AuthsNativeP256.P256_HALF_ORDER.val = order / 2 := by + unfold ByteLex.value AuthsNativeP256.P256_HALF_ORDER order + decide + +theorem guard_refines (input : P256LowScan.Input) : + AuthsNativeP256.p256_signature_is_low_s input = + ok (decide (ByteLex.value (input.val.drop 32) ≤ order / 2)) := by + obtain ⟨result, executes, meaning⟩ := spec_imp_exists + (P256LowScan.loop_refines input 32 0#usize (by scalar_tac)) + have exactSource : AuthsNativeP256.p256_signature_is_low_s input = + ok (ByteLex.le (input.val.drop 32) AuthsNativeP256.P256_HALF_ORDER.val) := by + simpa only [AuthsNativeP256.p256_signature_is_low_s, meaning, + UScalar.ofNatCore_val_eq, Nat.add_zero, List.drop_zero] using executes + rw [exactSource] + congr 1 + apply Bool.eq_iff_iff.mpr + have sizes : (input.val.drop 32).length = AuthsNativeP256.P256_HALF_ORDER.val.length := by + simp only [List.length_drop, P256LowScan.input_length, P256LowScan.half_length] + simpa only [half_order_exact, decide_eq_true_eq] using + ByteLex.le_numeric (input.val.drop 32) AuthsNativeP256.P256_HALF_ORDER.val sizes + +theorem r_bytes_irrelevant (left right : P256LowScan.Input) + (sameScalar : left.val.drop 32 = right.val.drop 32) : + AuthsNativeP256.p256_signature_is_low_s left = AuthsNativeP256.p256_signature_is_low_s right := by + rw [guard_refines, guard_refines, sameScalar] + +end Auths.Crypto.P256LowContract diff --git a/formal/Auths/Crypto/P256LowScan.lean b/formal/Auths/Crypto/P256LowScan.lean new file mode 100644 index 000000000..e1f3aced9 --- /dev/null +++ b/formal/Auths/Crypto/P256LowScan.lean @@ -0,0 +1,64 @@ +import qualification.aeneas.generated.p256.Funs +import Auths.Crypto.Strict.ByteLex +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.P256LowScan + +abbrev Input := Array Std.U8 64#usize + +theorem input_length (input : Input) : input.val.length = 64 := by + have bounded := input.property + scalar_tac + +theorem half_length : AuthsNativeP256.P256_HALF_ORDER.val.length = 32 := by + have bounded := AuthsNativeP256.P256_HALF_ORDER.property + scalar_tac + +theorem loop_refines (input : Input) (remaining : Nat) (index : Std.Usize) + (count : index.val + remaining = 32) : + AuthsNativeP256.p256_signature_is_low_s_loop input index + ⦃ result => result = ByteLex.le (input.val.drop (32 + index.val)) + (AuthsNativeP256.P256_HALF_ORDER.val.drop index.val) ⦄ := by + induction remaining generalizing index with + | zero => + have atEnd : index = 32#usize := by scalar_tac + subst index + rw [AuthsNativeP256.p256_signature_is_low_s_loop.eq_def] + have emptyInput : input.val.drop 64 = [] := List.drop_eq_nil_iff.mpr (by rw [input_length]) + have emptyHalf : AuthsNativeP256.P256_HALF_ORDER.val.drop 32 = [] := + List.drop_eq_nil_iff.mpr (by rw [half_length]) + simp [spec_ok, emptyInput, emptyHalf, ByteLex.le] + | succ remaining ih => + rw [AuthsNativeP256.p256_signature_is_low_s_loop.eq_def] + have advances : index < 32#usize := by scalar_tac + simp only [advances, ↓reduceIte] + have inputSize := input_length input + have halfSize := half_length + step as ⟨offset, offsetEq⟩ + step as ⟨byte, byteEq⟩ + step as ⟨bound, boundEq⟩ + have leftParts : input.val.drop (32 + index.val) = + byte :: input.val.drop (32 + index.val + 1) := by + rw [List.drop_eq_getElem_cons (by omega)] + simp only [byteEq, offsetEq] + have rightParts : AuthsNativeP256.P256_HALF_ORDER.val.drop index.val = + bound :: AuthsNativeP256.P256_HALF_ORDER.val.drop (index.val + 1) := by + rw [List.drop_eq_getElem_cons (by omega)] + simp only [boundEq] + by_cases less : byte < bound + · have natural : byte.val < bound.val := by scalar_tac + simp [less, spec_ok, leftParts, rightParts, ByteLex.le, natural] + · by_cases greater : bound < byte + · have naturalLess : ¬ byte.val < bound.val := by scalar_tac + have naturalGreater : bound.val < byte.val := by scalar_tac + simp [less, greater, spec_ok, leftParts, rightParts, ByteLex.le, naturalLess, naturalGreater] + · have naturalLess : ¬ byte.val < bound.val := by scalar_tac + have naturalGreater : ¬ bound.val < byte.val := by scalar_tac + simp only [less, greater, ↓reduceIte] + step as ⟨next, nextEq⟩ + have countNext : next.val + remaining = 32 := by omega + apply spec_mono (ih next countNext) + intro result exactResult + simpa only [leftParts, rightParts, ByteLex.le, naturalLess, naturalGreater, ↓reduceIte, + nextEq, Nat.add_assoc] using exactResult + +end Auths.Crypto.P256LowScan diff --git a/formal/Auths/Crypto/P256Native.lean b/formal/Auths/Crypto/P256Native.lean new file mode 100644 index 000000000..b0c6493a7 --- /dev/null +++ b/formal/Auths/Crypto/P256Native.lean @@ -0,0 +1,171 @@ +import Auths.Crypto.P256LowContract +import Auths.Crypto.P256Encoding +import Auths.Crypto.Strict.SourceAcceptance +open Aeneas Aeneas.Std Result +open AuthsNativeP256 +open Auths.Crypto.Strict.SuiteModel +namespace Auths.Crypto.P256Native + +/-- Projections of ordinary foreign Result values, independent of Auths policy. -/ +def resultOption {T E : Type} : Aeneas.Std.core.result.Result T E → Option T + | .Ok value => some value | .Err _ => none + +def resultIsOk {T E : Type} : Aeneas.Std.core.result.Result T E → Bool + | .Ok _ => true | .Err _ => false + +/-- Functional contracts of the three foreign P-256/SHA-256 operations. +No encoding guard, low-S check, Auths wrapper or desired suite result is a premise. -/ +structure Contract [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) : Prop where + decode_exact : ∀ bytes, (do let value ← P.decode bytes; ok (resultOption value)) = ok (decode bytes.val) + parse_exact : ∀ bytes, (do let value ← P.parse bytes; ok (resultOption value)) = ok (parse bytes.val) + verify_exact : ∀ key message signature, + (do let value ← P.verify key message signature; ok (resultIsOk value)) = + ok (equation key message.val signature) + +def keyOption [P : P256Primitives] : Option P.Key → core.qualified_p256_type_decls_13 + | none => .None | some key => .Some key + +def signatureOption [P : P256Primitives] : Option P.Signature → core.qualified_p256_type_decls_12 + | none => .None | some signature => .Some signature + +def failure : Failure → P256Error + | .key => .InvalidKey | .shape => .InvalidSignatureEncoding | .equation => .VerificationFailed + +def keyResult [P : P256Primitives] : Except Failure P.Key → core.qualified_p256_type_decls_3 + | .ok key => .Ok key | .error reason => .Err (failure reason) + +def verifyResult : Except Failure Unit → core.qualified_p256_type_decls_0 + | .ok unitValue => .Ok unitValue | .error reason => .Err (failure reason) + +def fixedResult : Option (Array Std.U8 64#usize) → core.qualified_p256_type_decls_9 + | none => .Err () | some bytes => .Ok bytes + +theorem decode_leaf_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) (bytes : Slice Std.U8) : + AuthsNativeP256.decode_p256_point bytes = ok (keyOption (decode bytes.val)) := by + have meaning := contract.decode_exact bytes + unfold AuthsNativeP256.decode_p256_point ecdsa.qualified_p256_fun_decls_29 + core.qualified_p256_fun_decls_30 + cases evaluated : P.decode bytes with + | fail reason => simp [evaluated] at meaning + | div => simp [evaluated] at meaning + | ok value => + cases value <;> simp_all [resultOption, keyOption] <;> rw [← meaning] + +theorem parse_leaf_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) (bytes : Array Std.U8 64#usize) : + AuthsNativeP256.parse_p256_signature bytes = ok (signatureOption (parse bytes.val)) := by + have meaning := contract.parse_exact bytes.to_slice + unfold AuthsNativeP256.parse_p256_signature ecdsa.qualified_p256_fun_decls_23 + core.qualified_p256_fun_decls_24 + simp only [lift, bind_tc_ok] + cases evaluated : P.parse bytes.to_slice with + | fail reason => simp [evaluated] at meaning + | div => simp [evaluated] at meaning + | ok value => + cases value <;> simp_all [resultOption, signatureOption] <;> rw [← meaning] + +theorem equation_leaf_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) + (key : P.Key) (message : Slice Std.U8) (signature : P.Signature) : + AuthsNativeP256.verify_p256_equation key message signature = ok (equation key message.val signature) := by + have meaning := contract.verify_exact key message signature + unfold AuthsNativeP256.verify_p256_equation + ecdsa.qualified_p256_type_decls_4.Insts.SignatureVerifierVerifierqualified_p256_type_decls_11.verify + core.qualified_p256_fun_decls_27 + cases evaluated : P.verify key message signature with + | fail reason => simp [evaluated] at meaning + | div => simp [evaluated] at meaning + | ok value => cases value <;> simp_all [resultIsOk] + +theorem fixed_refines (bytes : Slice Std.U8) : + SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into bytes = + ok (fixedResult (fixed 64#usize bytes.val)) := by + unfold SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into fixed fixedResult + by_cases sized : bytes.val.length = 64 <;> simp [sized] + +theorem decode_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) (bytes : Slice Std.U8) : + AuthsNativeP256.decode_p256_key_with bytes = ok (keyResult (p256Key decode bytes.val)) := by + unfold AuthsNativeP256.decode_p256_key_with + rw [P256Encoding.guard_refines] + simp only [bind_tc_ok, AuthsNativeP256.NativeP256.Insts.Auths_signature_coreP256Primitive.decode] + rw [decode_leaf_refines decode parse equation contract] + by_cases canonical : Auths.Crypto.Encoding.P256.Encoding (bytes.val.map UScalar.val) + · cases decoded : decode bytes.val <;> + simp [canonical, decoded, keyOption, keyResult, failure, p256Key, P256Encoding.Encoding] + · simp [canonical, keyResult, failure, p256Key, P256Encoding.Encoding] + +theorem public_verify_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) (bytes message signature : Slice Std.U8) : + AuthsNativeP256.verify_p256_sha256 bytes message signature = + ok (verifyResult (p256Verify decode parse equation bytes.val message.val signature.val)) := by + unfold AuthsNativeP256.verify_p256_sha256 AuthsNativeP256.verify_p256_sha256_with + rw [decode_refines decode parse equation contract] + cases decoded : p256Key decode bytes.val with + | error reason => + simp [keyResult, verifyResult, decoded, p256Verify, Except.bind, Bind.bind, Except.instMonad, + core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch, + core.qualified_p256_type_decls_0.Insts.CoreOpsTry_traitFromResidualqualified_p256_type_decls_7.from_residual] + | ok point => + simp only [keyResult, bind_tc_ok, + core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch] + rw [fixed_refines] + cases sized : fixed 64#usize signature.val with + | none => + simp [fixedResult, p256Verify, decoded, fixedSignature, sized, verifyResult, failure, Except.bind, Bind.bind, Except.instMonad] + | some array => + simp only [fixedResult, bind_tc_ok, + AuthsNativeP256.NativeP256.Insts.Auths_signature_coreP256Primitive.parse] + rw [parse_leaf_refines decode parse equation contract] + cases parsed : parse array.val with + | none => + simp [signatureOption, parsed, p256Verify, decoded, fixedSignature, sized, verifyResult, failure, Except.bind, Bind.bind, Except.instMonad] + | some scalar => + simp only [signatureOption, bind_tc_ok, + AuthsNativeP256.NativeP256.Insts.Auths_signature_coreP256Primitive.verify] + rw [P256LowContract.guard_refines, equation_leaf_refines decode parse equation contract] + by_cases low : ByteLex.value (array.val.drop 32) ≤ LowContract.order / 2 <;> + cases checked : equation point message.val scalar <;> + simp [low, checked, parsed, p256Verify, decoded, fixedSignature, sized, + P256LowContract.order, verifyResult, failure, Except.bind, Bind.bind, Except.instMonad] + +theorem verify_result_ok (result : Except Failure Unit) : + verifyResult result = .Ok () ↔ result = .ok () := by + cases result with + | error reason => simp [verifyResult] + | ok unitValue => cases unitValue; simp [verifyResult] + +theorem public_accepts_iff [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) (bytes message signature : Slice Std.U8) : + AuthsNativeP256.verify_p256_sha256 bytes message signature = ok (.Ok ()) ↔ + Auths.Crypto.Strict.Acceptance.P256Accepts decode parse equation bytes.val message.val signature.val := by + rw [public_verify_refines decode parse equation contract] + simp only [Result.ok.injEq, verify_result_ok, Auths.Crypto.Strict.Acceptance.p256_accepts_iff] + +theorem public_validate_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : Contract decode parse equation) (bytes : Slice Std.U8) : + AuthsNativeP256.validate_p256_key bytes = + ok (verifyResult (do let _ ← p256Key decode bytes.val; pure ())) := by + unfold AuthsNativeP256.validate_p256_key AuthsNativeP256.decode_p256_key + rw [decode_refines decode parse equation contract] + cases decoded : p256Key decode bytes.val <;> + simp [keyResult, verifyResult, Except.bind, Bind.bind, Except.instMonad] <;> rfl + +end Auths.Crypto.P256Native diff --git a/formal/Auths/Crypto/P256Primitives.lean b/formal/Auths/Crypto/P256Primitives.lean new file mode 100644 index 000000000..64c5baedb --- /dev/null +++ b/formal/Auths/Crypto/P256Primitives.lean @@ -0,0 +1,15 @@ +import Aeneas +open Aeneas Aeneas.Std +namespace Auths.Crypto + +/-- Explicit foreign P-256 implementation, with no instance or crypto law. +The public-wrapper theorems name its functional contract separately. -/ +class P256Primitives where + Key : Type + Signature : Type + Error : Type + decode : Slice U8 → Result (core.result.Result Key Error) + parse : Slice U8 → Result (core.result.Result Signature Error) + verify : Key → Slice U8 → Signature → Result (core.result.Result Unit Error) + +end Auths.Crypto diff --git a/formal/Auths/Crypto/Refinement.lean b/formal/Auths/Crypto/Refinement.lean new file mode 100644 index 000000000..c30f3e385 --- /dev/null +++ b/formal/Auths/Crypto/Refinement.lean @@ -0,0 +1,262 @@ +import qualification.aeneas.generated.codec.Funs +import Auths.Codec.Evaluation +import Auths.Crypto.Endian +import Auths.Crypto.Framing +import Auths.Crypto.BufferAllocation +import Mathlib.Tactic.CasesM +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_codec +open Auths.Crypto.Endian +set_option maxHeartbeats 2000000 +set_option maxRecDepth 4096 +namespace Auths.Crypto.Refinement + +@[cbv_eval] theorem object_tag (kind : hash.ObjectType) : + IScalar.hcast .U16 (read_discriminant kind) = + match kind with + | .Grant => 1#u16 + | .Action => 2#u16 + | .PrincipalStatus => 3#u16 + | .GrantStatus => 4#u16 + | .Observation => 9#u16 + | .Approval => 10#u16 := by + have discriminant (kind : hash.ObjectType) : + (read_discriminant kind).val = (match kind with + | .Grant => 1 | .Action => 2 | .PrincipalStatus => 3 + | .GrantStatus => 4 | .Observation => 9 | .Approval => 10 : Int) := by + cases kind <;> simp [read_discriminant, instDiscriminantObjectTypeIsize, + hash.ObjectType.read_discriminant, IScalar.ofInt, IScalar.ofInt_val_eq] + cases kind + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.ObjectType.Grant) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.ObjectType.Action) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.ObjectType.PrincipalStatus) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.ObjectType.GrantStatus) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.ObjectType.Observation) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + · apply UScalar.eq_of_val_eq + have contract := IScalar.hcast_inBounds_spec .U16 + (read_discriminant hash.ObjectType.Approval) (by rw [discriminant]; scalar_tac) + simp only [lift, Aeneas.Std.WP.spec_ok, discriminant] at contract + exact_mod_cast contract + + +theorem append_result_exact (left : alloc.vec.Vec Std.U8) (right : Slice Std.U8) + (output : alloc.vec.Vec Std.U8) + (accepted : alloc.vec.Vec.extend_from_slice core.clone.CloneU8 left right = ok output) : + output.val = left.val ++ right.val := by + rw [Auths.Codec.Evaluation.append_bytes] at accepted + split at accepted + · exact (congrArg Subtype.val (Result.ok.inj accepted)).symm + · split at accepted + · exact (congrArg Subtype.val (Result.ok.inj accepted)).symm + · cases accepted + +theorem conversion_value {source target : UScalarTy} (value : UScalar source) + (output : UScalar target) + (accepted : core.num.tryFromUScalar target value = ok (.Ok output)) : + output.val = value.val := by + unfold core.num.tryFromUScalar at accepted + split at accepted + · rename_i fits + have same : UScalar.cast target value = output := by simpa using accepted + rw [← same] + have contract := UScalar.cast_inBounds_spec target value fits + simpa only [lift, Aeneas.Std.WP.spec_ok] using contract + · simp at accepted + +def tagValue : hash.ObjectType → Nat + | .Grant => 1 | .Action => 2 | .PrincipalStatus => 3 + | .GrantStatus => 4 | .Observation => 9 | .Approval => 10 + +def inputFrame (kind : hash.ObjectType) (profile : Str) + (version : Std.U16) (statement : Slice Std.U8) : Auths.Crypto.Framing.Frame := + ⟨tagValue kind, profile.val.map (·.val), version.val, statement.val.map (·.val)⟩ + +theorem conversion_bound {source target : UScalarTy} (value : UScalar source) + (output : UScalar target) + (accepted : core.num.tryFromUScalar target value = ok (.Ok output)) : + value.val < 2 ^ target.numBits := by + rw [← conversion_value value output accepted] + exact output.bv.isLt + +theorem byte_values_valid (bytes : List Std.U8) : + Auths.Codec.BytesValid (bytes.map (·.val)) := by + intro byte present + obtain ⟨value, _, rfl⟩ := List.mem_map.mp present + exact value.bv.isLt + +theorem input_frame_valid_from_conversions + (kind : hash.ObjectType) (profile : Str) (version : Std.U16) (statement : Slice Std.U8) + (profileLength : Std.U16) (statementLength : Std.U64) + (profileConverted : core.num.tryFromUScalar .U16 (Slice.len profile) = ok (.Ok profileLength)) + (statementConverted : core.num.tryFromUScalar .U64 (Slice.len statement) = ok (.Ok statementLength)) : + (inputFrame kind profile version statement).Valid := by + have profileBound := conversion_bound (Slice.len profile) profileLength profileConverted + have statementBound := conversion_bound (Slice.len statement) statementLength statementConverted + refine ⟨?_, ?_, version.bv.isLt, ?_, byte_values_valid _, byte_values_valid _⟩ + · cases kind <;> simp only [inputFrame, tagValue] <;> decide + · simpa only [inputFrame, List.length_map, Slice.len_val, Slice.length, UScalarTy.numBits, Nat.reducePow] using profileBound + · simpa only [inputFrame, List.length_map, Slice.len_val, Slice.length, UScalarTy.numBits, Nat.reducePow] using statementBound + +theorem signing_preimage_exact (kind : hash.ObjectType) (profile : Str) + (version : Std.U16) (statement : Slice Std.U8) (output : alloc.vec.Vec Std.U8) + (accepted : hash.signing_preimage kind profile version statement = ok (.Ok output)) : + output.val.map (·.val) = Auths.Crypto.Framing.encode (inputFrame kind profile version statement) := by + unfold hash.signing_preimage at accepted + simp only [Auths.Crypto.BufferAllocation.buffer_refines] at accepted + simp only [core.str.Str.len, core.str.Str.as_bytes, + U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + error.limit_error, BuiltinFnOnce, core.result.Result.map_err, core.option.Option.ok_or, + Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output + all_goals casesm* core.result.Result (UScalar _) _ + all_goals split_ifs at * + all_goals simp_all only [lift, core.result.Result.Insts.CoreOpsTry.branch, + Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward append_result_exact) + (add safe forward conversion_value) + (add norm simp [inputFrame, Auths.Crypto.Framing.encode, + List.map_append, be16_exact, be64_exact, + hash.SIGNING_PREFIX, auths_model.PROTOCOL_V1, + alloc.vec.Vec.with_capacity, alloc.vec.Vec.new, + object_tag, tagValue]) + + +theorem accepted_frame_valid (kind : hash.ObjectType) (profile : Str) + (version : Std.U16) (statement : Slice Std.U8) (output : alloc.vec.Vec Std.U8) + (accepted : hash.signing_preimage kind profile version statement = ok (.Ok output)) : + (inputFrame kind profile version statement).Valid := by + unfold hash.signing_preimage at accepted + simp only [Auths.Crypto.BufferAllocation.buffer_refines] at accepted + simp only [core.str.Str.len, core.str.Str.as_bytes, + U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + error.limit_error, BuiltinFnOnce, core.result.Result.map_err, core.option.Option.ok_or, + Bind.bind, Aeneas.Std.bind] at accepted + repeat' first + | casesm* _ × _ + | dsimp only at accepted + | split at accepted + | simp (failIfUnchanged := true) only [uncurry, Bind.bind, Aeneas.Std.bind, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from, bind_tc_ok, bind_tc_fail, bind_tc_div, + Result.ok.injEq, core.result.Result.Ok.injEq, reduceCtorEq] at accepted + | contradiction + all_goals subst output + all_goals casesm* core.result.Result (UScalar _) _ + all_goals simp_all only [lift, core.result.Result.Insts.CoreOpsTry.branch, + Result.ok.injEq, core.result.Result.Ok.injEq, + core.ops.control_flow.ControlFlow.Continue.injEq, reduceCtorEq] + all_goals + aesop (add safe forward input_frame_valid_from_conversions) + +theorem tag_value_injective : Function.Injective tagValue := by + intro left right same + cases left <;> cases right <;> simp_all [tagValue] + +theorem byte_values_injective : + Function.Injective (fun bytes : List Std.U8 => bytes.map (·.val)) := by + intro left right same + induction left generalizing right with + | nil => cases right <;> simp_all + | cons first tail ih => + cases right with + | nil => simp at same + | cons next rest => + obtain ⟨head, tailEq⟩ := List.cons.inj same + have equalHead := UScalar.eq_of_val_eq head + exact congrArg₂ List.cons equalHead (ih tailEq) + +theorem accepted_preimages_bind_inputs + (leftKind rightKind : hash.ObjectType) (leftProfile rightProfile : Str) + (leftVersion rightVersion : Std.U16) (leftStatement rightStatement : Slice Std.U8) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftAccepted : hash.signing_preimage leftKind leftProfile leftVersion leftStatement = ok (.Ok leftOutput)) + (rightAccepted : hash.signing_preimage rightKind rightProfile rightVersion rightStatement = ok (.Ok rightOutput)) + (same : leftOutput.val = rightOutput.val) : + leftKind = rightKind ∧ leftProfile = rightProfile ∧ + leftVersion = rightVersion ∧ leftStatement = rightStatement := by + have leftExact := signing_preimage_exact _ _ _ _ _ leftAccepted + have rightExact := signing_preimage_exact _ _ _ _ _ rightAccepted + have sameBytes := congrArg (fun bytes : List Std.U8 => bytes.map (·.val)) same + have frames := Auths.Crypto.Framing.framing_is_unambiguous _ _ + (accepted_frame_valid _ _ _ _ _ leftAccepted) + (accepted_frame_valid _ _ _ _ _ rightAccepted) + (leftExact.symm.trans (sameBytes.trans rightExact)) + refine ⟨tag_value_injective (congrArg Auths.Crypto.Framing.Frame.objectTag frames), ?_, ?_, ?_⟩ + · apply Subtype.ext + exact byte_values_injective (congrArg Auths.Crypto.Framing.Frame.profile frames) + · apply UScalar.eq_of_val_eq + exact congrArg Auths.Crypto.Framing.Frame.profileVersion frames + · apply Subtype.ext + exact byte_values_injective (congrArg Auths.Crypto.Framing.Frame.statement frames) + +theorem preimage_length_exact (kind : hash.ObjectType) (profile : Str) + (version : Std.U16) (statement : Slice Std.U8) (output : alloc.vec.Vec Std.U8) + (accepted : hash.signing_preimage kind profile version statement = ok (.Ok output)) : + output.val.length = 21 + profile.val.length + statement.val.length := by + have length := congrArg List.length (signing_preimage_exact _ _ _ _ _ accepted) + simpa only [List.length_map, Auths.Crypto.Framing.length_exact, inputFrame] using length + + +theorem object_domains_separate + (leftKind rightKind : hash.ObjectType) (leftProfile rightProfile : Str) + (leftVersion rightVersion : Std.U16) (leftStatement rightStatement : Slice Std.U8) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftAccepted : hash.signing_preimage leftKind leftProfile leftVersion leftStatement = ok (.Ok leftOutput)) + (rightAccepted : hash.signing_preimage rightKind rightProfile rightVersion rightStatement = ok (.Ok rightOutput)) + (different : leftKind ≠ rightKind) : leftOutput.val ≠ rightOutput.val := by + intro same + exact different (accepted_preimages_bind_inputs _ _ _ _ _ _ _ _ _ _ leftAccepted rightAccepted same).1 + +theorem profile_limit_refused (kind : hash.ObjectType) (profile : Str) + (version : Std.U16) (statement : Slice Std.U8) + (oversized : 65535 < profile.val.length) : + hash.signing_preimage kind profile version statement = ok (.Err error.CodecError.LimitExceeded) := by + have tooLarge : ¬ (Slice.len profile).val ≤ UScalar.max .U16 := by + simpa only [Slice.len_val, Slice.length, UScalar.max_UScalarTy_U16_eq, U16.max_eq] using + Nat.not_le_of_lt oversized + unfold hash.signing_preimage + simp only [core.str.Str.len, U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from, + core.num.tryFromUScalar, if_neg tooLarge, bind_tc_ok, + core.result.Result.map_err, BuiltinFnOnce, error.limit_error, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame, core.convert.FromSame.from] + + +end Auths.Crypto.Refinement diff --git a/formal/Auths/Crypto/Sha256Examples.lean b/formal/Auths/Crypto/Sha256Examples.lean new file mode 100644 index 000000000..47014d3a2 --- /dev/null +++ b/formal/Auths/Crypto/Sha256Examples.lean @@ -0,0 +1,33 @@ +import Auths.Crypto.Sha256Native +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +set_option cbv.warning false +namespace Auths.Crypto.Sha256Examples + +-- A byte-forwarding mock, not a SHA-256 implementation or security claim. +def echo (bytes : List Std.U8) : Array Std.U8 32#usize := + Array.repeat 32#usize (bytes.headD 0#u8) + +@[reducible] def forwardingPrimitive : Sha256Primitives where + Output := Array Std.U8 32#usize + digest := fun bytes => ok (echo bytes.val) + intoBytes := fun bytes => ok bytes + +theorem forwarding_contract : Sha256Native.Contract (P := forwardingPrimitive) echo := by + refine Sha256Native.Contract.mk (P := forwardingPrimitive) ?_ + intro bytes + exact ⟨echo bytes.val, rfl, rfl⟩ + +theorem exact_input_reaches_selected_digest : + AuthsNativeSha256.hash.raw_sha256 (primitive := forwardingPrimitive) + (⟨[42#u8], by scalar_tac⟩ : Slice Std.U8) = ok (Array.repeat 32#usize 42#u8) := by + rw [Sha256Native.raw_hash_refines (P := forwardingPrimitive) echo forwarding_contract] + rfl + +theorem changed_input_reaches_selected_digest : + AuthsNativeSha256.hash.raw_sha256 (primitive := forwardingPrimitive) + (⟨[43#u8], by scalar_tac⟩ : Slice Std.U8) = ok (Array.repeat 32#usize 43#u8) := by + rw [Sha256Native.raw_hash_refines (P := forwardingPrimitive) echo forwarding_contract] + rfl + +end Auths.Crypto.Sha256Examples diff --git a/formal/Auths/Crypto/Sha256Native.lean b/formal/Auths/Crypto/Sha256Native.lean new file mode 100644 index 000000000..81130e685 --- /dev/null +++ b/formal/Auths/Crypto/Sha256Native.lean @@ -0,0 +1,21 @@ +import qualification.aeneas.generated.sha256.Funs +open Aeneas Aeneas.Std Result +namespace Auths.Crypto.Sha256Native + +/-- Functional SHA-256/output representation premise. This does not assert +collision freedom, preimage resistance or any signature authenticity. -/ +structure Contract [P : Sha256Primitives] (sha256 : List Std.U8 → Array Std.U8 32#usize) : Prop where + exact_calls : ∀ bytes, ∃ output, + P.digest bytes = ok output ∧ P.intoBytes output = ok (sha256 bytes.val) + +theorem raw_hash_refines [P : Sha256Primitives] + (sha256 : List Std.U8 → Array Std.U8 32#usize) (contract : Contract sha256) + (bytes : Slice Std.U8) : + AuthsNativeSha256.hash.raw_sha256 bytes = ok (sha256 bytes.val) := by + obtain ⟨output, digestExact, representationExact⟩ := contract.exact_calls bytes + simp only [AuthsNativeSha256.hash.raw_sha256, + digest.qualified_sha256_type_decls_11.Insts.DigestDigestDigest.digest, + generic_array.qualified_sha256_type_decls_1.Insts.CoreConvertIntoArrayU832.into, + digestExact, representationExact, bind_tc_ok, AuthsNativeSha256.auths_model.Digest.new] + +end Auths.Crypto.Sha256Native diff --git a/formal/Auths/Crypto/Sha256Primitives.lean b/formal/Auths/Crypto/Sha256Primitives.lean new file mode 100644 index 000000000..0acfab6be --- /dev/null +++ b/formal/Auths/Crypto/Sha256Primitives.lean @@ -0,0 +1,12 @@ +import Aeneas +open Aeneas Aeneas.Std Result +namespace Auths.Crypto + +/-- Explicit foreign SHA-256 and selected fixed-size output-conversion calls. +No global implementation instance or cryptographic axiom is supplied. -/ +class Sha256Primitives where + Output : Type + digest : Slice Std.U8 → Result Output + intoBytes : Output → Result (Array Std.U8 32#usize) + +end Auths.Crypto diff --git a/formal/Auths/Crypto/Strict/Acceptance.lean b/formal/Auths/Crypto/Strict/Acceptance.lean new file mode 100644 index 000000000..bc5a0a210 --- /dev/null +++ b/formal/Auths/Crypto/Strict/Acceptance.lean @@ -0,0 +1,139 @@ +import Auths.Crypto.Strict.SuiteRefinement +open Aeneas Aeneas.Std Result +open Auths.Crypto.Strict.SuiteModel Auths.Crypto.Strict.SuiteRefinement +namespace Auths.Crypto.Strict.Acceptance + +def EdForm (bytes : List Std.U8) : Prop := + ∃ encoded : Encoding.Encoded.Input, encoded.val = bytes ∧ Encoding.Encoded.Encoding encoded + +def EdAccepts {K : Type} (decode : List Std.U8 → Option K) + (equation : K → List Std.U8 → List Std.U8 → Bool) + (key message signature : List Std.U8) : Prop := + ∃ encoded : Encoding.Encoded.Input, ∃ signed : RContract.Input, + encoded.val = key ∧ signed.val = signature ∧ Encoding.Encoded.Encoding encoded ∧ + ¬ WeakContract.WeakCoordinate (Encoding.Encoded.ordinate encoded) ∧ RContract.Allowed signed ∧ + ∃ point, decode key = some point ∧ equation point message signature = true + +def P256Accepts {K S : Type} (decode : List Std.U8 → Option K) (parse : List Std.U8 → Option S) + (equation : K → List Std.U8 → S → Bool) (key message signature : List Std.U8) : Prop := + Encoding.P256.Encoding (key.map UScalar.val) ∧ signature.length = 64 ∧ + ByteLex.value (signature.drop 32) ≤ LowContract.order / 2 ∧ + ∃ point parsed, decode key = some point ∧ parse signature = some parsed ∧ equation point message parsed = true + +theorem fixed_exact (N : Std.Usize) (array : Array Std.U8 N) : fixed N array.val = some array := by + unfold fixed + have sized : array.val.length = N.val := array.property + simp only [sized, _root_.dite_true] + congr 1 + +theorem key_encoding_accepts_iff (bytes : List Std.U8) (encoded : Encoding.Encoded.Input) : + keyEncoding bytes = .ok encoded ↔ encoded.val = bytes ∧ Encoding.Encoded.Encoding encoded := by + constructor + · intro accepted + refine ⟨key_encoding_value bytes encoded accepted, ?_⟩ + unfold keyEncoding at accepted + cases sized : fixedKey bytes with + | none => simp [sized] at accepted + | some raw => + simp only [sized] at accepted + split at accepted + · rename_i canonical + simp only [Except.ok.injEq] at accepted + simpa [accepted] using canonical + · contradiction + · rintro ⟨exactBytes, canonical⟩ + have sized := fixed_exact 32#usize encoded + rw [exactBytes] at sized + simp [keyEncoding, fixedKey, sized, canonical] + +theorem p256_key_accepts_iff {K : Type} (decode : List Std.U8 → Option K) + (bytes : List Std.U8) (point : K) : + p256Key decode bytes = .ok point ↔ Encoding.P256.Encoding (bytes.map UScalar.val) ∧ decode bytes = some point := by + by_cases canonical : Encoding.P256.Encoding (bytes.map UScalar.val) + · cases decoded : decode bytes <;> simp [p256Key, canonical, decoded, eq_comm] + · simp [p256Key, canonical] + +theorem ed_accepts_iff {K : Type} (decode : List Std.U8 → Option K) + (equation : K → List Std.U8 → List Std.U8 → Bool) + (key message signature : List Std.U8) : + edVerify decode equation key message signature = .ok () ↔ EdAccepts decode equation key message signature := by + cases encoded : keyEncoding key with + | error reason => + have refused : ¬ EdAccepts decode equation key message signature := by + rintro ⟨raw, _, exactKey, _, canonical, _⟩ + have accepted := (key_encoding_accepts_iff key raw).mpr ⟨exactKey, canonical⟩ + rw [encoded] at accepted + contradiction + simp [edVerify, encoded, refused, Except.bind, Bind.bind, Except.instMonad] + | ok raw => + obtain ⟨exactKey, canonical⟩ := (key_encoding_accepts_iff key raw).mp encoded + cases decoded : decode key with + | none => simp [edVerify, encoded, decoded, EdAccepts, Except.bind, Bind.bind, Except.instMonad] + | some point => + cases sized : fixedSignature signature with + | none => + have refused : ¬ EdAccepts decode equation key message signature := by + rintro ⟨_, signed, _, exactSignature, _⟩ + have accepted := fixed_exact 64#usize signed + rw [exactSignature] at accepted + change fixedSignature signature = some signed at accepted + rw [sized] at accepted + contradiction + simp [edVerify, encoded, decoded, sized, refused, Except.bind, Bind.bind, Except.instMonad] + | some signed => + have exactSignature : signed.val = signature := fixed_value 64#usize signature signed sized + have relation : EdAccepts decode equation key message signature ↔ + ¬ WeakContract.WeakCoordinate (Encoding.Encoded.ordinate raw) ∧ + RContract.Allowed signed ∧ equation point message signature = true := by + constructor + · rintro ⟨other, otherSignature, otherKey, otherBytes, _, notWeak, allowed, otherPoint, samePoint, verifies⟩ + have sameKey : other = raw := Subtype.ext (otherKey.trans exactKey.symm) + have sameSignature : otherSignature = signed := Subtype.ext (otherBytes.trans exactSignature.symm) + have same : otherPoint = point := by simpa only [decoded, Option.some.injEq, eq_comm] using samePoint + simpa only [sameKey, sameSignature, same] using And.intro notWeak (And.intro allowed verifies) + · rintro ⟨notWeak, allowed, verifies⟩ + exact ⟨raw, signed, exactKey, exactSignature, canonical, notWeak, allowed, point, decoded, verifies⟩ + rw [relation] + by_cases weak : WeakContract.WeakCoordinate (Encoding.Encoded.ordinate raw) <;> + by_cases allowed : RContract.Allowed signed <;> cases verified : equation point message signature <;> + simp [edVerify, encoded, decoded, sized, weak, allowed, exactSignature, verified, + Except.bind, Bind.bind, Except.instMonad] + +theorem p256_accepts_iff {K S : Type} (decode : List Std.U8 → Option K) (parse : List Std.U8 → Option S) + (equation : K → List Std.U8 → S → Bool) (key message signature : List Std.U8) : + p256Verify decode parse equation key message signature = .ok () ↔ + P256Accepts decode parse equation key message signature := by + cases decoded : p256Key decode key with + | error reason => + have refused : ¬ P256Accepts decode parse equation key message signature := by + rintro ⟨form, _, _, point, parsed, pointBytes, _⟩ + have accepted := (p256_key_accepts_iff decode key point).mpr ⟨form, pointBytes⟩ + rw [decoded] at accepted + contradiction + simp [p256Verify, decoded, refused, Except.bind, Bind.bind, Except.instMonad] + | ok point => + obtain ⟨form, exactKey⟩ := (p256_key_accepts_iff decode key point).mp decoded + cases sized : fixedSignature signature with + | none => + have wrong : signature.length ≠ 64 := by + intro exactLength + unfold fixedSignature fixed at sized + simp only [show signature.length = (64#usize).val from by simpa using exactLength, _root_.dite_true] at sized + contradiction + simp [p256Verify, decoded, sized, P256Accepts, wrong, Except.bind, Bind.bind, Except.instMonad] + | some signed => + have exactSignature : signed.val = signature := fixed_value 64#usize signature signed sized + have length : signature.length = 64 := by + rw [← exactSignature] + have size := signed.property + scalar_tac + cases parsed : parse signature with + | none => simp [p256Verify, decoded, sized, P256Accepts, form, exactKey, exactSignature, parsed, + Except.bind, Bind.bind, Except.instMonad] + | some scalar => + by_cases low : ByteLex.value (signature.drop 32) ≤ LowContract.order / 2 <;> + cases verified : equation point message scalar <;> + simp [p256Verify, decoded, sized, P256Accepts, form, exactKey, exactSignature, parsed, + length, low, verified, Except.bind, Bind.bind, Except.instMonad] + +end Auths.Crypto.Strict.Acceptance diff --git a/formal/Auths/Crypto/Strict/ByteLex.lean b/formal/Auths/Crypto/Strict/ByteLex.lean new file mode 100644 index 000000000..dfd967aa2 --- /dev/null +++ b/formal/Auths/Crypto/Strict/ByteLex.lean @@ -0,0 +1,66 @@ +import Auths.Crypto.Encoding.Digits +open Aeneas Aeneas.Std +namespace Auths.Crypto.ByteLex + +def value (bytes : List Std.U8) : Nat := Nat.ofDigits 256 (bytes.map UScalar.val).reverse + +def le : List Std.U8 → List Std.U8 → Bool + | [], _ => true + | _ :: _, [] => false + | left :: restLeft, right :: restRight => + if left.val < right.val then true + else if right.val < left.val then false + else le restLeft restRight + +theorem value_bound (bytes : List Std.U8) : value bytes < 256 ^ bytes.length := by + have bounded : ∀ byte ∈ (bytes.map UScalar.val).reverse, byte < 256 := by + intro byte member + rcases List.mem_map.mp (List.mem_reverse.mp member) with ⟨original, _, rfl⟩ + scalar_tac + simpa [value] using Auths.Crypto.Encoding.Digits.value_bound (bytes.map UScalar.val).reverse bounded + +theorem value_cons (head : Std.U8) (tail : List Std.U8) : + value (head :: tail) = head.val * 256 ^ tail.length + value tail := by + simp [value, Nat.ofDigits_append, Nat.mul_comm, Nat.add_comm] + +theorem weighted_le_iff (left right tailLeft tailRight place : Nat) + (positive : 0 < place) (leftBound : tailLeft < place) (rightBound : tailRight < place) : + left * place + tailLeft ≤ right * place + tailRight ↔ + left < right ∨ left = right ∧ tailLeft ≤ tailRight := by + by_cases less : left < right + · have gap := Nat.mul_le_mul_right place (Nat.succ_le_of_lt less) + simp only [Nat.succ_mul] at gap + constructor + · intro _; exact Or.inl less + · intro _; omega + · by_cases greater : right < left + · have gap := Nat.mul_le_mul_right place (Nat.succ_le_of_lt greater) + simp only [Nat.succ_mul] at gap + have different : left ≠ right := by omega + have cannot : ¬ left * place + tailLeft ≤ right * place + tailRight := by omega + simp [less, different, cannot] + · have equal : left = right := by omega + subst right + simp + +theorem le_numeric (left right : List Std.U8) (same : left.length = right.length) : + le left right = true ↔ value left ≤ value right := by + induction left generalizing right with + | nil => cases right <;> simp_all [le, value] + | cons head tail ih => + cases right with + | nil => simp at same + | cons other rest => + have lengths : tail.length = rest.length := by simpa using same + rw [value_cons, value_cons, ← lengths] + rw [weighted_le_iff _ _ _ _ _ (by positivity) (value_bound tail) (lengths ▸ value_bound rest)] + have tails := ih rest lengths + by_cases less : head.val < other.val + · simp [le, less] + · by_cases greater : other.val < head.val + · have different : head.val ≠ other.val := by omega + simp [le, less, greater, different] + · have equal : head.val = other.val := by omega + simp [le, less, greater, equal, tails] + +end Auths.Crypto.ByteLex diff --git a/formal/Auths/Crypto/Strict/CoordinateContract.lean b/formal/Auths/Crypto/Strict/CoordinateContract.lean new file mode 100644 index 000000000..b207e55f2 --- /dev/null +++ b/formal/Auths/Crypto/Strict/CoordinateContract.lean @@ -0,0 +1,32 @@ +import Auths.Crypto.Strict.CoordinateScan +import Auths.Crypto.Strict.CoordinateModel +import Auths.Crypto.Encoding.RootFlags +open Aeneas Aeneas.Std Result Aeneas.Std.WP +open Auths.Crypto.Encoding.Encoded Auths.Crypto.Encoding.RootFlags +namespace Auths.Crypto.CoordinateContract + +theorem guard_refines (input expected : Input) : + auths_signature_core.ed25519_same_coordinate input expected = ok (decide (ordinate input = ordinate expected)) := by + obtain ⟨result, runs, meaning⟩ := spec_imp_exists + (CoordinateScan.loop_refines input expected 31 0#usize (by scalar_tac)) + have exactLoop : auths_signature_core.ed25519_same_coordinate_loop input expected 0#usize = + ok (decide (input.val.take 31 = expected.val.take 31)) := by + simpa only [meaning, UScalar.ofNatCore_val_eq, List.drop_zero] using runs + have masks : ((last input &&& 127#u8) = (last expected &&& 127#u8)) ↔ + (last input).val % 128 = (last expected).val % 128 := by + rw [UScalar.eq_equiv, Auths.Crypto.Encoding.Byte.lower_seven, Auths.Crypto.Encoding.Byte.lower_seven] + unfold auths_signature_core.ed25519_same_coordinate + rw [read_last] + simp only [lift, bind_tc_ok] + rw [read_last] + simp only [lift, bind_tc_ok] + by_cases same : (last input &&& 127#u8) = (last expected &&& 127#u8) + · simp only [same, bne_self_eq_false, Bool.false_eq_true, ite_false] + rw [exactLoop] + congr 1 + apply Bool.eq_iff_iff.mpr + simp only [decide_eq_true_eq, CoordinateModel.ordinate_eq_iff, masks.mp same, and_true] + · have different : (last input).val % 128 ≠ (last expected).val % 128 := by simpa only [masks] using same + simp [same, CoordinateModel.ordinate_eq_iff, different] + +end Auths.Crypto.CoordinateContract diff --git a/formal/Auths/Crypto/Strict/CoordinateModel.lean b/formal/Auths/Crypto/Strict/CoordinateModel.lean new file mode 100644 index 000000000..69c65a789 --- /dev/null +++ b/formal/Auths/Crypto/Strict/CoordinateModel.lean @@ -0,0 +1,50 @@ +import Auths.Crypto.Encoding.Encoded +open Aeneas Aeneas.Std +open Auths.Crypto.Encoding.Encoded +namespace Auths.Crypto.CoordinateModel + +def digits (input : Input) : List Nat := + (input.val.take 31).map UScalar.val ++ [(last input).val % 128] + +theorem digits_length (input : Input) : (digits input).length = 32 := by + simp [digits, input_length] + +theorem digits_bound (input : Input) : ∀ byte ∈ digits input, byte < 256 := by + intro byte member + simp only [digits, List.mem_append, List.mem_map, List.mem_singleton] at member + rcases member with mapped | lastByte + · rcases mapped with ⟨original, _, rfl⟩; scalar_tac + · subst byte + have bounded := Nat.mod_lt (last input).val (by decide : 0 < 128) + omega + +theorem coordinate_prefix (input : Input) : input.val.take 31 = first input :: middle input := by + cases values : input.val with + | nil => have bound := input_length input; simp [values] at bound + | cons head tail => simp [first, middle, values] + +theorem digits_value (input : Input) : Nat.ofDigits 256 (digits input) = ordinate input := by + unfold digits ordinate topValue + rw [coordinate_prefix] + simp only [List.map_cons, List.cons_append] + +theorem ordinate_eq_iff (input expected : Input) : + ordinate input = ordinate expected ↔ + input.val.take 31 = expected.val.take 31 ∧ (last input).val % 128 = (last expected).val % 128 := by + rw [← digits_value, ← digits_value] + constructor + · intro same + have equalDigits : digits input = digits expected := + Nat.ofDigits_inj_of_len_eq (by decide) (by rw [digits_length, digits_length]) + (digits_bound input) (digits_bound expected) same + have pieces := List.append_inj equalDigits (by simp [input_length]) + refine ⟨?_, ?_⟩ + · apply (List.map_injective_iff.mpr (show Function.Injective (fun byte : Std.U8 => byte.val) from by + intro left right equal; scalar_tac)) + exact pieces.1 + · simpa using pieces.2 + · rintro ⟨samePrefix, sameLast⟩ + apply congrArg (Nat.ofDigits 256) + simp [digits, samePrefix, sameLast] + +end Auths.Crypto.CoordinateModel diff --git a/formal/Auths/Crypto/Strict/CoordinateScan.lean b/formal/Auths/Crypto/Strict/CoordinateScan.lean new file mode 100644 index 000000000..eda797e15 --- /dev/null +++ b/formal/Auths/Crypto/Strict/CoordinateScan.lean @@ -0,0 +1,43 @@ +import qualification.aeneas.generated.signature.Funs +import Auths.Crypto.Encoding.Encoded +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.CoordinateScan +open Auths.Crypto.Encoding.Encoded + +theorem loop_refines (input expected : Input) (remaining : Nat) (index : Std.Usize) + (count : index.val + remaining = 31) : + auths_signature_core.ed25519_same_coordinate_loop input expected index + ⦃ result => result = decide ((input.val.drop index.val).take remaining = + (expected.val.drop index.val).take remaining) ⦄ := by + induction remaining generalizing index with + | zero => + have atEnd : index = 31#usize := by scalar_tac + subst index + rw [auths_signature_core.ed25519_same_coordinate_loop.eq_def] + simp [spec_ok] + | succ remaining ih => + rw [auths_signature_core.ed25519_same_coordinate_loop.eq_def] + have advances : index < 31#usize := by scalar_tac + simp only [advances, ↓reduceIte] + have inputSize := input_length input + have expectedSize := input_length expected + step as ⟨byte, byteEq⟩ + step as ⟨bound, boundEq⟩ + have leftParts : (input.val.drop index.val).take (remaining + 1) = + byte :: (input.val.drop (index.val + 1)).take remaining := by + rw [List.drop_eq_getElem_cons (by omega)] + simp only [List.take_succ_cons, byteEq] + have rightParts : (expected.val.drop index.val).take (remaining + 1) = + bound :: (expected.val.drop (index.val + 1)).take remaining := by + rw [List.drop_eq_getElem_cons (by omega)] + simp only [List.take_succ_cons, boundEq] + by_cases same : byte = bound + · simp only [same, bne_self_eq_false, Bool.false_eq_true, ite_false] + step as ⟨next, nextEq⟩ + have countNext : next.val + remaining = 31 := by omega + apply spec_mono (ih next countNext) + intro result exactResult + simpa only [leftParts, rightParts, same, List.cons.injEq, true_and, nextEq] using exactResult + · simp [same, spec_ok, leftParts, rightParts] + +end Auths.Crypto.CoordinateScan diff --git a/formal/Auths/Crypto/Strict/Examples.lean b/formal/Auths/Crypto/Strict/Examples.lean new file mode 100644 index 000000000..92e8fb684 --- /dev/null +++ b/formal/Auths/Crypto/Strict/Examples.lean @@ -0,0 +1,61 @@ +import Auths.Crypto.Strict.SourceAcceptance +import Auths.Crypto.Encoding.Examples +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 +-- Encoding/guard witnesses alone do not establish signature authenticity. +namespace Auths.Crypto.Strict.Examples + +def zero : LowScan.Input := ⟨List.replicate 64 0#u8, by scalar_tac⟩ +def half : LowScan.Input := ⟨List.replicate 32 0#u8 ++ auths_signature_core.P256_HALF_ORDER.val, by + have size := LowScan.half_length + scalar_tac⟩ +def aboveHalf : LowScan.Input := ⟨List.replicate 32 0#u8 ++ auths_signature_core.P256_HALF_ORDER.val.set 31 169#u8, by + have size := LowScan.half_length + scalar_tac⟩ +def maximum : LowScan.Input := ⟨List.replicate 32 0#u8 ++ List.replicate 32 255#u8, by scalar_tac⟩ +def publicR : RContract.Input := ⟨Encoding.Examples.rfcPublicKey.val ++ List.replicate 32 0#u8, by + have size := Encoding.Encoded.input_length Encoding.Examples.rfcPublicKey + scalar_tac⟩ + +theorem zero_s_form_allowed : auths_signature_core.p256_signature_is_low_s zero = ok true := by + rw [LowContract.guard_refines] + cbv + +theorem half_s_form_allowed : auths_signature_core.p256_signature_is_low_s half = ok true := by + rw [LowContract.guard_refines] + unfold half + simp only [List.drop_append, List.length_replicate, List.drop_replicate, Nat.sub_self, List.nil_append, + LowContract.half_order_exact] + cbv + +theorem above_half_s_refused : auths_signature_core.p256_signature_is_low_s aboveHalf = ok false := by + rw [LowContract.guard_refines] + unfold aboveHalf auths_signature_core.P256_HALF_ORDER + cbv + +theorem maximum_s_refused : auths_signature_core.p256_signature_is_low_s maximum = ok false := by + rw [LowContract.guard_refines] + cbv + +theorem identity_coordinate_is_weak : + auths_signature_core.ed25519_has_small_order_coordinate Encoding.Examples.canonicalIdentity = ok true := by + rw [WeakContract.guard_refines] + cbv + +theorem published_key_coordinate_is_not_weak : + auths_signature_core.ed25519_has_small_order_coordinate Encoding.Examples.rfcPublicKey = ok false := by + rw [WeakContract.guard_refines] + cbv + +theorem weak_r_form_refused : auths_signature_core.ed25519_signature_r_is_allowed zero = ok false := by + rw [RContract.guard_refines] + cbv + +theorem public_r_form_allowed : auths_signature_core.ed25519_signature_r_is_allowed publicR = ok true := by + rw [RContract.guard_refines] + cbv + +end Auths.Crypto.Strict.Examples diff --git a/formal/Auths/Crypto/Strict/LowContract.lean b/formal/Auths/Crypto/Strict/LowContract.lean new file mode 100644 index 000000000..6192e2635 --- /dev/null +++ b/formal/Auths/Crypto/Strict/LowContract.lean @@ -0,0 +1,34 @@ +import Auths.Crypto.Strict.LowScan +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.LowContract + +-- SEC 2 secp256r1 prime subgroup order, as an independent natural number. +def order : Nat := 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 + +theorem half_order_exact : ByteLex.value auths_signature_core.P256_HALF_ORDER.val = order / 2 := by + unfold ByteLex.value auths_signature_core.P256_HALF_ORDER order + decide + +theorem guard_refines (input : LowScan.Input) : + auths_signature_core.p256_signature_is_low_s input = + ok (decide (ByteLex.value (input.val.drop 32) ≤ order / 2)) := by + obtain ⟨result, executes, meaning⟩ := spec_imp_exists + (LowScan.loop_refines input 32 0#usize (by scalar_tac)) + have exactSource : auths_signature_core.p256_signature_is_low_s input = + ok (ByteLex.le (input.val.drop 32) auths_signature_core.P256_HALF_ORDER.val) := by + simpa only [auths_signature_core.p256_signature_is_low_s, meaning, + UScalar.ofNatCore_val_eq, Nat.add_zero, List.drop_zero] using executes + rw [exactSource] + congr 1 + apply Bool.eq_iff_iff.mpr + have sizes : (input.val.drop 32).length = auths_signature_core.P256_HALF_ORDER.val.length := by + simp only [List.length_drop, LowScan.input_length, LowScan.half_length] + simpa only [half_order_exact, decide_eq_true_eq] using + ByteLex.le_numeric (input.val.drop 32) auths_signature_core.P256_HALF_ORDER.val sizes + +theorem r_bytes_irrelevant (left right : LowScan.Input) + (sameScalar : left.val.drop 32 = right.val.drop 32) : + auths_signature_core.p256_signature_is_low_s left = auths_signature_core.p256_signature_is_low_s right := by + rw [guard_refines, guard_refines, sameScalar] + +end Auths.Crypto.LowContract diff --git a/formal/Auths/Crypto/Strict/LowScan.lean b/formal/Auths/Crypto/Strict/LowScan.lean new file mode 100644 index 000000000..66a57be68 --- /dev/null +++ b/formal/Auths/Crypto/Strict/LowScan.lean @@ -0,0 +1,64 @@ +import qualification.aeneas.generated.signature.Funs +import Auths.Crypto.Strict.ByteLex +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.LowScan + +abbrev Input := Array Std.U8 64#usize + +theorem input_length (input : Input) : input.val.length = 64 := by + have bounded := input.property + scalar_tac + +theorem half_length : auths_signature_core.P256_HALF_ORDER.val.length = 32 := by + have bounded := auths_signature_core.P256_HALF_ORDER.property + scalar_tac + +theorem loop_refines (input : Input) (remaining : Nat) (index : Std.Usize) + (count : index.val + remaining = 32) : + auths_signature_core.p256_signature_is_low_s_loop input index + ⦃ result => result = ByteLex.le (input.val.drop (32 + index.val)) + (auths_signature_core.P256_HALF_ORDER.val.drop index.val) ⦄ := by + induction remaining generalizing index with + | zero => + have atEnd : index = 32#usize := by scalar_tac + subst index + rw [auths_signature_core.p256_signature_is_low_s_loop.eq_def] + have emptyInput : input.val.drop 64 = [] := List.drop_eq_nil_iff.mpr (by rw [input_length]) + have emptyHalf : auths_signature_core.P256_HALF_ORDER.val.drop 32 = [] := + List.drop_eq_nil_iff.mpr (by rw [half_length]) + simp [spec_ok, emptyInput, emptyHalf, ByteLex.le] + | succ remaining ih => + rw [auths_signature_core.p256_signature_is_low_s_loop.eq_def] + have advances : index < 32#usize := by scalar_tac + simp only [advances, ↓reduceIte] + have inputSize := input_length input + have halfSize := half_length + step as ⟨offset, offsetEq⟩ + step as ⟨byte, byteEq⟩ + step as ⟨bound, boundEq⟩ + have leftParts : input.val.drop (32 + index.val) = + byte :: input.val.drop (32 + index.val + 1) := by + rw [List.drop_eq_getElem_cons (by omega)] + simp only [byteEq, offsetEq] + have rightParts : auths_signature_core.P256_HALF_ORDER.val.drop index.val = + bound :: auths_signature_core.P256_HALF_ORDER.val.drop (index.val + 1) := by + rw [List.drop_eq_getElem_cons (by omega)] + simp only [boundEq] + by_cases less : byte < bound + · have natural : byte.val < bound.val := by scalar_tac + simp [less, spec_ok, leftParts, rightParts, ByteLex.le, natural] + · by_cases greater : bound < byte + · have naturalLess : ¬ byte.val < bound.val := by scalar_tac + have naturalGreater : bound.val < byte.val := by scalar_tac + simp [less, greater, spec_ok, leftParts, rightParts, ByteLex.le, naturalLess, naturalGreater] + · have naturalLess : ¬ byte.val < bound.val := by scalar_tac + have naturalGreater : ¬ bound.val < byte.val := by scalar_tac + simp only [less, greater, ↓reduceIte] + step as ⟨next, nextEq⟩ + have countNext : next.val + remaining = 32 := by omega + apply spec_mono (ih next countNext) + intro result exactResult + simpa only [leftParts, rightParts, ByteLex.le, naturalLess, naturalGreater, ↓reduceIte, + nextEq, Nat.add_assoc] using exactResult + +end Auths.Crypto.LowScan diff --git a/formal/Auths/Crypto/Strict/RContract.lean b/formal/Auths/Crypto/Strict/RContract.lean new file mode 100644 index 000000000..77b6167d7 --- /dev/null +++ b/formal/Auths/Crypto/Strict/RContract.lean @@ -0,0 +1,43 @@ +import qualification.aeneas.generated.signature.Funs +import Auths.Crypto.Strict.WeakContract +import Auths.Crypto.Encoding.Ed25519 +open Aeneas Aeneas.Std Result Aeneas.Std.WP +namespace Auths.Crypto.RContract + +abbrev Input := Array Std.U8 64#usize + +def rBytes (input : Input) : Encoding.Encoded.Input := ⟨input.val.take 32, by + have size := input.property + scalar_tac⟩ + +def Allowed (input : Input) : Prop := Encoding.Encoded.Encoding (rBytes input) ∧ + ¬ WeakContract.WeakCoordinate (Encoding.Encoded.ordinate (rBytes input)) + +instance (input : Input) : Decidable (Allowed input) := inferInstanceAs + (Decidable (Encoding.Encoded.Encoding (rBytes input) ∧ + ¬ WeakContract.WeakCoordinate (Encoding.Encoded.ordinate (rBytes input)))) + +theorem guard_refines (input : Input) : + auths_signature_core.ed25519_signature_r_is_allowed input = ok (decide (Allowed input)) := by + suffices run : auths_signature_core.ed25519_signature_r_is_allowed input + ⦃ result => result = decide (Allowed input) ⦄ by + obtain ⟨result, executes, rfl⟩ := spec_imp_exists run + exact executes + unfold auths_signature_core.ed25519_signature_r_is_allowed + have inputSize : input.val.length = 64 := by have size := input.property; scalar_tac + step as ⟨prefixBytes, prefixEq⟩ + unfold core.array.TryFromSharedArraySlice.try_from + have sized : prefixBytes.len = 32#usize := by scalar_tac + simp only [sized, _root_.dite_true, bind_tc_ok] + rw [Encoding.Ed25519.guard_refines] + simp only [bind_tc_ok] + rw [WeakContract.guard_refines] + have same : (⟨prefixBytes.val, by scalar_tac⟩ : Encoding.Encoded.Input) = rBytes input := by + apply Subtype.ext + simpa [rBytes, List.slice, Array.to_slice] using prefixEq + simp only [same] + by_cases canonical : Encoding.Encoded.Encoding (rBytes input) + · simp [canonical, Allowed, spec_ok] + · simp [canonical, Allowed, spec_ok] + +end Auths.Crypto.RContract diff --git a/formal/Auths/Crypto/Strict/SourceAcceptance.lean b/formal/Auths/Crypto/Strict/SourceAcceptance.lean new file mode 100644 index 000000000..acac99130 --- /dev/null +++ b/formal/Auths/Crypto/Strict/SourceAcceptance.lean @@ -0,0 +1,48 @@ +import Auths.Crypto.Strict.Acceptance +open Aeneas Aeneas.Std Result +open auths_signature_core Auths.Crypto.Strict.SuiteModel Auths.Crypto.Strict.Acceptance +namespace Auths.Crypto.Strict.SourceAcceptance + +theorem ed_result_ok (outcome : Except Failure Unit) : + sourceEd outcome = .Ok () ↔ outcome = .ok () := by + cases outcome with + | error reason => simp [sourceEd] + | ok empty => cases empty; simp [sourceEd] + +theorem p256_result_ok (outcome : Except Failure Unit) : + sourceP256 outcome = .Ok () ↔ outcome = .ok () := by + cases outcome with + | error reason => simp [sourceP256] + | ok empty => cases empty; simp [sourceP256] + +theorem ed_source_accepts_iff {K D V : Type} + (decoderPrimitive : core.ops.function.FnOnce D (Array Std.U8 32#usize) (Option K)) + (verifierPrimitive : core.ops.function.FnOnce V (K × Slice Std.U8 × Array Std.U8 64#usize) Bool) + (decoder : D) (verifier : V) (decode : List Std.U8 → Option K) + (equation : K → List Std.U8 → List Std.U8 → Bool) + (decodeContract : ∀ array, decoderPrimitive.call_once decoder array = ok (decode array.val)) + (verifyContract : ∀ key message signature, verifierPrimitive.call_once verifier (key, message, signature) = + ok (equation key message.val signature.val)) + (bytes message signature : Slice Std.U8) : + verify_ed25519_with decoderPrimitive verifierPrimitive bytes message signature decoder verifier = ok (.Ok ()) ↔ + EdAccepts decode equation bytes.val message.val signature.val := by + rw [Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines decoderPrimitive verifierPrimitive decoder verifier + decode equation decodeContract verifyContract bytes message signature] + simp only [Result.ok.injEq, ed_result_ok, ed_accepts_iff] + +theorem p256_source_accepts_iff {T K S : Type} + (primitive : P256Primitive T K S) + (decode : List Std.U8 → Option K) (parse : List Std.U8 → Option S) + (equation : K → List Std.U8 → S → Bool) + (decodeContract : ∀ bytes, primitive.decode bytes = ok (decode bytes.val)) + (parseContract : ∀ array, primitive.parse array = ok (parse array.val)) + (verifyContract : ∀ key message signature, primitive.verify key message signature = + ok (equation key message.val signature)) + (bytes message signature : Slice Std.U8) : + verify_p256_sha256_with primitive bytes message signature = ok (.Ok ()) ↔ + P256Accepts decode parse equation bytes.val message.val signature.val := by + rw [Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines primitive + decode parse equation decodeContract parseContract verifyContract bytes message signature] + simp only [Result.ok.injEq, p256_result_ok, p256_accepts_iff] + +end Auths.Crypto.Strict.SourceAcceptance diff --git a/formal/Auths/Crypto/Strict/SuiteModel.lean b/formal/Auths/Crypto/Strict/SuiteModel.lean new file mode 100644 index 000000000..01e229a12 --- /dev/null +++ b/formal/Auths/Crypto/Strict/SuiteModel.lean @@ -0,0 +1,67 @@ +import Auths.Crypto.Strict.RContract +import Auths.Crypto.Strict.LowContract +import Auths.Crypto.Encoding.P256 +open Aeneas Aeneas.Std Result +namespace Auths.Crypto.Strict.SuiteModel + +def fixed (N : Std.Usize) (bytes : List Std.U8) : Option (Array Std.U8 N) := + if h : bytes.length = N.val then some ⟨bytes, h⟩ else none + +def fixedKey (bytes : List Std.U8) : Option Encoding.Encoded.Input := fixed 32#usize bytes + +def fixedSignature (bytes : List Std.U8) : Option RContract.Input := fixed 64#usize bytes + +inductive Failure where | key | shape | equation + +def keyEncoding (bytes : List Std.U8) : Except Failure Encoding.Encoded.Input := + match fixedKey bytes with + | none => .error .key + | some encoded => if decide (Encoding.Encoded.Encoding encoded) then .ok encoded else .error .key + +def edKey {K : Type} (decode : List Std.U8 → Option K) (bytes : List Std.U8) : Except Failure K := do + let _ ← keyEncoding bytes + match decode bytes with | none => .error .key | some key => .ok key + +def edVerify {K : Type} (decode : List Std.U8 → Option K) + (equation : K → List Std.U8 → List Std.U8 → Bool) + (key message signature : List Std.U8) : Except Failure Unit := do + let encoded ← keyEncoding key + let point ← match decode key with | none => .error .key | some point => .ok point + match fixedSignature signature with + | none => .error .shape + | some signature => + if decide (WeakContract.WeakCoordinate (Encoding.Encoded.ordinate encoded)) || + !decide (RContract.Allowed signature) then .error .equation + else if equation point message signature.val then .ok () else .error .equation + +def p256Key {K : Type} (decode : List Std.U8 → Option K) (bytes : List Std.U8) : Except Failure K := + if decide (Encoding.P256.Encoding (bytes.map UScalar.val)) then + match decode bytes with | none => .error .key | some key => .ok key + else .error .key + +def p256Verify {K S : Type} (decode : List Std.U8 → Option K) (parse : List Std.U8 → Option S) + (equation : K → List Std.U8 → S → Bool) + (key message signature : List Std.U8) : Except Failure Unit := do + let point ← p256Key decode key + match fixedSignature signature with + | none => .error .shape + | some signature => + match parse signature.val with + | none => .error .shape + | some parsed => + if decide (ByteLex.value (signature.val.drop 32) ≤ LowContract.order / 2) && + equation point message parsed then .ok () else .error .equation + +def sourceEdFailure : Failure → auths_signature_core.Ed25519Error + | .key => .InvalidKey | .shape => .InvalidSignatureEncoding | .equation => .VerificationFailed + +def sourceP256Failure : Failure → auths_signature_core.P256Error + | .key => .InvalidKey | .shape => .InvalidSignatureEncoding | .equation => .VerificationFailed + +def sourceEd {A : Type} : Except Failure A → core.result.Result A auths_signature_core.Ed25519Error + | .error error => .Err (sourceEdFailure error) | .ok value => .Ok value + +def sourceP256 {A : Type} : Except Failure A → core.result.Result A auths_signature_core.P256Error + | .error error => .Err (sourceP256Failure error) | .ok value => .Ok value + +end Auths.Crypto.Strict.SuiteModel diff --git a/formal/Auths/Crypto/Strict/SuiteRefinement.lean b/formal/Auths/Crypto/Strict/SuiteRefinement.lean new file mode 100644 index 000000000..b96c1f9ad --- /dev/null +++ b/formal/Auths/Crypto/Strict/SuiteRefinement.lean @@ -0,0 +1,173 @@ +import Auths.Crypto.Strict.SuiteModel +open Aeneas Aeneas.Std Result +open auths_signature_core Auths.Crypto.Strict.SuiteModel +namespace Auths.Crypto.Strict.SuiteRefinement + +theorem fixed_refines (N : Std.Usize) (bytes : Slice Std.U8) : + core.array.TryFromSharedArraySlice.try_from N bytes = + ok (match fixed N bytes.val with | some array => .Ok array | none => .Err ()) := by + unfold core.array.TryFromSharedArraySlice.try_from fixed + have sizes : bytes.len = N ↔ bytes.val.length = N.val := by scalar_tac + by_cases sized : bytes.val.length = N.val + · have words : bytes.len = N := sizes.mpr sized + simp only [words, sized, _root_.dite_true] + · have words : bytes.len ≠ N := fun h => sized (sizes.mp h) + simp only [words, sized, _root_.dite_false] + +theorem owned_fixed_refines (N : Std.Usize) (bytes : Slice Std.U8) : + core.array.TryFromArrayCopySlice.try_from N core.marker.CopyU8 bytes = + ok (match fixed N bytes.val with | some array => .Ok array | none => .Err ()) := by + unfold core.array.TryFromArrayCopySlice.try_from fixed + have sizes : bytes.length = N ↔ bytes.val.length = N.val := by scalar_tac + by_cases sized : bytes.val.length = N.val + · have words : bytes.length = N := sizes.mpr sized + simp only [words, sized, _root_.dite_true] + · have words : bytes.length ≠ N := fun h => sized (sizes.mp h) + simp only [words, sized, _root_.dite_false] + +theorem fixed_value (N : Std.Usize) (bytes : List Std.U8) (array : Array Std.U8 N) + (accepted : fixed N bytes = some array) : array.val = bytes := by + unfold fixed at accepted + split at accepted + · simp only [Option.some.injEq] at accepted + subst array + rfl + · contradiction + +theorem key_encoding_refines (bytes : Slice Std.U8) : + ed25519_key_encoding bytes = ok (sourceEd (keyEncoding bytes.val)) := by + unfold ed25519_key_encoding + rw [fixed_refines] + cases sized : fixed 32#usize bytes.val with + | none => simp [sized, keyEncoding, fixedKey, sourceEd, sourceEdFailure] + | some array => + simp only [bind_tc_ok] + rw [Auths.Crypto.Encoding.Ed25519.guard_refines] + by_cases canonical : Auths.Crypto.Encoding.Encoded.Encoding array <;> + simp [canonical, keyEncoding, fixedKey, sized, sourceEd, sourceEdFailure] + +theorem key_encoding_value (bytes : List Std.U8) (array : Auths.Crypto.Encoding.Encoded.Input) + (accepted : keyEncoding bytes = .ok array) : array.val = bytes := by + unfold keyEncoding at accepted + cases sized : fixedKey bytes with + | none => simp [sized] at accepted + | some raw => + simp only [sized] at accepted + split at accepted + · simp only [Except.ok.injEq] at accepted + subst array + exact fixed_value 32#usize bytes raw sized + · contradiction + +theorem decode_ed25519_refines {K D : Type} + (primitive : core.ops.function.FnOnce D (Array Std.U8 32#usize) (Option K)) + (decoder : D) (decode : List Std.U8 → Option K) + (contract : ∀ array, primitive.call_once decoder array = ok (decode array.val)) + (bytes : Slice Std.U8) : + decode_ed25519_key_with primitive bytes decoder = ok (sourceEd (edKey decode bytes.val)) := by + unfold decode_ed25519_key_with + rw [key_encoding_refines] + cases encoded : keyEncoding bytes.val with + | error reason => + simp [encoded, sourceEd, edKey, Except.bind, Bind.bind, Except.instMonad, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from] + | ok raw => + have exactBytes := key_encoding_value bytes.val raw encoded + simp only [encoded, sourceEd, bind_tc_ok, core.result.Result.Insts.CoreOpsTry.branch] + rw [contract] + cases decoded : decode bytes.val <;> + simp [exactBytes, decoded, encoded, edKey, sourceEd, sourceEdFailure, Except.bind, Bind.bind, Except.instMonad] + +theorem decode_p256_refines {T K S : Type} + (primitive : P256Primitive T K S) (decode : List Std.U8 → Option K) + (contract : ∀ bytes, primitive.decode bytes = ok (decode bytes.val)) + (bytes : Slice Std.U8) : + decode_p256_key_with primitive bytes = ok (sourceP256 (p256Key decode bytes.val)) := by + unfold decode_p256_key_with + rw [Auths.Crypto.Encoding.P256.guard_refines] + simp only [bind_tc_ok] + rw [contract] + by_cases canonical : Auths.Crypto.Encoding.P256.Encoding (bytes.val.map UScalar.val) + · cases decoded : decode bytes.val <;> simp [canonical, decoded, p256Key, sourceP256, sourceP256Failure] + · simp [canonical, p256Key, sourceP256, sourceP256Failure] + +theorem verify_ed25519_refines {K D V : Type} + (decoderPrimitive : core.ops.function.FnOnce D (Array Std.U8 32#usize) (Option K)) + (verifierPrimitive : core.ops.function.FnOnce V (K × Slice Std.U8 × Array Std.U8 64#usize) Bool) + (decoder : D) (verifier : V) (decode : List Std.U8 → Option K) + (equation : K → List Std.U8 → List Std.U8 → Bool) + (decodeContract : ∀ array, decoderPrimitive.call_once decoder array = ok (decode array.val)) + (verifyContract : ∀ key message signature, verifierPrimitive.call_once verifier (key, message, signature) = + ok (equation key message.val signature.val)) + (bytes message signature : Slice Std.U8) : + verify_ed25519_with decoderPrimitive verifierPrimitive bytes message signature decoder verifier = + ok (sourceEd (edVerify decode equation bytes.val message.val signature.val)) := by + unfold verify_ed25519_with + rw [key_encoding_refines] + cases encoded : keyEncoding bytes.val with + | error reason => + simp [encoded, sourceEd, edVerify, Except.bind, Bind.bind, Except.instMonad, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from] + | ok raw => + have exactBytes := key_encoding_value bytes.val raw encoded + simp only [sourceEd, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + rw [decodeContract] + simp only [exactBytes] + cases decoded : decode bytes.val with + | none => simp [edVerify, encoded, decoded, sourceEd, sourceEdFailure, Except.bind, Bind.bind, Except.instMonad] + | some point => + simp only [bind_tc_ok] + rw [fixed_refines] + cases sized : fixed 64#usize signature.val with + | none => simp [edVerify, encoded, decoded, fixedSignature, sized, sourceEd, sourceEdFailure, Except.bind, Bind.bind, Except.instMonad] + | some array => + simp only [bind_tc_ok] + rw [WeakContract.guard_refines, RContract.guard_refines, verifyContract] + by_cases weak : WeakContract.WeakCoordinate (Encoding.Encoded.ordinate raw) <;> + by_cases allowed : RContract.Allowed array <;> + cases checked : equation point message.val array.val <;> + simp [weak, allowed, checked, edVerify, encoded, decoded, fixedSignature, sized, + sourceEd, sourceEdFailure, Except.bind, Bind.bind, Except.instMonad] + +theorem verify_p256_refines {T K S : Type} + (primitive : P256Primitive T K S) + (decode : List Std.U8 → Option K) (parse : List Std.U8 → Option S) + (equation : K → List Std.U8 → S → Bool) + (decodeContract : ∀ bytes, primitive.decode bytes = ok (decode bytes.val)) + (parseContract : ∀ array, primitive.parse array = ok (parse array.val)) + (verifyContract : ∀ key message signature, primitive.verify key message signature = + ok (equation key message.val signature)) + (bytes message signature : Slice Std.U8) : + verify_p256_sha256_with primitive bytes message signature = + ok (sourceP256 (p256Verify decode parse equation bytes.val message.val signature.val)) := by + unfold verify_p256_sha256_with + rw [decode_p256_refines primitive decode decodeContract] + cases decoded : p256Key decode bytes.val with + | error reason => + simp [sourceP256, decoded, p256Verify, Except.bind, Bind.bind, Except.instMonad, + core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from] + | ok point => + simp only [sourceP256, core.result.Result.Insts.CoreOpsTry.branch, bind_tc_ok] + rw [owned_fixed_refines] + cases sized : fixed 64#usize signature.val with + | none => simp [p256Verify, decoded, fixedSignature, sized, sourceP256, sourceP256Failure, Except.bind, Bind.bind, Except.instMonad] + | some array => + simp only [bind_tc_ok] + rw [parseContract] + cases parsed : parse array.val with + | none => simp [p256Verify, decoded, fixedSignature, sized, parsed, sourceP256, sourceP256Failure, Except.bind, Bind.bind, Except.instMonad] + | some scalar => + simp only [bind_tc_ok] + rw [LowContract.guard_refines, verifyContract] + by_cases low : ByteLex.value (array.val.drop 32) ≤ LowContract.order / 2 <;> + cases verified : equation point message.val scalar <;> + simp [low, verified, parsed, p256Verify, decoded, fixedSignature, sized, + sourceP256, sourceP256Failure, Except.bind, Bind.bind, Except.instMonad] + +end Auths.Crypto.Strict.SuiteRefinement diff --git a/formal/Auths/Crypto/Strict/WeakContract.lean b/formal/Auths/Crypto/Strict/WeakContract.lean new file mode 100644 index 000000000..0d3ae1ea9 --- /dev/null +++ b/formal/Auths/Crypto/Strict/WeakContract.lean @@ -0,0 +1,47 @@ +import qualification.aeneas.generated.signature.Funs +import Auths.Crypto.Strict.CoordinateContract +open Aeneas Aeneas.Std Result +open Auths.Crypto.Encoding.Encoded +namespace Auths.Crypto.WeakContract + +def orderEightY : Nat := 55188659117513257062467267217118295137698188065244968500265048394206261417927 + +def WeakCoordinate (ordinate : Nat) : Prop := + ordinate = 0 ∨ ordinate = 1 ∨ ordinate = Encoding.Coordinate.prime - 1 ∨ + ordinate = orderEightY ∨ ordinate = Encoding.Coordinate.prime - orderEightY + +instance (ordinate : Nat) : Decidable (WeakCoordinate ordinate) := inferInstanceAs + (Decidable (ordinate = 0 ∨ ordinate = 1 ∨ ordinate = Encoding.Coordinate.prime - 1 ∨ + ordinate = orderEightY ∨ ordinate = Encoding.Coordinate.prime - orderEightY)) + +theorem zero_value : ordinate auths_signature_core.ED25519_WEAK_ZERO = 0 := by + unfold ordinate first middle topValue last auths_signature_core.ED25519_WEAK_ZERO + decide + +theorem one_value : ordinate auths_signature_core.ED25519_WEAK_ONE = 1 := by + unfold ordinate first middle topValue last auths_signature_core.ED25519_WEAK_ONE + decide + +theorem minus_one_value : ordinate auths_signature_core.ED25519_WEAK_MINUS_ONE = Encoding.Coordinate.prime - 1 := by + unfold ordinate first middle topValue last auths_signature_core.ED25519_WEAK_MINUS_ONE Encoding.Coordinate.prime + decide + +theorem order_eight_a_value : ordinate auths_signature_core.ED25519_WEAK_ORDER_EIGHT_A = orderEightY := by + unfold ordinate first middle topValue last auths_signature_core.ED25519_WEAK_ORDER_EIGHT_A orderEightY + decide + +theorem order_eight_b_value : ordinate auths_signature_core.ED25519_WEAK_ORDER_EIGHT_B = Encoding.Coordinate.prime - orderEightY := by + unfold ordinate first middle topValue last auths_signature_core.ED25519_WEAK_ORDER_EIGHT_B Encoding.Coordinate.prime orderEightY + decide + +theorem guard_refines (input : Input) : + auths_signature_core.ed25519_has_small_order_coordinate input = ok (decide (WeakCoordinate (ordinate input))) := by + unfold auths_signature_core.ed25519_has_small_order_coordinate + simp only [CoordinateContract.guard_refines, zero_value, one_value, minus_one_value, + order_eight_a_value, order_eight_b_value, bind_tc_ok] + by_cases zero : ordinate input = 0 <;> by_cases one : ordinate input = 1 <;> + by_cases minusOne : ordinate input = Encoding.Coordinate.prime - 1 <;> + by_cases firstEight : ordinate input = orderEightY <;> + simp [zero, one, minusOne, firstEight, WeakCoordinate] + +end Auths.Crypto.WeakContract diff --git a/formal/Auths/Crypto/SuiteAdapterExamples.lean b/formal/Auths/Crypto/SuiteAdapterExamples.lean new file mode 100644 index 000000000..7b06e3d11 --- /dev/null +++ b/formal/Auths/Crypto/SuiteAdapterExamples.lean @@ -0,0 +1,54 @@ +import Auths.Crypto.SuiteAdapters +import Auths.Crypto.NativeExamples +import Auths.Crypto.P256Examples +import Lean.Elab.Tactic.Cbv +open Aeneas Aeneas.Std Result +open AuthsSuiteAdapters +set_option cbv.warning false +set_option maxRecDepth 4096 +set_option maxHeartbeats 2000000 +namespace Auths.Crypto.SuiteAdapterExamples + +-- Literal private-ID carriers match the constructors' installed identifiers. +-- These witnesses do not claim constructor or registry-selection refinement. +def edSuite : Ed25519Suite := ⟨⟨[101#u8,100#u8,50#u8,53#u8,53#u8,49#u8,57#u8,45#u8,118#u8,49#u8], by scalar_tac⟩⟩ +def p256Suite : P256Sha256Suite := ⟨⟨[112#u8,50#u8,53#u8,54#u8,45#u8,115#u8,104#u8,97#u8,50#u8,53#u8,54#u8,45#u8,118#u8,49#u8], by scalar_tac⟩⟩ + +def edInput : auths_ports.SignatureInput := + ⟨NativeExamples.key, NativeExamples.message, NativeExamples.signature⟩ +def edChanged : auths_ports.SignatureInput := + ⟨NativeExamples.key, NativeExamples.changedMessage, NativeExamples.signature⟩ +def p256Input : auths_ports.SignatureInput := + ⟨P256Examples.key, P256Examples.message, P256Examples.signature⟩ +def p256Changed : auths_ports.SignatureInput := + ⟨P256Examples.key, P256Examples.changedMessage, P256Examples.signature⟩ + +theorem ed_exact_fields_admitted : + Ed25519Suite.Insts.Auths_portsSignatureSuite.verify + (edPrimitive := NativeExamples.forwardingPrimitive) edSuite edInput = ok (.Ok ()) := by + rw [SuiteAdapters.ed_public_refines (P := NativeExamples.forwardingPrimitive) + (fun _ => some ()) id NativeExamples.equation NativeExamples.forwarding_contract] + cbv + +theorem ed_changed_message_refused : + Ed25519Suite.Insts.Auths_portsSignatureSuite.verify + (edPrimitive := NativeExamples.forwardingPrimitive) edSuite edChanged = ok (.Err .InvalidSignature) := by + rw [SuiteAdapters.ed_public_refines (P := NativeExamples.forwardingPrimitive) + (fun _ => some ()) id NativeExamples.equation NativeExamples.forwarding_contract] + cbv + +theorem p256_exact_fields_admitted : + P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify + (p256Primitive := P256Examples.forwardingPrimitive) p256Suite p256Input = ok (.Ok ()) := by + rw [SuiteAdapters.p256_public_refines (P := P256Examples.forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) P256Examples.equation P256Examples.forwarding_contract] + cbv + +theorem p256_changed_message_refused : + P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify + (p256Primitive := P256Examples.forwardingPrimitive) p256Suite p256Changed = ok (.Err .InvalidSignature) := by + rw [SuiteAdapters.p256_public_refines (P := P256Examples.forwardingPrimitive) + (fun bytes => some bytes) (fun bytes => some bytes) P256Examples.equation P256Examples.forwarding_contract] + cbv + +end Auths.Crypto.SuiteAdapterExamples diff --git a/formal/Auths/Crypto/SuiteAdapters.lean b/formal/Auths/Crypto/SuiteAdapters.lean new file mode 100644 index 000000000..f28abef96 --- /dev/null +++ b/formal/Auths/Crypto/SuiteAdapters.lean @@ -0,0 +1,86 @@ +import qualification.aeneas.generated.suite_adapter.Funs +import Auths.Crypto.NativeContract +import Auths.Crypto.P256Native +open Aeneas Aeneas.Std Result +open AuthsSuiteAdapters +open Auths.Crypto.Strict.SuiteModel +namespace Auths.Crypto.SuiteAdapters + +def portFailure : Failure → auths_ports.SignatureError + | .key => .InvalidKey | .shape => .InvalidSignatureEncoding | .equation => .InvalidSignature + +def portResult : Except Failure Unit → Aeneas.Std.core.result.Result Unit auths_ports.SignatureError + | .ok value => .Ok value | .error reason => .Err (portFailure reason) + +theorem ed_public_refines [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Native.Ed25519Contract decode signatureValue equation) + (suite : Ed25519Suite) (input : auths_ports.SignatureInput) : + Ed25519Suite.Insts.Auths_portsSignatureSuite.verify (edPrimitive := P) suite input = + ok (portResult (edVerify decode equation input.verification_key.val + input.signing_preimage.val input.signature.val)) := by + unfold Ed25519Suite.Insts.Auths_portsSignatureSuite.verify + AuthsSuiteAdapters.auths_signature_core.verify_ed25519 + rw [Native.public_verify_refines decode signatureValue equation contract] + cases result : edVerify decode equation input.verification_key.val input.signing_preimage.val input.signature.val with + | error reason => + cases reason <;> simp [edResult, fromEdError, sourceEd, sourceEdFailure, portResult, portFailure, + AuthsSuiteAdapters.core.result.Result.map_err, _root_.core.result.Result.map_err, + SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError.call_once] + | ok value => + cases value + simp [edResult, sourceEd, portResult, AuthsSuiteAdapters.core.result.Result.map_err, + _root_.core.result.Result.map_err] + +theorem p256_public_refines [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : P256Native.Contract decode parse equation) + (suite : P256Sha256Suite) (input : auths_ports.SignatureInput) : + P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify (p256Primitive := P) suite input = + ok (portResult (p256Verify decode parse equation input.verification_key.val + input.signing_preimage.val input.signature.val)) := by + unfold P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify + AuthsSuiteAdapters.auths_signature_core.verify_p256_sha256 + rw [P256Native.public_verify_refines decode parse equation contract] + cases result : p256Verify decode parse equation input.verification_key.val input.signing_preimage.val input.signature.val with + | error reason => + cases reason <;> simp [p256Result, fromP256Error, P256Native.verifyResult, P256Native.failure, + portResult, portFailure, AuthsSuiteAdapters.core.result.Result.map_err, + _root_.core.result.Result.map_err, + SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError.call_once] + | ok value => + cases value + simp [p256Result, P256Native.verifyResult, portResult, + AuthsSuiteAdapters.core.result.Result.map_err, _root_.core.result.Result.map_err] + +theorem port_result_ok (result : Except Failure Unit) : + portResult result = .Ok () ↔ result = .ok () := by + cases result with + | error reason => simp [portResult] + | ok value => cases value; simp [portResult] + +theorem ed_accepts_iff [P : Ed25519Primitives] + (decode : List Std.U8 → Option P.Key) (signatureValue : List Std.U8 → P.Signature) + (equation : P.Key → List Std.U8 → List Std.U8 → Bool) + (contract : Native.Ed25519Contract decode signatureValue equation) + (suite : Ed25519Suite) (input : auths_ports.SignatureInput) : + Ed25519Suite.Insts.Auths_portsSignatureSuite.verify (edPrimitive := P) suite input = ok (.Ok ()) ↔ + Strict.Acceptance.EdAccepts decode equation input.verification_key.val + input.signing_preimage.val input.signature.val := by + rw [ed_public_refines decode signatureValue equation contract] + simp only [Result.ok.injEq, port_result_ok, Strict.Acceptance.ed_accepts_iff] + +theorem p256_accepts_iff [P : P256Primitives] + (decode : List Std.U8 → Option P.Key) (parse : List Std.U8 → Option P.Signature) + (equation : P.Key → List Std.U8 → P.Signature → Bool) + (contract : P256Native.Contract decode parse equation) + (suite : P256Sha256Suite) (input : auths_ports.SignatureInput) : + P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify (p256Primitive := P) suite input = ok (.Ok ()) ↔ + Strict.Acceptance.P256Accepts decode parse equation input.verification_key.val + input.signing_preimage.val input.signature.val := by + rw [p256_public_refines decode parse equation contract] + simp only [Result.ok.injEq, port_result_ok, Strict.Acceptance.p256_accepts_iff] + +end Auths.Crypto.SuiteAdapters diff --git a/formal/Auths/Model/IdentifierSemantics.lean b/formal/Auths/Model/IdentifierSemantics.lean new file mode 100644 index 000000000..f3224e7aa --- /dev/null +++ b/formal/Auths/Model/IdentifierSemantics.lean @@ -0,0 +1,164 @@ +import Std.Tactic +namespace Auths.Model.Identifier +/-- The fixed protocol exclusion set: control scalars and Unicode White_Space. -/ +def excluded (scalar : Nat) : Prop := + scalar ≤ 32 ∨ (127 ≤ scalar ∧ scalar ≤ 160) ∨ scalar = 5760 ∨ + (8192 ≤ scalar ∧ scalar ≤ 8202) ∨ scalar = 8232 ∨ scalar = 8233 ∨ + scalar = 8239 ∨ scalar = 8287 ∨ scalar = 12288 +instance (scalar : Nat) : Decidable (excluded scalar) := inferInstanceAs (Decidable (_ ∨ _)) +/-- Mathematical UTF-8 encoding, independently expressed using scalar digits. -/ +def utf8 (scalar : Nat) : List Nat := + if scalar < 128 then [scalar] + else if scalar < 2048 then [192 + scalar / 64, 128 + scalar % 64] + else if scalar < 65536 then + [224 + scalar / 4096, 128 + scalar / 64 % 64, 128 + scalar % 64] + else [240 + scalar / 262144, 128 + scalar / 4096 % 64, + 128 + scalar / 64 % 64, 128 + scalar % 64] +def excludedPrefix : List Nat → Bool + | [] => false + | first :: rest => + decide (first ≤ 32 ∨ first = 127) || + match rest with + | [] => false + | second :: tail => + decide (first = 194 ∧ 128 ≤ second ∧ second ≤ 160) || + match tail with + | [] => false + | third :: _ => decide ( + (first = 225 ∧ second = 154 ∧ third = 128) ∨ + (first = 226 ∧ + ((second = 128 ∧ + (128 ≤ third ∧ third ≤ 138 ∨ third = 168 ∨ + third = 169 ∨ third = 175)) ∨ + (second = 129 ∧ third = 159))) ∨ + (first = 227 ∧ second = 128 ∧ third = 128)) +/-- Every scalar, including all non-ASCII whitespace, agrees with the byte grammar. -/ +theorem utf8_excluded_exact (scalar : Nat) (bounded : scalar ≤ 1114111) : + excludedPrefix (utf8 scalar) = decide (excluded scalar) := by + unfold utf8 + by_cases one : scalar < 128 + · simp only [if_pos one, excludedPrefix, Bool.or_false] + apply Bool.eq_iff_iff.mpr + simp only [decide_eq_true_eq, excluded] + omega + · by_cases two : scalar < 2048 + · simp only [if_neg one, if_pos two, excludedPrefix, Bool.or_false] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · by_cases three : scalar < 65536 + · simp only [if_neg one, if_neg two, if_pos three, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · simp only [if_neg one, if_neg two, if_neg three, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + +/-- Adding following characters cannot change this scalar's classification. -/ +theorem utf8_excluded_append (scalar : Nat) (bounded : scalar ≤ 1114111) + (tail : List Nat) : + excludedPrefix (utf8 scalar ++ tail) = decide (excluded scalar) := by + cases tail with + | nil => simpa using utf8_excluded_exact scalar bounded + | cons a rest => + cases rest with + | nil => + unfold utf8 + by_cases one : scalar < 128 + · simp only [if_pos one, List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, Bool.false_eq_true, or_false, excluded] + omega + · by_cases two : scalar < 2048 + · simp only [if_neg one, if_pos two, List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · by_cases three : scalar < 65536 + · simp only [if_neg one, if_neg two, if_pos three, + List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · simp only [if_neg one, if_neg two, if_neg three, + List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + | cons b rest => + unfold utf8 + by_cases one : scalar < 128 + · simp only [if_pos one, List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · by_cases two : scalar < 2048 + · simp only [if_neg one, if_pos two, List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · by_cases three : scalar < 65536 + · simp only [if_neg one, if_neg two, if_pos three, + List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + · simp only [if_neg one, if_neg two, if_neg three, + List.cons_append, List.nil_append, excludedPrefix] + apply Bool.eq_iff_iff.mpr + simp only [Bool.or_eq_true, decide_eq_true_eq, excluded] + omega + +/-- Continuation bytes never begin an excluded scalar. -/ +theorem continuation_prefix (first : Nat) (low : 128 ≤ first) (high : first < 192) + (tail : List Nat) : excludedPrefix (first :: tail) = false := by + cases tail with + | nil => simp [excludedPrefix]; omega + | cons second rest => + cases rest with + | nil => simp [excludedPrefix]; omega + | cons third rest => simp [excludedPrefix]; omega + +def containsExcluded : List Nat → Bool + | [] => false + | first :: tail => excludedPrefix (first :: tail) || containsExcluded tail + +/-- Scanning one well-formed scalar consumes at most four bytes and leaves +classification of all later scalars independent. -/ +theorem contains_utf8_append (scalar : Nat) (bounded : scalar ≤ 1114111) + (tail : List Nat) : + containsExcluded (utf8 scalar ++ tail) = + (decide (excluded scalar) || containsExcluded tail) := by + have head := utf8_excluded_append scalar bounded tail + unfold utf8 at head ⊢ + split <;> rename_i one + · simp only [if_pos one, List.cons_append, List.nil_append, containsExcluded] at head ⊢ + rw [head] + · split <;> rename_i two + · simp only [if_neg one, if_pos two, List.cons_append, List.nil_append, containsExcluded] at head ⊢ + simp (disch := omega) only [continuation_prefix, Bool.false_or] + rw [head] + · split <;> rename_i three + · simp only [if_neg one, if_neg two, if_pos three, List.cons_append, List.nil_append, containsExcluded] at head ⊢ + simp (disch := omega) only [continuation_prefix, Bool.false_or] + rw [head] + · simp only [if_neg one, if_neg two, if_neg three, List.cons_append, List.nil_append, containsExcluded] at head ⊢ + simp (disch := omega) only [continuation_prefix, Bool.false_or] + rw [head] + + +/-- Scanning any finite UTF-8 scalar stream rejects exactly the prohibited +scalars; continuation bytes cannot create false matches across boundaries. -/ +theorem contains_encoded_scalars (scalars : List Nat) + (bounded : ∀ scalar ∈ scalars, scalar ≤ 1114111) : + containsExcluded (scalars.flatMap utf8) = + scalars.any (fun scalar => decide (excluded scalar)) := by + induction scalars with + | nil => rfl + | cons scalar rest ih => + rw [List.flatMap_cons, contains_utf8_append scalar (bounded scalar (by simp))] + rw [ih (fun value member => bounded value (by simp [member]))] + rfl +end Auths.Model.Identifier diff --git a/formal/Auths/Model/IdentifierString.lean b/formal/Auths/Model/IdentifierString.lean new file mode 100644 index 000000000..57cfc18c6 --- /dev/null +++ b/formal/Auths/Model/IdentifierString.lean @@ -0,0 +1,46 @@ +import Auths.Model.IdentifierSemantics +import Mathlib.Tactic.SplitIfs +namespace Auths.Model.Identifier + +theorem character_bound (character : Char) : character.toNat ≤ 1114111 := by + have valid := character.valid + change character.val.toNat < 55296 ∨ + 57343 < character.val.toNat ∧ character.val.toNat < 1114112 at valid + change character.val.toNat ≤ 1114111 + omega + +theorem character_encoding (character : Char) : + (String.utf8EncodeChar character).map UInt8.toNat = utf8 character.toNat := by + have bounded := character_bound character + simp only [← Char.toNat_val] at bounded ⊢ + simp only [String.utf8EncodeChar, utf8] + split_ifs <;> simp_all only [List.map_cons, List.map_nil, UInt8.toNat_ofNat', List.cons.injEq] + all_goals simp only [Nat.reducePow, and_true] + all_goals omega + +theorem byte_array_list (bytes : ByteArray) : bytes.toList = bytes.data.toList := by + have loop_eq : ∀ (position : Nat) (accumulator : List UInt8), + ByteArray.toList.loop bytes position accumulator = + accumulator.reverse ++ bytes.data.toList.drop position := by + intro position accumulator + fun_induction ByteArray.toList.loop bytes position accumulator with + | case1 position accumulator within ih => + rw [ih] + have bound : position < bytes.data.toList.length := by simpa using within + rw [List.drop_eq_getElem_cons bound] + simp [List.reverse_cons, List.append_assoc, ByteArray.get!, within] + rfl + | case2 position accumulator atEnd => + have bound : bytes.data.toList.length ≤ position := by simpa using Nat.le_of_not_lt atEnd + simp [List.drop_eq_nil_of_le bound] + simpa only [ByteArray.toList, List.reverse_nil, List.drop_zero, List.nil_append] + using loop_eq 0 [] + +theorem string_encoding (value : String) : + value.toByteArray.toList.map UInt8.toNat = + value.toList.flatMap (fun character => utf8 character.toNat) := by + rw [byte_array_list, ← String.utf8Encode_toList] + simp only [List.utf8Encode, List.toList_data_toByteArray, List.map_flatMap] + simp only [character_encoding] + +end Auths.Model.Identifier diff --git a/formal/Auths/Product/AdmissionExamples.lean b/formal/Auths/Product/AdmissionExamples.lean new file mode 100644 index 000000000..a315d1425 --- /dev/null +++ b/formal/Auths/Product/AdmissionExamples.lean @@ -0,0 +1,55 @@ +import Auths.Product.AdmissionOwnership +namespace Auths.Product.AdmissionHistory.Examples + +def policy : Policy := + {capacity := fun counter => if counter = 0 then 2 else 0, expires := fun _ => 100} +def first : Request := ⟨("operator", "payment-1"), 1, [⟨0, 1⟩]⟩ +def second : Request := ⟨("operator", "payment-2"), 2, [⟨0, 1⟩]⟩ +def third : Request := ⟨("operator", "payment-3"), 3, [⟨0, 1⟩]⟩ + +theorem available_capacity_admits : + (run policy empty [.admission first true]).handles first.operation = some 1 := by + simp [run, step, admit, empty, first, policy, fits, charge, Function.update] + +theorem lost_acknowledgement_preserves_claim : + (run policy empty [.admission first false]).claims first.operation = some 1 := by + simp [run, step, admit, empty, first, policy, fits, charge, Function.update] + +theorem lost_acknowledgement_cannot_enter : + (run policy empty [.admission first false, .writeEntry first.operation 1]).entries = [] := by + simp [run, step, admit, enter, empty, first, policy, fits, charge, Function.update] + +theorem replay_cannot_change_owner : + (run policy empty [.admission first true, + .admission {first with worker := 2, debits := []} true]).claims first.operation = some 1 := by + simp [run, step, admit, empty, first, policy, fits, charge, Function.update] + +theorem two_entries_consume_shared_capacity : + (run policy empty [.admission first true, .writeEntry first.operation 1, + .admission second true, .writeEntry second.operation 2, .admission third true]).historical 0 = 2 := by + simp [run, step, admit, enter, empty, first, second, third, policy, fits, charge, Function.update] + +theorem crash_cannot_refund_capacity : + (run policy empty [.admission first true, .processCrash 1]).historical 0 = 1 := by + simp [run, step, admit, crash, empty, first, policy, fits, charge, Function.update] + +theorem collected_window_cannot_reopen : + (run policy empty [.admission first true, .collection 100, .collection 0, + .admission second true]).claims second.operation = none := by + simp [run, step, admit, collect, empty, first, second, policy, fits, charge, Function.update] + +theorem write_handle_is_one_use : + (run policy empty [.admission first true, .writeEntry first.operation 1, + .writeEntry first.operation 1]).entries = [(first.operation, 1)] := by + simp [run, step, admit, enter, empty, first, policy, fits, charge, Function.update] + +theorem failure_before_commit_can_retry : + (run policy empty [.failedBeforeCommit, .admission first true]).handles first.operation = some 1 := by + simp [run, step, admit, empty, first, policy, fits, charge, Function.update] + +theorem terminal_refusal_retains_claim_without_capacity : + (run policy empty [.terminalRefusal first.operation 1]).claims first.operation = some 1 ∧ + (run policy empty [.terminalRefusal first.operation 1]).historical 0 = 0 := by + simp [run, step, admit, empty, first, policy, fits, charge, Function.update] + +end Auths.Product.AdmissionHistory.Examples diff --git a/formal/Auths/Product/AdmissionHistory.lean b/formal/Auths/Product/AdmissionHistory.lean new file mode 100644 index 000000000..2d35009e2 --- /dev/null +++ b/formal/Auths/Product/AdmissionHistory.lean @@ -0,0 +1,197 @@ +import Mathlib.Tactic + +/-! +Independent finite-history reference for shared fixed-window admission. +It includes commit-before-acknowledgement loss, durable claims, one-use entry, +crashes, read-only recovery and collection fences. Shipping reservation/store +correspondence is a separate obligation; this module is not that refinement. +-/ +namespace Auths.Product.AdmissionHistory + +abbrev Operation := String × String +abbrev Worker := Nat +abbrev Counter := Nat + +structure Debit where + counter : Counter + amount : Nat + deriving DecidableEq + +structure Request where + operation : Operation + worker : Worker + debits : List Debit + +structure Policy where + capacity : Counter → Nat + expires : Counter → Nat + +structure State where + claims : Operation → Option Worker + handles : Operation → Option Worker + entries : List (Operation × Worker) + slots : Counter → Nat + historical : Counter → Nat + collectedThrough : Nat + +/-- Aggregate every duplicate occurrence before comparing with a capacity. -/ +def charge (debits : List Debit) (counter : Counter) : Nat := + (debits.map fun debit => if debit.counter = counter then debit.amount else 0).sum + +def fits (policy : Policy) (state : State) (request : Request) : Bool := + request.debits.all fun debit => + decide (state.slots debit.counter + charge request.debits debit.counter ≤ policy.capacity debit.counter) && + decide (state.collectedThrough < policy.expires debit.counter) + +/-- A lost acknowledgement commits exactly the same durable claim and slots + while granting no volatile execution handle. -/ +def admit (policy : Policy) (state : State) (request : Request) (acknowledged : Bool) : State := + if state.claims request.operation = none ∧ fits policy state request then + {state with + claims := Function.update state.claims request.operation (some request.worker) + handles := Function.update state.handles request.operation + (if acknowledged then some request.worker else none) + slots := fun counter => state.slots counter + charge request.debits counter + historical := fun counter => state.historical counter + charge request.debits counter} + else state + +/-- Collection records its durable monotone fence before any deletion. This + reference collapses deletion prefixes into the final conservative state. -/ +def collect (policy : Policy) (state : State) (cutoff : Nat) : State := + let fence := max state.collectedThrough cutoff + {state with + collectedThrough := fence + slots := fun counter => if policy.expires counter ≤ fence then 0 else state.slots counter} + +def crash (state : State) (worker : Worker) : State := + {state with handles := fun operation => + if state.handles operation = some worker then none else state.handles operation} + +/-- The write-entry event consumes the handle. Connection/deadline/authority + permits must constrain source entry before composing this history model. -/ +def enter (state : State) (operation : Operation) (worker : Worker) : State := + if state.handles operation = some worker then + {state with + handles := Function.update state.handles operation none + entries := state.entries ++ [(operation, worker)]} + else state + +inductive Event where + | admission (request : Request) (acknowledged : Bool) + | collection (cutoff : Nat) + | processCrash (worker : Worker) + | writeEntry (operation : Operation) (worker : Worker) + | readOnlyRecovery + | failedBeforeCommit + | terminalRefusal (operation : Operation) (worker : Worker) + +def step (policy : Policy) (state : State) : Event → State + | .admission request acknowledged => admit policy state request acknowledged + | .collection cutoff => collect policy state cutoff + | .processCrash worker => crash state worker + | .writeEntry operation worker => enter state operation worker + | .readOnlyRecovery => state + | .failedBeforeCommit => state + | .terminalRefusal operation worker => admit policy state ⟨operation, worker, []⟩ false + +def run (policy : Policy) (initial : State) (events : List Event) : State := + events.foldl (step policy) initial + +def empty : State := + {claims := fun _ => none, handles := fun _ => none, entries := [], slots := fun _ => 0, + historical := fun _ => 0, collectedThrough := 0} + +def BudgetInvariant (policy : Policy) (state : State) : Prop := + (∀ counter, state.historical counter ≤ policy.capacity counter) ∧ + ∀ counter, state.collectedThrough < policy.expires counter → + state.slots counter = state.historical counter + +theorem charge_zero_of_absent (debits : List Debit) (counter : Counter) + (absent : ∀ debit ∈ debits, debit.counter ≠ counter) : charge debits counter = 0 := by + induction debits with + | nil => rfl + | cons debit rest ih => + have different := absent debit (by simp) + have tail : ∀ item ∈ rest, item.counter ≠ counter := fun item member => absent item (by simp [member]) + simpa only [charge, List.map_cons, List.sum_cons, if_neg different, Nat.zero_add] using ih tail + +theorem charge_positive_member (debits : List Debit) (counter : Counter) + (positive : 0 < charge debits counter) : ∃ debit ∈ debits, debit.counter = counter := by + by_contra missing + have zero := charge_zero_of_absent debits counter (by simpa using missing) + omega + +theorem fits_aggregate (policy : Policy) (state : State) (request : Request) + (accepted : fits policy state request = true) (counter : Counter) + (positive : 0 < charge request.debits counter) : + state.slots counter + charge request.debits counter ≤ policy.capacity counter ∧ + state.collectedThrough < policy.expires counter := by + obtain ⟨debit, member, same⟩ := charge_positive_member request.debits counter positive + have guard := List.all_eq_true.mp accepted debit member + simpa only [same, Bool.and_eq_true, decide_eq_true_eq] using guard + +theorem admit_preserves_budget (policy : Policy) (state : State) (request : Request) + (acknowledged : Bool) (valid : BudgetInvariant policy state) : + BudgetInvariant policy (admit policy state request acknowledged) := by + unfold admit + split + · rename_i allowed + rcases allowed with ⟨_, fitted⟩ + constructor + · intro counter + by_cases zero : charge request.debits counter = 0 + · simpa [zero] using valid.1 counter + · have guarded := fits_aggregate policy state request fitted counter (by omega) + rw [valid.2 counter guarded.2] at guarded + exact guarded.1 + · intro counter openWindow + simp only + rw [valid.2 counter openWindow] + · exact valid + +theorem collect_preserves_budget (policy : Policy) (state : State) (cutoff : Nat) + (valid : BudgetInvariant policy state) : BudgetInvariant policy (collect policy state cutoff) := by + constructor + · exact valid.1 + · intro counter stillOpen + have priorOpen : state.collectedThrough < policy.expires counter := + lt_of_le_of_lt (Nat.le_max_left _ _) stillOpen + change (if policy.expires counter ≤ max state.collectedThrough cutoff then 0 else state.slots counter) = state.historical counter + have closed : ¬ policy.expires counter ≤ max state.collectedThrough cutoff := by + change max state.collectedThrough cutoff < policy.expires counter at stillOpen + omega + rw [if_neg closed] + exact valid.2 counter priorOpen + +theorem step_preserves_budget (policy : Policy) (state : State) (event : Event) + (valid : BudgetInvariant policy state) : BudgetInvariant policy (step policy state event) := by + cases event with + | admission request acknowledged => exact admit_preserves_budget policy state request acknowledged valid + | collection cutoff => exact collect_preserves_budget policy state cutoff valid + | processCrash worker => exact valid + | writeEntry operation worker => + change BudgetInvariant policy (enter state operation worker) + unfold enter + split <;> exact valid + | readOnlyRecovery => exact valid + | failedBeforeCommit => exact valid + | terminalRefusal operation worker => + exact admit_preserves_budget policy state ⟨operation, worker, []⟩ false valid + +theorem run_preserves_budget (policy : Policy) (events : List Event) (initial : State) + (valid : BudgetInvariant policy initial) : BudgetInvariant policy (run policy initial events) := by + induction events generalizing initial with + | nil => exact valid + | cons event rest ih => + exact ih (step policy initial event) (step_preserves_budget policy initial event valid) + +/-- Arbitrarily many workers and every finite interleaving preserve each + window's historical capacity, including collection and earlier clocks. -/ +theorem every_history_preserves_capacity (policy : Policy) (events : List Event) : + BudgetInvariant policy (run policy empty events) := by + apply run_preserves_budget + constructor + · intro counter; exact Nat.zero_le _ + · intro counter _; rfl + +end Auths.Product.AdmissionHistory diff --git a/formal/Auths/Product/AdmissionOwnership.lean b/formal/Auths/Product/AdmissionOwnership.lean new file mode 100644 index 000000000..18d438396 --- /dev/null +++ b/formal/Auths/Product/AdmissionOwnership.lean @@ -0,0 +1,154 @@ +import Auths.Product.AdmissionHistory +namespace Auths.Product.AdmissionHistory + +structure SingleOwner (state : State) : Prop where + handleClaimed : ∀ operation worker, state.handles operation = some worker → state.claims operation = some worker + pending : ∀ operation worker, state.handles operation = some worker → operation ∉ state.entries.map Prod.fst + unique : (state.entries.map Prod.fst).Nodup + entryClaimed : ∀ entry ∈ state.entries, state.claims entry.1 = some entry.2 + +theorem admitted_claim_stays (policy : Policy) (state : State) (request : Request) + (acknowledged : Bool) (operation : Operation) (worker : Worker) + (known : state.claims operation = some worker) : + (admit policy state request acknowledged).claims operation = some worker := by + unfold admit + split + · rename_i admitted + have different : operation ≠ request.operation := by + intro same + have absent := admitted.1 + rw [← same, known] at absent + contradiction + simp [Function.update, different, known] + · exact known + +theorem admit_preserves_owner (policy : Policy) (state : State) (request : Request) + (acknowledged : Bool) (valid : SingleOwner state) : + SingleOwner (admit policy state request acknowledged) := by + unfold admit + split + · rename_i admitted + have fresh : request.operation ∉ state.entries.map Prod.fst := by + intro member + obtain ⟨entry, included, same⟩ := List.mem_map.mp member + have occupied := valid.entryClaimed entry included + rw [same, admitted.1] at occupied + contradiction + constructor + · intro operation worker handle + by_cases same : operation = request.operation + · subst operation + cases acknowledged with + | false => simp at handle + | true => + have sameWorker : request.worker = worker := by simpa using handle + simp [sameWorker] + · have previous : state.handles operation = some worker := by simpa [Function.update, same] using handle + simpa [Function.update, same] using valid.handleClaimed operation worker previous + · intro operation worker handle + by_cases same : operation = request.operation + · simpa only [same] using fresh + · exact valid.pending operation worker (by simpa [Function.update, same] using handle) + · exact valid.unique + · intro entry included + have previous := valid.entryClaimed entry included + have different : entry.1 ≠ request.operation := by + intro same + rw [same, admitted.1] at previous + contradiction + simpa [Function.update, different] using previous + · exact valid + +theorem enter_preserves_owner (state : State) (operation : Operation) (worker : Worker) + (valid : SingleOwner state) : SingleOwner (enter state operation worker) := by + unfold enter + split + · rename_i handle + have fresh := valid.pending operation worker handle + constructor + · intro other owner present + have different : other ≠ operation := by + intro same; simp [same] at present + exact valid.handleClaimed other owner (by simpa [Function.update, different] using present) + · intro other owner present + have different : other ≠ operation := by + intro same; simp [same] at present + have absent := valid.pending other owner (by simpa [Function.update, different] using present) + simpa [List.map_append, List.mem_append, different] using absent + · simp only [List.map_append, List.map_cons, List.map_nil, List.nodup_append] + refine ⟨valid.unique, by simp, ?_⟩ + intro prior priorMember new newMember equal + have same : new = operation := by simpa using newMember + have priorIsOperation : prior = operation := equal.trans same + exact fresh (priorIsOperation ▸ priorMember) + · intro entry included + rcases List.mem_append.mp included with previous | newEntry + · exact valid.entryClaimed entry previous + · have same := List.mem_singleton.mp newEntry + subst entry + exact valid.handleClaimed operation worker handle + · exact valid + +theorem crash_preserves_owner (state : State) (worker : Worker) (valid : SingleOwner state) : + SingleOwner (crash state worker) := by + constructor + · intro operation owner handle + change (if state.handles operation = some worker then none else state.handles operation) = some owner at handle + split_ifs at handle + exact valid.handleClaimed operation owner handle + · intro operation owner handle + change (if state.handles operation = some worker then none else state.handles operation) = some owner at handle + split_ifs at handle + exact valid.pending operation owner handle + · exact valid.unique + · exact valid.entryClaimed + +theorem step_preserves_owner (policy : Policy) (state : State) (event : Event) + (valid : SingleOwner state) : SingleOwner (step policy state event) := by + cases event with + | admission request acknowledged => exact admit_preserves_owner policy state request acknowledged valid + | collection cutoff => + exact ⟨valid.handleClaimed, valid.pending, valid.unique, valid.entryClaimed⟩ + | processCrash worker => exact crash_preserves_owner state worker valid + | writeEntry operation worker => exact enter_preserves_owner state operation worker valid + | readOnlyRecovery => exact valid + | failedBeforeCommit => exact valid + | terminalRefusal operation worker => + exact admit_preserves_owner policy state ⟨operation, worker, []⟩ false valid + +theorem run_preserves_owner (policy : Policy) (events : List Event) (initial : State) + (valid : SingleOwner initial) : SingleOwner (run policy initial events) := by + induction events generalizing initial with + | nil => exact valid + | cons event rest ih => exact ih _ (step_preserves_owner policy initial event valid) + +theorem claim_has_one_owner (policy : Policy) (events : List Event) : + SingleOwner (run policy empty events) := by + apply run_preserves_owner + constructor + · intros; contradiction + · intros; contradiction + · exact List.nodup_nil + · simp [empty] + +/-- Lost acknowledgements never grant a volatile handle, including on the + successful-commit branch; replay cannot recover that write capability. -/ +theorem unacknowledged_has_no_new_handle (policy : Policy) (state : State) (request : Request) + (valid : SingleOwner state) (fresh : state.claims request.operation = none) : + (admit policy state request false).handles request.operation = none := by + have previous : state.handles request.operation = none := by + cases handle : state.handles request.operation with + | none => rfl + | some worker => + have occupied := valid.handleClaimed request.operation worker handle + rw [fresh] at occupied + contradiction + unfold admit + split + · simp + · exact previous + +theorem recovery_mints_no_handle (policy : Policy) (state : State) : + (step policy state .readOnlyRecovery).handles = state.handles := rfl + +end Auths.Product.AdmissionHistory diff --git a/formal/Auths/Product/BoundedClaimHistory.lean b/formal/Auths/Product/BoundedClaimHistory.lean new file mode 100644 index 000000000..5e56f239f --- /dev/null +++ b/formal/Auths/Product/BoundedClaimHistory.lean @@ -0,0 +1,177 @@ +import Auths.Product.AdmissionOwnership +import Auths.Product.CeilingCount + +/-! +One fixed-window reference history combining the existing chain/partition +policy evaluator with durable logical claims and one-use ownership. Capacities +may differ between arrivals; no globally fixed counter capacity is assumed. +Atomic storage linearization and the shipping reservation driver remain +separate source-correspondence obligations. +-/ +namespace Auths.Product.BoundedClaimHistory +namespace C +export Auths.Product.CeilingCount (CounterKey Arrival Link SumBound Name chainAdmits admitStep + countInvariant sumInvariant countInvariant_preserved sumInvariant_preserved containing containingIn) +end C +namespace O +export Auths.Product.AdmissionHistory (State Policy Operation Worker SingleOwner empty admit crash enter + admit_preserves_owner crash_preserves_owner enter_preserves_owner claim_has_one_owner) +end O + +structure State where + bounds : (C.CounterKey → Nat) × List C.Arrival + ownership : O.State + closed : Bool + +private def ownershipPolicy : O.Policy := ⟨fun _ => 0, fun _ => 0⟩ +private def claim (state : O.State) (operation : O.Operation) (worker : O.Worker) + (acknowledged : Bool) : O.State := + O.admit ownershipPolicy state ⟨operation, worker, []⟩ acknowledged + +/-- Successful reservations charge every chain counter even if the commit's + acknowledgement is lost. Refusals can retain a terminal claim, but give + no handle. An existing logical claim cannot reserve a second time. -/ +def attempt (state : State) (operation : O.Operation) (worker : O.Worker) + (arrival : C.Arrival) (acknowledged : Bool) : State := + if state.ownership.claims operation = none then + if state.closed then + {state with ownership := claim state.ownership operation worker false} + else if C.chainAdmits arrival.facts arrival.value arrival.links state.bounds.1 then + {state with + bounds := C.admitStep state.bounds arrival + ownership := claim state.ownership operation worker acknowledged} + else {state with ownership := claim state.ownership operation worker false} + else state + +inductive Event where + | admission (operation : O.Operation) (worker : O.Worker) (arrival : C.Arrival) (acknowledged : Bool) + | processCrash (worker : O.Worker) + | writeEntry (operation : O.Operation) (worker : O.Worker) + | collection + | readOnlyRecovery + | failedBeforeCommit + +def step (state : State) : Event → State + | .admission operation worker arrival acknowledged => attempt state operation worker arrival acknowledged + | .processCrash worker => {state with ownership := O.crash state.ownership worker} + | .writeEntry operation worker => {state with ownership := O.enter state.ownership operation worker} + | .collection => {state with closed := true} + | .readOnlyRecovery | .failedBeforeCommit => state + +def run (initial : State) (events : List Event) : State := events.foldl step initial + +def initial : State := ⟨(fun _ => 0, []), O.empty, false⟩ + +structure Invariant (state : State) : Prop where + owner : O.SingleOwner state.ownership + counts : ∀ link, C.countInvariant link state.bounds + sums : ∀ (link : C.Link) (bound : C.SumBound), link.2.sum = some bound → ∀ partition, + C.sumInvariant link bound partition state.bounds + +theorem attempt_preserves (state : State) (operation : O.Operation) (worker : O.Worker) + (arrival : C.Arrival) (acknowledged : Bool) (valid : Invariant state) : + Invariant (attempt state operation worker arrival acknowledged) := by + unfold attempt + split + · split + · exact ⟨O.admit_preserves_owner _ _ _ _ valid.owner, valid.counts, valid.sums⟩ + · split + · exact ⟨O.admit_preserves_owner _ _ _ _ valid.owner, + fun link => C.countInvariant_preserved link state.bounds arrival (valid.counts link), + fun link bound carries partition => C.sumInvariant_preserved link carries partition + state.bounds arrival (valid.sums link bound carries partition)⟩ + · exact ⟨O.admit_preserves_owner _ _ _ _ valid.owner, valid.counts, valid.sums⟩ + · exact valid + +theorem step_preserves (state : State) (event : Event) (valid : Invariant state) : + Invariant (step state event) := by + cases event with + | admission operation worker arrival acknowledged => + exact attempt_preserves state operation worker arrival acknowledged valid + | processCrash worker => + exact ⟨O.crash_preserves_owner _ _ valid.owner, valid.counts, valid.sums⟩ + | writeEntry operation worker => + exact ⟨O.enter_preserves_owner _ _ _ valid.owner, valid.counts, valid.sums⟩ + | collection => exact ⟨valid.owner, valid.counts, valid.sums⟩ + | readOnlyRecovery => exact valid + | failedBeforeCommit => exact valid + +theorem run_preserves (events : List Event) (state : State) (valid : Invariant state) : + Invariant (run state events) := by + induction events generalizing state with + | nil => exact valid + | cons event rest ih => exact ih _ (step_preserves state event valid) + +/-- Every finite interleaving preserves one-use claim ownership and the + existing per-link count/ceiling/partition-sum invariants together. This + reference theorem permits different chains and policies on each arrival. -/ +theorem every_history_preserves (events : List Event) : Invariant (run initial events) := by + apply run_preserves + constructor + · exact O.claim_has_one_owner ownershipPolicy [] + · intro link + exact ⟨by simp [initial, C.containing], by simp [initial, C.containing], by simp [initial, C.containing]⟩ + · intro link bound _ partition + exact ⟨by simp [initial, C.containingIn], by simp [initial, C.containingIn]⟩ + +theorem every_history_count_bound (events : List Event) (link : C.Link) : + (C.containing link (run initial events).bounds.2).length ≤ link.2.maxCount := + ((every_history_preserves events).counts link).2.1 + +theorem every_history_sum_bound (events : List Event) (link : C.Link) (bound : C.SumBound) + (carries : link.2.sum = some bound) (partition : C.Name) : + ((C.containingIn link bound partition (run initial events).bounds.2).map Auths.Product.CeilingCount.Arrival.value).sum ≤ bound.limit := + ((every_history_preserves events).sums link bound carries partition).2 + +theorem every_history_one_owner (events : List Event) : + O.SingleOwner (run initial events).ownership := (every_history_preserves events).owner + +theorem replay_preserves_counters (state : State) (operation : O.Operation) (worker : O.Worker) + (arrival : C.Arrival) (acknowledged : Bool) (occupied : state.ownership.claims operation ≠ none) : + (attempt state operation worker arrival acknowledged).bounds = state.bounds := by + simp [attempt, occupied] + +theorem collection_preserves_charges (state : State) : (step state .collection).bounds = state.bounds := rfl + +theorem closed_window_cannot_charge (state : State) (operation : O.Operation) (worker : O.Worker) + (arrival : C.Arrival) (acknowledged : Bool) (closed : state.closed = true) : + (attempt state operation worker arrival acknowledged).bounds = state.bounds := by + by_cases fresh : state.ownership.claims operation = none + · simp only [attempt, fresh, closed, ↓reduceIte] + · simp only [attempt, fresh, ↓reduceIte] + +theorem crash_preserves_charges (state : State) (worker : O.Worker) : + (step state (.processCrash worker)).bounds = state.bounds := rfl + +namespace Examples +private def rootPolicy : Auths.Product.CeilingCount.Policy := + ⟨[1], 5, 60, 2, some ⟨10, none⟩, none⟩ +private def rootLink : C.Link := ([114], rootPolicy) +private def childLink : C.Link := ([99], {rootPolicy with maxCount := 1}) +private def rootArrival : C.Arrival := + ⟨⟨fun _ => some 5, fun _ => none⟩, [rootLink], 5⟩ +private def childArrival : C.Arrival := {rootArrival with links := [rootLink, childLink]} +private def trace : List Event := + [.admission ("operator", "first") 1 rootArrival false, + .processCrash 1, + .admission ("operator", "second") 2 childArrival true, + .admission ("operator", "third") 3 rootArrival true] + +/-- A useful delegated admission succeeds after a lost acknowledgement, + sharing the root's count and sum; the third action is refused. -/ +theorem useful_delegation_shares_capacity : + (run initial trace).bounds.2.length = 2 ∧ + (run initial trace).ownership.handles ("operator", "second") = some 2 ∧ + (run initial trace).ownership.handles ("operator", "third") = none := by + decide + +/-- Read-only recovery cannot turn the first unacknowledged admission into + an entry, while the acknowledged delegate can enter once. -/ +theorem recovery_cannot_reissue_lost_handle : + (run initial (trace ++ [.readOnlyRecovery, .writeEntry ("operator", "first") 1, + .writeEntry ("operator", "second") 2, .writeEntry ("operator", "second") 2])).ownership.entries = + [(("operator", "second"), 2)] := by + decide +end Examples + +end Auths.Product.BoundedClaimHistory diff --git a/formal/Auths/Product/CollectionFence.lean b/formal/Auths/Product/CollectionFence.lean new file mode 100644 index 000000000..6a20a813b --- /dev/null +++ b/formal/Auths/Product/CollectionFence.lean @@ -0,0 +1,107 @@ +import Std.Tactic + +namespace Auths.Product.CollectionFence + +/-- Durable cutoffs advance independently of a worker's wall-clock sample. -/ +def advance (current : Option Nat) (requested : Nat) : Nat := + match current with + | none => requested + | some previous => max previous requested + +/-- No caller-provided assertion substitutes for the stored cutoff. -/ +def openWindow (cutoff : Option Nat) (expiry : Nat) : Prop := + match cutoff with + | none => True + | some collected => collected < expiry + +instance (cutoff : Option Nat) (expiry : Nat) : Decidable (openWindow cutoff expiry) := by + unfold openWindow + split <;> infer_instance + +def NoEarlier (previous next : Option Nat) : Prop := + ∀ cutoff, previous = some cutoff → ∃ later, next = some later ∧ cutoff ≤ later + +theorem noEarlier_refl (cutoff : Option Nat) : NoEarlier cutoff cutoff := by + intro previous equal + exact ⟨previous, equal, Nat.le_refl _⟩ + +theorem noEarlier_trans {first second third : Option Nat} + (left : NoEarlier first second) (right : NoEarlier second third) : + NoEarlier first third := by + intro cutoff equal + obtain ⟨middle, middleEq, firstLe⟩ := left cutoff equal + obtain ⟨last, lastEq, secondLe⟩ := right middle middleEq + exact ⟨last, lastEq, Nat.le_trans firstLe secondLe⟩ + +theorem advance_noEarlier (current : Option Nat) (requested : Nat) : + NoEarlier current (some (advance current requested)) := by + intro previous equal + subst current + exact ⟨_, rfl, Nat.le_max_left previous requested⟩ + +theorem closed_stays_closed {previous next : Option Nat} (expiry : Nat) + (ordered : NoEarlier previous next) (closed : ¬ openWindow previous expiry) : + ¬ openWindow next expiry := by + cases previous with + | none => exact (closed trivial).elim + | some cutoff => + obtain ⟨later, rfl, earlier⟩ := ordered cutoff rfl + simp only [openWindow] at closed ⊢ + omega + +/-- A linearization history permits any number of workers. An admission with +lost acknowledgement still commits; only acknowledged success may mint a +volatile execution handle in the full admission model. Neither outcome can +bypass this atomic cutoff predicate. -/ +inductive Step : Option Nat → Option Nat → Prop where + | collect (current : Option Nat) (requested : Nat) : + Step current (some (advance current requested)) + | admit (current : Option Nat) (worker operation expiry : Nat) + (eligible : openWindow current expiry) (acknowledged : Bool) : Step current current + | sweep (current : Option Nat) (expiry : Nat) + (eligible : ∃ cutoff, current = some cutoff ∧ expiry ≤ cutoff) : Step current current + | crash (current : Option Nat) (worker : Nat) : Step current current + | recover (current : Option Nat) (worker : Nat) : Step current current + +theorem step_noEarlier {previous next : Option Nat} (step : Step previous next) : + NoEarlier previous next := by + cases step with + | collect requested => exact advance_noEarlier _ requested + | admit => exact noEarlier_refl _ + | sweep => exact noEarlier_refl _ + | crash => exact noEarlier_refl _ + | recover => exact noEarlier_refl _ + +inductive History : Option Nat → Option Nat → Prop where + | empty (state : Option Nat) : History state state + | append {first previous next : Option Nat} : + History first previous → Step previous next → History first next + +theorem history_noEarlier {first last : Option Nat} (history : History first last) : + NoEarlier first last := by + induction history with + | empty => exact noEarlier_refl _ + | append _ step ih => exact noEarlier_trans ih (step_noEarlier step) + +/-- Once a cutoff has been published, every later successful admission has an +expiry strictly after it, including across crashes, lost acknowledgements, +partial sweeps, and arbitrarily interleaved workers. -/ +theorem collection_cannot_reopen_window (cutoff expiry : Nat) + {current : Option Nat} (history : History (some cutoff) current) + (admitted : openWindow current expiry) : cutoff < expiry := by + obtain ⟨later, rfl, ordered⟩ := history_noEarlier history cutoff rfl + simp only [openWindow] at admitted + omega + +theorem swept_window_cannot_readmit (cutoff expiry : Nat) + {current : Option Nat} (history : History (some cutoff) current) + (swept : expiry ≤ cutoff) : ¬ openWindow current expiry := by + intro admitted + have := collection_cannot_reopen_window cutoff expiry history admitted + omega + +-- The fence permits useful work in a later window. +theorem later_window_admits (cutoff expiry : Nat) (later : cutoff < expiry) : + openWindow (some cutoff) expiry := later + +end Auths.Product.CollectionFence diff --git a/formal/Auths/Product/ConnectionBytes.lean b/formal/Auths/Product/ConnectionBytes.lean new file mode 100644 index 000000000..0526541d2 --- /dev/null +++ b/formal/Auths/Product/ConnectionBytes.lean @@ -0,0 +1,27 @@ +import Mathlib.Tactic +namespace Auths.Product.ConnectionBytes +abbrev Bytes := List Nat +def lowerHead (value : Nat) : Prop := 97 ≤ value ∧ value ≤ 122 +def lowerTail (value : Nat) : Prop := lowerHead value ∨ (48 ≤ value ∧ value ≤ 57) ∨ value = 45 +def graphic (value : Nat) : Prop := 33 ≤ value ∧ value ≤ 126 +instance (value : Nat) : Decidable (lowerHead value) := by unfold lowerHead; infer_instance +instance (value : Nat) : Decidable (lowerTail value) := by unfold lowerTail; infer_instance +instance (value : Nat) : Decidable (graphic value) := by unfold graphic; infer_instance + +def lowerValid (value : Bytes) (maximum : Nat) : Prop := + value ≠ [] ∧ value.length ≤ maximum ∧ lowerHead value[0]! ∧ ∀ byte ∈ value, lowerTail byte +def graphicValid (value : Bytes) (maximum : Nat) : Prop := + value ≠ [] ∧ value.length ≤ maximum ∧ ∀ byte ∈ value, graphic byte +instance (value : Bytes) (maximum : Nat) : Decidable (lowerValid value maximum) := by unfold lowerValid; infer_instance +instance (value : Bytes) (maximum : Nat) : Decidable (graphicValid value maximum) := by unfold graphicValid; infer_instance + +theorem lower_has_no_nul (value : Bytes) (maximum : Nat) (valid : lowerValid value maximum) : 0 ∉ value := by + intro member + have allowed := valid.2.2.2 0 member + simp [lowerTail, lowerHead] at allowed + +theorem graphic_has_no_nul (value : Bytes) (maximum : Nat) (valid : graphicValid value maximum) : 0 ∉ value := by + intro member + have allowed := valid.2.2 0 member + simp [graphic] at allowed +end Auths.Product.ConnectionBytes diff --git a/formal/Auths/Product/ConnectionBytesRefinement.lean b/formal/Auths/Product/ConnectionBytesRefinement.lean new file mode 100644 index 000000000..1a4c6ae22 --- /dev/null +++ b/formal/Auths/Product/ConnectionBytesRefinement.lean @@ -0,0 +1,206 @@ +import qualification.aeneas.generated.connections.Funs +import Auths.Product.ConnectionBytes +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_connections +namespace Auths.Product.ConnectionBytes.Refinement +set_option maxHeartbeats 4000000 +abbrev bytes (values : List Std.U8) : List Nat := values.map (·.val) + +@[step] theorem lower_tail_exact (byte : Std.U8) : + kernel.lower_tail_valid byte ⦃ actual => actual = decide (lowerTail byte.val) ⦄ := by + unfold kernel.lower_tail_valid + repeat' split + all_goals simp_all only [spec_ok, lowerTail, lowerHead, UScalar.eq_equiv] + all_goals apply Bool.eq_iff_iff.mpr + all_goals simp only [decide_eq_true_eq, true_iff] + all_goals scalar_tac + +@[step] theorem graphic_valid_exact (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.ascii_graphic_valid value maximum ⦃ actual => + actual = decide (graphicValid (bytes value.val) maximum.val) ⦄ := by + unfold kernel.ascii_graphic_valid + step as ⟨empty, emptyMeaning⟩ + cases empty + · simp only [Bool.false_eq_true, ↓reduceIte] + have nonempty : value.val ≠ [] := by simpa [Slice.length] using emptyMeaning.symm + split <;> rename_i exceeds + · simp only [spec_ok] + have tooLarge : maximum.val < value.val.length := by simpa using exceeds + simp [graphicValid, bytes, tooLarge.not_ge] + · have fits : value.val.length ≤ maximum.val := by simpa using exceeds + unfold kernel.ascii_graphic_valid_loop + apply loop.spec_decr_nat + (measure := fun index => value.val.length - index.val) + (inv := fun index => index.val ≤ value.val.length ∧ ∀ byte ∈ value.val.take index.val, graphic byte.val) + · intro index processed + unfold kernel.ascii_graphic_valid_loop.body + dsimp only + split <;> rename_i within + · have inside : index.val < value.val.length := by simpa using within + step as ⟨byte, byteAt⟩ + split <;> rename_i low + · simp only [spec_ok] + have invalid : ¬ graphicValid (bytes value.val) maximum.val := by + intro valid + have member : byte.val ∈ bytes value.val := by apply List.mem_map.mpr; exact ⟨byte, by rw [byteAt]; exact List.getElem_mem inside, rfl⟩ + have bound := valid.2.2 byte.val member + unfold graphic at bound + scalar_tac + simp [invalid] + · split <;> rename_i high + · simp only [spec_ok] + have invalid : ¬ graphicValid (bytes value.val) maximum.val := by + intro valid + have member : byte.val ∈ bytes value.val := by apply List.mem_map.mpr; exact ⟨byte, by rw [byteAt]; exact List.getElem_mem inside, rfl⟩ + have bound := valid.2.2 byte.val member + unfold graphic at bound + scalar_tac + simp [invalid] + · step as ⟨next, nextEq⟩ + refine ⟨by omega, ?_, by omega⟩ + rw [nextEq, List.take_succ_eq_append_getElem inside] + simp only [List.mem_append, List.mem_cons, List.not_mem_nil, or_false] + intro current member + rcases member with earlier | rfl + · exact processed.2 current earlier + · rw [← byteAt] + unfold graphic + scalar_tac + · simp only [spec_ok] + have atEnd : value.val.length ≤ index.val := by simpa using within + have complete : ∀ byte ∈ value.val, graphic byte.val := by simpa only [List.take_of_length_le atEnd] using processed.2 + have valid : graphicValid (bytes value.val) maximum.val := by + refine ⟨by simpa using nonempty, by simpa using fits, ?_⟩ + intro byte member + obtain ⟨native, nativeMember, rfl⟩ := List.mem_map.mp member + exact complete native nativeMember + simp [valid] + · exact ⟨by simp, by simp⟩ + · simp only [↓reduceIte, spec_ok] + have emptyList : value.val = [] := by simpa [Slice.length] using emptyMeaning.symm + simp [graphicValid, bytes, emptyList] + +@[step] theorem lower_valid_exact (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.lower_token_valid value maximum ⦃ actual => + actual = decide (lowerValid (bytes value.val) maximum.val) ⦄ := by + unfold kernel.lower_token_valid + step as ⟨empty, emptyMeaning⟩ + cases empty + · simp only [Bool.false_eq_true, ↓reduceIte] + have nonempty : value.val ≠ [] := by simpa [Slice.length] using emptyMeaning.symm + have firstInside : 0 < value.val.length := List.length_pos_iff.mpr nonempty + split <;> rename_i exceeds + · simp only [spec_ok] + have tooLarge : maximum.val < value.val.length := by simpa using exceeds + simp [lowerValid, bytes, tooLarge.not_ge] + · have fits : value.val.length ≤ maximum.val := by simpa using exceeds + step as ⟨first, firstMeaning⟩ + have firstAt : (bytes value.val)[0]! = first.val := by + rw [getElem!_pos (bytes value.val) 0 (by simpa using firstInside)] + simp [bytes, ← firstMeaning] + split <;> rename_i low + · simp only [spec_ok] + have invalid : ¬ lowerValid (bytes value.val) maximum.val := by + intro valid + have bound := valid.2.2.1 + rw [firstAt] at bound + unfold lowerHead at bound + scalar_tac + simp [invalid] + · split <;> rename_i high + · simp only [spec_ok] + have invalid : ¬ lowerValid (bytes value.val) maximum.val := by + intro valid + have bound := valid.2.2.1 + rw [firstAt] at bound + unfold lowerHead at bound + scalar_tac + simp [invalid] + · have firstValid : lowerHead (bytes value.val)[0]! := by + rw [firstAt] + unfold lowerHead + scalar_tac + unfold kernel.lower_token_valid_loop + apply loop.spec_decr_nat + (measure := fun index => value.val.length - index.val) + (inv := fun index => index.val ≤ value.val.length ∧ ∀ byte ∈ value.val.take index.val, lowerTail byte.val) + · intro index processed + unfold kernel.lower_token_valid_loop.body + dsimp only + split <;> rename_i within + · have inside : index.val < value.val.length := by simpa using within + step as ⟨byte, byteAt⟩ + step with lower_tail_exact as ⟨allowed, allowedMeaning⟩ + cases allowed + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have invalid : ¬ lowerValid (bytes value.val) maximum.val := by + intro valid + have member : byte.val ∈ bytes value.val := by + apply List.mem_map.mpr + exact ⟨byte, by rw [byteAt]; exact List.getElem_mem inside, rfl⟩ + have bound := valid.2.2.2 byte.val member + simp [bound] at allowedMeaning + simp [invalid] + · simp only [↓reduceIte] + step as ⟨next, nextEq⟩ + have permitted : lowerTail byte.val := by simpa using allowedMeaning.symm + refine ⟨by omega, ?_, by omega⟩ + rw [nextEq, List.take_succ_eq_append_getElem inside] + simp only [List.mem_append, List.mem_cons, List.not_mem_nil, or_false] + intro current member + rcases member with earlier | rfl + · exact processed.2 current earlier + · simpa only [← byteAt] using permitted + · simp only [spec_ok] + have atEnd : value.val.length ≤ index.val := by simpa using within + have complete : ∀ byte ∈ value.val, lowerTail byte.val := by + simpa only [List.take_of_length_le atEnd] using processed.2 + have valid : lowerValid (bytes value.val) maximum.val := by + refine ⟨by simpa using nonempty, by simpa using fits, firstValid, ?_⟩ + intro byte member + obtain ⟨native, nativeMember, rfl⟩ := List.mem_map.mp member + exact complete native nativeMember + simp [valid] + · exact ⟨by simp, by simp⟩ + · simp only [↓reduceIte, spec_ok] + have emptyList : value.val = [] := by simpa [Slice.length] using emptyMeaning.symm + simp [lowerValid, bytes, emptyList] + + +theorem source_lower_earns_no_nul (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.lower_token_valid value maximum ⦃ actual => actual = true → 0 ∉ bytes value.val ⦄ := by + step with lower_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have valid : lowerValid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact lower_has_no_nul _ _ valid + +theorem source_graphic_earns_no_nul (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.ascii_graphic_valid value maximum ⦃ actual => actual = true → 0 ∉ bytes value.val ⦄ := by + step with graphic_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have valid : graphicValid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact graphic_has_no_nul _ _ valid + +theorem source_lower_earns_size_bound (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.lower_token_valid value maximum ⦃ actual => actual = true → + value.val ≠ [] ∧ value.val.length ≤ maximum.val ⦄ := by + step with lower_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have valid : lowerValid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact ⟨by simpa using valid.1, by simpa using valid.2.1⟩ + +theorem source_graphic_earns_size_bound (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.ascii_graphic_valid value maximum ⦃ actual => actual = true → + value.val ≠ [] ∧ value.val.length ≤ maximum.val ⦄ := by + step with graphic_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have valid : graphicValid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact ⟨by simpa using valid.1, by simpa using valid.2.1⟩ +end Auths.Product.ConnectionBytes.Refinement + + diff --git a/formal/Auths/Product/ConnectionEntry.lean b/formal/Auths/Product/ConnectionEntry.lean new file mode 100644 index 000000000..41bd946ab --- /dev/null +++ b/formal/Auths/Product/ConnectionEntry.lean @@ -0,0 +1,26 @@ +import Auths.Product.SchemaIndex +import Mathlib.Tactic +namespace Auths.Product.ConnectionEntry +inductive State where | active | disabled | revoked + deriving DecidableEq +structure Profile where + id : List Nat + version : Nat + deriving DecidableEq + +def valid (state : State) (workloads : List (List Nat)) (profiles : List Profile) + (workload : List Nat) (profile : Profile) : Prop := + state = .active ∧ workload ∈ workloads ∧ profile ∈ profiles +instance (state : State) (workloads : List (List Nat)) (profiles : List Profile) + (workload : List Nat) (profile : Profile) : Decidable (valid state workloads profiles workload profile) := by + unfold valid + infer_instance + +def allows (state : State) (workloads : List (List Nat)) (profiles : List Profile) + (workload : List Nat) (profile : Profile) : Bool := decide (valid state workloads profiles workload profile) + +theorem admitted_binds_all (state : State) (workloads : List (List Nat)) (profiles : List Profile) + (workload : List Nat) (profile : Profile) (accepted : allows state workloads profiles workload profile = true) : + state = .active ∧ workload ∈ workloads ∧ profile ∈ profiles := by + simpa [allows, valid] using accepted +end Auths.Product.ConnectionEntry diff --git a/formal/Auths/Product/ConnectionEntryRefinement.lean b/formal/Auths/Product/ConnectionEntryRefinement.lean new file mode 100644 index 000000000..ab850b42e --- /dev/null +++ b/formal/Auths/Product/ConnectionEntryRefinement.lean @@ -0,0 +1,141 @@ +import Auths.Product.ConnectionEntry +import Auths.Product.Refinement.SchemaIndex +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_gateway_kernel +open Auths.Product.Refinement.ByteIdentity +open Auths.Product.SchemaIndex.Refinement +namespace Auths.Product.ConnectionEntry.Refinement +set_option maxHeartbeats 4000000 +abbrev bytes (values : List Std.U8) : List Nat := values.map (·.val) +theorem bytes_injective (left right : List Std.U8) : bytes left = bytes right ↔ left = right := + Auths.Product.Refinement.Gateway.byteList_inj +def profileView (value : entry_authorization.EntryProfile) : Profile := + ⟨bytes value.id.val, value.version.val⟩ +def profilesView (values : Slice entry_authorization.EntryProfile) : List Profile := values.val.map profileView + +def stateView : entry_authorization.EntryState → State + | .Active => .active + | .Disabled => .disabled + | .Revoked => .revoked + +@[step] theorem profile_allowed_exact (profiles : Slice entry_authorization.EntryProfile) + (requested : entry_authorization.EntryProfile) : + entry_authorization.profile_allowed profiles requested ⦃ actual => + actual = decide (profileView requested ∈ profilesView profiles) ⦄ := by + unfold entry_authorization.profile_allowed entry_authorization.profile_allowed_loop + apply loop.spec_decr_nat + (measure := fun index => profiles.val.length - index.val) + (inv := fun index => index.val ≤ profiles.val.length ∧ + ∀ position, position < index.val → (profilesView profiles)[position]? ≠ some (profileView requested)) + · intro index processed + unfold entry_authorization.profile_allowed_loop.body + dsimp only + split <;> rename_i within + · have inside : index.val < profiles.val.length := by simpa using within + step as ⟨profile, profileAt⟩ + have atModel : (profilesView profiles)[index.val]? = some (profileView profile) := by + simp [profilesView, List.getElem?_map, List.getElem?_eq_getElem inside, profileAt] + split <;> rename_i versionEq + · step with field_name_equal_exact as ⟨sameId, idMeaning⟩ + cases sameId + · simp only [Bool.false_eq_true, ↓reduceIte] + step as ⟨next, nextEq⟩ + refine ⟨by omega, ?_, by omega⟩ + intro position before + by_cases earlier : position < index.val + · exact processed.2 position earlier + · have current : position = index.val := by omega + subst position + rw [atModel] + intro same + have ids := congrArg Profile.id (Option.some.inj same) + have equalIds := (bytes_injective _ _).mp ids + simp [alloc.vec.Vec.deref, equalIds] at idMeaning + · simp only [↓reduceIte, spec_ok] + have same : profileView profile = profileView requested := by + have equalIds : profile.id.val = requested.id.val := by simpa [alloc.vec.Vec.deref] using idMeaning.symm + have equalVersions : profile.version.val = requested.version.val := congrArg UScalar.val versionEq + simp [profileView, equalIds, equalVersions] + have member : profileView requested ∈ profilesView profiles := + List.mem_iff_getElem?.mpr ⟨index.val, by simpa [same] using atModel⟩ + simp [member] + · step as ⟨next, nextEq⟩ + refine ⟨by omega, ?_, by omega⟩ + intro position before + by_cases earlier : position < index.val + · exact processed.2 position earlier + · have current : position = index.val := by omega + subst position + rw [atModel] + intro same + have versions := congrArg Profile.version (Option.some.inj same) + have nativeSame : profile.version = requested.version := (UScalar.eq_equiv _ _).mpr versions + exact versionEq nativeSame + · simp only [spec_ok] + have atEnd : profiles.val.length ≤ index.val := by simpa using within + have absent : profileView requested ∉ profilesView profiles := by + intro member + obtain ⟨position, atPosition⟩ := List.mem_iff_getElem?.mp member + have inside : position < (profilesView profiles).length := (List.getElem?_eq_some_iff.mp atPosition).1 + have before : position < index.val := by simpa only [profilesView, List.length_map] using (show position < profiles.val.length by simpa [profilesView] using inside) |> fun bound => lt_of_lt_of_le bound atEnd + exact processed.2 position before atPosition + simp [absent] + · exact ⟨by simp, by simp⟩ + + +@[step] theorem entry_allows_exact (state : entry_authorization.EntryState) + (workloads : Slice (alloc.vec.Vec Std.U8)) (profiles : Slice entry_authorization.EntryProfile) + (workload : Slice Std.U8) (profile : entry_authorization.EntryProfile) : + entry_authorization.entry_allows state workloads profiles workload profile ⦃ actual => + actual = allows (stateView state) (namesView workloads) (profilesView profiles) + (bytes workload.val) (profileView profile) ⦄ := by + cases hstate : state with + | Disabled => simp [entry_authorization.entry_allows, allows, valid, stateView] + | Revoked => simp [entry_authorization.entry_allows, allows, valid, stateView] + | Active => + unfold entry_authorization.entry_allows + dsimp only + step with field_index_spec as ⟨position, positionMeaning⟩ + cases position with + | none => + simp only [spec_ok] + have absent : bytes workload.val ∉ namesView workloads := + (SchemaIndex.absent_iff _ _).mp positionMeaning.symm + simp [allows, valid, stateView, absent] + | some index => + have atIndex := SchemaIndex.position_points_to_name _ _ index.val positionMeaning.symm + have member : bytes workload.val ∈ namesView workloads := + List.mem_iff_getElem?.mpr ⟨index.val, atIndex⟩ + step with profile_allowed_exact as ⟨actual, profileMeaning⟩ + simpa [allows, valid, stateView, member] using profileMeaning + + +theorem source_entry_requires_active_workload_profile (state : entry_authorization.EntryState) + (workloads : Slice (alloc.vec.Vec Std.U8)) (profiles : Slice entry_authorization.EntryProfile) + (workload : Slice Std.U8) (profile : entry_authorization.EntryProfile) : + entry_authorization.entry_allows state workloads profiles workload profile ⦃ actual => + actual = true → stateView state = .active ∧ bytes workload.val ∈ namesView workloads ∧ + profileView profile ∈ profilesView profiles ⦄ := by + step with entry_allows_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + exact admitted_binds_all _ _ _ _ _ exactMeaning.symm + +theorem source_disabled_refused (workloads : Slice (alloc.vec.Vec Std.U8)) + (profiles : Slice entry_authorization.EntryProfile) (workload : Slice Std.U8) + (profile : entry_authorization.EntryProfile) : + entry_authorization.entry_allows .Disabled workloads profiles workload profile ⦃ actual => actual = false ⦄ := by + step with entry_allows_exact as ⟨actual, exactMeaning⟩ + simpa [allows, valid, stateView] using exactMeaning + +theorem source_revoked_refused (workloads : Slice (alloc.vec.Vec Std.U8)) + (profiles : Slice entry_authorization.EntryProfile) (workload : Slice Std.U8) + (profile : entry_authorization.EntryProfile) : + entry_authorization.entry_allows .Revoked workloads profiles workload profile ⦃ actual => actual = false ⦄ := by + step with entry_allows_exact as ⟨actual, exactMeaning⟩ + simpa [allows, valid, stateView] using exactMeaning + +end Auths.Product.ConnectionEntry.Refinement + + diff --git a/formal/Auths/Product/ConnectionFrame.lean b/formal/Auths/Product/ConnectionFrame.lean new file mode 100644 index 000000000..34d513789 --- /dev/null +++ b/formal/Auths/Product/ConnectionFrame.lean @@ -0,0 +1,41 @@ +import Auths.Product.OperationIdentity +import Auths.Product.ConnectionBytes +namespace Auths.Product.ConnectionFrame +abbrev Bytes := List Nat +def domain : Bytes := [97,117,116,104,115,46,103,97,116,101,119,97,121,45,99,111,110,110,101,99,116,105,111,110,47,49,0] +structure Key where + provider : Bytes + aliasBytes : Bytes + deriving DecidableEq + +def preimage (key : Key) : Bytes := domain ++ (key.provider ++ 0 :: key.aliasBytes) + +theorem preimage_injective (left right : Key) + (leftNulFree : 0 ∉ left.provider) (rightNulFree : 0 ∉ right.provider) + (same : preimage left = preimage right) : left = right := by + have framed : left.provider ++ 0 :: left.aliasBytes = right.provider ++ 0 :: right.aliasBytes := by + apply List.append_cancel_left (as := domain) + exact same + have providers := congrArg (List.takeWhile (fun byte => byte != 0)) framed + have lf : OperationIdentity.NulFree left.provider := by + intro byte member zero + subst byte + exact leftNulFree member + have rf : OperationIdentity.NulFree right.provider := by + intro byte member zero + subst byte + exact rightNulFree member + rw [OperationIdentity.before_separator _ _ lf, OperationIdentity.before_separator _ _ rf] at providers + obtain ⟨_, tails⟩ := List.append_inj framed (congrArg List.length providers) + have aliasByteses := (List.cons.inj tails).2 + cases left; cases right + simp_all + +theorem validated_names_bind_both_fields (left right : Key) + (leftValid : ConnectionBytes.lowerValid left.provider 64) + (rightValid : ConnectionBytes.lowerValid right.provider 64) + (same : preimage left = preimage right) : left = right := by + exact preimage_injective left right + (ConnectionBytes.lower_has_no_nul _ _ leftValid) + (ConnectionBytes.lower_has_no_nul _ _ rightValid) same +end Auths.Product.ConnectionFrame diff --git a/formal/Auths/Product/ConnectionFrameRefinement.lean b/formal/Auths/Product/ConnectionFrameRefinement.lean new file mode 100644 index 000000000..92b71b69f --- /dev/null +++ b/formal/Auths/Product/ConnectionFrameRefinement.lean @@ -0,0 +1,36 @@ +import qualification.aeneas.generated.gateway.Funs +import Auths.Product.ConnectionFrame +import Auths.Product.Refinement.Gateway +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.ConnectionFrame.Refinement +open Auths.Product.Refinement.Gateway +@[step] theorem connection_preimage_exact (provider aliasBytes : Slice Std.U8) + (providerBound : provider.val.length ≤ 64) (aliasBytesBound : aliasBytes.val.length ≤ 64) : + identity.connection_record_preimage provider aliasBytes ⦃ output => + vecBytes output = ConnectionFrame.preimage ⟨sliceBytes provider, sliceBytes aliasBytes⟩ ⦄ := by + unfold identity.connection_record_preimage + simp only [lift, bind_tc_ok] + apply spec_bind (copy_bytes_spec _ (by decide)) + intro prefixValue prefixEq + apply spec_bind (append_bytes_spec _ _ (by simp only [prefixEq]; change 27 + provider.val.length < 4294967295; omega)) + intro withNamespace namespaceEq + have pushBound : withNamespace.val.length < Usize.max := by + apply lt_usize_max + simp only [namespaceEq, List.length_append, prefixEq] + change 27 + provider.val.length < 4294967295 + omega + apply spec_bind (alloc.vec.Vec.push_spec _ _ pushBound) + intro separated separatorEq + apply spec_mono (append_bytes_spec _ _ (by + simp only [separatorEq, List.length_append, List.length_singleton, namespaceEq, prefixEq] + change 27 + provider.val.length + 1 + aliasBytes.val.length < 4294967295 + omega)) + intro output outputEq + simp only [vecBytes, byteList, ConnectionFrame.preimage, ConnectionFrame.domain, + outputEq, separatorEq, namespaceEq, prefixEq, List.map_append, List.map_cons, + List.map_nil, UScalar.ofNatCore_val_eq, List.append_assoc, sliceBytes] + rfl + +end Auths.Product.ConnectionFrame.Refinement diff --git a/formal/Auths/Product/CounterAggregation.lean b/formal/Auths/Product/CounterAggregation.lean new file mode 100644 index 000000000..2c1f74914 --- /dev/null +++ b/formal/Auths/Product/CounterAggregation.lean @@ -0,0 +1,180 @@ +import Mathlib.Tactic +import Auths.Product.SchemaIndex +namespace Auths.Product.CounterAggregation +abbrev Key := List Nat +structure Counter where + key : Key + capacity : Nat + deriving DecidableEq + +def lookup : List Counter → Key → Option Nat + | [], _ => none + | first :: rest, key => if first.key = key then some first.capacity else lookup rest key + +def contribute : List Counter → Key → Nat → List Counter + | [], key, capacity => [⟨key, capacity⟩] + | first :: rest, key, capacity => + if first.key = key then ⟨key, min first.capacity capacity⟩ :: rest + else first :: contribute rest key capacity + +def tighten (previous : Option Nat) (capacity : Nat) : Option Nat := + some (match previous with | none => capacity | some old => min old capacity) + +/-- Lookup of every key agrees with an independent pointwise minimum update. -/ +theorem lookup_contribute (counters : List Counter) (key : Key) (capacity : Nat) (wanted : Key) : + lookup (contribute counters key capacity) wanted = + if wanted = key then tighten (lookup counters wanted) capacity else lookup counters wanted := by + induction counters with + | nil => + by_cases same : wanted = key + · subst wanted; simp [contribute, lookup, tighten] + · simp [contribute, lookup, tighten, same, Ne.symm same] + | cons first rest ih => + by_cases selected : first.key = key + · by_cases same : wanted = key + · subst wanted; simp [contribute, lookup, selected, tighten] + · have different : first.key ≠ wanted := by intro equal; exact same (equal.symm.trans selected) + simp [contribute, lookup, selected, same, different, Ne.symm same] + · by_cases same : first.key = wanted + · have different : wanted ≠ key := by intro equal; exact selected (same.trans equal) + simp [contribute, lookup, selected, same, different] + · simp [contribute, lookup, selected, same, ih] + +theorem contribute_keys (counters : List Counter) (key : Key) (capacity : Nat) : + (contribute counters key capacity).map Counter.key = + if key ∈ counters.map Counter.key then counters.map Counter.key else counters.map Counter.key ++ [key] := by + induction counters with + | nil => simp [contribute] + | cons first rest ih => + by_cases selected : first.key = key + · simp [contribute, selected, eq_comm] + · simp [contribute, selected, ih, Ne.symm selected] + split <;> rfl + +theorem contribute_unique (counters : List Counter) (key : Key) (capacity : Nat) + (unique : (counters.map Counter.key).Nodup) : + ((contribute counters key capacity).map Counter.key).Nodup := by + rw [contribute_keys] + split + · exact unique + · exact List.nodup_append'.mpr ⟨unique, by simp, + List.disjoint_singleton.mpr (by assumption)⟩ + +/-- The structural update agrees with a first-match indexed update. -/ +theorem contribute_at (counters : List Counter) (key : Key) (capacity index : Nat) (old : Counter) + (found : SchemaIndex.position (counters.map Counter.key) key = some index) + (atIndex : counters[index]? = some old) : + contribute counters key capacity = counters.set index {old with capacity := min old.capacity capacity} := by + induction counters generalizing index with + | nil => simp at atIndex + | cons first rest ih => + by_cases selected : first.key = key + · simp [SchemaIndex.position, selected] at found + subst index + simp at atIndex + subst old + simp [contribute, selected] + · cases index with + | zero => + simp [SchemaIndex.position, selected] at found + | succ index => + have tailFound : SchemaIndex.position (rest.map Counter.key) key = some index := by + simpa [SchemaIndex.position, selected] using found + have tailAt : rest[index]? = some old := by simpa using atIndex + simp [contribute, selected, ih index tailFound tailAt] + +theorem contribute_absent (counters : List Counter) (key : Key) (capacity : Nat) + (absent : SchemaIndex.position (counters.map Counter.key) key = none) : + contribute counters key capacity = counters ++ [⟨key, capacity⟩] := by + induction counters with + | nil => rfl + | cons first rest ih => + have different : first.key ≠ key := by intro same; simp [SchemaIndex.position, same] at absent + have tailAbsent : SchemaIndex.position (rest.map Counter.key) key = none := by + simpa [SchemaIndex.position, different] using absent + simp [contribute, different, ih tailAbsent] + +/-- Indexed first-match selection and recursive lookup agree, including duplicates. -/ +theorem lookup_at (counters : List Counter) (key : Key) (index : Nat) (entry : Counter) + (found : SchemaIndex.position (counters.map Counter.key) key = some index) + (atIndex : counters[index]? = some entry) : lookup counters key = some entry.capacity := by + induction counters generalizing index with + | nil => simp at atIndex + | cons first rest ih => + by_cases selected : first.key = key + · simp [SchemaIndex.position, selected] at found + subst index + simp at atIndex + subst entry + simp [lookup, selected] + · cases index with + | zero => simp [SchemaIndex.position, selected] at found + | succ index => + have tailFound : SchemaIndex.position (rest.map Counter.key) key = some index := by + simpa [SchemaIndex.position, selected] using found + have tailAt : rest[index]? = some entry := by simpa using atIndex + simpa [lookup, selected] using ih index tailFound tailAt + +theorem lookup_absent (counters : List Counter) (key : Key) + (absent : SchemaIndex.position (counters.map Counter.key) key = none) : lookup counters key = none := by + induction counters with + | nil => rfl + | cons first rest ih => + have different : first.key ≠ key := by intro same; simp [SchemaIndex.position, same] at absent + have tailAbsent : SchemaIndex.position (rest.map Counter.key) key = none := by + simpa [SchemaIndex.position, different] using absent + simp [lookup, different, ih tailAbsent] + +/-- Arbitrary finite contributions always share a key's smallest limit. -/ +def aggregate : List Counter → List Counter → List Counter + | state, [] => state + | state, first :: rest => aggregate (contribute state first.key first.capacity) rest + +def specification : (Key → Option Nat) → List Counter → Key → Option Nat + | state, [], wanted => state wanted + | state, first :: rest, wanted => + specification (fun key => if key = first.key then tighten (state key) first.capacity else state key) rest wanted + +theorem aggregate_exact (state contributions : List Counter) (wanted : Key) : + lookup (aggregate state contributions) wanted = specification (lookup state) contributions wanted := by + induction contributions generalizing state with + | nil => rfl + | cons first rest ih => + simp only [aggregate, specification, ih] + congr 1 + funext key + exact lookup_contribute state first.key first.capacity key + +theorem aggregate_unique (state contributions : List Counter) + (unique : (state.map Counter.key).Nodup) : + ((aggregate state contributions).map Counter.key).Nodup := by + induction contributions generalizing state with + | nil => exact unique + | cons first rest ih => exact ih _ (contribute_unique state first.key first.capacity unique) +theorem contribute_length_le (counters : List Counter) (key : Key) (capacity : Nat) : + (contribute counters key capacity).length ≤ counters.length + 1 := by + have lengths := congrArg List.length (contribute_keys counters key capacity) + by_cases present : key ∈ counters.map Counter.key <;> simp [present] at lengths <;> omega + +theorem aggregate_append (state first rest : List Counter) : + aggregate state (first ++ rest) = aggregate (aggregate state first) rest := by + induction first generalizing state with + | nil => rfl + | cons head tail ih => simpa only [List.cons_append, aggregate] using ih (contribute state head.key head.capacity) + +theorem aggregate_snoc (state first : List Counter) (next : Counter) : + aggregate state (first ++ [next]) = contribute (aggregate state first) next.key next.capacity := by + rw [aggregate_append] + rfl + +theorem aggregate_length_le (state incoming : List Counter) : + (aggregate state incoming).length ≤ state.length + incoming.length := by + induction incoming generalizing state with + | nil => simp [aggregate] + | cons first rest ih => + have next := ih (contribute state first.key first.capacity) + have lengthBound := contribute_length_le state first.key first.capacity + simp only [aggregate, List.length_cons] + omega + +end Auths.Product.CounterAggregation diff --git a/formal/Auths/Product/CounterAggregationRefinement.lean b/formal/Auths/Product/CounterAggregationRefinement.lean new file mode 100644 index 000000000..96b3d6815 --- /dev/null +++ b/formal/Auths/Product/CounterAggregationRefinement.lean @@ -0,0 +1,240 @@ +import qualification.aeneas.generated.gateway.Funs +import Auths.Product.CounterAggregation +import Auths.Product.SchemaIndex +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.CounterAggregation.Refinement +set_option maxHeartbeats 4000000 + +@[step] theorem counter_equal_spec (left right : Array Std.U8 32#usize) : + counter_aggregation.counter_equal left right ⦃ actual => actual = decide (left.val = right.val) ⦄ := by + unfold counter_aggregation.counter_equal counter_aggregation.counter_equal_loop + have leftSize : left.val.length = 32 := by simpa using left.property + have rightSize : right.val.length = 32 := by simpa using right.property + apply loop.spec_decr_nat + (measure := fun position => 32 - position.val) + (inv := fun position => position.val ≤ 32 ∧ left.val.take position.val = right.val.take position.val) + · intro position processed + unfold counter_aggregation.counter_equal_loop.body + split <;> rename_i within + · have inside : position.val < 32 := by simpa using within + step as ⟨leftByte, leftAt⟩ + step as ⟨rightByte, rightAt⟩ + split <;> rename_i equal + · simp only [spec_ok] + have different : left.val ≠ right.val := by + intro same + have sameAt := congrArg (fun values : List Std.U8 => values[position.val]?) same + rw [List.getElem?_eq_getElem (l := left.val) (i := position.val) (by omega), + List.getElem?_eq_getElem (l := right.val) (i := position.val) (by omega)] at sameAt + have sameByte : leftByte = rightByte := by + simpa only [← leftAt, ← rightAt, Option.some.injEq] using sameAt + simpa [sameByte] using equal + simp [different] + · step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + have sameByte : leftByte = rightByte := (UScalar.eq_equiv _ _).mpr (by simpa using equal) + rw [nextValue, List.take_succ_eq_append_getElem (by omega), List.take_succ_eq_append_getElem (by omega)] + simp only [← leftAt, ← rightAt, processed.2, sameByte] + · simp only [spec_ok] + have atEnd : 32 ≤ position.val := by simpa using within + have leftDone : left.val.take position.val = left.val := List.take_of_length_le (by omega) + have rightDone : right.val.take position.val = right.val := List.take_of_length_le (by omega) + have same : left.val = right.val := by simpa only [leftDone, rightDone] using processed.2 + simp [same] + · exact ⟨by simp, by simp⟩ + +def counterKeys (counters : Slice counter_aggregation.CounterCapacity) : List SchemaIndex.Name := + counters.val.map (fun counter => counter.key.val.map (·.val)) + +theorem byteList_injective (left right : List Std.U8) : left.map (·.val) = right.map (·.val) ↔ left = right := by + constructor + · intro same + induction left generalizing right with + | nil => cases right <;> simp_all + | cons head tail ih => + cases right with + | nil => simp at same + | cons other rest => + simp only [List.map_cons, List.cons.injEq] at same + rw [(UScalar.eq_equiv _ _).mpr same.1, ih rest same.2] + · intro same; rw [same] + +@[step] theorem counter_position_spec (counters : Slice counter_aggregation.CounterCapacity) (key : Array Std.U8 32#usize) : + counter_aggregation.counter_position counters key ⦃ actual => + actual.map UScalar.val = SchemaIndex.position (counterKeys counters) (key.val.map (·.val)) ⦄ := by + unfold counter_aggregation.counter_position counter_aggregation.counter_position_loop + apply loop.spec_decr_nat + (measure := fun position => counters.val.length - position.val) + (inv := fun position => position.val ≤ counters.val.length ∧ + ∀ index, index < position.val → (counterKeys counters)[index]? ≠ some (key.val.map (·.val))) + · intro position processed + unfold counter_aggregation.counter_position_loop.body + dsimp only + split <;> rename_i within + · have inside : position.val < counters.val.length := by simpa using within + step as ⟨counter, counterAt⟩ + step with counter_equal_spec as ⟨same, sameMeaning⟩ + cases same + · simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + intro index before + by_cases earlier : index < position.val + · exact processed.2 index earlier + · have atCurrent : index = position.val := by omega + subst index + simp_all [counterKeys, List.getElem?_map] + exact sameMeaning ∘ (byteList_injective _ _).mp + · simp only [↓reduceIte, spec_ok] + symm + apply SchemaIndex.position_eq_first + · simp_all [counterKeys, List.getElem?_map] + · exact processed.2 + · simp only [spec_ok] + symm + apply (SchemaIndex.absent_iff _ _).mpr + intro member + obtain ⟨index, atIndex⟩ := List.mem_iff_getElem?.mp member + have inside : index < (counterKeys counters).length := (List.getElem?_eq_some_iff.mp atIndex).1 + have atEnd : counters.val.length ≤ position.val := by simpa using within + have length : (counterKeys counters).length = counters.val.length := by simp [counterKeys] + exact processed.2 index (by omega) atIndex + · exact ⟨by simp, by simp⟩ +def counterView (counter : counter_aggregation.CounterCapacity) : CounterAggregation.Counter := + ⟨counter.key.val.map (·.val), counter.capacity.val⟩ + +def countersView (counters : alloc.vec.Vec counter_aggregation.CounterCapacity) : List CounterAggregation.Counter := + counters.val.map counterView + +/-- The actual keyed update preserves the independent minimum-capacity map. -/ +@[step] theorem contribute_spec (counters : alloc.vec.Vec counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) (capacity : Std.U64) + (fits : counters.val.length < 4294967295) : + counter_aggregation.contribute counters key capacity ⦃ actual => + countersView actual = CounterAggregation.contribute (countersView counters) (key.val.map (·.val)) capacity.val ⦄ := by + unfold counter_aggregation.contribute + step with counter_position_spec as ⟨position, positionMeaning⟩ + have positioned : position.map UScalar.val = + SchemaIndex.position ((countersView counters).map Counter.key) (key.val.map (·.val)) := by + simpa [counterKeys, countersView, counterView, alloc.vec.Vec.deref, List.map_map, Function.comp_def] using positionMeaning + cases position with + | none => + simp only [bind_tc_ok] + have room : counters.length < Usize.max := by + rcases Usize.bounds_eq with equal | equal <;> rw [equal] <;> + simp only [U32.max_eq, U64.max_eq] <;> change counters.val.length < _ <;> omega + step as ⟨actual, actualMeaning⟩ + rw [CounterAggregation.contribute_absent _ _ _ positioned.symm] + simp [countersView, actualMeaning, counterView, List.map_append] + | some index => + simp only [Option.map_some] at positioned + have keyAt := SchemaIndex.position_points_to_name _ _ index.val positioned.symm + have inside : index.val < counters.val.length := by + have lengthBound := (List.getElem?_eq_some_iff.mp keyAt).1 + simpa [countersView, List.length_map] using lengthBound + step as ⟨old, oldAt⟩ + have modelAt : (countersView counters)[index.val]? = some (counterView old) := by + simp [countersView, List.getElem?_map, List.getElem?_eq_getElem inside, oldAt] + have update := CounterAggregation.contribute_at _ _ capacity.val index.val (counterView old) positioned.symm modelAt + rw [update] + split <;> rename_i tighter + · step as ⟨mutable, restore, mutableAt, restoreMeaning⟩ + have same : mutable = old := mutableAt.trans oldAt.symm + subst mutable + have tight : capacity.val < old.capacity.val := by simpa using tighter + simp [restoreMeaning, countersView, counterView, List.map_set, Nat.min_eq_right (Nat.le_of_lt tight), same] + · simp only [spec_ok] + have kept : old.capacity.val ≤ capacity.val := by simpa using tighter + have same : {counterView old with capacity := min (counterView old).capacity capacity.val} = counterView old := by + simp [counterView, Nat.min_eq_left kept] + rw [same] + have modelInside : index.val < (countersView counters).length := by simpa [countersView] using inside + have actualAt : (countersView counters)[index.val] = counterView old := by + simpa only [List.getElem?_eq_getElem modelInside, Option.some.injEq] using modelAt + rw [← actualAt, List.set_getElem_self] + +/-- The complete native loop implements every contribution in order. Its size + bound is the admitted gateway chain limit, not a uniqueness assumption. -/ +@[step] theorem aggregate_spec (contributions : Slice counter_aggregation.CounterCapacity) + (bounded : contributions.val.length ≤ 16) : + counter_aggregation.aggregate contributions ⦃ actual => + countersView actual = CounterAggregation.aggregate [] (contributions.val.map counterView) ⦄ := by + unfold counter_aggregation.aggregate counter_aggregation.aggregate_loop + apply loop.spec_decr_nat + (measure := fun state => contributions.val.length - state.2.val) + (inv := fun state => state.1.val.length ≤ state.2.val ∧ state.2.val ≤ contributions.val.length ∧ + countersView state.1 = CounterAggregation.aggregate [] ((contributions.val.take state.2.val).map counterView)) + · rintro ⟨current, index⟩ ⟨currentSize, indexBound, currentMeaning⟩ + dsimp only at currentSize indexBound currentMeaning + unfold counter_aggregation.aggregate_loop.body + dsimp only + split <;> rename_i within + · have inside : index.val < contributions.val.length := by simpa using within + step as ⟨entry, entryAt⟩ + step with contribute_spec as ⟨updated, updatedMeaning⟩ + have updatedSize : updated.val.length ≤ current.val.length + 1 := by + have modelBound := CounterAggregation.contribute_length_le (countersView current) (entry.key.val.map (·.val)) entry.capacity.val + have exactSize := congrArg List.length updatedMeaning + simp only [countersView, List.length_map] at exactSize modelBound + omega + step as ⟨next, nextValue⟩ + have nextNat : next.val = index.val + 1 := by simpa using nextValue + refine ⟨by omega, by omega, ?_, by omega⟩ + rw [updatedMeaning, currentMeaning, nextValue, + List.take_succ_eq_append_getElem inside, List.map_append, List.map_cons, List.map_nil, + CounterAggregation.aggregate_snoc] + simp only [← entryAt, counterView] + · simp only [spec_ok] + have atEnd : contributions.val.length ≤ index.val := by simpa using within + simpa only [List.take_of_length_le atEnd] using currentMeaning + · simp [countersView, CounterAggregation.aggregate] + +theorem source_aggregate_unique (contributions : Slice counter_aggregation.CounterCapacity) + (bounded : contributions.val.length ≤ 16) : + counter_aggregation.aggregate contributions ⦃ actual => + ((countersView actual).map Counter.key).Nodup ⦄ := by + apply spec_mono (aggregate_spec contributions bounded) + intro actual exactResult + rw [exactResult] + exact CounterAggregation.aggregate_unique [] _ (by simp) + +theorem source_aggregate_capacities (contributions : Slice counter_aggregation.CounterCapacity) + (bounded : contributions.val.length ≤ 16) : + counter_aggregation.aggregate contributions ⦃ actual => + ∀ key, CounterAggregation.lookup (countersView actual) key = + CounterAggregation.specification (fun _ => none) (contributions.val.map counterView) key ⦄ := by + apply spec_mono (aggregate_spec contributions bounded) + intro actual exactResult key + rw [exactResult, CounterAggregation.aggregate_exact] + rfl + +/-- Sum-slot bounds read exactly the first count-key capacity, with zero for absence. -/ +@[step] theorem count_capacity_spec (counters : Slice counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) : + counter_aggregation.count_capacity counters key ⦃ actual => + actual.val = (CounterAggregation.lookup (counters.val.map counterView) (key.val.map (·.val))).getD 0 ⦄ := by + unfold counter_aggregation.count_capacity + step with counter_position_spec as ⟨position, positionMeaning⟩ + have positioned : position.map UScalar.val = + SchemaIndex.position ((counters.val.map counterView).map Counter.key) (key.val.map (·.val)) := by + simpa [counterKeys, counterView, List.map_map, Function.comp_def] using positionMeaning + cases position with + | none => + simp only [spec_ok] + rw [CounterAggregation.lookup_absent _ _ positioned.symm] + rfl + | some index => + simp only [Option.map_some] at positioned + have keyAt := SchemaIndex.position_points_to_name _ _ index.val positioned.symm + have inside : index.val < counters.val.length := by + have lengthBound := (List.getElem?_eq_some_iff.mp keyAt).1 + simpa using lengthBound + step as ⟨entry, entryAt⟩ + have modelAt : (counters.val.map counterView)[index.val]? = some (counterView entry) := by + simp [List.getElem?_map, List.getElem?_eq_getElem inside, entryAt] + rw [CounterAggregation.lookup_at _ _ _ _ positioned.symm modelAt] + rfl + +end Auths.Product.CounterAggregation.Refinement diff --git a/formal/Auths/Product/CounterFrames.lean b/formal/Auths/Product/CounterFrames.lean new file mode 100644 index 000000000..18e3122eb --- /dev/null +++ b/formal/Auths/Product/CounterFrames.lean @@ -0,0 +1,142 @@ +import Auths.Crypto.Framing +import Mathlib.Tactic +open Auths.Codec +namespace Auths.Product.CounterFrames +abbrev Bytes := List Nat + +def fields : List Bytes → Bytes + | [] => [] + | value :: rest => bigEndian 8 value.length ++ value ++ fields rest + +def Bounded (values : List Bytes) : Prop := ∀ value ∈ values, value.length < 2 ^ 64 + +/-- Fixed field counts let the consumer separate the framed fields from the + fixed-width final words, including empty components and embedded NUL. -/ +theorem fields_cancel (left right : List Bytes) (leftTail rightTail : Bytes) + (count : left.length = right.length) (leftBound : Bounded left) (rightBound : Bounded right) + (same : fields left ++ leftTail = fields right ++ rightTail) : + left = right ∧ leftTail = rightTail := by + induction left generalizing right with + | nil => + have empty : right = [] := List.length_eq_zero_iff.mp count.symm + subst right + exact ⟨rfl, by simpa [fields] using same⟩ + | cons first rest ih => + cases right with + | nil => simp at count + | cons next tail => + have firstBound := leftBound first (by simp) + have nextBound := rightBound next (by simp) + have framing : bigEndian 8 first.length ++ (first ++ (fields rest ++ leftTail)) = + bigEndian 8 next.length ++ (next ++ (fields tail ++ rightTail)) := by + simpa only [fields, List.append_assoc] using same + obtain ⟨lengthBytes, remaining⟩ := List.append_inj framing (by simp [bigEndian_length]) + have sizes := Auths.Crypto.Framing.endian_injective 8 _ _ firstBound nextBound lengthBytes + obtain ⟨exactFirst, suffix⟩ := List.append_inj remaining sizes + have leftRest : Bounded rest := fun value member => leftBound value (by simp [member]) + have rightRest : Bounded tail := fun value member => rightBound value (by simp [member]) + obtain ⟨exactRest, exactTail⟩ := ih tail (by simpa using count) leftRest rightRest suffix + exact ⟨by simp [exactFirst, exactRest], exactTail⟩ + +inductive Kind where + | count | sum + deriving DecidableEq + +-- UTF-8 bytes of the registered tags, including their final NUL. +def domain : Kind → Bytes + | .count => [97,117,116,104,115,46,103,97,116,101,119,97,121,45,98,111,117,110,100,101,100,45,99,111,117,110,116,47,50,0] + | .sum => [97,117,116,104,115,46,103,97,116,101,119,97,121,45,98,111,117,110,100,101,100,45,115,117,109,47,49,0] + +structure Counter where + kind : Kind + components : List Bytes + window : Nat + index : Nat + deriving DecidableEq + +def Counter.Valid (value : Counter) : Prop := + value.components.length = (if value.kind = .count then 3 else 4) ∧ + Bounded value.components ∧ value.window < 2 ^ 64 ∧ value.index < 2 ^ 64 + +def encode (value : Counter) : Bytes := + domain value.kind ++ fields value.components ++ bigEndian 8 value.window ++ bigEndian 8 value.index + +/-- Exact bytes, rather than any collision-free hash assumption, bind every + counter component and both fixed-window coordinates. -/ +theorem encode_injective (left right : Counter) (leftValid : left.Valid) (rightValid : right.Valid) + (same : encode left = encode right) : left = right := by + have kind : left.kind = right.kind := by + cases leftKind : left.kind <;> cases rightKind : right.kind + · rfl + · simp [encode, domain, leftKind, rightKind, List.append_assoc] at same + · simp [encode, domain, leftKind, rightKind, List.append_assoc] at same + · rfl + have framed : fields left.components ++ (bigEndian 8 left.window ++ bigEndian 8 left.index) = + fields right.components ++ (bigEndian 8 right.window ++ bigEndian 8 right.index) := by + apply List.append_cancel_left (as := domain left.kind) + simpa only [encode, kind, List.append_assoc] using same + have counts : left.components.length = right.components.length := by + rw [leftValid.1, rightValid.1, kind] + obtain ⟨components, coordinates⟩ := fields_cancel _ _ _ _ counts leftValid.2.1 rightValid.2.1 framed + obtain ⟨windows, indices⟩ := List.append_inj coordinates (by simp [bigEndian_length]) + have window := Auths.Crypto.Framing.endian_injective 8 _ _ leftValid.2.2.1 rightValid.2.2.1 windows + have index := Auths.Crypto.Framing.endian_injective 8 _ _ leftValid.2.2.2 rightValid.2.2.2 indices + cases left; cases right + simp_all + +def slotDomain : Kind → Bytes + | .count => [97, 117, 116, 104, 115, 46, 103, 97, 116, 101, 119, 97, 121, 45, 98, 111, 117, 110, 100, 101, 100, 45, 99, 111, 117, 110, 116, 45, 115, 108, 111, 116, 47, 50, 0] + | .sum => [97, 117, 116, 104, 115, 46, 103, 97, 116, 101, 119, 97, 121, 45, 98, 111, 117, 110, 100, 101, 100, 45, 115, 117, 109, 45, 115, 108, 111, 116, 47, 49, 0] + +structure Slot where + kind : Kind + counter : Bytes + index : Nat + deriving DecidableEq + +def Slot.Valid (value : Slot) : Prop := value.counter.length = 32 ∧ value.index < 2 ^ 64 + +def slotEncode (value : Slot) : Bytes := slotDomain value.kind ++ value.counter ++ bigEndian 8 value.index + +theorem slot_injective (left right : Slot) (leftValid : left.Valid) (rightValid : right.Valid) + (same : slotEncode left = slotEncode right) : left = right := by + have kind : left.kind = right.kind := by + cases leftKind : left.kind <;> cases rightKind : right.kind + · rfl + · simp [slotEncode, slotDomain, leftKind, rightKind, List.append_assoc] at same + · simp [slotEncode, slotDomain, leftKind, rightKind, List.append_assoc] at same + · rfl + have remaining : left.counter ++ bigEndian 8 left.index = right.counter ++ bigEndian 8 right.index := by + apply List.append_cancel_left (as := slotDomain left.kind) + simpa only [slotEncode, kind, List.append_assoc] using same + obtain ⟨counter, indices⟩ := List.append_inj remaining (leftValid.1.trans rightValid.1.symm) + have index := Auths.Crypto.Framing.endian_injective 8 _ _ leftValid.2 rightValid.2 indices + cases left; cases right + simp_all + +/-- Framing overhead is bounded independently of the component contents. -/ +theorem fields_length (values : List Bytes) : + (fields values).length = 8 * values.length + (values.map List.length).sum := by + induction values with + | nil => simp [fields] + | cons first rest ih => simp [fields, ih, bigEndian_length]; omega + +theorem count_frame_length (namespaceBytes subject evaluator : Bytes) (window index : Nat) + (namespaceBound : namespaceBytes.length ≤ 64) (subjectBound : subject.length ≤ 512) + (evaluatorBound : evaluator.length ≤ 128) : + (encode ⟨.count, [namespaceBytes, subject, evaluator], window, index⟩).length ≤ 774 := by + simp [encode, domain, fields, bigEndian_length] + omega + +theorem sum_frame_length (namespaceBytes subject evaluator partitionBytes : Bytes) (window index : Nat) + (namespaceBound : namespaceBytes.length ≤ 64) (subjectBound : subject.length ≤ 512) + (evaluatorBound : evaluator.length ≤ 128) (partitionBound : partitionBytes.length ≤ 64) : + (encode ⟨.sum, [namespaceBytes, subject, evaluator, partitionBytes], window, index⟩).length ≤ 844 := by + simp [encode, domain, fields, bigEndian_length] + omega + +theorem slot_frame_length (value : Slot) (valid : value.Valid) : + (slotEncode value).length = (if value.kind = .count then 75 else 73) := by + cases kind : value.kind <;> simp [slotEncode, slotDomain, kind, valid.1, bigEndian_length] + +end Auths.Product.CounterFrames diff --git a/formal/Auths/Product/CounterRefinement.lean b/formal/Auths/Product/CounterRefinement.lean new file mode 100644 index 000000000..59817361c --- /dev/null +++ b/formal/Auths/Product/CounterRefinement.lean @@ -0,0 +1,254 @@ +import qualification.aeneas.generated.gateway.Funs +import Auths.Product.CounterFrames +import Auths.Crypto.Endian +import Auths.Crypto.FramingTotality +import Auths.Product.Refinement.Gateway +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.CounterFrames.Refinement +set_option maxHeartbeats 2000000 +set_option Elab.async false +open Auths.Product.Refinement.Gateway + +private theorem append_exact (output : alloc.vec.Vec Std.U8) (value : Slice Std.U8) + (fits : output.val.length + value.val.length < 4294967295) : + _root_.auths_gateway_kernel.construct.append_bytes output value ⦃ actual => + actual.val = output.val ++ value.val ⦄ := by + exact Auths.Product.Refinement.Gateway.append_bytes_spec output value fits + +@[step] theorem word_exact (output : alloc.vec.Vec Std.U8) (value : Std.U64) + (fits : output.val.length + 8 < 4294967295) : + counter_preimages.append_word output value ⦃ actual => + vecBytes actual = vecBytes output ++ Auths.Codec.bigEndian 8 value.val ⦄ := by + unfold counter_preimages.append_word + simp only [lift, bind_tc_ok] + apply spec_mono (append_exact _ _ (by simpa using fits)) + intro actual same + simp only [vecBytes, byteList, same, List.map_append] + exact congrArg (fun bytes => output.val.map (·.val) ++ bytes) (Auths.Crypto.Endian.be64_exact value) + +@[step] theorem component_exact (output : alloc.vec.Vec Std.U8) (value : Slice Std.U8) + (fits : output.val.length + 8 + value.val.length < 4294967295) : + counter_preimages.append_component output value ⦃ actual => + vecBytes actual = vecBytes output ++ Auths.Codec.bigEndian 8 value.val.length ++ sliceBytes value ⦄ := by + unfold counter_preimages.append_component + simp only [_root_.U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from] + step with Auths.Crypto.FramingTotality.convert_total as ⟨length, lengthMeaning⟩ + cases length with + | Err reason => + have impossible : value.val.length ≤ U64.max := by rw [U64.max_eq]; omega + simp only [Slice.len_val, Slice.length, UScalar.max_UScalarTy_U64_eq] at lengthMeaning + omega + | Ok length => + simp only [_root_.core.result.Result.unwrap_or, bind_tc_ok] + have nativeLength : length.val = value.val.length := by simpa using lengthMeaning + apply spec_bind (word_exact output length (by omega)) + intro framedLength lengthBytes + have framedSize : framedLength.val.length = output.val.length + 8 := by + have size := congrArg List.length lengthBytes + simpa [vecBytes, byteList, Auths.Codec.bigEndian_length] using size + apply spec_mono (append_exact _ _ (by omega)) + intro actual actualBytes + simp [vecBytes, byteList, actualBytes, List.map_append] at lengthBytes ⊢ + rw [lengthBytes, nativeLength] + simp [sliceBytes, byteList] + +@[step] theorem coordinates_exact (output : alloc.vec.Vec Std.U8) (window index : Std.U64) + (fits : output.val.length + 16 < 4294967295) : + counter_preimages.append_coordinates output window index ⦃ actual => + vecBytes actual = vecBytes output ++ Auths.Codec.bigEndian 8 window.val ++ Auths.Codec.bigEndian 8 index.val ⦄ := by + unfold counter_preimages.append_coordinates + apply spec_bind (word_exact output window (by omega)) + intro first firstBytes + have firstSize : first.val.length = output.val.length + 8 := by + have size := congrArg List.length firstBytes + simpa [vecBytes, byteList, Auths.Codec.bigEndian_length] using size + apply spec_mono (word_exact first index (by omega)) + intro actual actualBytes + rw [actualBytes, firstBytes] + +private theorem component_size (output actual : alloc.vec.Vec Std.U8) (value : Slice Std.U8) + (same : vecBytes actual = vecBytes output ++ Auths.Codec.bigEndian 8 value.val.length ++ sliceBytes value) : + actual.val.length = output.val.length + 8 + value.val.length := by + have size := congrArg List.length same + simpa [vecBytes, byteList, sliceBytes, Auths.Codec.bigEndian_length, Nat.add_assoc] using size + +@[step] theorem count_exact (namespaceBytes subject evaluator : Slice Std.U8) (window index : Std.U64) + (namespaceBound : namespaceBytes.val.length ≤ 64) + (subjectBound : subject.val.length ≤ 512) (evaluatorBound : evaluator.val.length ≤ 128) : + counter_preimages.count_counter_preimage namespaceBytes subject evaluator window index ⦃ actual => + vecBytes actual = CounterFrames.encode ⟨.count, + [sliceBytes namespaceBytes, sliceBytes subject, sliceBytes evaluator], window.val, index.val⟩ ⦄ := by + unfold counter_preimages.count_counter_preimage + simp only [lift, bind_tc_ok] + apply spec_bind (Auths.Product.Refinement.Gateway.copy_bytes_spec _ (by decide)) + intro tagged prefixBytes + have prefixSize : tagged.val.length = 30 := by simp [prefixBytes] + apply spec_bind (component_exact tagged namespaceBytes (by omega)) + intro one oneBytes + have oneSize := component_size tagged one namespaceBytes oneBytes + apply spec_bind (component_exact one subject (by omega)) + intro two twoBytes + have twoSize := component_size one two subject twoBytes + apply spec_bind (component_exact two evaluator (by omega)) + intro three threeBytes + have threeSize := component_size two three evaluator threeBytes + apply spec_mono (coordinates_exact three window index (by omega)) + intro actual actualBytes + rw [actualBytes, threeBytes, twoBytes, oneBytes] + simp only [vecBytes, byteList, prefixBytes, CounterFrames.encode, CounterFrames.domain, + CounterFrames.fields, sliceBytes, List.map_append, List.map_cons, List.map_nil, + List.append_assoc, List.append_nil, List.length_map] + rfl + +@[step] theorem sum_exact (namespaceBytes subject evaluator partitionBytes : Slice Std.U8) (window index : Std.U64) + (namespaceBound : namespaceBytes.val.length ≤ 64) + (subjectBound : subject.val.length ≤ 512) (evaluatorBound : evaluator.val.length ≤ 128) + (partitionBound : partitionBytes.val.length ≤ 64) : + counter_preimages.sum_counter_preimage namespaceBytes subject evaluator partitionBytes window index ⦃ actual => + vecBytes actual = CounterFrames.encode ⟨.sum, + [sliceBytes namespaceBytes, sliceBytes subject, sliceBytes evaluator, sliceBytes partitionBytes], window.val, index.val⟩ ⦄ := by + unfold counter_preimages.sum_counter_preimage + simp only [lift, bind_tc_ok] + apply spec_bind (Auths.Product.Refinement.Gateway.copy_bytes_spec _ (by decide)) + intro tagged prefixBytes + have prefixSize : tagged.val.length = 28 := by simp [prefixBytes] + apply spec_bind (component_exact tagged namespaceBytes (by omega)) + intro one oneBytes + have oneSize := component_size tagged one namespaceBytes oneBytes + apply spec_bind (component_exact one subject (by omega)) + intro two twoBytes + have twoSize := component_size one two subject twoBytes + apply spec_bind (component_exact two evaluator (by omega)) + intro three threeBytes + have threeSize := component_size two three evaluator threeBytes + apply spec_bind (component_exact three partitionBytes (by omega)) + intro four fourBytes + have fourSize := component_size three four partitionBytes fourBytes + apply spec_mono (coordinates_exact four window index (by omega)) + intro actual actualBytes + rw [actualBytes, fourBytes, threeBytes, twoBytes, oneBytes] + simp only [vecBytes, byteList, prefixBytes, CounterFrames.encode, CounterFrames.domain, + CounterFrames.fields, sliceBytes, List.map_append, List.map_cons, List.map_nil, + List.append_assoc, List.append_nil, List.length_map] + rfl + +@[step] private theorem slot_generic (domainBytes : Slice Std.U8) (counter : Array Std.U8 32#usize) (slot : Std.U64) + (bounded : domainBytes.val.length ≤ 35) : + counter_preimages.slot_preimage domainBytes counter slot ⦃ actual => + vecBytes actual = sliceBytes domainBytes ++ byteList counter.val ++ Auths.Codec.bigEndian 8 slot.val ⦄ := by + unfold counter_preimages.slot_preimage + apply spec_bind (Auths.Product.Refinement.Gateway.copy_bytes_spec _ (by omega)) + intro copied copiedBytes + simp only [lift, bind_tc_ok] + have counterSize : counter.val.length = 32 := by simpa using counter.property + apply spec_bind (append_exact copied _ (by simp only [copiedBytes]; change domainBytes.val.length + counter.val.length < 4294967295; omega)) + intro combined combinedBytes + have combinedSize : combined.val.length = domainBytes.val.length + 32 := by + simp [combinedBytes, copiedBytes, counterSize] + apply spec_mono (word_exact combined slot (by omega)) + intro actual actualBytes + simp [vecBytes, byteList, combinedBytes, copiedBytes, List.map_append, sliceBytes] at actualBytes ⊢ + exact actualBytes + +@[step] theorem count_slot_exact (counter : Array Std.U8 32#usize) (slot : Std.U64) : + counter_preimages.count_slot_preimage counter slot ⦃ actual => + vecBytes actual = CounterFrames.slotEncode ⟨.count, byteList counter.val, slot.val⟩ ⦄ := by + unfold counter_preimages.count_slot_preimage + simp only [lift, bind_tc_ok] + apply spec_mono (slot_generic _ counter slot (by decide)) + intro actual actualBytes + rw [actualBytes] + rfl + +@[step] theorem sum_slot_exact (counter : Array Std.U8 32#usize) (slot : Std.U64) : + counter_preimages.sum_slot_preimage counter slot ⦃ actual => + vecBytes actual = CounterFrames.slotEncode ⟨.sum, byteList counter.val, slot.val⟩ ⦄ := by + unfold counter_preimages.sum_slot_preimage + simp only [lift, bind_tc_ok] + apply spec_mono (slot_generic _ counter slot (by decide)) + intro actual actualBytes + rw [actualBytes] + rfl + +private theorem count_model_valid (namespaceBytes subject evaluator : Slice Std.U8) (window index : Std.U64) + (namespaceBytesBound : namespaceBytes.val.length ≤ 64) + (subjectBound : subject.val.length ≤ 512) + (evaluatorBound : evaluator.val.length ≤ 128) + : (CounterFrames.Counter.mk .count [sliceBytes namespaceBytes, sliceBytes subject, sliceBytes evaluator] window.val index.val).Valid := by + have windowBound : window.val < 2 ^ 64 := window.bv.isLt + have indexBound : index.val < 2 ^ 64 := index.bv.isLt + simp [CounterFrames.Counter.Valid, CounterFrames.Bounded, sliceBytes, byteList] + omega + +/-- Equal outputs of two actual builders recover every budget identity field. + Successful source results are identified; no hash property is assumed. -/ +theorem count_source_binds_inputs + (leftNamespaceBytes leftSubject leftEvaluator : Slice Std.U8) + (leftWindow leftIndex : Std.U64) + (leftNamespaceBytesBound : leftNamespaceBytes.val.length ≤ 64) + (leftSubjectBound : leftSubject.val.length ≤ 512) + (leftEvaluatorBound : leftEvaluator.val.length ≤ 128) + (rightNamespaceBytes rightSubject rightEvaluator : Slice Std.U8) + (rightWindow rightIndex : Std.U64) + (rightNamespaceBytesBound : rightNamespaceBytes.val.length ≤ 64) + (rightSubjectBound : rightSubject.val.length ≤ 512) + (rightEvaluatorBound : rightEvaluator.val.length ≤ 128) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftProduced : counter_preimages.count_counter_preimage leftNamespaceBytes leftSubject leftEvaluator leftWindow leftIndex = ok leftOutput) + (rightProduced : counter_preimages.count_counter_preimage rightNamespaceBytes rightSubject rightEvaluator rightWindow rightIndex = ok rightOutput) + (same : vecBytes leftOutput = vecBytes rightOutput) : + (CounterFrames.Counter.mk .count [sliceBytes leftNamespaceBytes, sliceBytes leftSubject, sliceBytes leftEvaluator] leftWindow.val leftIndex.val) = (CounterFrames.Counter.mk .count [sliceBytes rightNamespaceBytes, sliceBytes rightSubject, sliceBytes rightEvaluator] rightWindow.val rightIndex.val) := by + have leftMeaning := count_exact leftNamespaceBytes leftSubject leftEvaluator leftWindow leftIndex leftNamespaceBytesBound leftSubjectBound leftEvaluatorBound + have rightMeaning := count_exact rightNamespaceBytes rightSubject rightEvaluator rightWindow rightIndex rightNamespaceBytesBound rightSubjectBound rightEvaluatorBound + rw [leftProduced, spec_ok] at leftMeaning + rw [rightProduced, spec_ok] at rightMeaning + apply CounterFrames.encode_injective _ _ + (count_model_valid leftNamespaceBytes leftSubject leftEvaluator leftWindow leftIndex leftNamespaceBytesBound leftSubjectBound leftEvaluatorBound) + (count_model_valid rightNamespaceBytes rightSubject rightEvaluator rightWindow rightIndex rightNamespaceBytesBound rightSubjectBound rightEvaluatorBound) + rw [← leftMeaning, ← rightMeaning] + exact same + +private theorem sum_model_valid (namespaceBytes subject evaluator partitionBytes : Slice Std.U8) (window index : Std.U64) + (namespaceBytesBound : namespaceBytes.val.length ≤ 64) + (subjectBound : subject.val.length ≤ 512) + (evaluatorBound : evaluator.val.length ≤ 128) + (partitionBytesBound : partitionBytes.val.length ≤ 64) + : (CounterFrames.Counter.mk .sum [sliceBytes namespaceBytes, sliceBytes subject, sliceBytes evaluator, sliceBytes partitionBytes] window.val index.val).Valid := by + have windowBound : window.val < 2 ^ 64 := window.bv.isLt + have indexBound : index.val < 2 ^ 64 := index.bv.isLt + simp [CounterFrames.Counter.Valid, CounterFrames.Bounded, sliceBytes, byteList] + omega + +/-- Equal outputs of two actual builders recover every budget identity field. + Successful source results are identified; no hash property is assumed. -/ +theorem sum_source_binds_inputs + (leftNamespaceBytes leftSubject leftEvaluator leftPartitionBytes : Slice Std.U8) + (leftWindow leftIndex : Std.U64) + (leftNamespaceBytesBound : leftNamespaceBytes.val.length ≤ 64) + (leftSubjectBound : leftSubject.val.length ≤ 512) + (leftEvaluatorBound : leftEvaluator.val.length ≤ 128) + (leftPartitionBytesBound : leftPartitionBytes.val.length ≤ 64) + (rightNamespaceBytes rightSubject rightEvaluator rightPartitionBytes : Slice Std.U8) + (rightWindow rightIndex : Std.U64) + (rightNamespaceBytesBound : rightNamespaceBytes.val.length ≤ 64) + (rightSubjectBound : rightSubject.val.length ≤ 512) + (rightEvaluatorBound : rightEvaluator.val.length ≤ 128) + (rightPartitionBytesBound : rightPartitionBytes.val.length ≤ 64) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftProduced : counter_preimages.sum_counter_preimage leftNamespaceBytes leftSubject leftEvaluator leftPartitionBytes leftWindow leftIndex = ok leftOutput) + (rightProduced : counter_preimages.sum_counter_preimage rightNamespaceBytes rightSubject rightEvaluator rightPartitionBytes rightWindow rightIndex = ok rightOutput) + (same : vecBytes leftOutput = vecBytes rightOutput) : + (CounterFrames.Counter.mk .sum [sliceBytes leftNamespaceBytes, sliceBytes leftSubject, sliceBytes leftEvaluator, sliceBytes leftPartitionBytes] leftWindow.val leftIndex.val) = (CounterFrames.Counter.mk .sum [sliceBytes rightNamespaceBytes, sliceBytes rightSubject, sliceBytes rightEvaluator, sliceBytes rightPartitionBytes] rightWindow.val rightIndex.val) := by + have leftMeaning := sum_exact leftNamespaceBytes leftSubject leftEvaluator leftPartitionBytes leftWindow leftIndex leftNamespaceBytesBound leftSubjectBound leftEvaluatorBound leftPartitionBytesBound + have rightMeaning := sum_exact rightNamespaceBytes rightSubject rightEvaluator rightPartitionBytes rightWindow rightIndex rightNamespaceBytesBound rightSubjectBound rightEvaluatorBound rightPartitionBytesBound + rw [leftProduced, spec_ok] at leftMeaning + rw [rightProduced, spec_ok] at rightMeaning + apply CounterFrames.encode_injective _ _ + (sum_model_valid leftNamespaceBytes leftSubject leftEvaluator leftPartitionBytes leftWindow leftIndex leftNamespaceBytesBound leftSubjectBound leftEvaluatorBound leftPartitionBytesBound) + (sum_model_valid rightNamespaceBytes rightSubject rightEvaluator rightPartitionBytes rightWindow rightIndex rightNamespaceBytesBound rightSubjectBound rightEvaluatorBound rightPartitionBytesBound) + rw [← leftMeaning, ← rightMeaning] + exact same + +end Auths.Product.CounterFrames.Refinement diff --git a/formal/Auths/Product/EntryDeadline.lean b/formal/Auths/Product/EntryDeadline.lean new file mode 100644 index 000000000..8e72c037f --- /dev/null +++ b/formal/Auths/Product/EntryDeadline.lean @@ -0,0 +1,99 @@ +import Std.Tactic + +namespace Auths.Product.EntryDeadline + +structure Bound where + deadline : Nat + inclusive : Bool + deriving DecidableEq + +def permits (bound : Bound) (now : Nat) : Prop := + now < bound.deadline ∨ (now = bound.deadline ∧ bound.inclusive = true) + +instance (bound : Bound) (now : Nat) : Decidable (permits bound now) := by + unfold permits + infer_instance + +def meet (left right : Bound) : Bound := + if left.deadline < right.deadline then left + else if right.deadline < left.deadline then right + else ⟨left.deadline, left.inclusive && right.inclusive⟩ + +theorem permits_meet (left right : Bound) (now : Nat) : + permits (meet left right) now ↔ permits left now ∧ permits right now := by + unfold meet + split <;> rename_i first + · simp only [permits] + constructor + · intro h + exact ⟨h, Or.inl (by rcases h with h | ⟨h, _⟩ <;> omega)⟩ + · exact And.left + · split <;> rename_i second + · simp only [permits] + constructor + · intro h + exact ⟨Or.inl (by rcases h with h | ⟨h, _⟩ <;> omega), h⟩ + · exact And.right + · have equal : left.deadline = right.deadline := by omega + simp only [permits, equal, Bool.and_eq_true] + constructor + · rintro (h | ⟨h, hl, hr⟩) + · exact ⟨Or.inl h, Or.inl h⟩ + · exact ⟨Or.inr ⟨h, hl⟩, Or.inr ⟨h, hr⟩⟩ + · rintro ⟨hl, hr⟩ + rcases hl with h | ⟨h, hl⟩ + · exact Or.inl h + · rcases hr with hr | ⟨_, hr⟩ + · exact Or.inl hr + · exact Or.inr ⟨h, hl, hr⟩ + +def admits (evaluatedAt : Nat) (bound : Bound) (now : Nat) : Prop := + evaluatedAt ≤ now ∧ permits bound now + +instance (evaluatedAt : Nat) (bound : Bound) (now : Nat) : + Decidable (admits evaluatedAt bound now) := by + unfold admits + infer_instance + +theorem no_clock_rollback (evaluatedAt : Nat) (bound : Bound) (now : Nat) + (accepted : admits evaluatedAt bound now) : evaluatedAt ≤ now := accepted.1 + +theorem every_deadline_holds (evaluatedAt : Nat) (left right : Bound) (now : Nat) : + admits evaluatedAt (meet left right) now ↔ + admits evaluatedAt left now ∧ admits evaluatedAt right now := by + simp only [admits, permits_meet] + constructor + · rintro ⟨h, hl, hr⟩; exact ⟨⟨h, hl⟩, ⟨h, hr⟩⟩ + · rintro ⟨⟨h, hl⟩, ⟨_, hr⟩⟩; exact ⟨h, hl, hr⟩ + +end Auths.Product.EntryDeadline + +namespace Auths.Product.EntryDeadline + +theorem permits_fold (bounds : List Bound) (initial : Bound) (now : Nat) : + permits (bounds.foldl meet initial) now ↔ + permits initial now ∧ ∀ bound ∈ bounds, permits bound now := by + induction bounds generalizing initial with + | nil => simp + | cons bound rest ih => + simp only [List.foldl_cons, ih, permits_meet, List.mem_cons] + constructor + · rintro ⟨⟨hi, hb⟩, hr⟩ + exact ⟨hi, fun candidate member => by + rcases member with rfl | member + · exact hb + · exact hr candidate member⟩ + · rintro ⟨hi, hall⟩ + exact ⟨⟨hi, hall bound (Or.inl rfl)⟩, + fun candidate member => hall candidate (Or.inr member)⟩ + +theorem exclusive_endpoint_refuses (evaluatedAt endpoint : Nat) : + ¬ admits evaluatedAt ⟨endpoint, false⟩ endpoint := by + simp [admits, permits] + +theorem inclusive_endpoint_admits (evaluatedAt endpoint : Nat) + (ordered : evaluatedAt ≤ endpoint) : + admits evaluatedAt ⟨endpoint, true⟩ endpoint := by + simp [admits, permits, ordered] + +end Auths.Product.EntryDeadline diff --git a/formal/Auths/Product/Frontier/Model.lean b/formal/Auths/Product/Frontier/Model.lean new file mode 100644 index 000000000..533871ad8 --- /dev/null +++ b/formal/Auths/Product/Frontier/Model.lean @@ -0,0 +1,137 @@ +import Mathlib.Tactic + +/-! +Readable bounded first-free-slot search. A store prefix contains precisely the +slots below its current frontier. Concurrent insertions may make individual +reads stale: the final candidate is conservative, and a successful atomic +insert at that candidate earns equality with the then-current frontier. +-/ +namespace Auths.Product.Frontier.Model + +structure Search where + lower : Nat + upper : Nat + deriving DecidableEq, Repr + +def valid (bound : Nat) (state : Search) : Prop := state.lower ≤ state.upper ∧ state.upper ≤ bound + +def start (bound : Nat) : Search := ⟨0, bound⟩ +def width (state : Search) : Nat := state.upper - state.lower + +def probe (state : Search) : Option Nat := + if state.lower < state.upper then some (state.lower + width state / 2) else none + +def observe (state : Search) (occupied : Bool) : Search := + match probe state with + | none => state + | some middle => if occupied then ⟨middle + 1, state.upper⟩ else ⟨state.lower, middle⟩ + +def run (state : Search) (answers : List Bool) : Search := answers.foldl observe state + +theorem start_valid (bound : Nat) : valid bound (start bound) := by simp [valid, start] + +theorem probe_inside (state : Search) (middle : Nat) (found : probe state = some middle) : + state.lower ≤ middle ∧ middle < state.upper := by + unfold probe width at found + split at found + · simp only [Option.some.injEq] at found + omega + · contradiction + +theorem observe_valid (bound : Nat) (state : Search) (occupied : Bool) (invariant : valid bound state) : + valid bound (observe state occupied) := by + unfold observe + cases found : probe state with + | none => exact invariant + | some middle => + have inside := probe_inside state middle found + cases occupied <;> simp_all [valid] <;> omega + +theorem width_halves (state : Search) (occupied : Bool) : + width (observe state occupied) ≤ width state / 2 := by + unfold observe + cases found : probe state with + | none => + have finished : state.upper ≤ state.lower := by simpa [probe] using found + simp only [width] + omega + | some middle => + have middleValue : middle = state.lower + width state / 2 := by + unfold probe at found + split at found + · exact (Option.some.inj found).symm + · contradiction + cases occupied <;> simp only [Bool.false_eq_true, ↓reduceIte, width] + all_goals unfold width at middleValue + all_goals omega + +theorem run_valid (bound : Nat) (state : Search) (answers : List Bool) (invariant : valid bound state) : + valid bound (run state answers) := by + induction answers generalizing state with + | nil => exact invariant + | cons occupied rest ih => exact ih _ (observe_valid bound state occupied invariant) + +theorem run_width (state : Search) (answers : List Bool) : + width (run state answers) ≤ width state / 2 ^ answers.length := by + induction answers generalizing state with + | nil => simp [run] + | cons occupied rest ih => + calc width (run state (occupied :: rest)) + ≤ width (observe state occupied) / 2 ^ rest.length := ih _ + _ ≤ (width state / 2) / 2 ^ rest.length := Nat.div_le_div_right (width_halves state occupied) + _ = width state / 2 ^ (occupied :: rest).length := by + simp only [List.length_cons, Nat.div_div_eq_div_mul, Nat.pow_succ] + rw [Nat.mul_comm] + +/-- At most 64 successful store reads on the full u64 bound, for every + possible sequence of occupancy answers; no stable snapshot is needed. -/ +theorem sixty_four_reads_suffice (bound : Nat) (fits : bound < 2 ^ 64) + (answers : List Bool) (enough : answers.length = 64) : + probe (run (start bound) answers) = none := by + have reduced := run_width (start bound) answers + have invariant := run_valid bound (start bound) answers (start_valid bound) + have noWidth : width (run (start bound) answers) = 0 := by + apply Nat.eq_zero_of_le_zero + calc width (run (start bound) answers) ≤ width (start bound) / 2 ^ answers.length := reduced + _ = 0 := by simpa [width, start, enough] using Nat.div_eq_of_lt fits + have finished : (run (start bound) answers).upper ≤ (run (start bound) answers).lower := by + unfold width at noWidth + omega + simp [probe, Nat.not_lt.mpr finished] + +/-- Even a stale read cannot push the candidate beyond a later append-only + prefix. This uses a store-prefix contract, not a trusted admission flag. -/ +theorem observed_prefix_conservative (state : Search) (observed latest : Nat) + (prior : state.lower ≤ latest) (monotone : observed ≤ latest) : + (observe state (decide ((probe state).getD 0 < observed))).lower ≤ latest := by + unfold observe + cases found : probe state with + | none => exact prior + | some middle => + simp only [Option.getD_some, decide_eq_true_eq] + split <;> dsimp only <;> omega + +def runPrefixes (state : Search) (frontiers : List Nat) : Search := + frontiers.foldl (fun current frontier => observe current (decide ((probe current).getD 0 < frontier))) state + +theorem candidate_conservative (state : Search) (frontiers : List Nat) (latest : Nat) + (prior : state.lower ≤ latest) (appendOnly : ∀ frontier ∈ frontiers, frontier ≤ latest) : + (runPrefixes state frontiers).lower ≤ latest := by + induction frontiers generalizing state with + | nil => exact prior + | cons frontier rest ih => + apply ih + · exact observed_prefix_conservative state frontier latest prior (appendOnly frontier (by simp)) + · intro later included + exact appendOnly later (by simp [included]) + +/-- If the atomic batch still finds this candidate unoccupied, the candidate + is exactly the current prefix end. Otherwise the caller must retry/refuse. -/ +theorem successful_insertion_is_at_frontier (state : Search) (frontiers : List Nat) (latest : Nat) + (prior : state.lower ≤ latest) (appendOnly : ∀ frontier ∈ frontiers, frontier ≤ latest) + (stillFree : ¬ (runPrefixes state frontiers).lower < latest) : + (runPrefixes state frontiers).lower = latest := by + have conservative := candidate_conservative state frontiers latest prior appendOnly + omega + +end Auths.Product.Frontier.Model diff --git a/formal/Auths/Product/Frontier/Refinement.lean b/formal/Auths/Product/Frontier/Refinement.lean new file mode 100644 index 000000000..0f53b4a83 --- /dev/null +++ b/formal/Auths/Product/Frontier/Refinement.lean @@ -0,0 +1,93 @@ +import Auths.Product.Frontier.Model +import qualification.aeneas.generated.gateway.Funs +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.Product.Frontier.Refinement +open auths_gateway_kernel +set_option maxHeartbeats 2000000 + +def view (state : frontier.FrontierSearch) : Model.Search := ⟨state.lower.val, state.upper.val⟩ + +@[step] theorem start_exact (bound : Std.U64) : + frontier.FrontierSearch.new bound ⦃ actual => view actual = Model.start bound.val ⦄ := by + simp [frontier.FrontierSearch.new, view, Model.start] + +/-- Complete probe result, including closed intervals; all arithmetic safety + is proved on the source u64 carrier, rather than assumed from a flag. -/ +@[step] theorem probe_exact (state : frontier.FrontierSearch) : + frontier.FrontierSearch.probe state ⦃ actual => actual.map UScalar.val = Model.probe (view state) ⦄ := by + unfold frontier.FrontierSearch.probe + split <;> rename_i active + · have remaining : state.lower.val < state.upper.val := by simpa using active + have upperBound := U64.le_max state.upper + step as ⟨difference, differenceValue⟩ + step as ⟨half, halfValue⟩ + have additionFits : state.lower.val + half.val ≤ U64.max := by + rw [U64.max_eq] + omega + step as ⟨middle, middleValue⟩ + simp [Model.probe, Model.width, view, remaining, middleValue, halfValue, differenceValue] + · have finished : ¬state.lower.val < state.upper.val := by simpa using active + simp [Model.probe, view, finished] + +@[step] theorem observe_exact (state : frontier.FrontierSearch) (occupied : Bool) : + frontier.FrontierSearch.observe state occupied ⦃ actual => + view actual = Model.observe (view state) occupied ⦄ := by + unfold frontier.FrontierSearch.observe + step with probe_exact as ⟨nextRead, readValue⟩ + cases nextRead with + | none => simp [Model.observe, ← readValue] + | some middle => + have found : Model.probe (view state) = some middle.val := by simpa using readValue.symm + have inside : middle.val < state.upper.val := (Model.probe_inside _ _ found).2 + by_cases occupiedAnswer : occupied = true + · simp only [occupiedAnswer, ↓reduceIte] + have additionFits : middle.val + 1 ≤ U64.max := by + rw [U64.max_eq] + have upperBound := U64.le_max state.upper + omega + step as ⟨next, nextValue⟩ + simp only [Model.observe, found, occupiedAnswer, ↓reduceIte] + simp [view, nextValue] + · simp only [Model.observe, found, occupiedAnswer, ↓reduceIte, spec_ok] + simp [view] + +@[step] theorem candidate_exact (state : frontier.FrontierSearch) : + frontier.FrontierSearch.candidate state ⦃ actual => actual.val = (view state).lower ⦄ := by + simp [frontier.FrontierSearch.candidate, view] + +/-- A proof-owned composition of the actual source methods, supplied with + observed answers. Runtime store-read correspondence remains explicit. -/ +def composeReads : frontier.FrontierSearch → List Bool → Result frontier.FrontierSearch + | state, [] => ok state + | state, answer :: rest => do + let next ← frontier.FrontierSearch.observe state answer + composeReads next rest + +theorem reads_refine (state : frontier.FrontierSearch) (answers : List Bool) : + composeReads state answers ⦃ actual => view actual = Model.run (view state) answers ⦄ := by + induction answers generalizing state with + | nil => simp [composeReads, Model.run] + | cons answer rest ih => + unfold composeReads + step with observe_exact as ⟨next, nextValue⟩ + apply spec_mono (ih next) + intro actual actualValue + simpa only [Model.run, List.foldl_cons, nextValue] using actualValue + +/-- Any 64 source transitions finish the search over a full-width u64 bound. + This bounds successful read transitions; a runtime read error exits earlier. -/ +theorem source_work_bound (bound : Std.U64) (answers : List Bool) (enough : answers.length = 64) : + (do + let start ← frontier.FrontierSearch.new bound + let final ← composeReads start answers + frontier.FrontierSearch.probe final) ⦃ actual => actual = none ⦄ := by + step with start_exact as ⟨start, startValue⟩ + step with reads_refine as ⟨final, finalValue⟩ + step with probe_exact as ⟨actual, actualValue⟩ + have fits : bound.val < 2 ^ 64 := bound.hBounds + have finished := Model.sixty_four_reads_suffice bound.val fits answers enough + rw [finalValue, startValue, finished] at actualValue + exact Option.map_eq_none_iff.mp actualValue + +end Auths.Product.Frontier.Refinement diff --git a/formal/Auths/Product/OperationIdentity.lean b/formal/Auths/Product/OperationIdentity.lean new file mode 100644 index 000000000..3765aea49 --- /dev/null +++ b/formal/Auths/Product/OperationIdentity.lean @@ -0,0 +1,83 @@ +import Mathlib.Tactic +namespace Auths.Product.OperationIdentity +abbrev Bytes := List Nat + +def Alphanumeric (byte : Nat) : Prop := + (48 ≤ byte ∧ byte ≤ 57) ∨ (65 ≤ byte ∧ byte ≤ 90) ∨ (97 ≤ byte ∧ byte ≤ 122) +def TailByte (byte : Nat) : Prop := Alphanumeric byte ∨ byte = 46 ∨ byte = 95 ∨ byte = 45 +local instance (byte : Nat) : Decidable (Alphanumeric byte) := inferInstanceAs (Decidable (_ ∨ _)) +local instance (byte : Nat) : Decidable (TailByte byte) := inferInstanceAs (Decidable (_ ∨ _)) + +def validToken (bytes : Bytes) (maximum : Nat) : Bool := + match bytes with + | [] => false + | first :: rest => decide (bytes.length ≤ maximum ∧ Alphanumeric first) && + rest.all (fun byte => decide (TailByte byte)) + +def NulFree (bytes : Bytes) : Prop := ∀ byte ∈ bytes, byte ≠ 0 + +theorem alphanumeric_nonzero (byte : Nat) (valid : Alphanumeric byte) : byte ≠ 0 := by + unfold Alphanumeric at valid + omega + +theorem tail_nonzero (byte : Nat) (valid : TailByte byte) : byte ≠ 0 := by + rcases valid with alpha | dot | underscore | hyphen + · exact alphanumeric_nonzero byte alpha + · omega + · omega + · omega + +theorem token_nul_free (bytes : Bytes) (maximum : Nat) (valid : validToken bytes maximum = true) : + NulFree bytes := by + cases bytes with + | nil => simp [validToken] at valid + | cons first rest => + simp only [validToken, Bool.and_eq_true, decide_eq_true_eq, List.all_eq_true] at valid + intro byte member + rcases List.mem_cons.mp member with same | tail + · subst byte; exact alphanumeric_nonzero first valid.1.2 + · exact tail_nonzero byte (by simpa using valid.2 byte tail) + +/-- UTF-8 bytes of `auths.gateway-logical-operation/1` followed by NUL. -/ +def domain : Bytes := [97,117,116,104,115,46,103,97,116,101,119,97,121,45,108,111,103, + 105,99,97,108,45,111,112,101,114,97,116,105,111,110,47,49,0] + +structure Identity where + namespaceBytes : Bytes + operation : Bytes + deriving DecidableEq + +def preimage (identity : Identity) : Bytes := + domain ++ (identity.namespaceBytes ++ 0 :: identity.operation) + +theorem before_separator (namespaceBytes operation : Bytes) (valid : NulFree namespaceBytes) : + (namespaceBytes ++ 0 :: operation).takeWhile (fun byte => byte != 0) = namespaceBytes := by + induction namespaceBytes with + | nil => simp + | cons first rest ih => + have firstNonzero := valid first (by simp) + have restFree : NulFree rest := fun byte member => valid byte (by simp [member]) + simp [firstNonzero, ih restFree] + +/-- Framing is injective on validated namespaceBytes carriers. This theorem is + about exact bytes and assumes no collision-free hash. -/ +theorem preimage_injective (left right : Identity) + (leftValid : NulFree left.namespaceBytes) (rightValid : NulFree right.namespaceBytes) + (same : preimage left = preimage right) : left = right := by + have framed : left.namespaceBytes ++ 0 :: left.operation = right.namespaceBytes ++ 0 :: right.operation := by + obtain ⟨_, rest⟩ := List.append_inj same (show domain.length = domain.length from rfl) + exact rest + have namespaces := congrArg (List.takeWhile (fun byte => byte != 0)) framed + rw [before_separator _ _ leftValid, before_separator _ _ rightValid] at namespaces + obtain ⟨_, tails⟩ := List.append_inj framed (congrArg List.length namespaces) + have operations := (List.cons.inj tails).2 + cases left; cases right + simp_all + +theorem valid_tokens_bind_identity (left right : Identity) + (leftValid : validToken left.namespaceBytes 64 = true) + (rightValid : validToken right.namespaceBytes 64 = true) + (same : preimage left = preimage right) : left = right := + preimage_injective left right (token_nul_free _ _ leftValid) (token_nul_free _ _ rightValid) same + +end Auths.Product.OperationIdentity diff --git a/formal/Auths/Product/ProfileConstructorRefinement.lean b/formal/Auths/Product/ProfileConstructorRefinement.lean new file mode 100644 index 000000000..e21ae960e --- /dev/null +++ b/formal/Auths/Product/ProfileConstructorRefinement.lean @@ -0,0 +1,33 @@ +import qualification.aeneas.generated.profile_construction.Funs +import Mathlib.Tactic +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_profile_construction.auths_connections +namespace Auths.Product.ProfileConstructor.Refinement +@[step] theorem constructor_exact (id : model.SemanticId) (version : Std.U16) : + model.ConnectionProfile.new id version ⦃ actual => + actual = if version.val = 0 then .Err .InvalidProfile else .Ok ⟨id, version⟩ ⦄ := by + unfold model.ConnectionProfile.new + by_cases zero : version.val = 0 + · have nativeZero : version = 0#u16 := by scalar_tac + simp [nativeZero] + · have nativeNonzero : version ≠ 0#u16 := by scalar_tac + simp [zero, nativeNonzero] + +theorem source_success_preserves_fields (id : model.SemanticId) (version : Std.U16) : + model.ConnectionProfile.new id version ⦃ actual => ∀ profile, actual = .Ok profile → + profile.id = id ∧ profile.version = version ∧ 0 < profile.version.val ⦄ := by + step with constructor_exact as ⟨actual, exactMeaning⟩ + rename_i profile accepted + rw [accepted] at exactMeaning + split at exactMeaning + · contradiction + · have fields : profile = ⟨id, version⟩ := by simpa using exactMeaning + subst profile + simp_all + omega +theorem source_zero_version_refused (id : model.SemanticId) : + model.ConnectionProfile.new id 0#u16 ⦃ actual => actual = .Err .InvalidProfile ⦄ := by + exact constructor_exact id 0#u16 + +end Auths.Product.ProfileConstructor.Refinement diff --git a/formal/Auths/Product/RecordShapeRefinement.lean b/formal/Auths/Product/RecordShapeRefinement.lean new file mode 100644 index 000000000..3674e4af0 --- /dev/null +++ b/formal/Auths/Product/RecordShapeRefinement.lean @@ -0,0 +1,354 @@ +import Mathlib.Data.String.Basic +import qualification.aeneas.generated.connections.Funs +import Auths.Product.StrictOrderRefinement +import Auths.Product.RecordTimesRefinement +import Auths.Product.StringConstructorsRefinement +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +namespace Auths.Product.RecordShape.Refinement +abbrev Profile := auths_connections.model.ConnectionProfile +abbrev State := auths_connections.model.ConnectionState +abbrev Error := auths_connections.model.ConnectionRecordError + +def textLess (a b : String) : Bool := decide (a < b) +def profileLess (a b : Profile) : Bool := decide (a.id < b.id ∨ (a.id = b.id ∧ a.version.val < b.version.val)) + +private theorem text_comparison (a b : String) : + alloc.string.String.Insts.CoreCmpOrd.partialOrdInst.lt a b ⦃ actual => actual = textLess a b ⦄ := by + simp only [alloc.string.String.Insts.CoreCmpOrd, alloc.string.String.Insts.CoreCmpPartialOrdString, + auths_connections.core.cmp.PartialOrd.lt.default, + Aeneas.Std.core.cmp.PartialOrd.lt.default, Aeneas.Std.core.cmp.PartialOrd.lt_body, + alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp, _root_.alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp, bind_tc_ok, spec_ok, textLess] + apply Bool.eq_iff_iff.mpr + simp only [decide_eq_true_eq] + simpa only [Option.some.injEq] using (compare_lt_iff_lt (a := a) (b := b)) + +@[step] theorem text_order_exact (values : Slice String) : + auths_connections.kernel.strictly_sorted_unique + alloc.string.String.Insts.CoreCmpOrd values ⦃ actual => + actual = StrictOrder.Refinement.ordered textLess values.val ⦄ := by + change _root_.auths_connections.kernel.strictly_sorted_unique _ values ⦃ actual => _ ⦄ + exact StrictOrder.Refinement.strict_order_exact _ textLess text_comparison values + +private theorem profile_comparison (a b : Profile) : + auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd.partialOrdInst.lt a b + ⦃ actual => actual = profileLess a b ⦄ := by + simp only [auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd, + auths_connections.model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile, + auths_connections.core.cmp.PartialOrd.lt.default, + Aeneas.Std.core.cmp.PartialOrd.lt.default, Aeneas.Std.core.cmp.PartialOrd.lt_body, + auths_connections.model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile.partial_cmp, + auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd.cmp, + auths_connections.model.SemanticId.Insts.CoreCmpOrd.cmp, + alloc.string.String.Insts.CoreCmpOrd.cmp, _root_.alloc.string.String.Insts.CoreCmpOrd.cmp, + bind_tc_ok] + cases compared : compare a.id b.id with + | eq => + have same : a.id = b.id := compare_eq_iff_eq.mp compared + simp [compared, profileLess, same, compare_lt_iff_lt, UScalar.lt_equiv] + | lt => + have before : a.id < b.id := compare_lt_iff_lt.mp compared + simp [compared, profileLess, before] + | gt => + have after : b.id < a.id := compare_gt_iff_gt.mp compared + have notBefore : ¬ a.id < b.id := not_lt_of_gt after + have notSame : a.id ≠ b.id := ne_of_gt after + simp [compared, profileLess, notBefore, notSame] + +@[step] theorem profile_order_exact (values : Slice Profile) : + kernel.strictly_sorted_unique model.ConnectionProfile.Insts.CoreCmpOrd values ⦃ actual => + actual = StrictOrder.Refinement.ordered profileLess values.val ⦄ := by + exact StrictOrder.Refinement.strict_order_exact _ profileLess profile_comparison values + +def textValid (value : String) : Prop := + ConnectionBytes.graphicValid (StringConstructors.Refinement.utf8Bytes value) 128 +instance (value : String) : Decidable (textValid value) := inferInstanceAs (Decidable (ConnectionBytes.graphicValid _ _)) + +def allText : List String → Bool + | [] => true + | head :: tail => decide (textValid head) && allText tail + +def workloadsValid (values : List String) : Bool := + decide (values ≠ [] ∧ values.length ≤ 256) && StrictOrder.Refinement.ordered textLess values && allText values + +def profilesValid (values : List Profile) : Bool := + decide (values ≠ [] ∧ values.length ≤ 32) && StrictOrder.Refinement.ordered profileLess values + +private theorem projected_bytes (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + ConnectionBytes.Refinement.bytes (toStr value bounded).val = StringConstructors.Refinement.utf8Bytes value := by + simp only [ConnectionBytes.Refinement.bytes, toStr, StringConstructors.Refinement.utf8Bytes, List.map_map, List.map_inj_left] + intro byte member + cases byte + rfl + +private theorem graphic_delegation (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_connections.kernel.ascii_graphic_valid (toStr value bounded) 128#usize + ⦃ actual => actual = decide (textValid value) ⦄ := by + change _root_.auths_connections.kernel.ascii_graphic_valid _ _ ⦃ actual => _ ⦄ + apply spec_mono (ConnectionBytes.Refinement.graphic_valid_exact (toStr value bounded) 128#usize) + intro actual meaning + rw [meaning] + apply Bool.eq_iff_iff.mpr + simp only [decide_eq_true_eq, textValid, projected_bytes] + have maximum : (128#usize).val = 128 := by scalar_tac + rw [maximum] + +private theorem text_suffix_exact (remaining : List String) (values : Slice String) (index : Std.Usize) + (suffix : values.val.drop index.val = remaining) + (bounded : ∀ value ∈ values.val, value.toByteArray.size ≤ U32.max) : + kernel.workloads_valid_loop values index ⦃ actual => actual = allText remaining ⦄ := by + induction remaining generalizing index with + | nil => + have finished : ¬ index < values.len := by + have size := congrArg List.length suffix + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold kernel.workloads_valid_loop + rw [loop.eq_def] + simp [kernel.workloads_valid_loop.body, finished, allText] + | cons head rest ih => + obtain ⟨guard, indexed⟩ := Auths.StatusSelection.indexed_head values index head rest suffix + obtain ⟨next, addition, nextValue, nextSuffix⟩ := Auths.StatusSelection.indexed_next values index head rest suffix + have member : head ∈ values.val := by + have inside : index.val < values.val.length := by simpa [Slice.length] using guard + have equal := List.drop_eq_getElem_cons inside + rw [suffix] at equal + exact (List.cons.inj equal).1 ▸ List.getElem_mem inside + have headBound := bounded head member + obtain ⟨allowed, checked, meaning⟩ := spec_imp_exists (graphic_delegation head headBound) + unfold kernel.workloads_valid_loop + rw [loop.eq_def] + simp only [kernel.workloads_valid_loop.body, guard, ↓reduceIte, indexed, + alloc.string.String.as_bytes, _root_.alloc.string.String.as_bytes, headBound, + ↓reduceDIte, checked, bind_tc_ok] + cases accepted : allowed + · simp [accepted, allText, ← meaning] + · simp only [accepted, ↓reduceIte, addition, bind_tc_ok] + change kernel.workloads_valid_loop values next ⦃ actual => actual = allText (head :: rest) ⦄ + simpa [allText, ← meaning, accepted] using ih next nextSuffix + +@[step] theorem workloads_exact (values : Slice String) + (bounded : ∀ value ∈ values.val, value.toByteArray.size ≤ U32.max) : + kernel.workloads_valid values ⦃ actual => actual = workloadsValid values.val ⦄ := by + have limit : model.MAX_WORKLOADS.val = 256 := by unfold model.MAX_WORKLOADS; scalar_tac + unfold kernel.workloads_valid + step as ⟨empty, emptyMeaning⟩ + cases empty + · simp only [Bool.false_eq_true, ↓reduceIte] + have nonempty : values.val ≠ [] := by simpa [Slice.length] using emptyMeaning.symm + split <;> rename_i exceeds + · have large : 256 < values.val.length := by simpa [Slice.length, limit] using exceeds + simp [workloadsValid, large.not_ge] + · have fits : values.val.length ≤ 256 := by simpa [Slice.length, limit] using exceeds + step with text_order_exact as ⟨ordered, orderedMeaning⟩ + cases accepted : ordered + · simp [accepted, workloadsValid, nonempty, fits, ← orderedMeaning] + · simp only [accepted, ↓reduceIte] + simpa [workloadsValid, nonempty, fits, ← orderedMeaning, accepted] using text_suffix_exact values.val values 0#usize (by simp) bounded + · have empty : values.val = [] := by simpa [Slice.length] using emptyMeaning.symm + simp [workloadsValid, empty] + +@[step] theorem profiles_exact (values : Slice Profile) : + kernel.profiles_valid values ⦃ actual => actual = profilesValid values.val ⦄ := by + have limit : model.MAX_PROFILES.val = 32 := by unfold model.MAX_PROFILES; scalar_tac + unfold kernel.profiles_valid + step as ⟨empty, emptyMeaning⟩ + cases empty + · simp only [Bool.false_eq_true, ↓reduceIte] + have nonempty : values.val ≠ [] := by simpa [Slice.length] using emptyMeaning.symm + split <;> rename_i fits + · have bound : values.val.length ≤ 32 := by simpa [Slice.length, limit] using fits + change _root_.auths_connections.kernel.strictly_sorted_unique _ values ⦃ actual => _ ⦄ + simpa [profilesValid, nonempty, bound] using StrictOrder.Refinement.strict_order_exact _ profileLess profile_comparison values + · have large : ¬ values.val.length ≤ 32 := by simpa [Slice.length, limit] using fits + simp [profilesValid, large] + · have empty : values.val = [] := by simpa [Slice.length] using emptyMeaning.symm + simp [profilesValid, empty] + + +def stateView : State → _root_.auths_connections.model.ConnectionState + | .Active => .Active + | .Disabled => .Disabled + | .Revoked => .Revoked + +@[step] private theorem times_exact (state : State) (created updated : Std.U64) (revoked : Option Std.U64) : + auths_connections.kernel.record_times_valid state created updated revoked ⦃ actual => + actual = decide (RecordTimes.Refinement.valid (stateView state) created.val updated.val (revoked.map (·.val))) ⦄ := by + have same : auths_connections.kernel.record_times_valid state created updated revoked = + _root_.auths_connections.kernel.record_times_valid (stateView state) created updated revoked := by + cases state <;> cases revoked <;> rfl + rw [same] + exact RecordTimes.Refinement.record_times_exact (stateView state) created updated revoked + +def verdict (workloads : List String) (profiles : List Profile) (state : State) + (created updated : Nat) (revoked : Option Nat) : core.result.Result Unit Error := + if workloadsValid workloads then + if profilesValid profiles then + if RecordTimes.Refinement.valid (stateView state) created updated revoked then .Ok () + else .Err .InvalidTimestamps + else .Err .InvalidProfiles + else .Err .InvalidWorkloads + +@[step] theorem record_shape_exact (workloads : Slice String) (profiles : Slice Profile) (state : State) + (created updated : Std.U64) (revoked : Option Std.U64) + (bounded : ∀ value ∈ workloads.val, value.toByteArray.size ≤ U32.max) : + kernel.validate_record_shape workloads profiles state created updated revoked ⦃ actual => + actual = verdict workloads.val profiles.val state created.val updated.val (revoked.map (·.val)) ⦄ := by + unfold kernel.validate_record_shape + step with workloads_exact workloads bounded as ⟨works, workMeaning⟩ + cases accepted : works + · simp [accepted, verdict, ← workMeaning] + · simp only [accepted, ↓reduceIte] + step with profiles_exact as ⟨profs, profileMeaning⟩ + cases acceptedProfiles : profs + · simp [acceptedProfiles, verdict, ← workMeaning, accepted, ← profileMeaning] + · simp only [acceptedProfiles, ↓reduceIte] + step with times_exact as ⟨times, timeMeaning⟩ + cases acceptedTimes : times <;> + simp_all [verdict] + +private theorem all_text_exact (values : List String) : + allText values = true ↔ ∀ value ∈ values, textValid value := by + induction values with + | nil => simp [allText] + | cons head rest ih => simp [allText, ih] + +private theorem text_less_transitive (a b c : String) : + textLess a b = true → textLess b c = true → textLess a c = true := by + simp only [textLess, decide_eq_true_eq] + exact lt_trans + +private theorem text_less_irreflexive (value : String) : textLess value value = false := by + simp [textLess] + +private theorem profile_less_transitive (a b c : Profile) : + profileLess a b = true → profileLess b c = true → profileLess a c = true := by + simp only [profileLess, decide_eq_true_eq] + intro left right + rcases left with left | ⟨idsLeft, versionsLeft⟩ <;> + rcases right with right | ⟨idsRight, versionsRight⟩ + · exact Or.inl (lt_trans left right) + · exact Or.inl (idsRight ▸ left) + · exact Or.inl (idsLeft.symm ▸ right) + · exact Or.inr ⟨idsLeft.trans idsRight, by omega⟩ + +private theorem profile_less_irreflexive (value : Profile) : profileLess value value = false := by + simp [profileLess] + +/-- The record's collection/text/time requirements, stated without an algorithm +or its acceptance predicate. Ordering is global over every earlier/later pair. -/ +def requirements (workloads : List String) (profiles : List Profile) (state : State) + (created updated : Nat) (revoked : Option Nat) : Prop := + workloads ≠ [] ∧ workloads.length ≤ 256 ∧ + workloads.Pairwise (fun a b => a < b) ∧ (∀ value ∈ workloads, textValid value) ∧ + profiles ≠ [] ∧ profiles.length ≤ 32 ∧ + profiles.Pairwise (fun a b => a.id < b.id ∨ (a.id = b.id ∧ a.version.val < b.version.val)) ∧ + RecordTimes.Refinement.valid (stateView state) created updated revoked + +private theorem ordered_of_pairwise {T : Type} (less : T → T → Bool) + (values : List T) (sorted : values.Pairwise (fun a b => less a b = true)) : + StrictOrder.Refinement.ordered less values = true := by + induction values with + | nil => rfl + | cons first rest ih => + have facts := List.pairwise_cons.mp sorted + have tailOrder := ih facts.2 + cases rest with + | nil => rfl + | cons next tail => + have firstNext := facts.1 next (by simp) + simpa only [StrictOrder.Refinement.ordered, StrictOrder.Refinement.chain, + Bool.and_eq_true] using And.intro firstNext tailOrder + +private theorem ordered_iff_pairwise {T : Type} (less : T → T → Bool) + (transitive : ∀ a b c, less a b = true → less b c = true → less a c = true) + (values : List T) : + StrictOrder.Refinement.ordered less values = true ↔ values.Pairwise (fun a b => less a b = true) := + ⟨StrictOrder.Refinement.ordered_implies_pairwise less transitive values, ordered_of_pairwise less values⟩ + +private theorem workloads_iff (values : List String) : + workloadsValid values = true ↔ values ≠ [] ∧ values.length ≤ 256 ∧ + values.Pairwise (fun a b => a < b) ∧ ∀ value ∈ values, textValid value := by + simp only [workloadsValid, Bool.and_eq_true, decide_eq_true_eq, + ordered_iff_pairwise textLess text_less_transitive, textLess, all_text_exact] + tauto + +private theorem profiles_iff (values : List Profile) : + profilesValid values = true ↔ values ≠ [] ∧ values.length ≤ 32 ∧ + values.Pairwise (fun a b => a.id < b.id ∨ (a.id = b.id ∧ a.version.val < b.version.val)) := by + simp only [profilesValid, Bool.and_eq_true, decide_eq_true_eq, + ordered_iff_pairwise profileLess profile_less_transitive, profileLess] + tauto + +private theorem verdict_iff (workloads : List String) (profiles : List Profile) (state : State) + (created updated : Nat) (revoked : Option Nat) : + verdict workloads profiles state created updated revoked = .Ok () ↔ + requirements workloads profiles state created updated revoked := by + have meaning : requirements workloads profiles state created updated revoked ↔ + workloadsValid workloads = true ∧ profilesValid profiles = true ∧ + RecordTimes.Refinement.valid (stateView state) created updated revoked := by + rw [workloads_iff, profiles_iff] + unfold requirements + tauto + rw [meaning] + unfold verdict + cases works : workloadsValid workloads <;> cases profs : profilesValid profiles <;> + simp only [works, profs, Bool.false_eq_true, ↓reduceIte, false_and, true_and] + all_goals try split_ifs + all_goals simp_all + + +private theorem success_invariants_core (workloads : Slice String) (profiles : Slice Profile) (state : State) + (created updated : Std.U64) (revoked : Option Std.U64) + (bounded : ∀ value ∈ workloads.val, value.toByteArray.size ≤ U32.max) : + kernel.validate_record_shape workloads profiles state created updated revoked ⦃ actual => + actual = .Ok () → + workloads.val ≠ [] ∧ workloads.val.length ≤ 256 ∧ workloads.val.Nodup ∧ + (∀ value ∈ workloads.val, textValid value) ∧ + profiles.val ≠ [] ∧ profiles.val.length ≤ 32 ∧ profiles.val.Nodup ∧ + RecordTimes.Refinement.valid (stateView state) created.val updated.val (revoked.map (·.val)) ⦄ := by + step with record_shape_exact workloads profiles state created updated revoked bounded as ⟨actual, meaning⟩ + rename_i accepted + rw [accepted] at meaning + unfold verdict at meaning + split at meaning <;> rename_i works + · split at meaning <;> rename_i profs + · split at meaning <;> rename_i times + · have workFacts := works + have profileFacts := profs + simp only [workloadsValid, Bool.and_eq_true, decide_eq_true_eq] at workFacts + simp only [profilesValid, Bool.and_eq_true, decide_eq_true_eq] at profileFacts + exact ⟨workFacts.1.1.1, workFacts.1.1.2, + StrictOrder.Refinement.ordered_implies_no_duplicates textLess text_less_transitive text_less_irreflexive _ workFacts.1.2, + (all_text_exact _).mp workFacts.2, + profileFacts.1.1, profileFacts.1.2, + StrictOrder.Refinement.ordered_implies_no_duplicates profileLess profile_less_transitive profile_less_irreflexive _ profileFacts.2, + times⟩ + · contradiction + · contradiction + · contradiction +/-- Exact acceptance against independent global requirements, together with the +success-earned bounds, text validity, duplicate absence and time shape. -/ +theorem success_earns_all_invariants (workloads : Slice String) (profiles : Slice Profile) (state : State) + (created updated : Std.U64) (revoked : Option Std.U64) + (bounded : ∀ value ∈ workloads.val, value.toByteArray.size ≤ U32.max) : + auths_connections.kernel.validate_record_shape workloads profiles state created updated revoked ⦃ actual => + (actual = .Ok () ↔ requirements workloads.val profiles.val state created.val updated.val (revoked.map (·.val))) ∧ + (actual = .Ok () → + workloads.val ≠ [] ∧ workloads.val.length ≤ 256 ∧ workloads.val.Nodup ∧ + (∀ value ∈ workloads.val, textValid value) ∧ + profiles.val ≠ [] ∧ profiles.val.length ≤ 32 ∧ profiles.val.Nodup ∧ + RecordTimes.Refinement.valid (stateView state) created.val updated.val (revoked.map (·.val))) ⦄ := by + obtain ⟨actual, evaluated, invariants⟩ := spec_imp_exists + (success_invariants_core workloads profiles state created updated revoked bounded) + have exactMeaning := record_shape_exact workloads profiles state created updated revoked bounded + simp only [evaluated, spec_ok] at exactMeaning + simp only [evaluated, spec_ok] + constructor + · rw [exactMeaning] + exact verdict_iff _ _ _ _ _ _ + · exact invariants + +end Auths.Product.RecordShape.Refinement diff --git a/formal/Auths/Product/RecordTimesRefinement.lean b/formal/Auths/Product/RecordTimesRefinement.lean new file mode 100644 index 000000000..0ddf65d27 --- /dev/null +++ b/formal/Auths/Product/RecordTimesRefinement.lean @@ -0,0 +1,64 @@ +import qualification.aeneas.generated.connections.Funs +import Auths.Product.RecoveryGateRefinement +import Mathlib.Tactic +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +namespace Auths.Product.RecordTimes.Refinement +open model + + +def valid (state : ConnectionState) (created updated : Nat) (revoked : Option Nat) : Prop := + created ≤ updated ∧ match state, revoked with + | .Revoked, some atTime => created ≤ atTime ∧ atTime ≤ updated + | .Revoked, none => False + | .Active, none | .Disabled, none => True + | .Active, some _ | .Disabled, some _ => False +instance (state : ConnectionState) (created updated : Nat) (revoked : Option Nat) : + Decidable (valid state created updated revoked) := by + cases state <;> cases revoked <;> unfold valid <;> infer_instance + +@[step] theorem record_times_exact (state : ConnectionState) (created updated : Std.U64) (revoked : Option Std.U64) : + kernel.record_times_valid state created updated revoked ⦃ actual => + actual = decide (valid state created.val updated.val (revoked.map (·.val))) ⦄ := by + cases hstate : state <;> cases hrevoked : revoked <;> unfold kernel.record_times_valid + all_goals repeat' split + all_goals simp_all [spec_ok, valid, UScalar.lt_equiv, UScalar.le_equiv] + +theorem success_earns_order (state : ConnectionState) (created updated : Std.U64) (revoked : Option Std.U64) : + kernel.record_times_valid state created updated revoked ⦃ actual => actual = true → created.val ≤ updated.val ⦄ := by + step with record_times_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have checked : valid state created.val updated.val (revoked.map (·.val)) := by simpa using exactMeaning.symm + exact checked.1 + +theorem success_earns_revocation_shape (state : ConnectionState) (created updated : Std.U64) (revoked : Option Std.U64) : + kernel.record_times_valid state created updated revoked ⦃ actual => actual = true → + (state = .Revoked ↔ revoked.isSome = true) ∧ + ∀ atTime, revoked = some atTime → created.val ≤ atTime.val ∧ atTime.val ≤ updated.val ⦄ := by + step with record_times_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have checked : valid state created.val updated.val (revoked.map (·.val)) := by simpa using exactMeaning.symm + cases hstate : state <;> cases hrevoked : revoked <;> simp_all [valid] + +theorem state_change_preserves_valid_time (current next : ConnectionState) + (created previous proposed : Nat) (revoked : Option Nat) + (before : valid current created previous revoked) + (allowed : current ≠ .Revoked ∧ current ≠ next ∧ previous ≤ proposed) : + valid next created proposed (if next = .Revoked then some proposed else none) := by + have ordered := before.1 + cases hnext : next <;> simp_all [valid] + all_goals omega + +theorem data_change_preserves_valid_time (state : ConnectionState) + (created previous proposed : Nat) (revoked : Option Nat) + (before : valid state created previous revoked) + (allowed : state ≠ .Revoked ∧ previous ≤ proposed) : + valid state created proposed none := by + have ordered := before.1 + cases hstate : state <;> simp_all [valid] + all_goals omega + +end Auths.Product.RecordTimes.Refinement diff --git a/formal/Auths/Product/RecoveryGateRefinement.lean b/formal/Auths/Product/RecoveryGateRefinement.lean new file mode 100644 index 000000000..cff723a59 --- /dev/null +++ b/formal/Auths/Product/RecoveryGateRefinement.lean @@ -0,0 +1,110 @@ +import qualification.aeneas.generated.connections.Funs +import Mathlib.Tactic +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +namespace Auths.Product.RecoveryGate.Refinement +open model + +deriving instance DecidableEq for ConnectionState + +@[step] theorem recovery_exact (state : ConnectionState) (current requested : Std.U64) : + kernel.recovery_lease state current requested ⦃ actual => + actual = if state = .Revoked then .Err .Revoked + else if current.val = 0 ∨ requested.val = 0 ∨ current.val < requested.val + then .Err .InvalidGeneration else .Ok () ⦄ := by + cases hstate : state <;> unfold kernel.recovery_lease + all_goals simp only [reduceCtorEq, ↓reduceIte, UScalar.eq_equiv, UScalar.lt_equiv, UScalar.ofNatCore_val_eq] + all_goals repeat' split + all_goals simp_all [spec_ok] + all_goals omega + +theorem revoked_refuses_every_generation (current requested : Std.U64) : + kernel.recovery_lease .Revoked current requested ⦃ actual => actual = .Err .Revoked ⦄ := by + exact recovery_exact .Revoked current requested + +theorem success_earns_generation_and_state (state : ConnectionState) (current requested : Std.U64) : + kernel.recovery_lease state current requested ⦃ actual => actual = .Ok () → + state ≠ .Revoked ∧ 0 < requested.val ∧ requested.val ≤ current.val ⦄ := by + step with recovery_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + split at exactMeaning + · contradiction + · split at exactMeaning + · contradiction + · simp_all + omega + +@[step] theorem binding_requirement_exact (current operation credential : Std.U64) : + kernel.recovery_binding_requirement current operation credential ⦃ actual => + actual = if current.val = 0 ∨ operation.val = 0 ∨ credential.val = 0 ∨ operation.val < credential.val + then kernel.RecoveryBindingRequirement.Refuse + else if operation.val < current.val then .RecordedCommitment + else if credential.val = current.val then .CurrentCommitment else .Refuse ⦄ := by + unfold kernel.recovery_binding_requirement + repeat' split + all_goals simp_all [spec_ok, UScalar.eq_equiv, UScalar.le_equiv, UScalar.lt_equiv] + all_goals omega + +theorem current_requirement_earns_exact_generation (current operation credential : Std.U64) : + kernel.recovery_binding_requirement current operation credential ⦃ actual => + actual = .CurrentCommitment → credential = current ∧ 0 < current.val ∧ current.val ≤ operation.val ⦄ := by + step with binding_requirement_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + split at exactMeaning + · contradiction + · split at exactMeaning + · contradiction + · split at exactMeaning + · constructor + · scalar_tac + · constructor <;> omega + · contradiction + +theorem recorded_requirement_earns_older_generation (current operation credential : Std.U64) : + kernel.recovery_binding_requirement current operation credential ⦃ actual => + actual = .RecordedCommitment → 0 < credential.val ∧ credential.val ≤ operation.val ∧ operation.val < current.val ⦄ := by + step with binding_requirement_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + split at exactMeaning + · contradiction + · split at exactMeaning + · constructor + · omega + · constructor <;> omega + · split at exactMeaning <;> contradiction + +@[step] theorem state_transition_exact (current next : ConnectionState) (previous proposed : Std.U64) : + kernel.state_transition_allows current next previous proposed ⦃ actual => + actual = decide (current ≠ .Revoked ∧ current ≠ next ∧ previous.val ≤ proposed.val) ⦄ := by + cases hcurrent : current <;> cases hnext : next <;> unfold kernel.state_transition_allows + all_goals simp only [UScalar.lt_equiv] + all_goals split <;> simp_all [spec_ok] + +theorem state_transition_earns_terminal_and_time (current next : ConnectionState) (previous proposed : Std.U64) : + kernel.state_transition_allows current next previous proposed ⦃ actual => actual = true → + current ≠ .Revoked ∧ current ≠ next ∧ previous.val ≤ proposed.val ⦄ := by + step with state_transition_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + simpa using exactMeaning.symm + + +@[step] theorem record_change_exact (state : ConnectionState) (previous proposed : Std.U64) : + kernel.record_change_allows state previous proposed ⦃ actual => + actual = decide (state ≠ .Revoked ∧ previous.val ≤ proposed.val) ⦄ := by + cases hstate : state <;> unfold kernel.record_change_allows + all_goals simp [spec_ok, UScalar.le_equiv, hstate] + +theorem record_change_earns_terminal_and_time (state : ConnectionState) (previous proposed : Std.U64) : + kernel.record_change_allows state previous proposed ⦃ actual => actual = true → + state ≠ .Revoked ∧ previous.val ≤ proposed.val ⦄ := by + step with record_change_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + simpa using exactMeaning.symm + +end Auths.Product.RecoveryGate.Refinement diff --git a/formal/Auths/Product/Refinement/ByteIdentity.lean b/formal/Auths/Product/Refinement/ByteIdentity.lean new file mode 100644 index 000000000..e8e511c44 --- /dev/null +++ b/formal/Auths/Product/Refinement/ByteIdentity.lean @@ -0,0 +1,77 @@ +import qualification.aeneas.generated.gateway.Funs +import Auths.Product.RequestConstruction +import Mathlib.Tactic +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_gateway_kernel +open Auths.Product.RequestConstruction +namespace Auths.Product.Refinement.ByteIdentity +set_option maxHeartbeats 4000000 + +/-- Exact byte identity, with no string normalization or case folding. -/ +@[step] theorem field_name_equal_exact (left right : Slice Std.U8) : + construct.field_name_equal left right ⦃ result => result = decide (left.val = right.val) ⦄ := by + unfold construct.field_name_equal + dsimp only + by_cases lengths : left.val.length = right.val.length + · have sameLen : left.len = right.len := by scalar_tac + simp only [sameLen, bne_self_eq_false, Bool.false_eq_true, ↓reduceIte] + unfold construct.field_name_equal_loop + apply loop.spec_decr_nat + (measure := fun state => left.val.length - state.1.val) + (inv := fun state => state.1.val ≤ left.val.length ∧ + (state.2 = true ↔ left.val.take state.1.val = right.val.take state.1.val)) + · rintro ⟨position, equal⟩ ⟨within, processed⟩ + unfold construct.field_name_equal_loop.body + dsimp only + split <;> rename_i remaining + · split <;> rename_i running + · have inside : position.val < left.val.length := by simpa using remaining + have rightInside : position.val < right.val.length := by omega + step as ⟨leftByte, leftAt⟩ + step as ⟨rightByte, rightAt⟩ + step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + have before := processed.mp running + rw [nextValue, List.take_succ_eq_append_getElem inside, + List.take_succ_eq_append_getElem rightInside] + simp only [← leftAt, ← rightAt, before, List.append_cancel_left_eq, + List.cons.injEq, and_true, decide_eq_true_eq] + · simp only [spec_ok] + have different : left.val ≠ right.val := by + intro same + have := processed.mpr (by rw [same]) + contradiction + simp [different] + · simp only [spec_ok] + have atEnd : left.val.length ≤ position.val := by simpa using remaining + have completed : left.val.take position.val = left.val := List.take_of_length_le atEnd + have rightCompleted : right.val.take position.val = right.val := List.take_of_length_le (by omega) + simp only [completed, rightCompleted] at processed + exact Bool.eq_iff_iff.mpr (by simpa using processed) + · exact ⟨by simp, by simp⟩ + · have nativeDifferent : left.len ≠ right.len := by + intro same + apply lengths + simpa only [Slice.len_val, Slice.length] using congrArg UScalar.val same + have different : left.val ≠ right.val := fun same => lengths (congrArg List.length same) + simp [nativeDifferent, different] + +@[step] theorem hex_lower_exact (nibble : Std.U8) (small : nibble.val < 16) : + construct.hex_lower nibble ⦃ result => result.val = hexLower nibble.val ⦄ := by + unfold construct.hex_lower hexLower + by_cases low : nibble.val < 10 + · have lowScalar : nibble < 10#u8 := by scalar_tac + simp only [lowScalar, if_true, low] + step as ⟨result, resultEq⟩ + omega + · have highScalar : ¬ nibble < 10#u8 := by scalar_tac + simp only [highScalar, if_false, low] + step as ⟨shifted, shiftedEq⟩ + step as ⟨result, resultEq⟩ + omega + + + + +end Auths.Product.Refinement.ByteIdentity diff --git a/formal/Auths/Product/Refinement/CollectionFence.lean b/formal/Auths/Product/Refinement/CollectionFence.lean new file mode 100644 index 000000000..285591d7c --- /dev/null +++ b/formal/Auths/Product/Refinement/CollectionFence.lean @@ -0,0 +1,46 @@ +import Auths.Product.CollectionFence +import qualification.aeneas.generated.stores.Funs + +open Aeneas Aeneas.Std Result +open Auths.Product.CollectionFence + +namespace Auths.Product.Refinement.CollectionFence + +def cutoffView (current : Option Std.U64) : Option Nat := current.map (·.val) + +theorem translated_window_open_refines_model (expiry : Std.U64) + (current : Option Std.U64) : + auths_stores.gateway_fence.gateway_window_open expiry current = + ok (decide (openWindow (cutoffView current) expiry.val)) := by + cases current with + | none => simp [auths_stores.gateway_fence.gateway_window_open, cutoffView, openWindow] + | some previous => + simp [auths_stores.gateway_fence.gateway_window_open, cutoffView, openWindow] + +theorem translated_advance_refines_model (current : Option Std.U64) + (requested : Std.U64) : + auths_stores.gateway_fence.advance_gateway_collection current requested + ⦃ result => result.val = advance (cutoffView current) requested.val ⦄ := by + cases currentCase : current with + | none => + simp [auths_stores.gateway_fence.advance_gateway_collection, cutoffView, advance] + | some previous => + simp only [auths_stores.gateway_fence.advance_gateway_collection] + split <;> rename_i later + · simp only [Aeneas.Std.WP.spec_ok] + simp only [advance, cutoffView, Option.map_some] + exact (Nat.max_eq_left (by scalar_tac)).symm + · simp only [Aeneas.Std.WP.spec_ok] + simp only [advance, cutoffView, Option.map_some] + exact (Nat.max_eq_right (by scalar_tac)).symm + +theorem translated_closed_window_refuses (cutoff : Nat) (expiry : Std.U64) + (current : Option Std.U64) + (history : History (some cutoff) (cutoffView current)) + (collected : expiry.val ≤ cutoff) : + auths_stores.gateway_fence.gateway_window_open expiry current = ok false := by + rw [translated_window_open_refines_model] + have closed := swept_window_cannot_readmit cutoff expiry.val history collected + simp [closed] + +end Auths.Product.Refinement.CollectionFence diff --git a/formal/Auths/Product/Refinement/EntryDeadline.lean b/formal/Auths/Product/Refinement/EntryDeadline.lean new file mode 100644 index 000000000..0e1ffaadb --- /dev/null +++ b/formal/Auths/Product/Refinement/EntryDeadline.lean @@ -0,0 +1,59 @@ +import Auths.Product.EntryDeadline +import qualification.aeneas.generated.gateway.Funs + +open Aeneas Aeneas.Std Result +open Auths.Product.EntryDeadline + +namespace Auths.Product.Refinement.EntryDeadline + +def boundView (bound : auths_gateway_kernel.deadline.EntryBound) : Bound := + ⟨bound.not_after.val, bound.inclusive⟩ + +theorem translated_entry_time_refines_model (evaluatedAt now : Std.U64) + (bound : auths_gateway_kernel.deadline.EntryBound) : + auths_gateway_kernel.deadline.entry_time_allows evaluatedAt now bound = + ok (decide (admits evaluatedAt.val (boundView bound) now.val)) := by + simp only [auths_gateway_kernel.deadline.entry_time_allows] + split <;> rename_i ordered + · split <;> rename_i before + · simp [admits, permits, boundView, UScalar.le_equiv, UScalar.lt_equiv] at * + omega + · split <;> rename_i equal + · subst now + cases inclusive : bound.inclusive <;> + simp_all [admits, permits, boundView, UScalar.le_equiv] + · simp [admits, permits, boundView, UScalar.le_equiv, UScalar.lt_equiv] at * + omega + · simp [admits, permits, boundView, UScalar.le_equiv] at * + omega + +theorem translated_intersection_refines_model + (left right : auths_gateway_kernel.deadline.EntryBound) : + auths_gateway_kernel.deadline.intersect_entry_bounds left right + ⦃ result => boundView result = meet (boundView left) (boundView right) ⦄ := by + simp only [auths_gateway_kernel.deadline.intersect_entry_bounds, lift, bind_tc_ok, + core.cmp.impls.OrdU64.cmp] + by_cases first : left.not_after.val < right.not_after.val + · have order := Nat.compare_eq_lt.mpr first + simp [order, boundView, meet, first] + · by_cases second : right.not_after.val < left.not_after.val + · have order := Nat.compare_eq_gt.mpr second + simp [order, boundView, meet, first, second] + · have equal : left.not_after.val = right.not_after.val := by omega + have order := Nat.compare_eq_eq.mpr equal + cases inclusive : left.inclusive <;> + simp [order, boundView, meet, first, second, inclusive] + +theorem translated_clock_rollback_refuses (evaluatedAt now : Std.U64) + (bound : auths_gateway_kernel.deadline.EntryBound) + (rollback : now.val < evaluatedAt.val) : + auths_gateway_kernel.deadline.entry_time_allows evaluatedAt now bound = ok false := by + rw [translated_entry_time_refines_model] + have refused : ¬ admits evaluatedAt.val (boundView bound) now.val := by + intro accepted + have ordered := accepted.1 + omega + simp [refused] + + +end Auths.Product.Refinement.EntryDeadline diff --git a/formal/Auths/Product/Refinement/Gateway.lean b/formal/Auths/Product/Refinement/Gateway.lean index ee13c66c5..f477c46fd 100644 --- a/formal/Auths/Product/Refinement/Gateway.lean +++ b/formal/Auths/Product/Refinement/Gateway.lean @@ -1,3 +1,4 @@ +import Auths.Product.Refinement.ByteIdentity import Auths.Product.Recovery import Auths.Product.RelativeCeiling import Auths.Product.RequestConstruction @@ -186,17 +187,7 @@ open Auths.Product.RequestConstruction in open Auths.Product.RequestConstruction in @[step] theorem hex_lower_spec (nibble : Std.U8) (small : nibble.val < 16) : construct.hex_lower nibble ⦃ result => result.val = hexLower nibble.val ⦄ := by - unfold construct.hex_lower hexLower - by_cases low : nibble.val < 10 - · have lowScalar : nibble < 10#u8 := by scalar_tac - simp only [lowScalar, if_true, low] - step as ⟨result, resultEq⟩ - omega - · have highScalar : ¬ nibble < 10#u8 := by scalar_tac - simp only [highScalar, if_false, low] - step as ⟨shifted, shiftedEq⟩ - step as ⟨result, resultEq⟩ - omega + exact ByteIdentity.hex_lower_exact nibble small /-! ## Construction: list lemmas -/ diff --git a/formal/Auths/Product/Refinement/OperationIdentity.lean b/formal/Auths/Product/Refinement/OperationIdentity.lean new file mode 100644 index 000000000..d900b7430 --- /dev/null +++ b/formal/Auths/Product/Refinement/OperationIdentity.lean @@ -0,0 +1,176 @@ +import Auths.Product.OperationIdentity +import Auths.Product.Refinement.Gateway +import Auths.Verifier.StatusLeaves +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.OperationIdentity.Refinement +open Auths.Product.Refinement.Gateway +set_option maxHeartbeats 4000000 +set_option maxRecDepth 4096 +local instance (byte : Nat) : Decidable (Alphanumeric byte) := inferInstanceAs (Decidable (_ ∨ _)) +local instance (byte : Nat) : Decidable (TailByte byte) := inferInstanceAs (Decidable (_ ∨ _)) + +@[step] theorem logical_preimage_exact (namespaceBytes operation : Slice Std.U8) + (namespaceBound : namespaceBytes.val.length ≤ 64) (operationBound : operation.val.length ≤ 128) : + identity.logical_operation_preimage namespaceBytes operation ⦃ output => + vecBytes output = OperationIdentity.preimage ⟨sliceBytes namespaceBytes, sliceBytes operation⟩ ⦄ := by + unfold identity.logical_operation_preimage + simp only [lift, bind_tc_ok] + apply spec_bind (copy_bytes_spec _ (by decide)) + intro prefixValue prefixEq + apply spec_bind (append_bytes_spec _ _ (by simp only [prefixEq]; change 34 + namespaceBytes.val.length < 4294967295; omega)) + intro withNamespace namespaceEq + have pushBound : withNamespace.val.length < Usize.max := by + apply lt_usize_max + simp only [namespaceEq, List.length_append, prefixEq] + change 34 + namespaceBytes.val.length < 4294967295 + omega + apply spec_bind (alloc.vec.Vec.push_spec _ _ pushBound) + intro separated separatorEq + apply spec_mono (append_bytes_spec _ _ (by + simp only [separatorEq, List.length_append, List.length_singleton, namespaceEq, prefixEq] + change 34 + namespaceBytes.val.length + 1 + operation.val.length < 4294967295 + omega)) + intro output outputEq + simp only [vecBytes, byteList, OperationIdentity.preimage, OperationIdentity.domain, + outputEq, separatorEq, namespaceEq, prefixEq, List.map_append, List.map_cons, + List.map_nil, UScalar.ofNatCore_val_eq, List.append_assoc, sliceBytes] + rfl + +private def byteAt (position byte : Nat) : Prop := + if position = 0 then Alphanumeric byte else TailByte byte +local instance (position byte : Nat) : Decidable (byteAt position byte) := by + unfold byteAt + infer_instance + +private def scan : Nat → List Nat → Bool + | _, [] => true + | position, byte :: rest => decide (byteAt position byte) && scan (position + 1) rest + +private theorem scan_tail (position : Nat) (positive : 0 < position) (bytes : List Nat) : + scan position bytes = bytes.all (fun byte => decide (TailByte byte)) := by + induction bytes generalizing position with + | nil => rfl + | cons byte rest ih => simp [scan, byteAt, Nat.ne_of_gt positive, ih (position + 1) (by omega)] + +private theorem classify_exact (position : Std.Usize) (byte : Std.U8) : + (do + let b ← construct.is_alphanumeric byte + if b then ok true else if position > 0#usize then + if byte = 46#u8 then ok true else if byte = 95#u8 then ok true else ok (byte = 45#u8) + else ok false) = ok (decide (byteAt position.val byte.val)) := by + rw [show construct.is_alphanumeric byte = ok (Auths.Product.RequestConstruction.alphanumeric byte.val) from + (spec_imp_exists (is_alphanumeric_spec byte)).choose_spec.1.trans + (congrArg ok (spec_imp_exists (is_alphanumeric_spec byte)).choose_spec.2)] + simp only [bind_tc_ok] + unfold byteAt TailByte Auths.Product.RequestConstruction.alphanumeric + simp only [UScalar.lt_equiv, UScalar.eq_equiv, UScalar.ofNatCore_val_eq] + split_ifs <;> simp_all [Alphanumeric] + all_goals try omega + +private theorem stopped (value : Slice Std.U8) (position : Std.Usize) : + identity.valid_token_loop value position false = ok false := by + unfold identity.valid_token_loop + rw [loop.eq_def] + unfold identity.valid_token_loop.body + by_cases guard : position < value.len <;> simp [guard] + +private theorem loop_suffix (remaining : List Std.U8) (value : Slice Std.U8) (position : Std.Usize) + (suffix : value.val.drop position.val = remaining) : + identity.valid_token_loop value position true ⦃ actual => actual = scan position.val (byteList remaining) ⦄ := by + induction remaining generalizing position with + | nil => + have finished : ¬position < value.len := by + have size := congrArg List.length suffix + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold identity.valid_token_loop + rw [loop.eq_def] + simp [identity.valid_token_loop.body, finished, scan, byteList] + | cons head rest ih => + obtain ⟨guard, indexed⟩ := Auths.StatusSelection.indexed_head value position head rest suffix + obtain ⟨next, addition, nextValue, nextSuffix⟩ := Auths.StatusSelection.indexed_next value position head rest suffix + unfold identity.valid_token_loop + rw [loop.eq_def] + simp only [identity.valid_token_loop.body, guard, ↓reduceIte, indexed, bind_tc_ok, + addition] + have classification := classify_exact position head + obtain ⟨alpha, alphaEval, alphaMeaning⟩ := spec_imp_exists (is_alphanumeric_spec head) + simp only [alphaEval, bind_tc_ok] at classification ⊢ + rw [classification] + simp only [bind_tc_ok] + change (do + let valid := decide (byteAt position.val head.val) + identity.valid_token_loop value next valid) ⦃ actual => actual = scan position.val (byteList (head :: rest)) ⦄ + by_cases valid : byteAt position.val head.val + · simp only [valid, decide_true] + simpa only [scan, byteList, List.map_cons, valid, decide_true, Bool.true_and, nextValue] using ih next nextSuffix + · simp [valid, stopped, scan, byteList] + +/-- The actual bounded ASCII parser agrees with the independent token grammar + on every source carrier, including empty and oversized refusals. -/ +@[step] theorem token_exact (value : Slice Std.U8) (maximum : Std.Usize) : + identity.valid_token value maximum ⦃ actual => + actual = OperationIdentity.validToken (sliceBytes value) maximum.val ⦄ := by + unfold identity.valid_token + simp only [core.slice.Slice.is_empty, bind_tc_ok, decide_eq_true_eq, Slice.len_val, + Slice.length, UScalar.lt_equiv] + by_cases empty : value.val.length = 0 + · have values : value.val = [] := List.length_eq_zero_iff.mp empty + simp [values, OperationIdentity.validToken, sliceBytes, byteList] + · simp only [empty, ↓reduceIte] + by_cases oversized : maximum.val < value.val.length + · have refused : OperationIdentity.validToken (sliceBytes value) maximum.val = false := by + cases values : value.val with + | nil => simp [sliceBytes, byteList, values, OperationIdentity.validToken] + | cons first rest => + have bound : ¬rest.length < maximum.val := by rw [values] at oversized; simp only [List.length_cons] at oversized; omega + simp [sliceBytes, byteList, values, OperationIdentity.validToken, bound] + simp [oversized, refused] + · simp only [oversized, ↓reduceIte] + apply spec_mono (loop_suffix value.val value 0#usize (by simp)) + intro result resultEq + rw [resultEq] + cases values : value.val with + | nil => simp [values] at empty + | cons first rest => + have bound : rest.length < maximum.val := by rw [values] at oversized; simp only [List.length_cons] at oversized; omega + simp [sliceBytes, byteList, values, OperationIdentity.validToken, scan, byteAt, + scan_tail, bound] + rfl + +/-- Successful native namespace checks earn separator safety. Equal actual + preimage bytes then bind both input fields without any hash assumption. -/ +theorem source_preimage_binds_identity + (leftNamespace leftOperation rightNamespace rightOperation : Slice Std.U8) + (leftNamespaceBound : leftNamespace.val.length ≤ 64) + (rightNamespaceBound : rightNamespace.val.length ≤ 64) + (leftOperationBound : leftOperation.val.length ≤ 128) + (rightOperationBound : rightOperation.val.length ≤ 128) + (leftChecked : identity.valid_token leftNamespace 64#usize = ok true) + (rightChecked : identity.valid_token rightNamespace 64#usize = ok true) + (leftOutput rightOutput : alloc.vec.Vec Std.U8) + (leftProduced : identity.logical_operation_preimage leftNamespace leftOperation = ok leftOutput) + (rightProduced : identity.logical_operation_preimage rightNamespace rightOperation = ok rightOutput) + (same : leftOutput.val = rightOutput.val) : + leftNamespace.val = rightNamespace.val ∧ leftOperation.val = rightOperation.val := by + have leftGrammar := token_exact leftNamespace 64#usize + have rightGrammar := token_exact rightNamespace 64#usize + rw [leftChecked, spec_ok] at leftGrammar + rw [rightChecked, spec_ok] at rightGrammar + have leftFraming := logical_preimage_exact leftNamespace leftOperation leftNamespaceBound leftOperationBound + have rightFraming := logical_preimage_exact rightNamespace rightOperation rightNamespaceBound rightOperationBound + rw [leftProduced, spec_ok] at leftFraming + rw [rightProduced, spec_ok] at rightFraming + have framed : OperationIdentity.preimage ⟨sliceBytes leftNamespace, sliceBytes leftOperation⟩ = + OperationIdentity.preimage ⟨sliceBytes rightNamespace, sliceBytes rightOperation⟩ := by + rw [← leftFraming, ← rightFraming] + exact congrArg byteList same + have bound := valid_tokens_bind_identity _ _ leftGrammar.symm rightGrammar.symm framed + constructor + · exact byteList_inj.mp (congrArg Identity.namespaceBytes bound) + · exact byteList_inj.mp (congrArg Identity.operation bound) + +end Auths.Product.OperationIdentity.Refinement diff --git a/formal/Auths/Product/Refinement/SchemaIndex.lean b/formal/Auths/Product/Refinement/SchemaIndex.lean new file mode 100644 index 000000000..7c23e5871 --- /dev/null +++ b/formal/Auths/Product/Refinement/SchemaIndex.lean @@ -0,0 +1,77 @@ +import Auths.Product.SchemaIndex +import Auths.Product.Refinement.Gateway +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.SchemaIndex.Refinement +set_option maxHeartbeats 4000000 +set_option maxRecDepth 4096 + +/-- Exact byte identity, with no string normalization or case folding. -/ +@[step] theorem field_name_equal_spec (left right : Slice Std.U8) : + construct.field_name_equal left right ⦃ result => result = decide (left.val = right.val) ⦄ := by + exact Auths.Product.Refinement.ByteIdentity.field_name_equal_exact left right + +def namesView (names : Slice (alloc.vec.Vec Std.U8)) : List SchemaIndex.Name := + names.val.map (fun fieldName => fieldName.val.map (·.val)) + +/-- Source first-match lookup returns exactly the readable schema position. + The actual compiler uses it on its unique, ordered schema-fieldName snapshot. -/ +@[step] theorem field_index_spec (names : Slice (alloc.vec.Vec Std.U8)) (wanted : Slice Std.U8) : + construct.field_index names wanted ⦃ result => + result.map UScalar.val = SchemaIndex.position (namesView names) (wanted.val.map (·.val)) ⦄ := by + unfold construct.field_index construct.field_index_loop + apply loop.spec_decr_nat + (measure := fun state => names.val.length - state.1.val) + (inv := fun state => state.1.val ≤ names.val.length ∧ + match state.2 with + | some position => SchemaIndex.position (namesView names) (wanted.val.map (·.val)) = some position.val + | none => ∀ index, index < state.1.val → + (namesView names)[index]? ≠ some (wanted.val.map (·.val))) + · rintro ⟨position, found⟩ ⟨bound, processed⟩ + unfold construct.field_index_loop.body + dsimp only + split <;> rename_i within + · cases found with + | some index => + simp only [core.option.Option.is_none] + exact processed.symm + | none => + simp only [core.option.Option.is_none, Option.isNone, ↓reduceIte] + have inside : position.val < names.val.length := by simpa using within + step as ⟨fieldName, nameAt⟩ + step with field_name_equal_spec as ⟨equal, equalSpec⟩ + cases equal + · simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + intro index before + by_cases earlier : index < position.val + · exact processed index earlier + · have sameIndex : index = position.val := by omega + subst index + simp_all [namesView, List.getElem?_map] + exact equalSpec ∘ Auths.Product.Refinement.Gateway.byteList_inj.mp + · simp only [↓reduceIte, bind_tc_ok] + step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + apply SchemaIndex.position_eq_first + · simp_all [namesView, List.getElem?_map] + · exact processed + · simp only [spec_ok] + cases found with + | some index => simpa using processed.symm + | none => + symm + apply (SchemaIndex.absent_iff _ _).mpr + intro member + obtain ⟨index, atIndex⟩ := List.mem_iff_getElem?.mp member + have inside : index < position.val := by + have indexed : index < (namesView names).length := List.getElem?_eq_some_iff.mp atIndex |>.1 + simp only [namesView, List.length_map] at indexed + have atEnd : names.val.length ≤ position.val := by simpa using within + omega + exact processed index inside atIndex + · exact ⟨by simp, by simp⟩ + +end Auths.Product.SchemaIndex.Refinement diff --git a/formal/Auths/Product/ReservationAdmission.lean b/formal/Auths/Product/ReservationAdmission.lean new file mode 100644 index 000000000..0a27544ff --- /dev/null +++ b/formal/Auths/Product/ReservationAdmission.lean @@ -0,0 +1,58 @@ +import Auths.Product.CeilingCount +import Mathlib.Data.List.Forall2 +import Mathlib.Tactic +namespace Auths.Product.ReservationAdmission +open Auths.Product.CeilingCount + +inductive Code where + | admit + | windowExhausted + | sumExhausted + deriving DecidableEq + +abbrev CountRoom (frontiers capacities : List Nat) := List.Forall₂ (· < ·) frontiers capacities +abbrev SumRoom (totals : List Nat) (amount : Nat) (capacities : List Nat) := + List.Forall₂ (fun total cap => total + amount ≤ cap) totals capacities + +def decideReservation (counts countCaps slots slotCaps totals sumCaps : List Nat) (amount : Nat) : Code := + if CountRoom counts countCaps ∧ CountRoom slots slotCaps then + if SumRoom totals amount sumCaps then .admit else .sumExhausted + else .windowExhausted + +theorem counts_admit_iff (values capacities : List Nat) : + countsAdmit values capacities = true ↔ CountRoom values capacities := by + simp [countsAdmit, CountRoom, List.forall₂_iff_zip, List.all_eq_true, Prod.forall] + +theorem sums_admit_iff (values capacities : List Nat) (amount : Nat) : + sumsAdmit values amount capacities = true ↔ SumRoom values amount capacities := by + simp [sumsAdmit, SumRoom, List.forall₂_iff_zip, List.all_eq_true, Prod.forall] + +theorem admitted_iff (counts countCaps slots slotCaps totals sumCaps : List Nat) (amount : Nat) : + decideReservation counts countCaps slots slotCaps totals sumCaps amount = .admit ↔ + CountRoom counts countCaps ∧ CountRoom slots slotCaps ∧ SumRoom totals amount sumCaps := by + by_cases countRoom : CountRoom counts countCaps <;> + by_cases slotRoom : CountRoom slots slotCaps <;> + by_cases sumRoom : SumRoom totals amount sumCaps <;> + simp [decideReservation, countRoom, slotRoom, sumRoom] + +theorem admitted_shapes (counts countCaps slots slotCaps totals sumCaps : List Nat) (amount : Nat) + (admitted : decideReservation counts countCaps slots slotCaps totals sumCaps amount = .admit) : + counts.length = countCaps.length ∧ slots.length = slotCaps.length ∧ totals.length = sumCaps.length := by + have room := (admitted_iff _ _ _ _ _ _ _).mp admitted + exact ⟨room.1.length_eq, room.2.1.length_eq, room.2.2.length_eq⟩ + +theorem admitted_sum_at (counts countCaps slots slotCaps totals sumCaps : List Nat) (amount index : Nat) + (admitted : decideReservation counts countCaps slots slotCaps totals sumCaps amount = .admit) + (inside : index < totals.length) : totals[index]! + amount ≤ sumCaps[index]! := by + have room := ((admitted_iff _ _ _ _ _ _ _).mp admitted).2.2 + have capInside : index < sumCaps.length := by rw [← room.length_eq]; exact inside + have point := room.get inside capInside + simpa only [getElem!_pos totals index inside, getElem!_pos sumCaps index capInside, List.get_eq_getElem] using point + +theorem window_refusal_precedes_sum (counts countCaps slots slotCaps totals sumCaps : List Nat) (amount : Nat) + (exhausted : ¬ CountRoom counts countCaps ∨ ¬ CountRoom slots slotCaps) : + decideReservation counts countCaps slots slotCaps totals sumCaps amount = .windowExhausted := by + simp only [decideReservation] + have noRoom : ¬ (CountRoom counts countCaps ∧ CountRoom slots slotCaps) := by tauto + simp [noRoom] +end Auths.Product.ReservationAdmission diff --git a/formal/Auths/Product/ReservationAdmissionRefinement.lean b/formal/Auths/Product/ReservationAdmissionRefinement.lean new file mode 100644 index 000000000..4b7f60eaf --- /dev/null +++ b/formal/Auths/Product/ReservationAdmissionRefinement.lean @@ -0,0 +1,106 @@ +import Auths.Product.ReservationAdmission +import Auths.Product.Refinement +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_bounded_policy +open Auths.Product.Refinement +namespace Auths.Product.ReservationAdmission.Refinement +set_option maxHeartbeats 2000000 + +def codeView : kernel.ReservationCode → Code + | .Admit => .admit + | .WindowExhausted => .windowExhausted + | .SumExhausted => .sumExhausted + +@[step] theorem reservation_admission_exact + (counts countCaps slots slotCaps totals sumCaps : Slice Std.U64) (amount : Std.U64) : + kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount ⦃ actual => + codeView actual = decideReservation (natList counts.val) (natList countCaps.val) + (natList slots.val) (natList slotCaps.val) (natList totals.val) (natList sumCaps.val) amount.val ⦄ := by + unfold kernel.reservation_admission + step with translated_chain_counts_admit_refines_model as ⟨countsFit, countMeaning⟩ + cases countsFit + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have noRoom : ¬ CountRoom (natList counts.val) (natList countCaps.val) := by + intro room + have admitted := (counts_admit_iff _ _).mpr room + rw [← countMeaning] at admitted + contradiction + simp [codeView, decideReservation, noRoom] + · simp only [↓reduceIte] + have countRoom : CountRoom (natList counts.val) (natList countCaps.val) := + (counts_admit_iff _ _).mp countMeaning.symm + step with translated_chain_counts_admit_refines_model as ⟨slotsFit, slotMeaning⟩ + cases slotsFit + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have noRoom : ¬ CountRoom (natList slots.val) (natList slotCaps.val) := by + intro room + have admitted := (counts_admit_iff _ _).mpr room + rw [← slotMeaning] at admitted + contradiction + simp [codeView, decideReservation, noRoom] + · simp only [↓reduceIte] + have slotRoom : CountRoom (natList slots.val) (natList slotCaps.val) := + (counts_admit_iff _ _).mp slotMeaning.symm + step with translated_chain_sums_admit_refines_model as ⟨sumsFit, sumMeaning⟩ + cases sumsFit + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have noRoom : ¬ SumRoom (natList totals.val) amount.val (natList sumCaps.val) := by + intro room + have admitted := (sums_admit_iff _ _ _).mpr room + rw [← sumMeaning] at admitted + contradiction + simp [codeView, decideReservation, countRoom, slotRoom, noRoom] + · simp only [↓reduceIte, spec_ok] + have sumRoom : SumRoom (natList totals.val) amount.val (natList sumCaps.val) := + (sums_admit_iff _ _ _).mp sumMeaning.symm + simp [codeView, decideReservation, countRoom, slotRoom, sumRoom] + +theorem source_admission_earns_bounds + (counts countCaps slots slotCaps totals sumCaps : Slice Std.U64) (amount : Std.U64) : + kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount ⦃ actual => + actual = .Admit → + CountRoom (natList counts.val) (natList countCaps.val) ∧ + CountRoom (natList slots.val) (natList slotCaps.val) ∧ + SumRoom (natList totals.val) amount.val (natList sumCaps.val) ⦄ := by + step with reservation_admission_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + exact (admitted_iff _ _ _ _ _ _ _).mp exactMeaning.symm + +theorem source_window_refusal_precedes_sum + (counts countCaps slots slotCaps totals sumCaps : Slice Std.U64) (amount : Std.U64) + (exhausted : ¬ CountRoom (natList counts.val) (natList countCaps.val) ∨ + ¬ CountRoom (natList slots.val) (natList slotCaps.val)) : + kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount ⦃ actual => + actual = .WindowExhausted ⦄ := by + step with reservation_admission_exact as ⟨actual, exactMeaning⟩ + rw [window_refusal_precedes_sum _ _ _ _ _ _ _ exhausted] at exactMeaning + cases actual <;> simp_all [codeView] +theorem source_admitted_has_complete_vectors + (counts countCaps slots slotCaps totals sumCaps : Slice Std.U64) (amount : Std.U64) : + kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount ⦃ actual => + actual = .Admit → counts.val.length = countCaps.val.length ∧ + slots.val.length = slotCaps.val.length ∧ totals.val.length = sumCaps.val.length ⦄ := by + step with reservation_admission_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + simpa only [natList, List.length_map] using admitted_shapes _ _ _ _ _ _ _ exactMeaning.symm + +theorem source_admitted_sums_do_not_overflow + (counts countCaps slots slotCaps totals sumCaps : Slice Std.U64) (amount : Std.U64) : + kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount ⦃ actual => + actual = .Admit → ∀ index, index < totals.val.length → + (natList totals.val)[index]! + amount.val ≤ U64.max ⦄ := by + step with reservation_admission_exact as ⟨actual, exactMeaning⟩ + rename_i accepted index inside + rw [accepted] at exactMeaning + have shape := admitted_shapes _ _ _ _ _ _ _ exactMeaning.symm + have capInside : index < sumCaps.val.length := by simpa only [natList, List.length_map] using (show index < (natList sumCaps.val).length by rw [← shape.2.2]; simpa [natList] using inside) + have point := admitted_sum_at _ _ _ _ _ _ _ index exactMeaning.symm (by simpa [natList] using inside) + rw [getElem!_pos (natList sumCaps.val) index (by simpa [natList] using capInside)] at point + have capacityMax : sumCaps.val[index].val ≤ U64.max := by scalar_tac + apply point.trans + simpa only [natList, List.getElem_map] using capacityMax + +end Auths.Product.ReservationAdmission.Refinement diff --git a/formal/Auths/Product/ReservationRetry.lean b/formal/Auths/Product/ReservationRetry.lean new file mode 100644 index 000000000..a27d488d8 --- /dev/null +++ b/formal/Auths/Product/ReservationRetry.lean @@ -0,0 +1,65 @@ +import Mathlib.Tactic +namespace Auths.Product.ReservationRetry +inductive Target where + | replay + | count (position next : Nat) + | sum (position readSlot next : Nat) + | corrupt + deriving DecidableEq + +def wordMax : Nat := 2 ^ 64 - 1 + +def target (index : Nat) (counts sums : List Nat) (totalSize counterSize : Nat) : Target := + if index = 0 then .replay + else + let position := index - 1 + if position < counts.length then + let previous := counts[position]! + if previous < wordMax then .count position (previous + 1) else .corrupt + else + let position := position - counts.length + if position < sums.length ∧ position < totalSize ∧ position < counterSize then + let previous := sums[position]! + if previous < wordMax then .sum position previous (previous + 1) else .corrupt + else .corrupt + +theorem existing_claim_is_replay (counts sums : List Nat) (totalSize counterSize : Nat) : + target 0 counts sums totalSize counterSize = .replay := by simp [target] + +theorem count_progress_exact (index : Nat) (counts sums : List Nat) (totalSize counterSize position next : Nat) + (progress : target index counts sums totalSize counterSize = .count position next) : + index = position + 1 ∧ position < counts.length ∧ + next = counts[position]! + 1 ∧ next ≤ wordMax := by + unfold target at progress + dsimp only at progress + split_ifs at progress <;> simp_all + all_goals rcases progress with ⟨rfl, rfl⟩ + all_goals omega + +theorem sum_progress_exact (index : Nat) (counts sums : List Nat) + (totalSize counterSize position readSlot next : Nat) + (progress : target index counts sums totalSize counterSize = .sum position readSlot next) : + index = counts.length + position + 1 ∧ position < sums.length ∧ + position < totalSize ∧ position < counterSize ∧ + readSlot = sums[position]! ∧ next = readSlot + 1 ∧ next ≤ wordMax := by + unfold target at progress + dsimp only at progress + split_ifs at progress <;> simp_all + all_goals rcases progress with ⟨rfl, rfl, rfl⟩ + all_goals omega + +theorem count_available (counts sums : List Nat) (totalSize counterSize position : Nat) + (inside : position < counts.length) (room : counts[position]! < wordMax) : + target (position + 1) counts sums totalSize counterSize = .count position (counts[position]! + 1) := by + have roomExact : counts[position] < wordMax := by simpa only [getElem!_pos counts position inside] using room + simp [target, inside, roomExact] + +theorem sum_available (counts sums : List Nat) (totalSize counterSize position : Nat) + (inside : position < sums.length) (totals : position < totalSize) (counters : position < counterSize) + (room : sums[position]! < wordMax) : + target (counts.length + position + 1) counts sums totalSize counterSize = + .sum position sums[position]! (sums[position]! + 1) := by + have roomExact : sums[position] < wordMax := by simpa only [getElem!_pos sums position inside] using room + simp [target, inside, totals, counters, roomExact] + +end Auths.Product.ReservationRetry diff --git a/formal/Auths/Product/ReservationRetryRefinement.lean b/formal/Auths/Product/ReservationRetryRefinement.lean new file mode 100644 index 000000000..bfeb74497 --- /dev/null +++ b/formal/Auths/Product/ReservationRetryRefinement.lean @@ -0,0 +1,155 @@ +import qualification.aeneas.generated.gateway.Funs +import Auths.Product.ReservationRetry +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.ReservationRetry.Refinement +set_option maxHeartbeats 4000000 + +def meaning : reservation_retry.RetryTarget → Target + | .Replay => .replay + | .Corrupt => .corrupt + | .Count position next => .count position.val next.val + | .Sum position readSlot next => .sum position.val readSlot.val next.val + +private theorem successor_exact (previous : Std.U64) : + (U64.checked_add previous 1#u64).map (fun value => value.val) = + if previous.val < wordMax then some (previous.val + 1) else none := by + have specification := U64.checked_add_bv_spec previous 1#u64 + cases equation : U64.checked_add previous 1#u64 with + | none => + rw [equation] at specification + simp only [U64.max_eq] at specification + simp only [Option.map_none, wordMax, Nat.reducePow, Nat.reduceSub] + split <;> first | rfl | (exfalso; scalar_tac) + | some next => + rw [equation] at specification + simp only [U64.max_eq] at specification + obtain ⟨within, nextValue, _⟩ := specification + simp only [Option.map_some, wordMax, Nat.reducePow, Nat.reduceSub] + split + · simp only [Option.some.injEq]; scalar_tac + · exfalso; scalar_tac + +private theorem checked_count (position : Std.Usize) (previous : Std.U64) : + (match U64.checked_add previous 1#u64 with + | none => ok reservation_retry.RetryTarget.Corrupt + | some next => ok (reservation_retry.RetryTarget.Count position next)) ⦃ actual => + meaning actual = if previous.val < wordMax then .count position.val (previous.val + 1) else .corrupt ⦄ := by + have nextMeaning := successor_exact previous + cases next : U64.checked_add previous 1#u64 with + | none => + rw [next] at nextMeaning + simp only [Option.map_none] at nextMeaning + split_ifs at nextMeaning ⊢ <;> simp_all [spec_ok, meaning] + | some value => + rw [next] at nextMeaning + simp only [Option.map_some] at nextMeaning + split_ifs at nextMeaning ⊢ <;> simp_all [spec_ok, meaning] + +private theorem checked_sum (position : Std.Usize) (previous : Std.U64) : + (match U64.checked_add previous 1#u64 with + | none => ok reservation_retry.RetryTarget.Corrupt + | some next => ok (reservation_retry.RetryTarget.Sum position previous next)) ⦃ actual => + meaning actual = if previous.val < wordMax then .sum position.val previous.val (previous.val + 1) else .corrupt ⦄ := by + have nextMeaning := successor_exact previous + cases next : U64.checked_add previous 1#u64 with + | none => + rw [next] at nextMeaning + simp only [Option.map_none] at nextMeaning + split_ifs at nextMeaning ⊢ <;> simp_all [spec_ok, meaning] + | some value => + rw [next] at nextMeaning + simp only [Option.map_some] at nextMeaning + split_ifs at nextMeaning ⊢ <;> simp_all [spec_ok, meaning] + +/-- Every native conflict index is interpreted exactly, including malformed + indices, missing parallel arrays and word overflow. No bounds are assumed. -/ +@[step] theorem retry_target_exact (index : Std.Usize) (counts sums : Slice Std.U64) + (totalSize counterSize : Std.Usize) : + reservation_retry.retry_target index counts sums totalSize counterSize ⦃ actual => + meaning actual = target index.val (counts.val.map (fun value => value.val)) (sums.val.map (fun value => value.val)) + totalSize.val counterSize.val ⦄ := by + unfold reservation_retry.retry_target + split <;> rename_i zero + · have zeroNat : index.val = 0 := by scalar_tac + simp only [spec_ok, meaning, target, zeroNat, ↓reduceIte] + · + have nonzero : index.val ≠ 0 := by intro equal; apply zero; scalar_tac + step as ⟨position, positionValue⟩ + have positionNat : position.val = index.val - 1 := by simpa using positionValue + split <;> rename_i countRole + · have inside : position.val < counts.val.length := by simpa using countRole + step as ⟨previous, previousAt⟩ + have projected : (counts.val.map (fun value => value.val))[position.val]! = previous.val := by + simp [getElem!_pos (counts.val.map (fun value => value.val)) position.val (by simpa using inside), previousAt] + have model : target index.val (counts.val.map (fun value => value.val)) (sums.val.map (fun value => value.val)) totalSize.val counterSize.val = + if previous.val < wordMax then .count position.val (previous.val + 1) else .corrupt := by + simp only [target, nonzero, ↓reduceIte, List.length_map, ← positionNat, inside, projected] + rw [model] + simp only [lift, bind_tc_ok] + exact checked_count position previous + · have notCount : ¬ position.val < counts.val.length := by simpa using countRole + step as ⟨sumPosition, sumPositionValue⟩ + have sumPositionNat : sumPosition.val = position.val - counts.val.length := by simpa using sumPositionValue + have model : target index.val (counts.val.map (fun value => value.val)) (sums.val.map (fun value => value.val)) totalSize.val counterSize.val = + if sumPosition.val < sums.val.length ∧ sumPosition.val < totalSize.val ∧ sumPosition.val < counterSize.val then + let previous := (sums.val.map (fun value => value.val))[sumPosition.val]! + if previous < wordMax then .sum sumPosition.val previous (previous + 1) else .corrupt + else .corrupt := by + simp only [target, nonzero, ↓reduceIte, List.length_map, ← positionNat, notCount, ← sumPositionNat] + rw [model] + split <;> rename_i outsideSums + · have outside : ¬sumPosition.val < sums.val.length := by simpa using outsideSums + simp [outside, meaning, spec_ok] + · have inside : sumPosition.val < sums.val.length := by simpa using outsideSums + split <;> rename_i outsideTotals + · have outside : ¬sumPosition.val < totalSize.val := by simpa using outsideTotals + simp [outside, meaning, spec_ok] + · have insideTotals : sumPosition.val < totalSize.val := by simpa using outsideTotals + split <;> rename_i outsideCounters + · have outside : ¬sumPosition.val < counterSize.val := by simpa using outsideCounters + simp [outside, meaning, spec_ok] + · have insideCounters : sumPosition.val < counterSize.val := by simpa using outsideCounters + step as ⟨previous, previousAt⟩ + have projected : (sums.val.map (fun value => value.val))[sumPosition.val]! = previous.val := by + simp [getElem!_pos (sums.val.map (fun value => value.val)) sumPosition.val (by simpa using inside), previousAt] + simp only [inside, insideTotals, insideCounters, and_self, ↓reduceIte, projected, lift, bind_tc_ok] + exact checked_sum sumPosition previous +theorem source_claim_conflict_is_replay (counts sums : Slice Std.U64) (totalSize counterSize : Std.Usize) : + reservation_retry.retry_target 0#usize counts sums totalSize counterSize ⦃ actual => + actual = .Replay ⦄ := by + apply spec_mono (retry_target_exact 0#usize counts sums totalSize counterSize) + intro actual exactResult + have matched : meaning actual = .replay := by simpa [target] using exactResult + cases actual <;> simp_all [meaning] + +theorem source_count_progress_safe (index : Std.Usize) (counts sums : Slice Std.U64) + (totalSize counterSize : Std.Usize) : + reservation_retry.retry_target index counts sums totalSize counterSize ⦃ actual => + ∀ position next, meaning actual = .count position next → + index.val = position + 1 ∧ position < counts.val.length ∧ + next = (counts.val.map (fun value => value.val))[position]! + 1 ∧ next ≤ wordMax ⦄ := by + apply spec_mono (retry_target_exact index counts sums totalSize counterSize) + intro actual exactResult position next returned + have modelResult := exactResult.symm.trans returned + simpa only [List.length_map] using + count_progress_exact index.val (counts.val.map (fun value => value.val)) + (sums.val.map (fun value => value.val)) totalSize.val counterSize.val position next modelResult + +theorem source_sum_progress_safe (index : Std.Usize) (counts sums : Slice Std.U64) + (totalSize counterSize : Std.Usize) : + reservation_retry.retry_target index counts sums totalSize counterSize ⦃ actual => + ∀ position readSlot next, meaning actual = .sum position readSlot next → + index.val = counts.val.length + position + 1 ∧ position < sums.val.length ∧ + position < totalSize.val ∧ position < counterSize.val ∧ + readSlot = (sums.val.map (fun value => value.val))[position]! ∧ + next = readSlot + 1 ∧ next ≤ wordMax ⦄ := by + apply spec_mono (retry_target_exact index counts sums totalSize counterSize) + intro actual exactResult position readSlot next returned + have modelResult := exactResult.symm.trans returned + simpa only [List.length_map] using + sum_progress_exact index.val (counts.val.map (fun value => value.val)) + (sums.val.map (fun value => value.val)) totalSize.val counterSize.val position readSlot next modelResult + +end Auths.Product.ReservationRetry.Refinement diff --git a/formal/Auths/Product/SchemaIndex.lean b/formal/Auths/Product/SchemaIndex.lean new file mode 100644 index 000000000..2682eca53 --- /dev/null +++ b/formal/Auths/Product/SchemaIndex.lean @@ -0,0 +1,112 @@ +import Auths.Product.RequestConstruction +import Mathlib.Tactic +namespace Auths.Product.SchemaIndex +open RequestConstruction +abbrev Name := Bytes + +def position : List Name → Name → Option Nat + | [], _ => none + | field :: rest, wanted => + if field = wanted then some 0 else (position rest wanted).map Nat.succ + +theorem position_points_to_name (fields : List Name) (wanted : Name) (index : Nat) + (found : position fields wanted = some index) : fields[index]? = some wanted := by + induction fields generalizing index with + | nil => simp [position] at found + | cons field rest ih => + by_cases same : field = wanted + · simp [position, same] at found + subst index + simp [same] + · simp only [position, same, ↓reduceIte] at found + cases tail : position rest wanted with + | none => simp [tail] at found + | some next => + simp only [tail, Option.map_some, Option.some.injEq] at found + subst index + simpa using ih next tail + +theorem absent_iff (fields : List Name) (wanted : Name) : + position fields wanted = none ↔ wanted ∉ fields := by + induction fields with + | nil => simp [position] + | cons field rest ih => + by_cases same : field = wanted + · simp [position, same] + · simp [position, same, ih, Ne.symm same] + +theorem position_eq_first (fields : List Name) (wanted : Name) (index : Nat) + (atIndex : fields[index]? = some wanted) + (first : ∀ earlier, earlier < index → fields[earlier]? ≠ some wanted) : + position fields wanted = some index := by + induction fields generalizing index with + | nil => simp at atIndex + | cons field rest ih => + cases index with + | zero => + have same : field = wanted := by simpa using atIndex + simp [position, same] + | succ index => + have different : field ≠ wanted := by + intro same + exact first 0 (by omega) (by simp [same]) + have tail : rest[index]? = some wanted := by simpa using atIndex + have earliest : ∀ earlier, earlier < index → rest[earlier]? ≠ some wanted := by + intro earlier before + simpa using first (earlier + 1) (by omega) + simp [position, different, ih index tail earliest] + +/-- A named argument environment and its positional projection agree at every + declared schema position. This relation is independent of lowered plans. -/ +def Aligned (fields : List Name) (arguments : List Arg) (named : Name → Option Arg) : Prop := + fields.length = arguments.length ∧ + ∀ (index : Nat) (name : Name), fields[index]? = some name → arguments[index]? = named name + +theorem indexed_argument_is_named (fields : List Name) (arguments : List Arg) + (named : Name → Option Arg) (aligned : Aligned fields arguments named) + (name : Name) (index : Nat) (lowered : position fields name = some index) : + arguments[index]? = named name := + aligned.2 index name (position_points_to_name fields name index lowered) + +inductive NamedSegment where + | fixed (bytes : Bytes) + | field (name : Name) + deriving DecidableEq + +def lowerSegment (fields : List Name) : NamedSegment → Option Segment + | .fixed bytes => some (.fixed bytes) + | .field name => (position fields name).map Segment.field + +def namedSegmentBytes (named : Name → Option Arg) : NamedSegment → Option Bytes + | .fixed bytes => some bytes + | .field name => + match named name with + | some (.text bytes) => some (pathEncode bytes) + | _ => none + +/-- Successful lowering cannot substitute a similarly named argument. -/ +theorem lowered_field_uses_exact_name (fields : List Name) (arguments : List Arg) + (named : Name → Option Arg) (aligned : Aligned fields arguments named) + (name : Name) (index : Nat) (lowered : lowerSegment fields (.field name) = some (.field index)) : + arguments[index]? = named name := by + simp only [lowerSegment] at lowered + have found : position fields name = some index := by + cases candidate : position fields name <;> simp_all + exact indexed_argument_is_named fields arguments named aligned name index found + +/-- Naming an undeclared field cannot produce a positional field reference. -/ +theorem undeclared_field_refused (fields : List Name) (name : Name) (absent : name ∉ fields) : + lowerSegment fields (.field name) = none := by + simp [lowerSegment, (absent_iff fields name).mpr absent] + +/-- A reference to an exact field in the source has the same bytes after + positional lowering, under the independently stated projection relation. -/ +theorem field_rendering_preserved (fields : List Name) (arguments : List Arg) + (named : Name → Option Arg) (aligned : Aligned fields arguments named) + (name : Name) (index : Nat) (value : Bytes) + (lowered : position fields name = some index) (provided : named name = some (.text value)) : + segmentBytes arguments (.field index) = pathEncode value := by + have same := indexed_argument_is_named fields arguments named aligned name index lowered + simp [segmentBytes, same, provided] + +end Auths.Product.SchemaIndex diff --git a/formal/Auths/Product/SemanticId.lean b/formal/Auths/Product/SemanticId.lean new file mode 100644 index 000000000..0acce4309 --- /dev/null +++ b/formal/Auths/Product/SemanticId.lean @@ -0,0 +1,23 @@ +import Mathlib.Tactic +namespace Auths.Product.SemanticId +abbrev Bytes := List Nat +def head (value : Nat) : Prop := (97 ≤ value ∧ value ≤ 122) ∨ (65 ≤ value ∧ value ≤ 90) ∨ (48 ≤ value ∧ value ≤ 57) +def tail (value : Nat) : Prop := head value ∨ value = 46 ∨ value = 95 ∨ value = 58 ∨ value = 47 ∨ value = 45 +instance (value : Nat) : Decidable (head value) := by unfold head; infer_instance +instance (value : Nat) : Decidable (tail value) := by unfold tail; infer_instance +def valid (value : Bytes) (maximum : Nat) : Prop := + value ≠ [] ∧ value.length ≤ maximum ∧ head value[0]! ∧ ∀ byte ∈ value, tail byte +instance (value : Bytes) (maximum : Nat) : Decidable (valid value maximum) := by unfold valid; infer_instance + +theorem valid_has_no_nul (value : Bytes) (maximum : Nat) (accepted : valid value maximum) : 0 ∉ value := by + intro member + have permitted := accepted.2.2.2 0 member + simp [tail, head] at permitted + +theorem valid_is_ascii (value : Bytes) (maximum : Nat) (accepted : valid value maximum) : + ∀ byte ∈ value, byte < 128 := by + intro byte member + have permitted := accepted.2.2.2 byte member + simp only [tail, head] at permitted + omega +end Auths.Product.SemanticId diff --git a/formal/Auths/Product/SemanticIdRefinement.lean b/formal/Auths/Product/SemanticIdRefinement.lean new file mode 100644 index 000000000..5b7091a31 --- /dev/null +++ b/formal/Auths/Product/SemanticIdRefinement.lean @@ -0,0 +1,132 @@ +import qualification.aeneas.generated.connections.Funs +import Auths.Product.SemanticId +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_connections +namespace Auths.Product.SemanticId.Refinement +abbrev bytes (values : List Std.U8) : List Nat := values.map (·.val) +@[step] theorem semantic_head_exact (byte : Std.U8) : + kernel.semantic_head_valid byte ⦃ actual => actual = decide (head byte.val) ⦄ := by + unfold kernel.semantic_head_valid + repeat' split + all_goals simp_all only [spec_ok, head] + all_goals apply Bool.eq_iff_iff.mpr + all_goals simp only [decide_eq_true_eq, true_iff] + all_goals scalar_tac + +@[step] theorem semantic_tail_exact (byte : Std.U8) : + kernel.semantic_tail_valid byte ⦃ actual => actual = decide (tail byte.val) ⦄ := by + unfold kernel.semantic_tail_valid + step with semantic_head_exact as ⟨allowed, allowedMeaning⟩ + repeat' split + all_goals simp_all only [spec_ok, tail, UScalar.eq_equiv] + all_goals apply Bool.eq_iff_iff.mpr + all_goals simp only [decide_eq_true_eq, true_iff] + all_goals simp_all + +@[step] theorem semantic_valid_exact (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.semantic_id_valid value maximum ⦃ actual => + actual = decide (valid (bytes value.val) maximum.val) ⦄ := by + unfold kernel.semantic_id_valid + step as ⟨empty, emptyMeaning⟩ + cases empty + · simp only [Bool.false_eq_true, ↓reduceIte] + have nonempty : value.val ≠ [] := by simpa [Slice.length] using emptyMeaning.symm + have firstInside : 0 < value.val.length := List.length_pos_iff.mpr nonempty + split <;> rename_i exceeds + · simp only [spec_ok] + have tooLarge : maximum.val < value.val.length := by simpa using exceeds + simp [valid, bytes, tooLarge.not_ge] + · have fits : value.val.length ≤ maximum.val := by simpa using exceeds + step as ⟨first, firstMeaning⟩ + have firstAt : (bytes value.val)[0]! = first.val := by + rw [getElem!_pos (bytes value.val) 0 (by simpa using firstInside)] + simp [bytes, ← firstMeaning] + step with semantic_head_exact as ⟨allowed, allowedMeaning⟩ + cases allowed + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have invalid : ¬ valid (bytes value.val) maximum.val := by + intro accepted + have permitted := accepted.2.2.1 + rw [firstAt] at permitted + simp [permitted] at allowedMeaning + simp [invalid] + · simp only [↓reduceIte] + have firstValid : head (bytes value.val)[0]! := by + rw [firstAt] + simpa using allowedMeaning.symm + unfold kernel.semantic_id_valid_loop + apply loop.spec_decr_nat + (measure := fun index => value.val.length - index.val) + (inv := fun index => index.val ≤ value.val.length ∧ ∀ byte ∈ value.val.take index.val, tail byte.val) + · intro index processed + unfold kernel.semantic_id_valid_loop.body + dsimp only + split <;> rename_i within + · have inside : index.val < value.val.length := by simpa using within + step as ⟨byte, byteAt⟩ + step with semantic_tail_exact as ⟨allowed, allowedMeaning⟩ + cases allowed + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have invalid : ¬ valid (bytes value.val) maximum.val := by + intro valid + have member : byte.val ∈ bytes value.val := by + apply List.mem_map.mpr + exact ⟨byte, by rw [byteAt]; exact List.getElem_mem inside, rfl⟩ + have bound := valid.2.2.2 byte.val member + simp [bound] at allowedMeaning + simp [invalid] + · simp only [↓reduceIte] + step as ⟨next, nextEq⟩ + have permitted : tail byte.val := by simpa using allowedMeaning.symm + refine ⟨by omega, ?_, by omega⟩ + rw [nextEq, List.take_succ_eq_append_getElem inside] + simp only [List.mem_append, List.mem_cons, List.not_mem_nil, or_false] + intro current member + rcases member with earlier | rfl + · exact processed.2 current earlier + · simpa only [← byteAt] using permitted + · simp only [spec_ok] + have atEnd : value.val.length ≤ index.val := by simpa using within + have complete : ∀ byte ∈ value.val, tail byte.val := by + simpa only [List.take_of_length_le atEnd] using processed.2 + have valid : valid (bytes value.val) maximum.val := by + refine ⟨by simpa using nonempty, by simpa using fits, firstValid, ?_⟩ + intro byte member + obtain ⟨native, nativeMember, rfl⟩ := List.mem_map.mp member + exact complete native nativeMember + simp [valid] + · exact ⟨by simp, by simp⟩ + · simp only [↓reduceIte, spec_ok] + have emptyList : value.val = [] := by simpa [Slice.length] using emptyMeaning.symm + simp [valid, bytes, emptyList] + + + +theorem source_earns_no_nul (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.semantic_id_valid value maximum ⦃ actual => actual = true → 0 ∉ bytes value.val ⦄ := by + step with semantic_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have checked : valid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact valid_has_no_nul _ _ checked + +theorem source_earns_ascii (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.semantic_id_valid value maximum ⦃ actual => actual = true → + ∀ byte ∈ bytes value.val, byte < 128 ⦄ := by + step with semantic_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted byte member + rw [accepted] at exactMeaning + have checked : valid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact valid_is_ascii _ _ checked byte member + +theorem source_earns_bounds (value : Slice Std.U8) (maximum : Std.Usize) : + kernel.semantic_id_valid value maximum ⦃ actual => actual = true → + value.val ≠ [] ∧ value.val.length ≤ maximum.val ⦄ := by + step with semantic_valid_exact as ⟨actual, exactMeaning⟩ + rename_i accepted + rw [accepted] at exactMeaning + have checked : valid (bytes value.val) maximum.val := by simpa using exactMeaning.symm + exact ⟨by simpa using checked.1, by simpa using checked.2.1⟩ + +end Auths.Product.SemanticId.Refinement diff --git a/formal/Auths/Product/SlotBatch.lean b/formal/Auths/Product/SlotBatch.lean new file mode 100644 index 000000000..eaedbb6d2 --- /dev/null +++ b/formal/Auths/Product/SlotBatch.lean @@ -0,0 +1,93 @@ +import Mathlib.Tactic +namespace Auths.Product.SlotBatch +abbrev Key := List Nat +inductive Entry where + | claim (key : Key) + | count (counter : Key) (slot : Nat) + | sum (counter : Key) (slot amount cumulative : Nat) + deriving DecidableEq + +def wordMax : Nat := 2 ^ 64 - 1 + +def countEntries (counters : List Key) (slots : List Nat) : List Entry := + List.zipWith Entry.count counters slots + +def sumEntries : List Key → List Nat → List Nat → Nat → Option (List Entry) + | [], [], [], _ => some [] + | counter :: counters, slot :: slots, total :: totals, amount => + if total + amount ≤ wordMax then + (sumEntries counters slots totals amount).map (Entry.sum counter slot amount (total + amount) :: ·) + else none + | _, _, _, _ => none + +def shape (counts : List Key) (countSlots : List Nat) (sums : List Key) (sumSlots totals : List Nat) : Prop := + counts.length ≤ 16 ∧ sums.length ≤ 16 ∧ counts.length = countSlots.length ∧ + sums.length = sumSlots.length ∧ sums.length = totals.length + +instance (counts : List Key) (countSlots : List Nat) (sums : List Key) (sumSlots totals : List Nat) : + Decidable (shape counts countSlots sums sumSlots totals) := inferInstanceAs (Decidable (_ ∧ _ ∧ _ ∧ _ ∧ _)) + +def build (claim : Key) (counts : List Key) (countSlots : List Nat) (sums : List Key) + (sumSlots totals : List Nat) (amount : Nat) : Option (List Entry) := + if shape counts countSlots sums sumSlots totals then + (sumEntries sums sumSlots totals amount).map (fun entries => .claim claim :: (countEntries counts countSlots ++ entries)) + else none + +theorem sum_entries_length (counters : List Key) (slots totals : List Nat) (amount : Nat) (entries : List Entry) + (produced : sumEntries counters slots totals amount = some entries) : + entries.length = counters.length ∧ counters.length = slots.length ∧ counters.length = totals.length := by + induction counters generalizing slots totals entries with + | nil => cases slots <;> cases totals <;> simp_all [sumEntries] + | cons counter rest ih => + cases slots with + | nil => simp [sumEntries] at produced + | cons slot slots => + cases totals with + | nil => simp [sumEntries] at produced + | cons total totals => + simp only [sumEntries] at produced + split at produced <;> rename_i fits + · cases tail : sumEntries rest slots totals amount with + | none => simp [tail] at produced + | some next => + simp only [tail, Option.map_some, Option.some.injEq] at produced + subst entries + obtain ⟨length, slotsLength, totalsLength⟩ := ih slots totals next tail + simp_all + · simp at produced + +theorem first_is_claim (claim : Key) (counts : List Key) (countSlots : List Nat) (sums : List Key) + (sumSlots totals : List Nat) (amount : Nat) (entries : List Entry) + (produced : build claim counts countSlots sums sumSlots totals amount = some entries) : + entries.head? = some (.claim claim) := by + unfold build at produced + split at produced + · cases result : sumEntries sums sumSlots totals amount with + | none => simp [result] at produced + | some suffix => + simp only [result, Option.map_some, Option.some.injEq] at produced + subst entries + rfl + · simp at produced + +theorem exact_entry_count (claim : Key) (counts : List Key) (countSlots : List Nat) (sums : List Key) + (sumSlots totals : List Nat) (amount : Nat) (entries : List Entry) + (produced : build claim counts countSlots sums sumSlots totals amount = some entries) : + entries.length = 1 + counts.length + sums.length ∧ entries.length ≤ 33 := by + unfold build at produced + split at produced <;> rename_i valid + · cases result : sumEntries sums sumSlots totals amount with + | none => simp [result] at produced + | some suffix => + simp only [result, Option.map_some, Option.some.injEq] at produced + subst entries + have sumLength := sum_entries_length sums sumSlots totals amount suffix result + obtain ⟨countBound, sumBound, countsLength, sumsLength, totalsLength⟩ := valid + simp only [List.length_cons, List.length_append, countEntries, List.length_zipWith, countsLength, Nat.min_self] + omega + · simp at produced + +theorem invalid_shape_refused (claim : Key) (counts : List Key) (countSlots : List Nat) (sums : List Key) + (sumSlots totals : List Nat) (amount : Nat) (invalid : ¬shape counts countSlots sums sumSlots totals) : + build claim counts countSlots sums sumSlots totals amount = none := by simp [build, invalid] +end Auths.Product.SlotBatch diff --git a/formal/Auths/Product/SlotBatchRefinement.lean b/formal/Auths/Product/SlotBatchRefinement.lean new file mode 100644 index 000000000..b7c643090 --- /dev/null +++ b/formal/Auths/Product/SlotBatchRefinement.lean @@ -0,0 +1,266 @@ +import qualification.aeneas.generated.gateway.Funs +import Auths.Product.SlotBatch +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.SlotBatch.Refinement +set_option maxHeartbeats 4000000 + +def keyBytes (value : Array Std.U8 32#usize) : Key := value.val.map (·.val) +def meaning : reservation_batch.SlotEntry → Entry + | .Claim key => .claim (keyBytes key) + | .Count key slot => .count (keyBytes key) slot.val + | .Sum key slot amount cumulative => .sum (keyBytes key) slot.val amount.val cumulative.val + +def entriesView (value : alloc.vec.Vec reservation_batch.SlotEntry) : List Entry := value.val.map meaning + +def nativeCounts (counts : Slice counter_aggregation.CounterCapacity) (slots : Slice Std.U64) : List Entry := + List.zipWith (fun counter slot => Entry.count (keyBytes counter.key) slot.val) counts.val slots.val + +private theorem below_pointer_max {size : Nat} (small : size < 4294967295) : size < Usize.max := by + rcases Usize.bounds_eq with equal | equal <;> rw [equal] <;> + simp only [U32.max_eq, U64.max_eq] <;> omega + +@[step] theorem count_loop_exact (counts : Slice counter_aggregation.CounterCapacity) (slots : Slice Std.U64) + (initial : alloc.vec.Vec reservation_batch.SlotEntry) + (bound : counts.val.length ≤ 16) (aligned : counts.val.length = slots.val.length) + (initialBound : initial.val.length ≤ 1) : + reservation_batch.build_batch_loop0 counts slots initial 0#usize ⦃ actual => + entriesView actual = entriesView initial ++ nativeCounts counts slots ⦄ := by + unfold reservation_batch.build_batch_loop0 + have completeLength : (nativeCounts counts slots).length = counts.val.length := by + simp [nativeCounts, aligned] + apply loop.spec_decr_nat + (measure := fun state => counts.val.length - state.2.val) + (inv := fun state => state.2.val ≤ counts.val.length ∧ + entriesView state.1 = entriesView initial ++ (nativeCounts counts slots).take state.2.val) + · rintro ⟨current, index⟩ ⟨indexBound, prefixMeaning⟩ + dsimp only at indexBound prefixMeaning + unfold reservation_batch.build_batch_loop0.body + dsimp only + split <;> rename_i within + · have inside : index.val < counts.val.length := by simpa using within + step as ⟨counter, counterAt⟩ + step as ⟨slot, slotAt⟩ + have currentSize : current.val.length = initial.val.length + index.val := by + have size := congrArg List.length prefixMeaning + simp only [entriesView, List.length_map, List.length_append, List.length_take, completeLength, + Nat.min_eq_left indexBound] at size + exact size + have room : current.length < Usize.max := below_pointer_max (by change current.val.length < _; omega) + step as ⟨updated, updatedMeaning⟩ + step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + have viewUpdate : entriesView updated = entriesView current ++ [Entry.count (keyBytes counter.key) slot.val] := by + simp [entriesView, updatedMeaning, meaning, List.map_append] + rw [viewUpdate, prefixMeaning, nextValue, List.take_succ_eq_append_getElem (by omega)] + simp only [List.append_assoc, List.append_cancel_left_eq, List.cons.injEq, and_true] + simp [nativeCounts, counterAt, slotAt] + · simp only [spec_ok] + have atEnd : counts.val.length ≤ index.val := by simpa using within + have complete : (nativeCounts counts slots).length ≤ index.val := by omega + simpa only [List.take_of_length_le complete] using prefixMeaning + · exact ⟨by simp, by simp⟩ +def nativeSums : List Entry → List counter_aggregation.SumCapacity → List Std.U64 → List Std.U64 → Std.U64 → Option (List Entry) + | built, [], [], [], _ => some built + | built, counter :: counters, slot :: slots, total :: totals, amount => + match U64.checked_add total amount with + | none => none + | some cumulative => nativeSums + (built ++ [.sum (keyBytes counter.key) slot.val amount.val cumulative.val]) counters slots totals amount + | _, _, _, _, _ => none + +/-- The tail-recursive native-shaped value model agrees with the independent + list specification, including failure after any complete prefix. -/ +theorem native_sums_refines (built : List Entry) (counters : List counter_aggregation.SumCapacity) + (slots totals : List Std.U64) (amount : Std.U64) : + nativeSums built counters slots totals amount = + (sumEntries (counters.map (fun counter => keyBytes counter.key)) + (slots.map (fun slot => slot.val)) (totals.map (fun total => total.val)) amount.val).map (built ++ ·) := by + induction counters generalizing built slots totals with + | nil => cases slots <;> cases totals <;> simp [nativeSums, sumEntries] + | cons counter counters ih => + cases slots with + | nil => simp [nativeSums, sumEntries] + | cons slot slots => + cases totals with + | nil => simp [nativeSums, sumEntries] + | cons total totals => + have specification := U64.checked_add_bv_spec total amount + cases equation : U64.checked_add total amount with + | none => + rw [equation] at specification + simp only [U64.max_eq] at specification + have overflow : ¬total.val + amount.val ≤ wordMax := by unfold wordMax; scalar_tac + simp [nativeSums, equation, sumEntries, overflow] + | some cumulative => + rw [equation] at specification + simp only [U64.max_eq] at specification + obtain ⟨within, cumulativeValue, _⟩ := specification + have fits : total.val + amount.val ≤ wordMax := by unfold wordMax; scalar_tac + have exactValue : cumulative.val = total.val + amount.val := by scalar_tac + simp [nativeSums, equation, sumEntries, fits, ih, exactValue, Option.map_map, + Function.comp_def, List.append_assoc] + +@[step] theorem sum_loop_exact (sums : Slice counter_aggregation.SumCapacity) (slots totals : Slice Std.U64) + (amount : Std.U64) (initial : alloc.vec.Vec reservation_batch.SlotEntry) + (bound : sums.val.length ≤ 16) (slotsAligned : sums.val.length = slots.val.length) + (totalsAligned : sums.val.length = totals.val.length) (initialBound : initial.val.length ≤ 17) : + reservation_batch.build_batch_loop1 sums slots totals amount initial 0#usize ⦃ actual => + actual.map entriesView = nativeSums (entriesView initial) sums.val slots.val totals.val amount ⦄ := by + unfold reservation_batch.build_batch_loop1 + let wanted := nativeSums (entriesView initial) sums.val slots.val totals.val amount + apply loop.spec_decr_nat + (measure := fun state => sums.val.length - state.2.val) + (inv := fun state => state.2.val ≤ sums.val.length ∧ + state.1.val.length ≤ initial.val.length + state.2.val ∧ + wanted = nativeSums (entriesView state.1) (sums.val.drop state.2.val) + (slots.val.drop state.2.val) (totals.val.drop state.2.val) amount) + · rintro ⟨current, index⟩ ⟨indexBound, currentBound, remainingMeaning⟩ + dsimp only at indexBound currentBound remainingMeaning + unfold reservation_batch.build_batch_loop1.body + dsimp only + split <;> rename_i within + · have inside : index.val < sums.val.length := by simpa using within + have insideSlots : index.val < slots.val.length := by omega + have insideTotals : index.val < totals.val.length := by omega + step as ⟨total, totalAt⟩ + simp only [lift, bind_tc_ok] + cases equation : U64.checked_add total amount with + | none => + simp only [spec_ok, Option.map_none] + rw [List.drop_eq_getElem_cons inside, List.drop_eq_getElem_cons insideSlots, + List.drop_eq_getElem_cons insideTotals] at remainingMeaning + simp only [nativeSums, ← totalAt, equation] at remainingMeaning + exact remainingMeaning.symm + | some cumulative => + step as ⟨counter, counterAt⟩ + step as ⟨slot, slotAt⟩ + have room : current.length < Usize.max := below_pointer_max (by change current.val.length < _; omega) + step as ⟨updated, updatedMeaning⟩ + step as ⟨next, nextValue⟩ + have updatedSize : updated.val.length = current.val.length + 1 := by simp [updatedMeaning] + have nextNat : next.val = index.val + 1 := by simpa using nextValue + refine ⟨by omega, by omega, ?_, by omega⟩ + have viewUpdate : entriesView updated = entriesView current ++ + [.sum (keyBytes counter.key) slot.val amount.val cumulative.val] := by + simp [entriesView, updatedMeaning, meaning, List.map_append] + rw [List.drop_eq_getElem_cons inside, List.drop_eq_getElem_cons insideSlots, + List.drop_eq_getElem_cons insideTotals] at remainingMeaning + simp only [nativeSums, ← totalAt, equation, ← counterAt, ← slotAt] at remainingMeaning + simpa only [viewUpdate, nextNat] using remainingMeaning + · simp only [spec_ok, Option.map_some] + have atEnd : sums.val.length ≤ index.val := by simpa using within + have slotsEnd : slots.val.length ≤ index.val := by omega + have totalsEnd : totals.val.length ≤ index.val := by omega + simp only [List.drop_of_length_le atEnd, List.drop_of_length_le slotsEnd, + List.drop_of_length_le totalsEnd, nativeSums] at remainingMeaning + exact remainingMeaning.symm + · simp [wanted] + +def countKeys (counts : Slice counter_aggregation.CounterCapacity) : List Key := counts.val.map (fun counter => keyBytes counter.key) +def sumKeys (sums : Slice counter_aggregation.SumCapacity) : List Key := sums.val.map (fun counter => keyBytes counter.key) +def wordValues (values : Slice Std.U64) : List Nat := values.val.map (fun value => value.val) + +/-- The complete source constructor either refuses the checked malformed shape + or produces the independent complete claim/count/sum batch. -/ +@[step] theorem build_exact (claim : Array Std.U8 32#usize) + (counts : Slice counter_aggregation.CounterCapacity) (countSlots : Slice Std.U64) + (sums : Slice counter_aggregation.SumCapacity) (sumSlots totals : Slice Std.U64) (amount : Std.U64) : + reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount ⦃ actual => + actual.map entriesView = build (keyBytes claim) (countKeys counts) (wordValues countSlots) + (sumKeys sums) (wordValues sumSlots) (wordValues totals) amount.val ⦄ := by + have reject (invalid : ¬shape (countKeys counts) (wordValues countSlots) (sumKeys sums) + (wordValues sumSlots) (wordValues totals)) : + ok (none : Option (alloc.vec.Vec reservation_batch.SlotEntry)) ⦃ actual => + actual.map entriesView = build (keyBytes claim) (countKeys counts) (wordValues countSlots) + (sumKeys sums) (wordValues sumSlots) (wordValues totals) amount.val ⦄ := by + simp [spec_ok, build, invalid] + unfold reservation_batch.build_batch + simp only [reservation_batch.MAX_COUNTERS_PER_KIND] + split <;> rename_i longCounts + · apply reject + simp only [shape, countKeys, sumKeys, wordValues, List.length_map] + scalar_tac + · split <;> rename_i longSums + · apply reject + simp only [shape, countKeys, sumKeys, wordValues, List.length_map] + scalar_tac + · split <;> rename_i mismatchedCounts + · apply reject + simp only [shape, countKeys, sumKeys, wordValues, List.length_map] + scalar_tac + · split <;> rename_i mismatchedSlots + · apply reject + simp only [shape, countKeys, sumKeys, wordValues, List.length_map] + scalar_tac + · split <;> rename_i mismatchedTotals + · apply reject + simp only [shape, countKeys, sumKeys, wordValues, List.length_map] + scalar_tac + · have countBound : counts.val.length ≤ 16 := by scalar_tac + have sumBound : sums.val.length ≤ 16 := by scalar_tac + have countAligned : counts.val.length = countSlots.val.length := by scalar_tac + have slotsAligned : sums.val.length = sumSlots.val.length := by scalar_tac + have totalsAligned : sums.val.length = totals.val.length := by scalar_tac + have valid : shape (countKeys counts) (wordValues countSlots) (sumKeys sums) + (wordValues sumSlots) (wordValues totals) := by + simp only [shape, countKeys, sumKeys, wordValues, List.length_map] + exact ⟨countBound, sumBound, countAligned, slotsAligned, totalsAligned⟩ + step as ⟨initial, initialMeaning⟩ + apply spec_bind (count_loop_exact counts countSlots initial countBound countAligned (by simp [initialMeaning])) + intro afterCounts countsMeaning + have countLength : afterCounts.val.length = 1 + counts.val.length := by + have length := congrArg List.length countsMeaning + simpa [entriesView, initialMeaning, nativeCounts, countAligned, Nat.add_comm] using length + apply spec_mono (sum_loop_exact sums sumSlots totals amount afterCounts sumBound slotsAligned totalsAligned (by omega)) + intro actual actualMeaning + simp only [build, valid, ↓reduceIte] + rw [actualMeaning, native_sums_refines, countsMeaning] + simp [build, valid, entriesView, initialMeaning, meaning, nativeCounts, + countEntries, countKeys, sumKeys, wordValues, List.zipWith_map, + List.append_assoc] + +theorem source_claim_first (claim : Array Std.U8 32#usize) + (counts : Slice counter_aggregation.CounterCapacity) (countSlots : Slice Std.U64) + (sums : Slice counter_aggregation.SumCapacity) (sumSlots totals : Slice Std.U64) (amount : Std.U64) : + reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount ⦃ actual => + match actual with + | none => True + | some entries => (entriesView entries).head? = some (.claim (keyBytes claim)) ⦄ := by + apply spec_mono (build_exact claim counts countSlots sums sumSlots totals amount) + intro actual exactResult + cases actual with + | none => trivial + | some entries => + simp only [Option.map_some] at exactResult + exact first_is_claim _ _ _ _ _ _ _ _ exactResult.symm + +theorem source_complete_entry_count (claim : Array Std.U8 32#usize) + (counts : Slice counter_aggregation.CounterCapacity) (countSlots : Slice Std.U64) + (sums : Slice counter_aggregation.SumCapacity) (sumSlots totals : Slice Std.U64) (amount : Std.U64) : + reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount ⦃ actual => + match actual with + | none => True + | some entries => entries.val.length = 1 + counts.val.length + sums.val.length ∧ entries.val.length ≤ 33 ⦄ := by + apply spec_mono (build_exact claim counts countSlots sums sumSlots totals amount) + intro actual exactResult + cases actual with + | none => trivial + | some entries => + simp only [Option.map_some] at exactResult + have complete := exact_entry_count _ _ _ _ _ _ _ _ exactResult.symm + simpa only [entriesView, countKeys, sumKeys, List.length_map] using complete + +theorem source_invalid_shape_refused (claim : Array Std.U8 32#usize) + (counts : Slice counter_aggregation.CounterCapacity) (countSlots : Slice Std.U64) + (sums : Slice counter_aggregation.SumCapacity) (sumSlots totals : Slice Std.U64) (amount : Std.U64) + (invalid : ¬shape (countKeys counts) (wordValues countSlots) (sumKeys sums) + (wordValues sumSlots) (wordValues totals)) : + reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount ⦃ actual => actual = none ⦄ := by + apply spec_mono (build_exact claim counts countSlots sums sumSlots totals amount) + intro actual exactResult + rw [invalid_shape_refused _ _ _ _ _ _ _ invalid] at exactResult + cases actual <;> simp_all + +end Auths.Product.SlotBatch.Refinement diff --git a/formal/Auths/Product/SlotRecord.lean b/formal/Auths/Product/SlotRecord.lean new file mode 100644 index 000000000..8267f6dfa --- /dev/null +++ b/formal/Auths/Product/SlotRecord.lean @@ -0,0 +1,69 @@ +import Auths.Product.RequestConstruction +import Mathlib.Tactic +namespace Auths.Product.SlotRecord +open Auths.Product.RequestConstruction +abbrev Bytes := List Nat + +def pairsMatch (stored counter : Bytes) (processed : Nat) : Prop := + ∀ index, index < processed → + stored[2 * index]? = some (hexLower (counter[index]! / 16)) ∧ + stored[2 * index + 1]? = some (hexLower (counter[index]! % 16)) + +def hexMatches (stored counter : Bytes) : Prop := + stored.length = 2 * counter.length ∧ pairsMatch stored counter counter.length + +instance (stored counter : Bytes) : Decidable (hexMatches stored counter) := by + unfold hexMatches pairsMatch + exact inferInstanceAs (Decidable (_ ∧ ∀ index, index < counter.length → _)) + +structure Values where + slot : Nat + amount : Nat + cumulative : Nat + deriving DecidableEq + +def valid (schema expectedSchema stored counter : Bytes) (expectedSlot : Nat) (values : Values) : Prop := + schema = expectedSchema ∧ hexMatches stored counter ∧ + values.slot = expectedSlot ∧ values.amount ≤ values.cumulative + +instance (schema expectedSchema stored counter : Bytes) (expectedSlot : Nat) (values : Values) : + Decidable (valid schema expectedSchema stored counter expectedSlot values) := by + unfold valid + infer_instance + +def validate (schema expectedSchema stored counter : Bytes) (expectedSlot : Nat) (values : Values) : Option Nat := + if valid schema expectedSchema stored counter expectedSlot values then some values.cumulative else none + +theorem accepted_iff (schema expectedSchema stored counter : Bytes) (expectedSlot : Nat) (values : Values) : + validate schema expectedSchema stored counter expectedSlot values = some values.cumulative ↔ + valid schema expectedSchema stored counter expectedSlot values := by simp [validate] + +theorem accepted_binds_slot (schema expectedSchema stored counter : Bytes) (expectedSlot value : Nat) (values : Values) + (accepted : validate schema expectedSchema stored counter expectedSlot values = some value) : + schema = expectedSchema ∧ hexMatches stored counter ∧ values.slot = expectedSlot ∧ + values.amount ≤ value ∧ value = values.cumulative := by + unfold validate at accepted + split at accepted <;> simp_all [valid] +private theorem hex_lower_injective (left right : Nat) (leftBound : left < 16) (rightBound : right < 16) + (same : hexLower left = hexLower right) : left = right := by + unfold hexLower at same + split at same <;> split at same <;> omega + +theorem hex_matches_injective (stored left right : Bytes) + (leftBytes : ∀ value ∈ left, value < 256) (rightBytes : ∀ value ∈ right, value < 256) + (leftMatches : hexMatches stored left) (rightMatches : hexMatches stored right) : left = right := by + have lengths : left.length = right.length := by have := leftMatches.1; have := rightMatches.1; omega + apply List.ext_getElem lengths + intro index leftInside rightInside + have leftPair := leftMatches.2 index leftInside + have rightPair := rightMatches.2 index rightInside + rw [getElem!_pos left index leftInside] at leftPair + rw [getElem!_pos right index rightInside] at rightPair + have leftByte := leftBytes left[index] (List.getElem_mem leftInside) + have rightByte := rightBytes right[index] (List.getElem_mem rightInside) + have highEq : left[index] / 16 = right[index] / 16 := + hex_lower_injective _ _ (by omega) (by omega) (Option.some.inj (leftPair.1.symm.trans rightPair.1)) + have lowEq : left[index] % 16 = right[index] % 16 := + hex_lower_injective _ _ (by omega) (by omega) (Option.some.inj (leftPair.2.symm.trans rightPair.2)) + omega +end Auths.Product.SlotRecord diff --git a/formal/Auths/Product/SlotRecordRefinement.lean b/formal/Auths/Product/SlotRecordRefinement.lean new file mode 100644 index 000000000..4b391e5c0 --- /dev/null +++ b/formal/Auths/Product/SlotRecordRefinement.lean @@ -0,0 +1,174 @@ +import Auths.Product.SlotRecord +import Auths.Product.Refinement.ByteIdentity +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_gateway_kernel +open Auths.Product.RequestConstruction +open Auths.Product.Refinement.ByteIdentity +namespace Auths.Product.SlotRecord.Refinement +set_option maxHeartbeats 4000000 + +def bytes (values : List Std.U8) : List Nat := values.map (·.val) + +theorem bytes_at (values : List Std.U8) (index : Nat) (inside : index < values.length) : + (bytes values)[index]! = values[index].val := by + rw [getElem!_pos (bytes values) index (by simpa [bytes] using inside)] + simp [bytes] + +theorem bytes_at_optional (values : List Std.U8) (index : Nat) (inside : index < values.length) : + (bytes values)[index]? = some values[index].val := by + rw [List.getElem?_eq_getElem (by simpa [bytes] using inside)] + simp [bytes] + +@[step] theorem counter_hex_matches_spec (stored : Slice Std.U8) (counter : Array Std.U8 32#usize) : + slot_record.counter_hex_matches stored counter ⦃ actual => + actual = decide (hexMatches (bytes stored.val) (bytes counter.val)) ⦄ := by + have counterSize : counter.val.length = 32 := by simp + unfold slot_record.counter_hex_matches + dsimp only + split <;> rename_i sized + · simp only [spec_ok] + have notSized : stored.val.length ≠ 64 := by simp_all + simp [hexMatches, bytes, counterSize, notSized] + · have storedSize : stored.val.length = 64 := by simp_all + unfold slot_record.counter_hex_matches_loop + apply loop.spec_decr_nat + (measure := fun position => 32 - position.val) + (inv := fun position => position.val ≤ 32 ∧ pairsMatch (bytes stored.val) (bytes counter.val) position.val) + · intro position processed + unfold slot_record.counter_hex_matches_loop.body + split <;> rename_i within + · have inside : position.val < 32 := by simpa using within + step as ⟨byte, byteAt⟩ + step as ⟨highIndex, highIndexEq⟩ + step as ⟨highStored, highStoredAt⟩ + step as ⟨high, highEq⟩ + step with hex_lower_exact as ⟨highDigit, highDigitEq⟩ + have counterAt : (bytes counter.val)[position.val]! = byte.val := by + rw [bytes_at counter.val position.val (by omega), ← byteAt] + have highAt : (bytes stored.val)[2 * position.val]? = some highStored.val := by + have indexEq : 2 * position.val = highIndex.val := by omega + rw [indexEq, bytes_at_optional stored.val highIndex.val (by omega), ← highStoredAt] + split <;> rename_i highSame + · simp only [spec_ok] + have invalid : ¬ hexMatches (bytes stored.val) (bytes counter.val) := by + intro valid + have pair := valid.2 position.val (by simpa [bytes, counterSize] using inside) + rw [counterAt, highAt] at pair + have same : highStored.val = highDigit.val := by + simpa only [Option.some.injEq, highDigitEq, highEq] using pair.1 + simp [same] at highSame + simp [invalid] + · step as ⟨lowIndex, lowIndexEq⟩ + step as ⟨lowStored, lowStoredAt⟩ + step as ⟨low, lowEq⟩ + step with hex_lower_exact as ⟨lowDigit, lowDigitEq⟩ + have lowAt : (bytes stored.val)[2 * position.val + 1]? = some lowStored.val := by + have indexEq : 2 * position.val + 1 = lowIndex.val := by omega + rw [indexEq, bytes_at_optional stored.val lowIndex.val (by omega), ← lowStoredAt] + split <;> rename_i lowSame + · simp only [spec_ok] + have invalid : ¬ hexMatches (bytes stored.val) (bytes counter.val) := by + intro valid + have pair := valid.2 position.val (by simpa [bytes, counterSize] using inside) + rw [counterAt, lowAt] at pair + have same : lowStored.val = lowDigit.val := by + simpa only [Option.some.injEq, lowDigitEq, lowEq] using pair.2 + simp [same] at lowSame + simp [invalid] + · step as ⟨next, nextEq⟩ + refine ⟨by omega, ?_, by omega⟩ + intro index before + by_cases earlier : index < position.val + · exact processed.2 index earlier + · have current : index = position.val := by omega + subst index + rw [counterAt, highAt, lowAt] + have highValue : highStored.val = highDigit.val := by simpa using highSame + have lowValue : lowStored.val = lowDigit.val := by simpa using lowSame + simp [highValue, lowValue, highDigitEq, lowDigitEq, highEq, lowEq] + · simp only [spec_ok] + have atEnd : position.val = 32 := by simpa using (show position.val = 32 by scalar_tac) + have valid : hexMatches (bytes stored.val) (bytes counter.val) := by + refine ⟨by simp [bytes, storedSize, counterSize], ?_⟩ + simpa [bytes, counterSize, atEnd] using processed.2 + simp [valid] + · exact ⟨by simp, by simp [pairsMatch]⟩ + + +theorem bytes_injective (left right : List Std.U8) : bytes left = bytes right ↔ left = right := by + constructor + · intro same + induction left generalizing right with + | nil => cases right <;> simp_all [bytes] + | cons head tail ih => + cases right with + | nil => simp [bytes] at same + | cons other rest => + simp only [bytes, List.map_cons, List.cons.injEq] at same + rw [(UScalar.eq_equiv _ _).mpr same.1, ih rest same.2] + · intro same; rw [same] + +def valuesView (value : slot_record.SumValues) : Values := + ⟨value.slot.val, value.amount.val, value.cumulative.val⟩ + +@[step] theorem validate_cumulative_exact (schema expectedSchema stored : Slice Std.U8) + (counter : Array Std.U8 32#usize) (expectedSlot : Std.U64) (values : slot_record.SumValues) : + slot_record.validate_cumulative schema expectedSchema stored counter expectedSlot values ⦃ actual => + actual.map UScalar.val = validate (bytes schema.val) (bytes expectedSchema.val) + (bytes stored.val) (bytes counter.val) expectedSlot.val (valuesView values) ⦄ := by + unfold slot_record.validate_cumulative + step with field_name_equal_exact as ⟨sameSchema, schemaEq⟩ + cases sameSchema + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have different : bytes schema.val ≠ bytes expectedSchema.val := by + intro sameBytes + have nativeSame := (bytes_injective schema.val expectedSchema.val).mp sameBytes + simp [nativeSame] at schemaEq + simp [validate, valid, different] + · simp only [↓reduceIte] + have same : bytes schema.val = bytes expectedSchema.val := by + apply (bytes_injective schema.val expectedSchema.val).mpr + simpa using schemaEq.symm + step with counter_hex_matches_spec as ⟨sameCounter, counterEq⟩ + cases sameCounter + · simp only [Bool.false_eq_true, ↓reduceIte, spec_ok] + have different : ¬ hexMatches (bytes stored.val) (bytes counter.val) := by simpa using counterEq.symm + simp [validate, valid, different] + · simp only [↓reduceIte] + have counterBound : hexMatches (bytes stored.val) (bytes counter.val) := by simpa using counterEq.symm + split <;> rename_i sameSlot + · simp only [spec_ok] + have different : values.slot.val ≠ expectedSlot.val := by simpa using sameSlot + simp [validate, valid, valuesView, different] + · split <;> rename_i amountBound + · simp only [spec_ok] + have tooLarge : ¬ values.amount.val ≤ values.cumulative.val := by scalar_tac + simp [validate, valid, valuesView, tooLarge] + · simp only [spec_ok] + have slotBound : values.slot.val = expectedSlot.val := by simpa using sameSlot + have deltaBound : values.amount.val ≤ values.cumulative.val := by scalar_tac + simp [validate, valid, valuesView, same, counterBound, slotBound, deltaBound] + +theorem source_accepted_binds_record (schema expectedSchema stored : Slice Std.U8) + (counter : Array Std.U8 32#usize) (expectedSlot : Std.U64) (values : slot_record.SumValues) : + slot_record.validate_cumulative schema expectedSchema stored counter expectedSlot values ⦃ actual => + ∀ value, actual = some value → + schema.val = expectedSchema.val ∧ hexMatches (bytes stored.val) (bytes counter.val) ∧ + values.slot.val = expectedSlot.val ∧ values.amount.val ≤ value.val ∧ value.val = values.cumulative.val ⦄ := by + step with validate_cumulative_exact as ⟨actual, exactMeaning⟩ + rename_i value accepted + rw [accepted] at exactMeaning + have bound := accepted_binds_slot _ _ _ _ _ _ _ exactMeaning.symm + exact ⟨(bytes_injective _ _).mp bound.1, bound.2⟩ + +theorem source_invalid_record_refused (schema expectedSchema stored : Slice Std.U8) + (counter : Array Std.U8 32#usize) (expectedSlot : Std.U64) (values : slot_record.SumValues) + (invalid : ¬ valid (bytes schema.val) (bytes expectedSchema.val) (bytes stored.val) + (bytes counter.val) expectedSlot.val (valuesView values)) : + slot_record.validate_cumulative schema expectedSchema stored counter expectedSlot values ⦃ actual => actual = none ⦄ := by + step with validate_cumulative_exact as ⟨actual, exactMeaning⟩ + have empty : actual.map UScalar.val = none := by simpa [validate, invalid] using exactMeaning + exact Option.map_eq_none_iff.mp empty + +end Auths.Product.SlotRecord.Refinement diff --git a/formal/Auths/Product/StrictOrderRefinement.lean b/formal/Auths/Product/StrictOrderRefinement.lean new file mode 100644 index 000000000..9d7372065 --- /dev/null +++ b/formal/Auths/Product/StrictOrderRefinement.lean @@ -0,0 +1,119 @@ +import qualification.aeneas.generated.connections.Funs +import Auths.Verifier.StatusLeaves +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +namespace Auths.Product.StrictOrder.Refinement + +def chain {T : Type} (less : T → T → Bool) : T → List T → Bool + | _, [] => true + | previous, next :: rest => less previous next && chain less next rest + +def ordered {T : Type} (less : T → T → Bool) : List T → Bool + | [] => true + | first :: rest => chain less first rest + +private theorem suffix_exact {T : Type} (order : core.cmp.Ord T) (less : T → T → Bool) + (comparison : ∀ a b, order.partialOrdInst.lt a b ⦃ actual => actual = less a b ⦄) + (remaining : List T) (values : Slice T) (index : Std.Usize) (previous : T) + (positive : 0 < index.val) (atPrevious : values.val[index.val - 1]? = some previous) + (suffix : values.val.drop index.val = remaining) : + kernel.strictly_sorted_unique_loop order values index ⦃ actual => actual = chain less previous remaining ⦄ := by + induction remaining generalizing index previous with + | nil => + have finished : ¬ index < values.len := by + have size := congrArg List.length suffix + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold kernel.strictly_sorted_unique_loop + rw [loop.eq_def] + simp [kernel.strictly_sorted_unique_loop.body, finished, chain] + | cons head rest ih => + obtain ⟨guard, indexed⟩ := Auths.StatusSelection.indexed_head values index head rest suffix + obtain ⟨next, addition, nextValue, nextSuffix⟩ := Auths.StatusSelection.indexed_next values index head rest suffix + obtain ⟨prior, subtraction, priorValue⟩ := spec_imp_exists (Usize.sub_spec (x := index) (y := 1#usize) (by scalar_tac)) + have priorMeaning : prior.val = index.val - 1 := by simpa using priorValue.1 + have previousIndexed : Slice.index_usize values prior = ok previous := by + simp [Slice.index_usize, priorMeaning, atPrevious] + have nextPrevious : values.val[next.val - 1]? = some head := by + rw [nextValue, Nat.add_sub_cancel] + have inside : index.val < values.val.length := by simpa [Slice.length] using guard + have atHead : values.val[index.val] = head := by + have split := List.drop_eq_getElem_cons inside + rw [suffix] at split + exact (List.cons.inj split).1.symm + simp [List.getElem?_eq_getElem inside, atHead] + obtain ⟨result, compared, comparisonMeaning⟩ := spec_imp_exists (comparison previous head) + unfold kernel.strictly_sorted_unique_loop + rw [loop.eq_def] + simp only [kernel.strictly_sorted_unique_loop.body, guard, ↓reduceIte, subtraction, + previousIndexed, indexed, compared, comparisonMeaning, bind_tc_ok] + cases allowed : less previous head + · simp [allowed, chain] + · simp only [↓reduceIte, addition, bind_tc_ok] + change kernel.strictly_sorted_unique_loop order values next ⦃ actual => actual = chain less previous (head :: rest) ⦄ + simpa [chain, allowed] using ih next head (by omega) nextPrevious nextSuffix + +@[step] theorem strict_order_exact {T : Type} (order : core.cmp.Ord T) (less : T → T → Bool) + (comparison : ∀ a b, order.partialOrdInst.lt a b ⦃ actual => actual = less a b ⦄) + (values : Slice T) : + kernel.strictly_sorted_unique order values ⦃ actual => actual = ordered less values.val ⦄ := by + unfold kernel.strictly_sorted_unique + step as ⟨empty, emptyMeaning⟩ + cases contents : values.val with + | nil => simp [contents, Slice.length] at emptyMeaning; simp [emptyMeaning, ordered] + | cons first rest => + have nonempty : empty = false := by simp [contents, Slice.length] at emptyMeaning; exact emptyMeaning + simp only [nonempty, Bool.false_eq_true, ↓reduceIte] + apply spec_mono (suffix_exact order less comparison rest values 1#usize first (by decide) + (by simp [contents]) (by simp [contents])) + intro actual meaning + simpa [ordered, contents] using meaning + +private theorem chain_facts {T : Type} (less : T → T → Bool) + (transitive : ∀ a b c, less a b = true → less b c = true → less a c = true) + (values : List T) (previous : T) (accepted : chain less previous values = true) : + (∀ next ∈ values, less previous next = true) ∧ values.Pairwise (fun a b => less a b = true) := by + induction values generalizing previous with + | nil => simp + | cons head rest ih => + simp only [chain, Bool.and_eq_true] at accepted + obtain ⟨fromHead, sortedRest⟩ := ih head accepted.2 + constructor + · intro next member + rcases List.mem_cons.mp member with rfl | member + · exact accepted.1 + · exact transitive previous head next accepted.1 (fromHead next member) + · exact List.Pairwise.cons fromHead sortedRest + +theorem ordered_implies_pairwise {T : Type} (less : T → T → Bool) + (transitive : ∀ a b c, less a b = true → less b c = true → less a c = true) + (values : List T) (accepted : ordered less values = true) : + values.Pairwise (fun a b => less a b = true) := by + cases values with + | nil => exact List.Pairwise.nil + | cons first rest => + obtain ⟨fromFirst, sortedRest⟩ := chain_facts less transitive rest first accepted + exact List.Pairwise.cons fromFirst sortedRest + +theorem ordered_implies_no_duplicates {T : Type} (less : T → T → Bool) + (transitive : ∀ a b c, less a b = true → less b c = true → less a c = true) + (irreflexive : ∀ value, less value value = false) + (values : List T) (accepted : ordered less values = true) : values.Nodup := by + have sorted := ordered_implies_pairwise less transitive values accepted + change values.Pairwise (fun a b => a ≠ b) + exact sorted.imp (by intro a b related same; subst b; simp [irreflexive] at related) + +theorem source_earns_no_duplicates {T : Type} (order : core.cmp.Ord T) (less : T → T → Bool) + (comparison : ∀ a b, order.partialOrdInst.lt a b ⦃ actual => actual = less a b ⦄) + (transitive : ∀ a b c, less a b = true → less b c = true → less a c = true) + (irreflexive : ∀ value, less value value = false) + (values : Slice T) : + kernel.strictly_sorted_unique order values ⦃ actual => actual = true → values.val.Nodup ⦄ := by + step with strict_order_exact order less comparison as ⟨actual, meaning⟩ + rename_i accepted + rw [accepted] at meaning + exact ordered_implies_no_duplicates less transitive irreflexive values.val meaning.symm + +end Auths.Product.StrictOrder.Refinement diff --git a/formal/Auths/Product/StringConstructorsRefinement.lean b/formal/Auths/Product/StringConstructorsRefinement.lean new file mode 100644 index 000000000..d9b363616 --- /dev/null +++ b/formal/Auths/Product/StringConstructorsRefinement.lean @@ -0,0 +1,111 @@ +import qualification.aeneas.generated.profile_construction.Funs +import Auths.Product.ConnectionBytesRefinement +import Auths.Product.SemanticIdRefinement +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_profile_construction +namespace Auths.Product.StringConstructors.Refinement + +def utf8Bytes (value : String) : List Nat := value.toByteArray.toList.map UInt8.toNat + +private theorem lower_delegation (value : Slice Std.U8) (maximum : Std.Usize) : + auths_profile_construction.auths_connections.kernel.lower_token_valid value maximum ⦃ actual => + actual = decide (ConnectionBytes.lowerValid (ConnectionBytes.Refinement.bytes value.val) maximum.val) ⦄ := by + change _root_.auths_connections.kernel.lower_token_valid value maximum ⦃ actual => + actual = decide (ConnectionBytes.lowerValid (ConnectionBytes.Refinement.bytes value.val) maximum.val) ⦄ + exact ConnectionBytes.Refinement.lower_valid_exact value maximum + +private theorem semantic_delegation (value : Slice Std.U8) (maximum : Std.Usize) : + auths_profile_construction.auths_connections.kernel.semantic_id_valid value maximum ⦃ actual => + actual = decide (SemanticId.valid (SemanticId.Refinement.bytes value.val) maximum.val) ⦄ := by + change _root_.auths_connections.kernel.semantic_id_valid value maximum ⦃ actual => + actual = decide (SemanticId.valid (SemanticId.Refinement.bytes value.val) maximum.val) ⦄ + exact SemanticId.Refinement.semantic_valid_exact value maximum + +private theorem projected_bytes (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + ConnectionBytes.Refinement.bytes (toStr value bounded).val = utf8Bytes value := by + simp only [ConnectionBytes.Refinement.bytes, toStr, utf8Bytes, List.map_map, List.map_inj_left] + intro byte member + cases byte + rfl + +@[step] theorem actual_provider_exact (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_profile_construction.auths_connections.model.ProviderKind.parse (core.convert.IntoFrom (core.convert.FromSame String)) value ⦃ actual => + actual = if ConnectionBytes.lowerValid (utf8Bytes value) 64 + then .Ok value else .Err .InvalidProviderKind ⦄ := by + unfold auths_profile_construction.auths_connections.model.ProviderKind.parse + simp only [core.convert.IntoFrom.into, core.convert.FromSame.from, bind_tc_ok] + unfold auths_profile_construction.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref + simp only [_root_.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref, bounded, ↓reduceDIte, bind_tc_ok] + unfold auths_profile_construction.auths_connections.model.is_lower_token auths_profile_construction.core.str.Str.as_bytes + simp only [_root_.core.str.Str.as_bytes, bind_tc_ok] + step with lower_delegation as ⟨allowed, allowedMeaning⟩ + rw [projected_bytes] at allowedMeaning + rw [allowedMeaning] + split <;> simp_all [spec_ok] +@[step] theorem actual_alias_exact (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_profile_construction.auths_connections.model.ConnectionAlias.parse (core.convert.IntoFrom (core.convert.FromSame String)) value ⦃ actual => + actual = if ConnectionBytes.lowerValid (utf8Bytes value) 64 + then .Ok value else .Err .InvalidAlias ⦄ := by + unfold auths_profile_construction.auths_connections.model.ConnectionAlias.parse + simp only [core.convert.IntoFrom.into, core.convert.FromSame.from, bind_tc_ok] + unfold auths_profile_construction.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref + simp only [_root_.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref, bounded, ↓reduceDIte, bind_tc_ok] + unfold auths_profile_construction.auths_connections.model.is_lower_token auths_profile_construction.core.str.Str.as_bytes + simp only [_root_.core.str.Str.as_bytes, bind_tc_ok] + step with lower_delegation as ⟨allowed, allowedMeaning⟩ + rw [projected_bytes] at allowedMeaning + rw [allowedMeaning] + split <;> simp_all [spec_ok] +@[step] theorem actual_semantic_exact (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_profile_construction.auths_connections.model.SemanticId.parse (core.convert.IntoFrom (core.convert.FromSame String)) value ⦃ actual => + actual = if SemanticId.valid (utf8Bytes value) 128 + then .Ok value else .Err .InvalidSemanticId ⦄ := by + unfold auths_profile_construction.auths_connections.model.SemanticId.parse + simp only [core.convert.IntoFrom.into, core.convert.FromSame.from, bind_tc_ok] + unfold auths_profile_construction.alloc.string.String.as_bytes + simp only [_root_.alloc.string.String.as_bytes, bounded, ↓reduceDIte, bind_tc_ok] + step with semantic_delegation as ⟨allowed, allowedMeaning⟩ + have projection : SemanticId.Refinement.bytes (toStr value bounded).val = utf8Bytes value := by + exact projected_bytes value bounded + rw [projection] at allowedMeaning + rw [allowedMeaning] + split <;> simp_all [spec_ok] + +theorem provider_success_earns_exact_valid_payload (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_profile_construction.auths_connections.model.ProviderKind.parse (core.convert.IntoFrom (core.convert.FromSame String)) value ⦃ actual => + ∀ parsed, actual = .Ok parsed → parsed = value ∧ ConnectionBytes.lowerValid (utf8Bytes parsed) 64 ⦄ := by + step with actual_provider_exact as ⟨actual, exactMeaning⟩ + rename_i parsed accepted + rw [accepted] at exactMeaning + split at exactMeaning + · have preserved : parsed = value := by simpa using exactMeaning + subst parsed + exact ⟨rfl, by assumption⟩ + · contradiction + +theorem alias_success_earns_exact_valid_payload (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_profile_construction.auths_connections.model.ConnectionAlias.parse (core.convert.IntoFrom (core.convert.FromSame String)) value ⦃ actual => + ∀ parsed, actual = .Ok parsed → parsed = value ∧ ConnectionBytes.lowerValid (utf8Bytes parsed) 64 ⦄ := by + step with actual_alias_exact as ⟨actual, exactMeaning⟩ + rename_i parsed accepted + rw [accepted] at exactMeaning + split at exactMeaning + · have preserved : parsed = value := by simpa using exactMeaning + subst parsed + exact ⟨rfl, by assumption⟩ + · contradiction + +theorem semantic_success_earns_exact_valid_payload (value : String) (bounded : value.toByteArray.size ≤ U32.max) : + auths_profile_construction.auths_connections.model.SemanticId.parse (core.convert.IntoFrom (core.convert.FromSame String)) value ⦃ actual => + ∀ parsed, actual = .Ok parsed → parsed = value ∧ SemanticId.valid (utf8Bytes parsed) 128 ⦄ := by + step with actual_semantic_exact as ⟨actual, exactMeaning⟩ + rename_i parsed accepted + rw [accepted] at exactMeaning + split at exactMeaning + · have preserved : parsed = value := by simpa using exactMeaning + subst parsed + exact ⟨rfl, by assumption⟩ + · contradiction + +end Auths.Product.StringConstructors.Refinement diff --git a/formal/Auths/Product/SumAggregation.lean b/formal/Auths/Product/SumAggregation.lean new file mode 100644 index 000000000..f84f39dd4 --- /dev/null +++ b/formal/Auths/Product/SumAggregation.lean @@ -0,0 +1,109 @@ +import Auths.Product.CounterAggregation +import Mathlib.Tactic +namespace Auths.Product.CounterAggregation +structure SumCounter where + key : Key + capacity : Nat + slots : Nat + deriving DecidableEq + +def SumCounter.counter (value : SumCounter) : Counter := ⟨value.key, value.capacity⟩ + +def contributeSum : List SumCounter → Key → Nat → Nat → List SumCounter + | [], key, capacity, slots => [⟨key, capacity, slots⟩] + | first :: rest, key, capacity, slots => + if first.key = key then {first with capacity := min first.capacity capacity} :: rest + else first :: contributeSum rest key capacity slots + +def aggregateSum : List SumCounter → List SumCounter → List SumCounter + | state, [] => state + | state, first :: rest => aggregateSum (contributeSum state first.key first.capacity first.slots) rest + +/-- Sum aggregation obeys the same shared minimum-capacity semantics as count + aggregation; the separately retained slot bound never changes that map. -/ +theorem sum_contribution_projection (state : List SumCounter) (key : Key) (capacity slots : Nat) : + (contributeSum state key capacity slots).map SumCounter.counter = + contribute (state.map SumCounter.counter) key capacity := by + induction state with + | nil => rfl + | cons first rest ih => + by_cases selected : first.key = key <;> + simp [contributeSum, contribute, SumCounter.counter, selected, ih] + +theorem sum_aggregate_projection (state incoming : List SumCounter) : + (aggregateSum state incoming).map SumCounter.counter = + aggregate (state.map SumCounter.counter) (incoming.map SumCounter.counter) := by + induction incoming generalizing state with + | nil => rfl + | cons first rest ih => + simp only [aggregateSum, List.map_cons, aggregate, ih] + rw [sum_contribution_projection] + rfl + +theorem sum_aggregate_unique (incoming : List SumCounter) : + (((aggregateSum [] incoming).map SumCounter.counter).map Counter.key).Nodup := by + rw [sum_aggregate_projection] + exact aggregate_unique [] _ (by simp) + +theorem sum_aggregate_capacities (incoming : List SumCounter) (key : Key) : + lookup ((aggregateSum [] incoming).map SumCounter.counter) key = + specification (fun _ => none) (incoming.map SumCounter.counter) key := by + rw [sum_aggregate_projection, aggregate_exact] + rfl + +theorem sum_contribute_length_le (state : List SumCounter) (key : Key) (capacity slots : Nat) : + (contributeSum state key capacity slots).length ≤ state.length + 1 := by + have bound := contribute_length_le (state.map SumCounter.counter) key capacity + rw [← sum_contribution_projection state key capacity slots] at bound + simpa using bound + +theorem sum_aggregate_append (state first rest : List SumCounter) : + aggregateSum state (first ++ rest) = aggregateSum (aggregateSum state first) rest := by + induction first generalizing state with + | nil => rfl + | cons head tail ih => simpa only [List.cons_append, aggregateSum] using ih (contributeSum state head.key head.capacity head.slots) + +theorem sum_aggregate_snoc (state first : List SumCounter) (next : SumCounter) : + aggregateSum state (first ++ [next]) = contributeSum (aggregateSum state first) next.key next.capacity next.slots := by + rw [sum_aggregate_append] + rfl + +/-- A duplicate contribution retains the first slot bound, independently of + whether it tightens the sum capacity. -/ +theorem first_slots_preserved (first : SumCounter) (rest : List SumCounter) (capacity slots : Nat) : + contributeSum (first :: rest) first.key capacity slots = + {first with capacity := min first.capacity capacity} :: rest := by + simp [contributeSum] +theorem sum_contribute_at (counters : List SumCounter) (key : Key) (capacity slots index : Nat) (old : SumCounter) + (found : SchemaIndex.position (counters.map SumCounter.key) key = some index) + (atIndex : counters[index]? = some old) : + contributeSum counters key capacity slots = counters.set index {old with capacity := min old.capacity capacity} := by + induction counters generalizing index with + | nil => simp at atIndex + | cons first rest ih => + by_cases selected : first.key = key + · simp [SchemaIndex.position, selected] at found + subst index + simp at atIndex + subst old + simp [contributeSum, selected] + · cases index with + | zero => simp [SchemaIndex.position, selected] at found + | succ index => + have tailFound : SchemaIndex.position (rest.map SumCounter.key) key = some index := by + simpa [SchemaIndex.position, selected] using found + have tailAt : rest[index]? = some old := by simpa using atIndex + simp [contributeSum, selected, ih index tailFound tailAt] + +theorem sum_contribute_absent (counters : List SumCounter) (key : Key) (capacity slots : Nat) + (absent : SchemaIndex.position (counters.map SumCounter.key) key = none) : + contributeSum counters key capacity slots = counters ++ [⟨key, capacity, slots⟩] := by + induction counters with + | nil => rfl + | cons first rest ih => + have different : first.key ≠ key := by intro same; simp [SchemaIndex.position, same] at absent + have tailAbsent : SchemaIndex.position (rest.map SumCounter.key) key = none := by + simpa [SchemaIndex.position, different] using absent + simp [contributeSum, different, ih tailAbsent] + +end Auths.Product.CounterAggregation diff --git a/formal/Auths/Product/SumAggregationRefinement.lean b/formal/Auths/Product/SumAggregationRefinement.lean new file mode 100644 index 000000000..9c0fbf2e3 --- /dev/null +++ b/formal/Auths/Product/SumAggregationRefinement.lean @@ -0,0 +1,189 @@ +import Auths.Product.CounterAggregationRefinement +import Auths.Product.SumAggregation +open Aeneas Aeneas.Std Result ControlFlow +open Aeneas.Std.WP +open auths_gateway_kernel +namespace Auths.Product.CounterAggregation.Refinement +set_option maxHeartbeats 4000000 +def sumKeys (counters : Slice counter_aggregation.SumCapacity) : List SchemaIndex.Name := + counters.val.map (fun counter => counter.key.val.map (·.val)) +@[step] theorem sum_position_spec (counters : Slice counter_aggregation.SumCapacity) (key : Array Std.U8 32#usize) : + counter_aggregation.sum_position counters key ⦃ actual => + actual.map UScalar.val = SchemaIndex.position (sumKeys counters) (key.val.map (·.val)) ⦄ := by + unfold counter_aggregation.sum_position counter_aggregation.sum_position_loop + apply loop.spec_decr_nat + (measure := fun position => counters.val.length - position.val) + (inv := fun position => position.val ≤ counters.val.length ∧ + ∀ index, index < position.val → (sumKeys counters)[index]? ≠ some (key.val.map (·.val))) + · intro position processed + unfold counter_aggregation.sum_position_loop.body + dsimp only + split <;> rename_i within + · have inside : position.val < counters.val.length := by simpa using within + step as ⟨counter, counterAt⟩ + step with counter_equal_spec as ⟨same, sameMeaning⟩ + cases same + · simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + step as ⟨next, nextValue⟩ + refine ⟨by omega, ?_, by omega⟩ + intro index before + by_cases earlier : index < position.val + · exact processed.2 index earlier + · have atCurrent : index = position.val := by omega + subst index + simp_all [sumKeys, List.getElem?_map] + exact sameMeaning ∘ (byteList_injective _ _).mp + · simp only [↓reduceIte, spec_ok] + symm + apply SchemaIndex.position_eq_first + · simp_all [sumKeys, List.getElem?_map] + · exact processed.2 + · simp only [spec_ok] + symm + apply (SchemaIndex.absent_iff _ _).mpr + intro member + obtain ⟨index, atIndex⟩ := List.mem_iff_getElem?.mp member + have inside : index < (sumKeys counters).length := (List.getElem?_eq_some_iff.mp atIndex).1 + have atEnd : counters.val.length ≤ position.val := by simpa using within + have length : (sumKeys counters).length = counters.val.length := by simp [sumKeys] + exact processed.2 index (by omega) atIndex + · exact ⟨by simp, by simp⟩ +def sumView (counter : counter_aggregation.SumCapacity) : CounterAggregation.SumCounter := + ⟨counter.key.val.map (·.val), counter.capacity.val, counter.slots.val⟩ + +def sumCountersView (counters : alloc.vec.Vec counter_aggregation.SumCapacity) : List CounterAggregation.SumCounter := + counters.val.map sumView + +/-- The actual keyed update preserves the independent minimum-capacity map. -/ +@[step] theorem contribute_sum_spec (counters : alloc.vec.Vec counter_aggregation.SumCapacity) + (key : Array Std.U8 32#usize) (capacity slots : Std.U64) + (fits : counters.val.length < 4294967295) : + counter_aggregation.contribute_sum counters key capacity slots ⦃ actual => + sumCountersView actual = CounterAggregation.contributeSum (sumCountersView counters) (key.val.map (·.val)) capacity.val slots.val ⦄ := by + unfold counter_aggregation.contribute_sum + step with sum_position_spec as ⟨position, positionMeaning⟩ + have positioned : position.map UScalar.val = + SchemaIndex.position ((sumCountersView counters).map SumCounter.key) (key.val.map (·.val)) := by + simpa [sumKeys, sumCountersView, sumView, alloc.vec.Vec.deref, List.map_map, Function.comp_def] using positionMeaning + cases position with + | none => + simp only [bind_tc_ok] + have room : counters.length < Usize.max := by + rcases Usize.bounds_eq with equal | equal <;> rw [equal] <;> + simp only [U32.max_eq, U64.max_eq] <;> change counters.val.length < _ <;> omega + step as ⟨actual, actualMeaning⟩ + rw [CounterAggregation.sum_contribute_absent _ _ _ _ positioned.symm] + simp [sumCountersView, actualMeaning, sumView, List.map_append] + | some index => + simp only [Option.map_some] at positioned + have keyAt := SchemaIndex.position_points_to_name _ _ index.val positioned.symm + have inside : index.val < counters.val.length := by + have lengthBound := (List.getElem?_eq_some_iff.mp keyAt).1 + simpa [sumCountersView, List.length_map] using lengthBound + step as ⟨old, oldAt⟩ + have modelAt : (sumCountersView counters)[index.val]? = some (sumView old) := by + simp [sumCountersView, List.getElem?_map, List.getElem?_eq_getElem inside, oldAt] + have update := CounterAggregation.sum_contribute_at _ _ capacity.val slots.val index.val (sumView old) positioned.symm modelAt + rw [update] + split <;> rename_i tighter + · step as ⟨mutable, restore, mutableAt, restoreMeaning⟩ + have same : mutable = old := mutableAt.trans oldAt.symm + subst mutable + have tight : capacity.val < old.capacity.val := by simpa using tighter + simp [restoreMeaning, sumCountersView, sumView, List.map_set, Nat.min_eq_right (Nat.le_of_lt tight), same] + · simp only [spec_ok] + have kept : old.capacity.val ≤ capacity.val := by simpa using tighter + have same : {sumView old with capacity := min (sumView old).capacity capacity.val} = sumView old := by + simp [sumView, Nat.min_eq_left kept] + rw [same] + have modelInside : index.val < (sumCountersView counters).length := by simpa [sumCountersView] using inside + have actualAt : (sumCountersView counters)[index.val] = sumView old := by + simpa only [List.getElem?_eq_getElem modelInside, Option.some.injEq] using modelAt + rw [← actualAt, List.set_getElem_self] + +/-- The complete native loop implements every contribution in order. Its size + bound is the admitted gateway chain limit, not a uniqueness assumption. -/ +@[step] theorem aggregate_sum_spec (contributions : Slice counter_aggregation.SumCapacity) + (bounded : contributions.val.length ≤ 16) : + counter_aggregation.aggregate_sum contributions ⦃ actual => + sumCountersView actual = CounterAggregation.aggregateSum [] (contributions.val.map sumView) ⦄ := by + unfold counter_aggregation.aggregate_sum counter_aggregation.aggregate_sum_loop + apply loop.spec_decr_nat + (measure := fun state => contributions.val.length - state.2.val) + (inv := fun state => state.1.val.length ≤ state.2.val ∧ state.2.val ≤ contributions.val.length ∧ + sumCountersView state.1 = CounterAggregation.aggregateSum [] ((contributions.val.take state.2.val).map sumView)) + · rintro ⟨current, index⟩ ⟨currentSize, indexBound, currentMeaning⟩ + dsimp only at currentSize indexBound currentMeaning + unfold counter_aggregation.aggregate_sum_loop.body + dsimp only + split <;> rename_i within + · have inside : index.val < contributions.val.length := by simpa using within + step as ⟨entry, entryAt⟩ + step with contribute_sum_spec as ⟨updated, updatedMeaning⟩ + have updatedSize : updated.val.length ≤ current.val.length + 1 := by + have modelBound := CounterAggregation.sum_contribute_length_le (sumCountersView current) (entry.key.val.map (·.val)) entry.capacity.val entry.slots.val + have exactSize := congrArg List.length updatedMeaning + simp only [sumCountersView, List.length_map] at exactSize modelBound + omega + step as ⟨next, nextValue⟩ + have nextNat : next.val = index.val + 1 := by simpa using nextValue + refine ⟨by omega, by omega, ?_, by omega⟩ + rw [updatedMeaning, currentMeaning, nextValue, + List.take_succ_eq_append_getElem inside, List.map_append, List.map_cons, List.map_nil, + CounterAggregation.sum_aggregate_snoc] + simp only [← entryAt, sumView] + · simp only [spec_ok] + have atEnd : contributions.val.length ≤ index.val := by simpa using within + simpa only [List.take_of_length_le atEnd] using currentMeaning + · simp [sumCountersView, CounterAggregation.aggregateSum] + +theorem source_sum_aggregate_unique (contributions : Slice counter_aggregation.SumCapacity) + (bounded : contributions.val.length ≤ 16) : + counter_aggregation.aggregate_sum contributions ⦃ actual => + ((sumCountersView actual).map SumCounter.key).Nodup ⦄ := by + apply spec_mono (aggregate_sum_spec contributions bounded) + intro actual exactResult + rw [exactResult] + simpa [SumCounter.counter, List.map_map, Function.comp_def] using + CounterAggregation.sum_aggregate_unique (contributions.val.map sumView) + +theorem source_sum_aggregate_capacities (contributions : Slice counter_aggregation.SumCapacity) + (bounded : contributions.val.length ≤ 16) : + counter_aggregation.aggregate_sum contributions ⦃ actual => + ∀ key, CounterAggregation.lookup ((sumCountersView actual).map SumCounter.counter) key = + CounterAggregation.specification (fun _ => none) + ((contributions.val.map sumView).map SumCounter.counter) key ⦄ := by + apply spec_mono (aggregate_sum_spec contributions bounded) + intro actual exactResult key + rw [exactResult] + exact CounterAggregation.sum_aggregate_capacities _ key +/-- Every sum contribution receives the exact shared count counter's slot bound. -/ +@[step] theorem linked_sum_contribution_exact (counts : Slice counter_aggregation.CounterCapacity) + (countKey sumKey : Array Std.U8 32#usize) (capacity : Std.U64) : + counter_aggregation.linked_sum_contribution counts countKey sumKey capacity ⦃ actual => + sumView actual = ⟨sumKey.val.map (·.val), capacity.val, + (CounterAggregation.lookup (counts.val.map counterView) (countKey.val.map (·.val))).getD 0⟩ ⦄ := by + unfold counter_aggregation.linked_sum_contribution + step with count_capacity_spec as ⟨slots, slotMeaning⟩ + simp [sumView, slotMeaning] + +/-- Composing the actual count aggregator and sum constructor earns the minimum; + it does not assume a precomputed minimum or uniqueness of input keys. -/ +theorem source_sum_slots_share_count_minimum (incoming : Slice counter_aggregation.CounterCapacity) + (countKey sumKey : Array Std.U8 32#usize) (capacity : Std.U64) (bounded : incoming.val.length ≤ 16) : + (do + let counts ← counter_aggregation.aggregate incoming + counter_aggregation.linked_sum_contribution (alloc.vec.Vec.deref counts) countKey sumKey capacity) ⦃ actual => + sumView actual = ⟨sumKey.val.map (·.val), capacity.val, + (CounterAggregation.specification (fun _ => none) (incoming.val.map counterView) + (countKey.val.map (·.val))).getD 0⟩ ⦄ := by + step with aggregate_spec as ⟨counts, countMeaning⟩ + step with linked_sum_contribution_exact as ⟨actual, exactMeaning⟩ + have lookupMeaning : CounterAggregation.lookup (counts.val.map counterView) (countKey.val.map (·.val)) = + CounterAggregation.specification (fun _ => none) (incoming.val.map counterView) (countKey.val.map (·.val)) := by + change CounterAggregation.lookup (countersView counts) _ = _ + rw [countMeaning, CounterAggregation.aggregate_exact] + rfl + simpa [alloc.vec.Vec.deref, lookupMeaning] using exactMeaning + +end Auths.Product.CounterAggregation.Refinement diff --git a/formal/Auths/Refinement/Identifier.lean b/formal/Auths/Refinement/Identifier.lean new file mode 100644 index 000000000..38e2fcf00 --- /dev/null +++ b/formal/Auths/Refinement/Identifier.lean @@ -0,0 +1,243 @@ +import qualification.aeneas.generated.model.Funs +import Auths.Model.IdentifierString +open Aeneas Aeneas.Std Result +set_option maxHeartbeats 1000000 +namespace Auths.Refinement.Identifier + +def threeExcluded (first second third : Std.U8) : Prop := + (first.val = 225 ∧ second.val = 154 ∧ third.val = 128) ∨ + (first.val = 226 ∧ + ((second.val = 128 ∧ (128 ≤ third.val ∧ third.val ≤ 138 ∨ + third.val = 168 ∨ third.val = 169 ∨ third.val = 175)) ∨ + (second.val = 129 ∧ third.val = 159))) ∨ + (first.val = 227 ∧ second.val = 128 ∧ third.val = 128) +instance (a b c : Std.U8) : Decidable (threeExcluded a b c) := + inferInstanceAs (Decidable (_ ∨ _)) + +@[step] theorem three_excluded_exact (first second third : Std.U8) : + auths_model.identifier.forbidden_three_byte_prefix first second third + ⦃ result => result = decide (threeExcluded first second third) ⦄ := by + unfold auths_model.identifier.forbidden_three_byte_prefix + split_ifs <;> simp_all [threeExcluded, UScalar.le_equiv, UScalar.eq_equiv] + +/-- A byte grammar for the fixed Unicode control/whitespace exclusions. -/ +def excludedPrefix : List Std.U8 → Bool + | [] => false + | first :: rest => + decide (first.val ≤ 32 ∨ first.val = 127) || + match rest with + | [] => false + | second :: tail => + decide (first.val = 194 ∧ 128 ≤ second.val ∧ second.val ≤ 160) || + match tail with + | [] => false + | third :: _ => decide (threeExcluded first second third) + +@[step] theorem forbidden_at_exact (input : Slice Std.U8) (position : Std.Usize) : + auths_model.identifier.forbidden_identifier_at input position + ⦃ result => result = excludedPrefix (input.val.drop position.val) ⦄ := by + unfold auths_model.identifier.forbidden_identifier_at + simp only [core.slice.Slice.get, core.slice.index.Usize.get, + Slice.getElem?_Usize_eq, bind_tc_ok] + cases present : input.val[position.val]? with + | none => + have absent := List.getElem?_eq_none_iff.mp present + simp [List.drop_eq_nil_of_le absent, excludedPrefix] + | some first => + have bound := (List.getElem?_eq_some_iff.mp present).1 + have suffix : input.val.drop position.val = + first :: input.val.drop (position.val + 1) := by + rw [List.drop_eq_getElem_cons bound] + simp only [(List.getElem?_eq_some_iff.mp present).2] + rw [suffix] + clear suffix present + by_cases low : first ≤ 32#u8 + all_goals simp only [low, ↓reduceIte] + · have lowNat : first.val ≤ 32 := by scalar_tac + simp [excludedPrefix, lowNat] + · by_cases del : first = 127#u8 + all_goals simp only [del, ↓reduceIte] + · simp [excludedPrefix] + · have notLow : ¬ first.val ≤ 32 := by scalar_tac + have notDel : first.val ≠ 127 := by scalar_tac + step as ⟨remaining, remainingEq⟩ + by_cases short : remaining < 2#usize + all_goals simp only [short, ↓reduceIte] + · have one : input.val.drop (position.val + 1) = [] := by + apply List.drop_eq_nil_of_le + scalar_tac + simp [one, excludedPrefix, notLow, notDel] + · step as ⟨secondAt, secondAtEq⟩ + step as ⟨second, secondEq⟩ + have secondBound : position.val + 1 < input.val.length := by scalar_tac + have secondSuffix : input.val.drop (position.val + 1) = + second :: input.val.drop (position.val + 2) := by + rw [List.drop_eq_getElem_cons secondBound] + have eq : second = input.val[position.val + 1] := by + simpa [secondAtEq] using secondEq + simp [eq, Nat.add_assoc] + rw [secondSuffix] + clear secondSuffix + by_cases c2 : first = 194#u8 + all_goals simp only [c2, ↓reduceIte] + · have firstVal : first.val = 194 := by scalar_tac + cases tail : input.val.drop (position.val + 2) with + | nil => split_ifs <;> simp_all [excludedPrefix, UScalar.le_equiv, + UScalar.eq_equiv] + | cons byte tail => split_ifs <;> simp_all [excludedPrefix, + threeExcluded, UScalar.le_equiv, UScalar.eq_equiv] + · step as ⟨remaining2, remaining2Eq⟩ + by_cases short2 : remaining2 < 3#usize + all_goals simp only [short2, ↓reduceIte] + · have two : input.val.drop (position.val + 2) = [] := by + apply List.drop_eq_nil_of_le + scalar_tac + simp [two, excludedPrefix, notLow, notDel, + show first.val ≠ 194 by scalar_tac] + · step as ⟨thirdAt, thirdAtEq⟩ + step as ⟨third, thirdEq⟩ + have thirdBound : position.val + 2 < input.val.length := by scalar_tac + have thirdSuffix : input.val.drop (position.val + 2) = + third :: input.val.drop (position.val + 3) := by + rw [List.drop_eq_getElem_cons thirdBound] + have eq : third = input.val[position.val + 2] := by + simpa [thirdAtEq] using thirdEq + simp [eq, Nat.add_assoc] + rw [thirdSuffix] + clear thirdSuffix + step as ⟨matched, matchedEq⟩ + simp [excludedPrefix, notLow, notDel, matchedEq, + show first.val ≠ 194 by scalar_tac] + +def containsExcluded : List Std.U8 → Bool + | [] => false + | first :: rest => excludedPrefix (first :: rest) || containsExcluded rest + +theorem contains_drop_cons (bytes : List Std.U8) (position : Nat) + (within : position < bytes.length) : + containsExcluded (bytes.drop position) = + (excludedPrefix (bytes.drop position) || containsExcluded (bytes.drop (position + 1))) := by + rw [List.drop_eq_getElem_cons within] + rfl + +@[step] theorem scan_exact (input : Slice Std.U8) (position : Std.Usize) : + auths_model.identifier.contains_forbidden_identifier_loop input position + ⦃ result => result = containsExcluded (input.val.drop position.val) ⦄ := by + unfold auths_model.identifier.contains_forbidden_identifier_loop + apply loop.spec_decr_nat + (measure := fun current => input.val.length - current.val) + (inv := fun current => + containsExcluded (input.val.drop current.val) = + containsExcluded (input.val.drop position.val)) + · intro current invariant + unfold auths_model.identifier.contains_forbidden_identifier_loop.body + by_cases within : current < Slice.len input + all_goals simp only [within, ↓reduceIte] + · have withinNat : current.val < input.val.length := by scalar_tac + step as ⟨excluded, excludedEq⟩ + by_cases found : excluded = true + all_goals simp only [found, ↓reduceIte] + · change true = containsExcluded (input.val.drop position.val) + rw [← invariant, contains_drop_cons input.val current.val withinNat, + ← excludedEq, found] + rfl + · have absent : excluded = false := by simp_all + simp only [Bool.false_eq_true, ↓reduceIte] + step as ⟨next, nextEq⟩ + refine ⟨?_, ?_⟩ + · rw [← invariant, contains_drop_cons input.val current.val withinNat, + ← excludedEq, absent, Bool.false_or] + simp only [nextEq] + · omega + · have atEnd : input.val.length ≤ current.val := by scalar_tac + change false = containsExcluded (input.val.drop position.val) + simpa only [List.drop_eq_nil_of_le atEnd, containsExcluded] using invariant + · rfl + +@[step] theorem identifier_exact (value : Str) (maximum : Std.Usize) : + auths_model.identifier.bounded_identifier_valid value maximum + ⦃ result => result = + (!value.val.isEmpty && decide (value.val.length ≤ maximum.val) && + !containsExcluded value.val) ⦄ := by + unfold auths_model.identifier.bounded_identifier_valid + simp only [core.str.Str.is_empty, core.str.Str.len, core.str.Str.as_bytes, + bind_tc_ok] + by_cases empty : value.val.isEmpty = true + all_goals simp only [empty, Bool.false_eq_true, ↓reduceIte] + · simp + · by_cases fits : Slice.len value ≤ maximum + all_goals simp only [fits, ↓reduceIte] + · simp only [auths_model.identifier.contains_forbidden_identifier] + step with scan_exact as ⟨excluded, excludedEq⟩ + simp [excludedEq, + List.drop_zero, show value.val.length ≤ maximum.val by scalar_tac] + · simp [show ¬ value.val.length ≤ maximum.val by scalar_tac] + +/-- The proof-facing byte grammar is the independent scalar-digit grammar. -/ +theorem prefix_view (bytes : List Std.U8) : + excludedPrefix bytes = Auths.Model.Identifier.excludedPrefix (bytes.map (·.val)) := by + cases bytes with + | nil => rfl + | cons first rest => + cases rest with + | nil => rfl + | cons second tail => + cases tail with + | nil => rfl + | cons third tail => rfl + +theorem scan_view (bytes : List Std.U8) : + containsExcluded bytes = Auths.Model.Identifier.containsExcluded (bytes.map (·.val)) := by + induction bytes with + | nil => rfl + | cons first rest ih => + simp only [containsExcluded, List.map_cons, + Auths.Model.Identifier.containsExcluded, prefix_view, List.map_cons, ih] + +/-- Exact source-to-policy refinement on any represented UTF-8 scalar stream. +The byte representation premise is explicit; this does not assume that an +arbitrary Aeneas `Str` carrier has already been validated as UTF-8. -/ +theorem identifier_unicode_exact (value : Str) (maximum : Std.Usize) + (scalars : List Nat) + (represented : value.val.map (·.val) = scalars.flatMap Auths.Model.Identifier.utf8) + (bounded : ∀ scalar ∈ scalars, scalar ≤ 1114111) : + auths_model.identifier.bounded_identifier_valid value maximum + ⦃ result => result = + (!value.val.isEmpty && decide (value.val.length ≤ maximum.val) && + !(scalars.any (fun scalar => decide (Auths.Model.Identifier.excluded scalar)))) ⦄ := by + step with identifier_exact as ⟨result, resultEq⟩ + rw [scan_view, represented, Auths.Model.Identifier.contains_encoded_scalars scalars bounded] + at resultEq + exact resultEq + +theorem string_representation (value : String) + (bounded : value.toByteArray.size ≤ U32.max) : + (toStr value bounded).val.map (·.val) = + (value.toList.map Char.toNat).flatMap Auths.Model.Identifier.utf8 := by + have carrier : (toStr value bounded).val.map (·.val) = + value.toByteArray.toList.map UInt8.toNat := by + unfold toStr + rw [List.map_map] + apply List.map_congr_left + intro byte _ + rfl + rw [carrier] + simpa only [List.flatMap_map] using Auths.Model.Identifier.string_encoding value + +/-- The actual validated string carrier supplies its own UTF-8 representation; +no caller assertion about raw `Str` bytes is needed. -/ +theorem identifier_string_exact (value : String) (maximum : Std.Usize) + (bounded : value.toByteArray.size ≤ U32.max) : + auths_model.identifier.bounded_identifier_valid (toStr value bounded) maximum + ⦃ result => result = + (!(toStr value bounded).val.isEmpty && + decide ((toStr value bounded).val.length ≤ maximum.val) && + !((value.toList.map Char.toNat).any + (fun scalar => decide (Auths.Model.Identifier.excluded scalar)))) ⦄ := by + apply identifier_unicode_exact _ _ (value.toList.map Char.toNat) + (string_representation value bounded) + intro scalar present + obtain ⟨character, _, rfl⟩ := List.mem_map.mp present + exact Auths.Model.Identifier.character_bound character + +end Auths.Refinement.Identifier diff --git a/formal/Auths/Support/Discriminant.lean b/formal/Auths/Support/Discriminant.lean new file mode 100644 index 000000000..606fc9eed --- /dev/null +++ b/formal/Auths/Support/Discriminant.lean @@ -0,0 +1,37 @@ +import Aeneas.Data.Discriminant +/-! +The pinned Aeneas attribute gives anonymous instances short global names. +Independent extractions of the same Rust enum consequently collide on import. +This attribute reuses the pinned generator without changing its match body or +values. Only the instance command's namespace changes to the full declaration +name. Lean still elaborates and kernel-checks every generated definition. +The qualification gate records this exact metadata-only normalization. +-/ +open Lean Elab Term Meta +open Lean.Parser.Term Command +namespace Auths.Support.Discriminant +syntax (name := qualifiedDiscriminant) "qualified_discriminant" ident ("["num,*"]")? : attr +initialize qualifiedDiscriminantAttribute : AttributeImpl ← do + let attrImpl : AttributeImpl := { + name := `qualifiedDiscriminant, + descr := "Pinned Aeneas discriminants with declaration-scoped instance names", + add := fun declName stx _ => do + let (ty, values) ← match stx with + | `(attr| qualified_discriminant $ty) => + pure (← Aeneas.Discriminant.elabTypeToken ty, none) + | `(attr| qualified_discriminant $ty [$x,*]) => + pure (← Aeneas.Discriminant.elabTypeToken ty, + some ((x.getElems.toList.map Syntax.isNatLit?).map Option.get!)) + | _ => throwUnsupportedSyntax + liftCommandElabM do + let commands ← liftTermElabM + (Aeneas.Discriminant.generateReadDiscriminantCmds declName ty values) + match commands with + | [definition, instanceCommand] => + elabCommand definition + withScope ({ · with currNamespace := declName }) (elabCommand instanceCommand) + | _ => throwError "Pinned Aeneas discriminant generator changed" + } + registerBuiltinAttribute attrImpl + pure attrImpl +end Auths.Support.Discriminant diff --git a/formal/Auths/Support/PositiveVec.lean b/formal/Auths/Support/PositiveVec.lean new file mode 100644 index 000000000..30e1829f9 --- /dev/null +++ b/formal/Auths/Support/PositiveVec.lean @@ -0,0 +1,85 @@ +import Aeneas +open Aeneas Aeneas.Std +namespace auths_composition.alloc.vec + +-- Equivalent bounded vectors whose element occurrences are strictly positive. +inductive SizedList (α : Type u) : Nat → Type u where + | nil : SizedList α 0 + | cons {n : Nat} (head : α) (tail : SizedList α n) : SizedList α (n + 1) + +structure Vec (α : Type u) where + size : Nat + elements : SizedList α size + bound : size ≤ Usize.max + +def SizedList.toList {α : Type u} {n : Nat} : SizedList α n → List α + | .nil => [] + | .cons head tail => head :: tail.toList + +theorem SizedList.length {α : Type u} {n : Nat} (value : SizedList α n) : value.toList.length = n := by + induction value with + | nil => rfl + | cons head tail ih => simp [toList, ih] + +def SizedList.ofList {α : Type u} : (values : List α) → SizedList α values.length + | [] => .nil + | head :: tail => .cons head (ofList tail) + +theorem SizedList.toList_ofList {α : Type u} (values : List α) : + (ofList values).toList = values := by + induction values with + | nil => rfl + | cons head tail ih => simp [ofList, toList, ih] + +def Vec.toBase {α : Type u} (value : Vec α) : Aeneas.Std.alloc.vec.Vec α := + ⟨value.elements.toList, by rw [SizedList.length]; exact value.bound⟩ + +def Vec.ofBase {α : Type u} (value : Aeneas.Std.alloc.vec.Vec α) : Vec α := + ⟨value.val.length, SizedList.ofList value.val, value.property⟩ + +theorem Vec.toBase_ofBase {α : Type u} (value : Aeneas.Std.alloc.vec.Vec α) : + (ofBase value).toBase = value := by + apply Subtype.ext + simp [toBase, ofBase, SizedList.toList_ofList] + +theorem SizedList.toList_injective {α : Type u} {n : Nat} (left right : SizedList α n) + (same : left.toList = right.toList) : left = right := by + induction left with + | nil => cases right; rfl + | cons head tail ih => + cases right with + | cons other rest => + simp only [toList, List.cons.injEq] at same + obtain ⟨rfl, sameTail⟩ := same + have sameTail := ih rest sameTail + cases sameTail + rfl + +theorem Vec.toBase_injective {α : Type u} (left right : Vec α) + (same : left.toBase = right.toBase) : left = right := by + cases left with + | mk n elements bound => + cases right with + | mk m other otherBound => + have values : elements.toList = other.toList := congrArg Subtype.val same + have sizes : n = m := by + have length := congrArg List.length values + simpa only [SizedList.length] using length + cases sizes + have elementsEqual := SizedList.toList_injective elements other values + cases elementsEqual + rfl + +theorem Vec.ofBase_toBase {α : Type u} (value : Vec α) : + ofBase value.toBase = value := by + apply toBase_injective + exact toBase_ofBase value.toBase + +-- Exact delegation to the pinned library; no Auths algorithm is replaced. +def Vec.deref {α : Type} (value : Vec α) : Slice α := + Aeneas.Std.alloc.vec.Vec.deref value.toBase + +theorem Vec.deref_exact {α : Type} (value : Vec α) : + (deref value).val = value.elements.toList := rfl + +end auths_composition.alloc.vec diff --git a/formal/Auths/Support/UnitCallback.lean b/formal/Auths/Support/UnitCallback.lean new file mode 100644 index 000000000..dc075fe10 --- /dev/null +++ b/formal/Auths/Support/UnitCallback.lean @@ -0,0 +1,22 @@ +import Aeneas +open Aeneas Aeneas.Std Result +namespace Auths.Support.UnitCallback + +/-- Restores the unit output erased by the backend at a concrete callback ABI. -/ +def restore {S : Type} (operation : Result S) : Result (Unit × S) := do + let state ← operation + ok ((), state) + +def erase {S : Type} (operation : Result (Unit × S)) : Result S := do + let (_, state) ← operation + ok state + +theorem erase_restore {S : Type} (operation : Result S) : erase (restore operation) = operation := by + cases operation <;> rfl + +theorem restore_erase {S : Type} (operation : Result (Unit × S)) : restore (erase operation) = operation := by + cases operation with + | fail reason => rfl + | div => rfl + | ok value => cases value with | mk empty state => cases empty; rfl +end Auths.Support.UnitCallback diff --git a/formal/Auths/Theorems.lean b/formal/Auths/Theorems.lean index ede497928..ca875343d 100644 --- a/formal/Auths/Theorems.lean +++ b/formal/Auths/Theorems.lean @@ -1,7 +1,60 @@ +import Auths.Codec.Payload +import Auths.Codec.Collection +import Auths.Codec.Fields +import Auths.Codec.Cursor +import Auths.Product.RecordShapeRefinement +import Auths.Product.StrictOrderRefinement +import Auths.Product.RecordTimesRefinement +import Auths.Product.StringConstructorsRefinement +import Auths.Product.RecoveryGateRefinement +import Auths.Product.SemanticIdRefinement +import Auths.Product.ConnectionFrameRefinement +import Auths.Product.ProfileConstructorRefinement +import Auths.Product.ConnectionBytesRefinement +import Auths.Product.ConnectionEntryRefinement +import Auths.Product.ReservationAdmissionRefinement +import Auths.Product.SlotRecordRefinement +import Auths.Product.SlotBatchRefinement +import Auths.Product.ReservationRetryRefinement +import Auths.Product.SumAggregationRefinement +import Auths.Product.CounterAggregationRefinement +import Auths.Product.CounterRefinement +import Auths.Product.Frontier.Refinement +import Auths.Product.BoundedClaimHistory +import Auths.Codec.PrincipalConstructor +import Auths.Codec.PrincipalScheme +import Auths.Codec.ScopeTrustSelectors +import Auths.Product.AdmissionExamples +import Auths.Product.Refinement.SchemaIndex +import Auths.Product.Refinement.OperationIdentity +import Auths.Codec.ScopeDecodedUse +import Auths.Codec.ScopeDecodeSafety +import Auths.Codec.ScopeDecodeExamples +import Auths.Codec.ScopeSelectors +import Auths.Codec.ScopeExamples +import Auths.Verifier.StatusAnchorExamples +import Auths.Verifier.StatusSemantics +import Auths.Verifier.StatusExamples +import Auths.Verifier.TemporalExamples +import Auths.Crypto.SuiteAdapterExamples +import Auths.Crypto.P256Examples +import Auths.Crypto.FramingTotality +import Auths.Crypto.CommitmentValidity +import Auths.Crypto.CommitmentExamples +import Auths.Crypto.Sha256Examples +import Auths.Crypto.NativeExamples +import Auths.Crypto.Strict.Examples +import Auths.Composition.FacadeExamples +import Auths.Crypto.Encoding.Examples +import Auths.Composition.ValidationExamples import Auths.Attenuation import Auths.Authority import Auths.Rich.Mutations import Auths.Composition +import Auths.Composition.Examples +import Auths.Composition.PlanExamples +import Auths.Composition.Work +import Auths.Composition.Bounds import Auths.Diversity import Auths.Product.Theorems import Auths.Product.Refinement @@ -19,11 +72,456 @@ import Auths.Refinement.Observation import Auths.Refinement.Approval import Auths.Observation import Auths.Approval +import Auths.Codec.Refinement +import Auths.Codec.Encoder +import Auths.Codec.Action +import Auths.Crypto.Examples +import Auths.Codec.ActionValidity +import Auths.Codec.Examples +import Auths.Codec.String +import Auths.Refinement.Identifier +import Auths.Product.Refinement.CollectionFence +import Auths.Product.Refinement.EntryDeadline namespace Auths def theoremInventory : List Lean.Name := [ + `Auths.Product.CounterFrames.Refinement.word_exact, + `Auths.Product.CounterFrames.Refinement.component_exact, + `Auths.Product.CounterFrames.Refinement.coordinates_exact, + `Auths.Product.CounterFrames.Refinement.count_exact, + `Auths.Product.CounterFrames.Refinement.sum_exact, + `Auths.Product.CounterFrames.Refinement.count_slot_exact, + `Auths.Product.CounterFrames.Refinement.sum_slot_exact, + `Auths.Product.CounterFrames.Refinement.count_source_binds_inputs, + `Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs, + `Auths.Product.CounterFrames.fields_cancel, + `Auths.Product.CounterFrames.encode_injective, + `Auths.Product.CounterFrames.slot_injective, + `Auths.Product.CounterFrames.fields_length, + `Auths.Product.CounterFrames.count_frame_length, + `Auths.Product.CounterFrames.sum_frame_length, + `Auths.Product.CounterFrames.slot_frame_length, + `Auths.Product.Frontier.Refinement.start_exact, + `Auths.Product.Frontier.Refinement.probe_exact, + `Auths.Product.Frontier.Refinement.observe_exact, + `Auths.Product.Frontier.Refinement.candidate_exact, + `Auths.Product.Frontier.Model.sixty_four_reads_suffice, + `Auths.Product.Frontier.Model.candidate_conservative, + `Auths.Product.Frontier.Model.successful_insertion_is_at_frontier, + `Auths.Product.Frontier.Refinement.source_work_bound, + `Auths.Product.BoundedClaimHistory.every_history_preserves, + `Auths.Product.BoundedClaimHistory.every_history_count_bound, + `Auths.Product.BoundedClaimHistory.every_history_sum_bound, + `Auths.Product.BoundedClaimHistory.every_history_one_owner, + `Auths.Product.BoundedClaimHistory.replay_preserves_counters, + `Auths.Product.BoundedClaimHistory.closed_window_cannot_charge, + `Auths.Product.BoundedClaimHistory.Examples.useful_delegation_shares_capacity, + `Auths.Product.BoundedClaimHistory.Examples.recovery_cannot_reissue_lost_handle, + `Auths.PrincipalConstructor.parse_exact, + `Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity, + `Auths.Product.AdmissionHistory.Examples.failure_before_commit_can_retry, + `Auths.Product.AdmissionHistory.Examples.terminal_refusal_retains_claim_without_capacity, + `Auths.PrincipalScheme.scheme_refines, + `Auths.ScopeConstructor.accepted_rule_valid, + `Auths.ScopeConstructor.accepted_trust_valid, + `Auths.ScopeConstructor.decoded_trust_principal, + `Auths.ScopeConstructor.decoded_trust_grant, + `Auths.Product.SchemaIndex.Refinement.field_name_equal_spec, + `Auths.Product.SchemaIndex.Refinement.field_index_spec, + `Auths.Product.OperationIdentity.Refinement.logical_preimage_exact, + `Auths.Product.OperationIdentity.Refinement.token_exact, + `Auths.Product.AdmissionHistory.every_history_preserves_capacity, + `Auths.Product.AdmissionHistory.claim_has_one_owner, + `Auths.Product.AdmissionHistory.unacknowledged_has_no_new_handle, + `Auths.Product.AdmissionHistory.recovery_mints_no_handle, + `Auths.Product.AdmissionHistory.Examples.available_capacity_admits, + `Auths.Product.AdmissionHistory.Examples.lost_acknowledgement_preserves_claim, + `Auths.Product.AdmissionHistory.Examples.lost_acknowledgement_cannot_enter, + `Auths.Product.AdmissionHistory.Examples.replay_cannot_change_owner, + `Auths.Product.AdmissionHistory.Examples.two_entries_consume_shared_capacity, + `Auths.Product.AdmissionHistory.Examples.crash_cannot_refund_capacity, + `Auths.Product.AdmissionHistory.Examples.collected_window_cannot_reopen, + `Auths.Product.AdmissionHistory.Examples.write_handle_is_one_use, + `Auths.Product.SchemaIndex.indexed_argument_is_named, + `Auths.Product.SchemaIndex.lowered_field_uses_exact_name, + `Auths.Product.SchemaIndex.undeclared_field_refused, + `Auths.Product.SchemaIndex.field_rendering_preserved, + `Auths.Product.OperationIdentity.preimage_injective, + `Auths.Product.OperationIdentity.valid_tokens_bind_identity, + `Auths.PrincipalScheme.Model.evaluate_iff_grammar, + `Auths.PrincipalScheme.Model.grammar_minimum, + `Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list, + `Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list, + `Auths.ScopeConstructor.decoded_scope_covers, + `Auths.ScopeConstructor.accepted_scope_valid, + `Auths.ScopeConstructor.DecodeExamples.accepts_own, + `Auths.ScopeConstructor.DecodeExamples.accepts_any, + `Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag, + `Auths.ScopeConstructor.DecodeExamples.refuses_truncation, + `Auths.ScopeConstructor.DecodeExamples.accepts_listed, + `Auths.ScopeConstructor.DecodeExamples.refuses_empty_list, + `Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id, + `Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit, + `Auths.ScopeConstructor.constructed_grant_selection, + `Auths.ScopeConstructor.constructed_principal_selection, + `Auths.ScopeConstructor.constructor_refines, + `Auths.ScopeConstructor.constructor_validity, + `Auths.ScopeConstructor.constructed_lookup, + `Auths.ScopeConstructor.Examples.accepts_unsorted, + `Auths.ScopeConstructor.Examples.rejects_duplicate, + `Auths.ScopeConstructor.Examples.rejects_empty, + `Auths.ScopeConstructor.Examples.rejects_oversized, + `Auths.StatusSelection.Search.search_loop, + `Auths.StatusSelection.Search.scope_contains, + `Auths.StatusSelection.visibility_refines, + `Auths.StatusSelection.principal_method_all_views, + `Auths.StatusSelection.grant_method_all_views, + `Auths.StatusSelection.AnchorExamples.first_listed_anchor, + `Auths.StatusSelection.AnchorExamples.last_listed_anchor, + `Auths.StatusSelection.AnchorExamples.unlisted_anchor_refused, + `Auths.StatusSelection.AnchorExamples.own_anchor_active, + `Auths.StatusSelection.AnchorExamples.other_anchor_hidden, + `Auths.StatusSelection.Algebra.evaluateScan_eq_evaluate, + `Auths.StatusSelection.principal_method_approver_independent, + `Auths.StatusSelection.grant_method_approver_independent, + `Auths.StatusSelection.sequence_floor_refines, + `Auths.StatusSelection.approver_visibility_refines, + `Auths.StatusSelection.freshness_exact, + `Auths.StatusSelection.principal_loop_refines, + `Auths.StatusSelection.principal_selector_approver_refines, + `Auths.StatusSelection.principal_method_approver_refines, + `Auths.StatusSelection.grant_loop_refines, + `Auths.StatusSelection.grant_selector_approver_refines, + `Auths.StatusSelection.grant_method_approver_refines, + `Auths.StatusSelection.byte_array_comparison, + `Auths.StatusSelection.native_floor_view, + `Auths.StatusSelection.unknown_issuer_visible, + `AuthsStatusSelection.lt_default_delegates, + `AuthsStatusSelection.gt_default_delegates, + `AuthsStatusSelection.max_default_delegates, + `Auths.StatusSelection.Examples.active_selected_horizon, + `Auths.StatusSelection.Examples.revoked_selected_horizon, + `Auths.StatusSelection.Examples.stale_selected_refused, + `Auths.StatusSelection.Examples.rollback_despite_newer, + `Auths.StatusSelection.Examples.newer_discards_old_stale_revocation, + `Auths.StatusSelection.Examples.latest_ties_conservatively_revoke, + `Auths.StatusSelection.Examples.wrong_method_refused, + `Auths.StatusSelection.Examples.missing_uses_snapshot_window, + `Auths.StatusSelection.Examples.unknown_issuer_refused, + `Auths.TemporalWitness.status_horizon_exact, + `Auths.TemporalWitness.status_horizon_accepts_iff, + `Auths.TemporalWitness.status_horizon_stale_refused, + `Auths.TemporalWitness.status_decision_accepts_iff, + `Auths.TemporalWitness.Status.decision_refines, + `Auths.TemporalWitness.assurance_loop_refines, + `Auths.TemporalWitness.assurance_entry_refines, + `Auths.TemporalWitness.successful_native_horizon_exact, + `Auths.TemporalWitness.native_horizon_permits_iff, + `Auths.TemporalWitness.assurance_permits_iff, + `Auths.TemporalWitness.successful_horizon_bounded, + `AuthsTemporalWitness.lt_default_delegates, + `Auths.TemporalWitness.Examples.inclusive_status_endpoint, + `Auths.TemporalWitness.Examples.expired_status_refused, + `Auths.TemporalWitness.Examples.revoked_principal_refused, + `Auths.TemporalWitness.Examples.revoked_grant_refused, + `Auths.TemporalWitness.Examples.selected_expiry_admitted, + `Auths.TemporalWitness.Examples.missing_requirement_refused, + `Auths.TemporalWitness.Examples.missing_observation_refused, + `Auths.TemporalWitness.Examples.unbounded_requirement_needs_no_observation, + `Auths.TemporalWitness.Examples.overflowing_expiry_saturates, + `Auths.Crypto.SuiteAdapters.ed_public_refines, + `Auths.Crypto.SuiteAdapters.ed_accepts_iff, + `Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted, + `Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused, + `Auths.Crypto.SuiteAdapters.p256_public_refines, + `Auths.Crypto.SuiteAdapters.p256_accepts_iff, + `Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted, + `Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused, + `AuthsSuiteAdapters.ed_error_to_from, + `AuthsSuiteAdapters.ed_error_from_to, + `AuthsSuiteAdapters.p256_error_to_from, + `AuthsSuiteAdapters.p256_error_from_to, + `AuthsSuiteAdapters.ed25519_delegates, + `AuthsSuiteAdapters.p256_delegates, + `Auths.Crypto.P256Encoding.guard_refines, + `Auths.Crypto.P256LowScan.loop_refines, + `Auths.Crypto.P256LowContract.guard_refines, + `Auths.Crypto.P256LowContract.r_bytes_irrelevant, + `Auths.Crypto.P256Native.decode_leaf_refines, + `Auths.Crypto.P256Native.parse_leaf_refines, + `Auths.Crypto.P256Native.equation_leaf_refines, + `Auths.Crypto.P256Native.decode_refines, + `Auths.Crypto.P256Native.public_verify_refines, + `Auths.Crypto.P256Native.public_accepts_iff, + `Auths.Crypto.P256Native.public_validate_refines, + `Auths.Crypto.P256Examples.public_call_forwards_exact_bytes, + `Auths.Crypto.P256Examples.changed_message_is_refused, + `Auths.Crypto.P256Examples.changed_key_is_refused, + `Auths.Crypto.P256Examples.changed_signature_is_refused, + `Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract, + `Auths.Crypto.P256Examples.forwarding_contract, + `Auths.Crypto.FramingTotality.identifier_total, + `Auths.Crypto.FramingTotality.identifier_accepts_iff, + `Auths.Crypto.FramingTotality.identifier_refuses_iff, + `Auths.Crypto.FramingTotality.application_total, + `Auths.Crypto.FramingTotality.application_accepts_iff, + `Auths.Crypto.FramingTotality.application_refuses_iff, + `Auths.Crypto.FramingTotality.signing_total, + `Auths.Crypto.FramingTotality.signing_accepts_iff, + `Auths.Crypto.FramingTotality.signing_refuses_iff, + `Auths.Crypto.CommitmentValidity.application_accepted_frame_valid, + `Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid, + `Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind, + `Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind, + `Auths.Crypto.CommitmentValidity.application_output_length, + `Auths.Crypto.CommitmentValidity.identifier_output_length, + `Auths.Crypto.BufferAllocation.buffer_refines, + `Auths.Crypto.BufferAllocation.accepted_empty, + `Auths.Crypto.BufferAllocation.accepted_capacity_fits, + `Auths.Crypto.CommitmentRefinement.application_preimage_exact, + `Auths.Crypto.CommitmentRefinement.identifier_preimage_exact, + `Auths.Crypto.Sha256Native.raw_hash_refines, + `Auths.Crypto.CommitmentExamples.empty_domain_refused, + `Auths.Crypto.CommitmentExamples.oversized_domain_refused, + `Auths.Crypto.CommitmentExamples.application_sample_admitted, + `Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted, + `Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest, + `Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest, + `Auths.Crypto.BufferAllocation.signed_bounds_iff, + `Auths.Crypto.CommitmentFrames.application_length, + `Auths.Crypto.CommitmentFrames.identifier_length, + `Auths.Crypto.CommitmentFrames.application_unambiguous, + `Auths.Crypto.CommitmentFrames.identifier_unambiguous, + `Auths.Crypto.CommitmentFrames.application_identifier_separate, + `Auths.Crypto.CommitmentFrames.signing_application_separate, + `Auths.Crypto.CommitmentFrames.signing_identifier_separate, + `Auths.Crypto.CommitmentRefinement.identifier_tag_word, + `Auths.Crypto.Sha256Examples.forwarding_contract, + `Auths.Crypto.Native.decode_leaf_refines, + `Auths.Crypto.Native.equation_leaf_refines, + `Auths.Crypto.Native.public_verify_refines, + `Auths.Crypto.Native.public_verify_accepts_iff, + `Auths.Crypto.Native.public_validate_refines, + `Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes, + `Auths.Crypto.NativeExamples.changed_message_is_refused, + `Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract, + `Auths.Crypto.NativeExamples.forwarding_contract, + `Auths.Crypto.ByteLex.value_bound, + `Auths.Crypto.ByteLex.value_cons, + `Auths.Crypto.ByteLex.le_numeric, + `Auths.Crypto.LowScan.loop_refines, + `Auths.Crypto.LowContract.half_order_exact, + `Auths.Crypto.LowContract.guard_refines, + `Auths.Crypto.LowContract.r_bytes_irrelevant, + `Auths.Crypto.CoordinateModel.ordinate_eq_iff, + `Auths.Crypto.CoordinateScan.loop_refines, + `Auths.Crypto.CoordinateContract.guard_refines, + `Auths.Crypto.WeakContract.zero_value, + `Auths.Crypto.WeakContract.one_value, + `Auths.Crypto.WeakContract.minus_one_value, + `Auths.Crypto.WeakContract.order_eight_a_value, + `Auths.Crypto.WeakContract.order_eight_b_value, + `Auths.Crypto.WeakContract.guard_refines, + `Auths.Crypto.RContract.guard_refines, + `Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines, + `Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines, + `Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines, + `Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines, + `Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines, + `Auths.Crypto.Strict.Acceptance.key_encoding_accepts_iff, + `Auths.Crypto.Strict.Acceptance.p256_key_accepts_iff, + `Auths.Crypto.Strict.Acceptance.ed_accepts_iff, + `Auths.Crypto.Strict.Acceptance.p256_accepts_iff, + `Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff, + `Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff, + `Auths.Crypto.Strict.Examples.zero_s_form_allowed, + `Auths.Crypto.Strict.Examples.half_s_form_allowed, + `Auths.Crypto.Strict.Examples.above_half_s_refused, + `Auths.Crypto.Strict.Examples.maximum_s_refused, + `Auths.Crypto.Strict.Examples.identity_coordinate_is_weak, + `Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak, + `Auths.Crypto.Strict.Examples.weak_r_form_refused, + `Auths.Crypto.Strict.Examples.public_r_form_allowed, + `Auths.Support.UnitCallback.erase_restore, + `Auths.Support.UnitCallback.restore_erase, + `Auths.Composition.Facade.event_outcome_exact, + `Auths.Composition.Facade.observer_mut_exact, + `Auths.Composition.Facade.observer_once_exact, + `Auths.Composition.Facade.evaluate_refines, + `Auths.Composition.Facade.invalid_plan_preserves_callback, + `Auths.Composition.FacadeExamples.conjunction_authorizes, + `Auths.Composition.FacadeExamples.duplicate_refused, + `Auths.Composition.FacadeExamples.threshold_indeterminate, + `Auths.Crypto.Encoding.Byte.lower_seven, + `Auths.Crypto.Encoding.Byte.sign_bit, + `Auths.Crypto.Encoding.Digits.value_bound, + `Auths.Crypto.Encoding.Digits.maximum_iff, + `Auths.Crypto.Encoding.Digits.zero_iff, + `Auths.Crypto.Encoding.Coordinate.encoding_criterion, + `Auths.Crypto.Encoding.Scan.loop_refines, + `Auths.Crypto.Encoding.Encoded.input_decomposes, + `Auths.Crypto.Encoding.Encoded.ordinate_frame, + `Auths.Crypto.Encoding.RootFlags.root_flags, + `Auths.Crypto.Encoding.Ed25519.guard_refines, + `Auths.Crypto.Encoding.P256.guard_refines, + `Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted, + `Auths.Crypto.Encoding.Examples.field_alias_refused, + `Auths.Crypto.Encoding.Examples.negative_zero_refused, + `Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted, + `Auths.Crypto.Encoding.Examples.compressed_form_accepted, + `Auths.Crypto.Encoding.Examples.uncompressed_tag_refused, + `Auths.Crypto.Encoding.Examples.short_compressed_refused, + `Auths.Composition.Order.reference_key_injective, + `Auths.Composition.Order.reference_comparison, + `Auths.Composition.SetModel.insert_values, + `Auths.Composition.SetModel.ordered_nodup, + `Auths.Composition.SetModel.insert_set, + `Auths.Composition.Collect.push_exact, + `Auths.Composition.Collect.collect_exact, + `Auths.Composition.ValidationCapacity.checker_preserves_capacity, + `Auths.Composition.ValidationProgress.progress_append, + `Auths.Composition.ValidationProgress.progress_card, + `Auths.Composition.ValidationProgress.checker_progress, + `Auths.Composition.ValidationShape.checker_shape, + `Auths.Composition.ValidationComplete.checker_complete, + `Auths.Composition.ValidationComplete.valid_is_accepted, + `Auths.Composition.ValidationSoundness.accepted_is_valid, + `Auths.Composition.ValidationSoundness.accepted_iff_valid, + `Auths.Composition.ValidationSoundness.operators_are_proper, + `Auths.Composition.ValidationSoundness.valid_has_bounded_events, + `Auths.Composition.ValidationLeaves.word_max_exact, + `Auths.Composition.ValidationLeaves.proof_leaf_exact, + `Auths.Composition.ValidationRefinement.walk_refines, + `Auths.Composition.ValidationPublic.validator_refines, + `Auths.Composition.ValidationPublic.public_evaluator_refines, + `Auths.Composition.ValidationContract.source_accepts_iff_valid, + `Auths.Composition.ValidationContract.valid_public_evaluator_refines, + `Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks, + `Auths.Composition.ValidationContract.public_event_bound, + `Auths.Composition.ValidationExamples.conjunction_valid, + `Auths.Composition.ValidationExamples.public_conjunction, + `Auths.Composition.ValidationExamples.duplicate_refused, + `Auths.Composition.ValidationExamples.zero_threshold_refused, + `Auths.Composition.ValidationExamples.empty_invalid, + `Auths.Composition.ValidationExamples.mixed_threshold_valid, + `Auths.Composition.ValidationExamples.public_threshold_indeterminate, + `Auths.Composition.ValidationExamples.narrow_refused, + `Auths.Composition.ValidationExamples.shallow_refused, + `Auths.Composition.Bounds.node_bound, + `Auths.Composition.Bounds.bounded_events, + `Auths.Composition.Bounds.source_bounded_events, + `auths_composition.alloc.vec.Vec.toBase_ofBase, + `auths_composition.alloc.vec.Vec.ofBase_toBase, + `auths_composition.alloc.vec.Vec.toBase_injective, + `auths_composition.alloc.vec.Vec.deref_exact, + `Auths.Composition.Traversal.evaluator_refines, + `Auths.Composition.Work.event_count, + `Auths.Composition.Work.leaf_order, + `Auths.Composition.Work.source_event_count, + `Auths.Composition.Work.source_leaf_order, + `Auths.Composition.PlanExamples.two_leaf_conjunction, + `Auths.Composition.PlanExamples.all_visits_after_denial, + `Auths.Composition.PlanExamples.any_visits_after_authorization, + `Auths.Composition.PlanExamples.threshold_indeterminate, + `Auths.Composition.PlanExamples.threshold_refused, + `Auths.Composition.Model.least_none_iff_empty, + `Auths.Composition.Model.all_children_authorize_iff, + `Auths.Composition.Model.threshold_children_authorize_iff, + `Auths.Composition.Model.denial_rank_lexical, + `Auths.Composition.Model.requirement_rank_lexical, + `Auths.Composition.Model.retain_minimum_least, + `Auths.Composition.Model.record_matches, + `Auths.Composition.Model.summarize_matches, + `Auths.Composition.Model.threshold_authorized_iff, + `Auths.Composition.Model.all_authorized_iff, + `Auths.Composition.Refinement.denial_order_exact, + `Auths.Composition.Refinement.denial_precedes_exact, + `Auths.Composition.Refinement.requirement_order_exact, + `Auths.Composition.Refinement.requirement_precedes_exact, + `Auths.Composition.Refinement.push_exact, + `Auths.Composition.Refinement.all_exact, + `Auths.Composition.Refinement.saturating_add_exact, + `Auths.Composition.Refinement.threshold_exact, + `Auths.Composition.Refinement.denial_precedes_lexical, + `Auths.Composition.Refinement.requirement_precedes_lexical, + `Auths.Composition.Refinement.threshold_authorized_exact, + `Auths.Composition.Refinement.source_fold_exact, + `Auths.Composition.Examples.all_positive, + `Auths.Composition.Examples.all_denial_before_missing, + `Auths.Composition.Examples.all_smallest_code, + `Auths.Composition.Examples.any_positive_overrides_invalid, + `Auths.Composition.Examples.any_missing_before_denial, + `Auths.Composition.Examples.any_smallest_requirement, + `Auths.Composition.Examples.threshold_lower_bound, + `Auths.Composition.Examples.threshold_reachable, + `Auths.Composition.Examples.threshold_impossible, + `Auths.Crypto.Framing.length_exact, + `Auths.Crypto.Framing.framing_is_unambiguous, + `Auths.Crypto.Framing.different_tags_separate, + `Auths.Crypto.Endian.be16_exact, + `Auths.Crypto.Endian.be64_exact, + `Auths.Crypto.Refinement.signing_preimage_exact, + `Auths.Crypto.Refinement.accepted_frame_valid, + `Auths.Crypto.Refinement.accepted_preimages_bind_inputs, + `Auths.Crypto.Refinement.preimage_length_exact, + `Auths.Crypto.Refinement.object_domains_separate, + `Auths.Crypto.Refinement.profile_limit_refused, + `Auths.Crypto.Examples.minimal_preimage_exact, + `Auths.Crypto.Examples.unicode_preimage_exact, + `Auths.Codec.Constructors.identifier_exact, + `Auths.Codec.Constructors.identifier_decision_valid, + `Auths.Codec.Constructors.media_type_parse_exact, + `Auths.Codec.Constructors.profile_id_parse_exact, + `Auths.Codec.Constructors.capability_id_parse_exact, + `Auths.Codec.Constructors.resource_id_parse_exact, + `Auths.Codec.Constructors.budget_algebra_id_parse_exact, + `Auths.Codec.Constructors.canonical_action_new_exact, + `Auths.Codec.Action.bounded_bytes_valid, + `Auths.Codec.Action.decoded_body_valid, + `Auths.Codec.Action.decoded_body_within_deployment, + `Auths.Codec.Examples.minimal_limits_valid, + `Auths.Codec.Examples.minimal_encoding_exact, + `Auths.Codec.Examples.minimal_action_accepted, + `Auths.Codec.Examples.duplicate_key_refused, + `Auths.Codec.Examples.nonminimal_integer_refused, + `Auths.Codec.Examples.invalid_utf8_refused, + `Auths.Codec.Examples.truncated_refused, + `Auths.Codec.Examples.trailing_byte_refused, + `Auths.Codec.Examples.action_byte_limit_refused, + `Auths.Codec.Examples.action_byte_limit_exact, + `Auths.Refinement.Identifier.identifier_string_exact, + `Auths.Codec.Action.decode_encode_exact, + `Auths.Codec.Action.accepted_encoding_unique, + `Auths.Codec.StringRefinement.string_copy_exact, + `Auths.Codec.StringRefinement.string_borrow_exact, + `Auths.Codec.StringRefinement.utf8_accepts_string, + `Auths.Model.Identifier.contains_encoded_scalars, + `Auths.Refinement.Identifier.forbidden_at_exact, + `Auths.Refinement.Identifier.scan_exact, + `Auths.Refinement.Identifier.identifier_exact, + `Auths.Refinement.Identifier.identifier_unicode_exact, + `Auths.Codec.Refinement.Encoder.append_tail_exact, + `Auths.Codec.Refinement.Encoder.encode_head_refines, + `Auths.Codec.Refinement.Encoder.encode_head_byte_bound, + `Auths.Codec.Refinement.Encoder.encode_head_roundtrip, + `Auths.Product.EntryDeadline.permits_fold, + `Auths.Product.EntryDeadline.exclusive_endpoint_refuses, + `Auths.Product.EntryDeadline.inclusive_endpoint_admits, + `Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model, + `Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model, + `Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses, + `Auths.Product.CollectionFence.collection_cannot_reopen_window, + `Auths.Product.CollectionFence.swept_window_cannot_readmit, + `Auths.Product.CollectionFence.later_window_admits, + `Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model, + `Auths.Product.Refinement.CollectionFence.translated_advance_refines_model, + `Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses, + `Auths.Codec.readHead_encodeHead, + `Auths.Codec.Refinement.read_head_refines, + `Auths.Codec.Refinement.read_tail_bounded, + `Auths.Codec.Refinement.read_head_accepts_encoding, `Auths.Rich.finiteSet_subset_refl, `Auths.Rich.finiteSet_subset_trans, `Auths.Rich.finiteSet_subset_antisymm, @@ -345,7 +843,168 @@ def theoremInventory : List Lean.Name := `Auths.Refinement.Approval.translated_principal_ids_subset_refines_model, `Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model, `Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model, - `Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model + `Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model, + `Auths.Product.CounterAggregation.Refinement.counter_equal_spec, + `Auths.Product.CounterAggregation.Refinement.counter_position_spec, + `Auths.Product.CounterAggregation.Refinement.contribute_spec, + `Auths.Product.CounterAggregation.Refinement.aggregate_spec, + `Auths.Product.CounterAggregation.Refinement.source_aggregate_unique, + `Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities, + `Auths.Product.CounterAggregation.lookup_contribute, + `Auths.Product.CounterAggregation.contribute_keys, + `Auths.Product.CounterAggregation.contribute_unique, + `Auths.Product.CounterAggregation.contribute_at, + `Auths.Product.CounterAggregation.contribute_absent, + `Auths.Product.CounterAggregation.aggregate_exact, + `Auths.Product.CounterAggregation.aggregate_unique, + `Auths.Product.CounterAggregation.contribute_length_le, + `Auths.Product.CounterAggregation.aggregate_append, + `Auths.Product.CounterAggregation.aggregate_snoc, + `Auths.Product.CounterAggregation.aggregate_length_le, + `Auths.Product.CounterAggregation.Refinement.sum_position_spec, + `Auths.Product.CounterAggregation.Refinement.contribute_sum_spec, + `Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec, + `Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique, + `Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities, + `Auths.Product.CounterAggregation.sum_contribution_projection, + `Auths.Product.CounterAggregation.sum_aggregate_projection, + `Auths.Product.CounterAggregation.sum_aggregate_unique, + `Auths.Product.CounterAggregation.sum_aggregate_capacities, + `Auths.Product.CounterAggregation.sum_contribute_length_le, + `Auths.Product.CounterAggregation.sum_aggregate_append, + `Auths.Product.CounterAggregation.sum_aggregate_snoc, + `Auths.Product.CounterAggregation.first_slots_preserved, + `Auths.Product.CounterAggregation.sum_contribute_at, + `Auths.Product.CounterAggregation.sum_contribute_absent, + `Auths.Product.ReservationRetry.Refinement.retry_target_exact, + `Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay, + `Auths.Product.ReservationRetry.Refinement.source_count_progress_safe, + `Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe, + `Auths.Product.ReservationRetry.existing_claim_is_replay, + `Auths.Product.ReservationRetry.count_progress_exact, + `Auths.Product.ReservationRetry.sum_progress_exact, + `Auths.Product.ReservationRetry.count_available, + `Auths.Product.ReservationRetry.sum_available, + `Auths.Product.SlotBatch.Refinement.count_loop_exact, + `Auths.Product.SlotBatch.Refinement.sum_loop_exact, + `Auths.Product.SlotBatch.Refinement.build_exact, + `Auths.Product.SlotBatch.Refinement.source_claim_first, + `Auths.Product.SlotBatch.Refinement.source_complete_entry_count, + `Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused, + `Auths.Product.SlotBatch.sum_entries_length, + `Auths.Product.SlotBatch.first_is_claim, + `Auths.Product.SlotBatch.exact_entry_count, + `Auths.Product.SlotBatch.invalid_shape_refused, + `Auths.Product.SlotBatch.Refinement.native_sums_refines, + `Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec, + `Auths.Product.SlotRecord.Refinement.validate_cumulative_exact, + `Auths.Product.SlotRecord.Refinement.source_accepted_binds_record, + `Auths.Product.SlotRecord.Refinement.source_invalid_record_refused, + `Auths.Product.SlotRecord.accepted_iff, + `Auths.Product.SlotRecord.accepted_binds_slot, + `Auths.Product.SlotRecord.hex_matches_injective, + `Auths.Product.CounterAggregation.lookup_at, + `Auths.Product.CounterAggregation.lookup_absent, + `Auths.Product.CounterAggregation.Refinement.count_capacity_spec, + `Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact, + `Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum, + `Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact, + `Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds, + `Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum, + `Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors, + `Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow, + `Auths.Product.ReservationAdmission.counts_admit_iff, + `Auths.Product.ReservationAdmission.sums_admit_iff, + `Auths.Product.ReservationAdmission.admitted_iff, + `Auths.Product.ReservationAdmission.admitted_shapes, + `Auths.Product.ReservationAdmission.window_refusal_precedes_sum, + `Auths.Product.ReservationAdmission.admitted_sum_at, + `Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact, + `Auths.Product.ConnectionEntry.Refinement.entry_allows_exact, + `Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile, + `Auths.Product.ConnectionEntry.Refinement.source_disabled_refused, + `Auths.Product.ConnectionEntry.Refinement.source_revoked_refused, + `Auths.Product.ConnectionEntry.admitted_binds_all, + `Auths.Product.ConnectionBytes.Refinement.lower_tail_exact, + `Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact, + `Auths.Product.ConnectionBytes.Refinement.lower_valid_exact, + `Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul, + `Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul, + `Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound, + `Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound, + `Auths.Product.ConnectionBytes.lower_has_no_nul, + `Auths.Product.ConnectionBytes.graphic_has_no_nul, + `Auths.Product.ProfileConstructor.Refinement.constructor_exact, + `Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields, + `Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused, + `Auths.Product.SemanticId.Refinement.semantic_head_exact, + `Auths.Product.SemanticId.Refinement.semantic_tail_exact, + `Auths.Product.SemanticId.Refinement.semantic_valid_exact, + `Auths.Product.SemanticId.Refinement.source_earns_no_nul, + `Auths.Product.SemanticId.Refinement.source_earns_ascii, + `Auths.Product.SemanticId.Refinement.source_earns_bounds, + `Auths.Product.SemanticId.valid_has_no_nul, + `Auths.Product.SemanticId.valid_is_ascii, + `Auths.Product.ConnectionFrame.preimage_injective, + `Auths.Product.ConnectionFrame.validated_names_bind_both_fields, + `Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact, + `Auths.Product.RecoveryGate.Refinement.recovery_exact, + `Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation, + `Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state, + `Auths.Product.RecoveryGate.Refinement.binding_requirement_exact, + `Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation, + `Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation, + `Auths.Product.RecoveryGate.Refinement.state_transition_exact, + `Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time, + `Auths.Product.RecoveryGate.Refinement.record_change_exact, + `Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time, + `Auths.Product.StringConstructors.Refinement.actual_provider_exact, + `Auths.Product.StringConstructors.Refinement.actual_alias_exact, + `Auths.Product.StringConstructors.Refinement.actual_semantic_exact, + `Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload, + `Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload, + `Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload, + `Auths.Product.RecordTimes.Refinement.record_times_exact, + `Auths.Product.RecordTimes.Refinement.success_earns_order, + `Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape, + `Auths.Product.RecordTimes.Refinement.state_change_preserves_valid_time, + `Auths.Product.RecordTimes.Refinement.data_change_preserves_valid_time, + `Auths.Product.StrictOrder.Refinement.strict_order_exact, + `Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates, + `Auths.Product.StrictOrder.Refinement.ordered_implies_pairwise, + `Auths.Product.StrictOrder.Refinement.ordered_implies_no_duplicates, + `Auths.Product.RecordShape.Refinement.text_order_exact, + `Auths.Product.RecordShape.Refinement.profile_order_exact, + `Auths.Product.RecordShape.Refinement.workloads_exact, + `Auths.Product.RecordShape.Refinement.profiles_exact, + `Auths.Product.RecordShape.Refinement.record_shape_exact, + `Auths.Product.RecordShape.Refinement.success_earns_all_invariants, + `Auths.Codec.Cursor.new_exact, + `Auths.Codec.Cursor.at_exact, + `Auths.Codec.Cursor.position_exact, + `Auths.Codec.Cursor.head_exact, + `Auths.Codec.Cursor.u64_exact, + `Auths.Codec.Cursor.u8_exact, + `Auths.Codec.Cursor.u16_exact, + `Auths.Codec.Cursor.null_exact, + `Auths.Codec.Cursor.datatype_exact, + `Auths.Codec.Cursor.ensure_complete_exact, + `Auths.Codec.Payload.payload_exact, + `Auths.Codec.Payload.bytes_exact, + `Auths.Codec.Payload.str_exact, + `Auths.Codec.Payload.success_earns_span, + `Auths.Codec.Collection.collection_exact, + `Auths.Codec.Collection.map_exact, + `Auths.Codec.Collection.array_exact, + `Auths.Codec.Fields.key_exact, + `Auths.Codec.Fields.map_exact, + `Auths.Codec.Fields.text_exact, + `Auths.Codec.Fields.null_exact, + `Auths.Codec.Fields.is_null_exact, + `Auths.Codec.Fields.array_exact, + `Auths.Codec.Fields.bounded_bytes_exact, + `Auths.Codec.Fields.digest_bytes_exact ] end Auths + diff --git a/formal/Auths/Verifier/StatusAdequacy.lean b/formal/Auths/Verifier/StatusAdequacy.lean new file mode 100644 index 000000000..b28b53b46 --- /dev/null +++ b/formal/Auths/Verifier/StatusAdequacy.lean @@ -0,0 +1,63 @@ +import Auths.Verifier.StatusSummary +namespace Auths.StatusSelection.Algebra +open Model + +def summaryFinish (cap now : Nat) : Summary → Evaluation + | .rollback => ⟨.rollback, now⟩ + | .details facts => + if !facts.candidate then ⟨.missing, cap⟩ + else if !facts.matching then ⟨.wrongMethod, now⟩ + else match facts.latest with + | none => ⟨.untrusted, now⟩ + | some latest => if latest.stale then ⟨.stale, now⟩ + else ⟨if latest.revoked then .revoked else .active, latest.through⟩ + +theorem finish_normalize (cap now : Nat) (state : Scan) (bound : state.through ≤ cap) : + finish cap now state = summaryFinish cap now (normalize cap state) := by + cases state with + | mk candidate matching rollback maximum stale revoked through => + cases candidate <;> cases matching <;> cases rollback <;> + cases maximum <;> cases stale <;> cases revoked <;> + simp_all [finish, normalize, summaryFinish] + +theorem contribute_bound {Subject : Type} (cap age now : Nat) (row : Statement Subject) + (state : Scan) (bound : state.through ≤ cap) : + (contribute cap age now row state).through ≤ cap := by + unfold contribute + cases state.maximum <;> dsimp only <;> (try split_ifs) <;> simp_all + +theorem record_bound {Subject : Type} [BEq Subject] (cap age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (row : Statement Subject) (state : Scan) (bound : state.through ≤ cap) : + (record cap age now method rules subject view row state).through ≤ cap := by + unfold record + split_ifs + · cases sequenceFloor rules method row.issuer <;> dsimp only + · exact bound + · split_ifs + · exact bound + · exact contribute_bound cap age now row _ bound + · exact bound + · exact bound + +theorem scan_bound {Subject : Type} [BEq Subject] (cap age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (rows : List (Statement Subject)) (state : Scan) (bound : state.through ≤ cap) : + (scan cap age now method rules subject view rows state).through ≤ cap := by + induction rows generalizing state with + | nil => exact bound + | cons row rest ih => + simp only [scan] + split_ifs + · exact bound + · exact ih _ (record_bound cap age now method rules subject view row state bound) + +theorem scan_finish_independent {Subject : Type} [BEq Subject] (cap age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (rows : List (Statement Subject)) : + finish cap now (scan cap age now method rules subject view rows (initial cap)) = + summaryFinish cap now (independentAggregate cap age now method rules subject view rows) := by + rw [finish_normalize cap now _ (scan_bound cap age now method rules subject view rows _ (by rfl))] + rw [normalize_scan, normalize_initial, combine_empty_left, aggregate_independent] + +end Auths.StatusSelection.Algebra diff --git a/formal/Auths/Verifier/StatusAlgebra.lean b/formal/Auths/Verifier/StatusAlgebra.lean new file mode 100644 index 000000000..1b15bc70a --- /dev/null +++ b/formal/Auths/Verifier/StatusAlgebra.lean @@ -0,0 +1,164 @@ +import Auths.Verifier.StatusModel +import Mathlib.Tactic +namespace Auths.StatusSelection.Algebra +open Model + +structure Latest where + sequence : Nat + stale : Bool + revoked : Bool + through : Nat + deriving DecidableEq + +def mergeLatest : Option Latest → Option Latest → Option Latest + | none, right => right + | left, none => left + | some left, some right => + if left.sequence < right.sequence then some right + else if right.sequence < left.sequence then some left + else some ⟨left.sequence, left.stale || right.stale, left.revoked || right.revoked, + min left.through right.through⟩ + +theorem mergeLatest_none_left (right : Option Latest) : mergeLatest none right = right := rfl + +theorem mergeLatest_none_right (left : Option Latest) : mergeLatest left none = left := by + cases left <;> rfl + +theorem mergeLatest_comm (left right : Option Latest) : mergeLatest left right = mergeLatest right left := by + cases left <;> cases right <;> simp only [mergeLatest] + split_ifs <;> simp_all [Latest.mk.injEq, Bool.or_comm, Nat.min_comm] <;> omega + +theorem mergeLatest_assoc (left middle right : Option Latest) : + mergeLatest (mergeLatest left middle) right = mergeLatest left (mergeLatest middle right) := by + cases left with + | none => simp [mergeLatest] + | some a => + cases middle with + | none => simp [mergeLatest] + | some b => + cases right with + | none => simp [mergeLatest_none_right] + | some c => + by_cases ab : a.sequence < b.sequence <;> + by_cases ba : b.sequence < a.sequence <;> + by_cases ac : a.sequence < c.sequence <;> + by_cases ca : c.sequence < a.sequence <;> + by_cases bc : b.sequence < c.sequence <;> + by_cases cb : c.sequence < b.sequence <;> + simp only [mergeLatest, ab, ba, ac, ca, bc, cb, ↓reduceIte] <;> + simp_all [Latest.mk.injEq, Bool.or_assoc, Nat.min_assoc] <;> omega + +structure Facts where + candidate : Bool + matching : Bool + latest : Option Latest + deriving DecidableEq + +inductive Summary where + | rollback + | details (facts : Facts) + deriving DecidableEq + +def combine : Summary → Summary → Summary + | .rollback, _ => .rollback + | _, .rollback => .rollback + | .details left, .details right => .details + ⟨left.candidate || right.candidate, left.matching || right.matching, mergeLatest left.latest right.latest⟩ + +def empty : Summary := .details ⟨false, false, none⟩ + +theorem combine_assoc (left middle right : Summary) : + combine (combine left middle) right = combine left (combine middle right) := by + cases left <;> cases middle <;> cases right <;> + simp [combine, mergeLatest_assoc, Bool.or_assoc] + +theorem combine_empty_left (right : Summary) : combine empty right = right := by + cases right <;> simp [combine, empty, mergeLatest] + +theorem combine_empty_right (left : Summary) : combine left empty = left := by + cases left <;> simp [combine, empty, mergeLatest_none_right] + +def normalize (expiresAt : Nat) (state : Scan) : Summary := + if state.rollback then .rollback + else .details ⟨state.candidateSeen, state.methodSeen, + state.maximum.map (fun sequence => + ⟨sequence, state.stale, state.revoked, min expiresAt state.through⟩)⟩ + +def prepared {Subject : Type} [BEq Subject] (expiresAt age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) (row : Statement Subject) : Summary := + if row.subject == subject && visible rules row.issuer view then + if row.method == method then + match sequenceFloor rules method row.issuer with + | none => .details ⟨true, true, none⟩ + | some floor => if row.sequence < floor then .rollback + else .details ⟨true, true, some ⟨row.sequence, !fresh age row.observed row.expiresAt now, + !row.active, min expiresAt (deadline age row.observed row.expiresAt)⟩⟩ + else .details ⟨true, false, none⟩ + else empty + +theorem normalize_contribute {Subject : Type} (expiresAt age now : Nat) + (row : Statement Subject) (state : Scan) : + normalize expiresAt (contribute expiresAt age now row state) = + combine (normalize expiresAt state) + (.details ⟨false, false, some ⟨row.sequence, + !fresh age row.observed row.expiresAt now, !row.active, + min expiresAt (deadline age row.observed row.expiresAt)⟩⟩) := by + cases state with + | mk candidate matching rollback maximum stale revoked through => + cases rollback <;> cases maximum <;> + simp only [normalize, contribute, combine, mergeLatest, Option.map, + Bool.false_eq_true, ↓reduceIte] + all_goals split_ifs <;> + simp_all [Latest.mk.injEq, Facts.mk.injEq, Bool.or_comm, + Nat.min_assoc, Nat.min_left_comm] <;> omega + +theorem normalize_record {Subject : Type} [BEq Subject] (expiresAt age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (row : Statement Subject) (state : Scan) : + normalize expiresAt (record expiresAt age now method rules subject view row state) = + combine (normalize expiresAt state) (prepared expiresAt age now method rules subject view row) := by + unfold record prepared + split_ifs + · cases floorEquation : sequenceFloor rules method row.issuer with + | none => + cases state with + | mk candidate matching rollback maximum stale revoked through => + cases rollback <;> simp [normalize, combine, mergeLatest_none_right] + | some floor => + dsimp only + split_ifs + · cases state with + | mk candidate matching rollback maximum stale revoked through => + cases rollback <;> simp [normalize, combine] + · rw [normalize_contribute] + cases state with + | mk candidate matching rollback maximum stale revoked through => + cases rollback <;> simp [normalize, combine] + · cases state with + | mk candidate matching rollback maximum stale revoked through => + cases rollback <;> simp [normalize, combine, mergeLatest_none_right] + · simp [combine_empty_right] + +def aggregate {Subject : Type} [BEq Subject] (expiresAt age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) : + List (Statement Subject) → Summary + | [] => empty + | row :: rest => combine (prepared expiresAt age now method rules subject view row) + (aggregate expiresAt age now method rules subject view rest) + +theorem normalize_scan {Subject : Type} [BEq Subject] (expiresAt age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (rows : List (Statement Subject)) (state : Scan) : + normalize expiresAt (scan expiresAt age now method rules subject view rows state) = + combine (normalize expiresAt state) (aggregate expiresAt age now method rules subject view rows) := by + induction rows generalizing state with + | nil => simp [scan, aggregate, combine_empty_right] + | cons row rest ih => + simp only [scan, aggregate] + split_ifs with stopped + · simp [normalize, stopped, combine] + · rw [ih, normalize_record, combine_assoc] + +theorem normalize_initial (expiresAt : Nat) : normalize expiresAt (initial expiresAt) = empty := rfl + +end Auths.StatusSelection.Algebra diff --git a/formal/Auths/Verifier/StatusAllViews.lean b/formal/Auths/Verifier/StatusAllViews.lean new file mode 100644 index 000000000..8caf98c57 --- /dev/null +++ b/formal/Auths/Verifier/StatusAllViews.lean @@ -0,0 +1,327 @@ +import Auths.Verifier.StatusAnchorVisibility +import Auths.Verifier.StatusIndependent +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection +set_option maxHeartbeats 4000000 + +def principalLoopAll (method : String) (age : Std.U64) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (subject : String) (view : AuthsStatusSelection.auths_model.StatusView) (now : Std.U64) (statements : Slice AuthsStatusSelection.auths_model.SignedPrincipalStatus) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (state : NativeScan) (position : Std.Usize) := + select_principal_from_snapshot_loop method age snapshot subject view now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position + +theorem principal_loop_all_views (records : List AuthsStatusSelection.auths_model.SignedPrincipalStatus) + (statements : Slice AuthsStatusSelection.auths_model.SignedPrincipalStatus) (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (method subject : String) (age now : Std.U64) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (view : AuthsStatusSelection.auths_model.StatusView) (ordered : rulesOrdered rules.val) + (state : NativeScan) (position : Std.Usize) + (remaining : statements.val.drop position.val = records) : + AuthsStatusSelection.select_principal_from_snapshot_loop method age snapshot subject view now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject (viewView view) (records.map principalView) (scanView state) ⦄ := by + change Aeneas.Std.WP.spec (principalLoopAll method age snapshot subject view now statements rules state position) _ + induction records generalizing state position with + | nil => + have finished : ¬ position < statements.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold principalLoopAll + rw [select_principal_from_snapshot_loop.eq_def] + simp [finished, Model.scan] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := indexed_head statements position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next statements position head tail remaining + rcases state with ⟨seen, methodSeen, rollback, maximum, stale, revoked, through⟩ + by_cases stopped : rollback = true + · + unfold principalLoopAll + rw [select_principal_from_snapshot_loop.eq_def] + simp [guard, stopped, Model.scan, scanView] + · have running : rollback = false := by simpa using stopped + subst rollback + have advance (nextSeen nextMethod nextRollback : Bool) (nextMaximum : Option Std.U64) + (nextStale nextRevoked : Bool) (nextThrough : Std.U64) + (meaning : scanView (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) = Model.record snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject (viewView view) (principalView head) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through))) : + select_principal_from_snapshot_loop method age snapshot subject view now statements rules + nextSeen nextMethod nextRollback nextMaximum nextStale nextRevoked nextThrough next ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject (viewView view) ((head :: tail).map principalView) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through)) ⦄ := by + have contract := ih (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) next nextRemaining + rw [meaning] at contract + simpa only [principalLoopAll, List.map_cons, Model.scan, Bool.false_eq_true, ↓reduceIte, scanView] using contract + unfold principalLoopAll + rw [select_principal_from_snapshot_loop.eq_def] + simp only [guard, ↓reduceIte, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.SignedPrincipalStatus.impl.statement, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.principal, principal_eq, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.issuer, visibility_exact _ _ _ ordered, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.method, method_eq, + sequence_floor_exact, AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.sequence, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.valid_until, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.observed_at, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.valid_until, + freshness_exact, stale_test, AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.state, + principal_not_active, timestamp_min_exact, + AuthsStatusSelection.auths_model.Timestamp.get, AuthsStatusSelection.auths_model.FreshnessLimit.get, + AuthsStatusSelection.auths_model.Timestamp.new, lift, step] + cases subjectMatch : (head.statement.principal == subject) <;> + cases visible : Model.visible (rules.val.map ruleView) head.statement.issuer (viewView view) <;> + cases methodMatch : (head.statement.method == method) <;> + simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, principalView, scanView, subjectMatch, visible, methodMatch]) + | skip + all_goals + cases floor : nativeFloor rules method head.statement.issuer <;> + try simp only [bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, principalView, scanView, subjectMatch, visible, methodMatch, + ← native_floor_view rules method head.statement.issuer, floor]) + | skip + all_goals + cases maximum <;> try simp only [bind_tc_ok] + all_goals + repeat' (split_ifs <;> try simp (config := { zeta := true, zetaHave := true }) only [bind_tc_ok]) + all_goals try simp only [result_ite, bind_tc_ok, boolean_or] + all_goals + exact advance _ _ _ _ _ _ _ (by + clear ih advance + simp only [scanView] + repeat' rw [minimum_value] + simp_all [Model.record, Model.contribute, principalView, Model.deadline, + ← native_floor_view rules method head.statement.issuer, + saturation_exact, UScalar.lt_equiv, UScalar.eq_equiv, Nat.min_assoc, beq_iff_eq] <;> + (split_ifs <;> simp_all <;> omega)) + +def grantLoopAll (method : String) (age : Std.U64) (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (subject : AuthsStatusSelection.auths_model.GrantId) (view : AuthsStatusSelection.auths_model.StatusView) (now : Std.U64) (statements : Slice AuthsStatusSelection.auths_model.SignedGrantStatus) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (state : NativeScan) (position : Std.Usize) := + select_grant_from_snapshot_loop method age snapshot subject view now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position + +theorem grant_loop_all_views (records : List AuthsStatusSelection.auths_model.SignedGrantStatus) + (statements : Slice AuthsStatusSelection.auths_model.SignedGrantStatus) (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (method : String) (subject : AuthsStatusSelection.auths_model.GrantId) (age now : Std.U64) (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (view : AuthsStatusSelection.auths_model.StatusView) (ordered : rulesOrdered rules.val) + (state : NativeScan) (position : Std.Usize) + (remaining : statements.val.drop position.val = records) : + AuthsStatusSelection.select_grant_from_snapshot_loop method age snapshot subject view now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject (viewView view) (records.map grantView) (scanView state) ⦄ := by + change Aeneas.Std.WP.spec (grantLoopAll method age snapshot subject view now statements rules state position) _ + induction records generalizing state position with + | nil => + have finished : ¬ position < statements.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold grantLoopAll + rw [select_grant_from_snapshot_loop.eq_def] + simp [finished, Model.scan] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := indexed_head statements position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next statements position head tail remaining + rcases state with ⟨seen, methodSeen, rollback, maximum, stale, revoked, through⟩ + by_cases stopped : rollback = true + · + unfold grantLoopAll + rw [select_grant_from_snapshot_loop.eq_def] + simp [guard, stopped, Model.scan, scanView] + · have running : rollback = false := by simpa using stopped + subst rollback + have advance (nextSeen nextMethod nextRollback : Bool) (nextMaximum : Option Std.U64) + (nextStale nextRevoked : Bool) (nextThrough : Std.U64) + (meaning : scanView (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) = Model.record snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject (viewView view) (grantView head) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through))) : + select_grant_from_snapshot_loop method age snapshot subject view now statements rules + nextSeen nextMethod nextRollback nextMaximum nextStale nextRevoked nextThrough next ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject (viewView view) ((head :: tail).map grantView) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through)) ⦄ := by + have contract := ih (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) next nextRemaining + rw [meaning] at contract + simpa only [grantLoopAll, List.map_cons, Model.scan, Bool.false_eq_true, ↓reduceIte, scanView] using contract + unfold grantLoopAll + rw [select_grant_from_snapshot_loop.eq_def] + simp only [guard, ↓reduceIte, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.SignedGrantStatus.impl.statement, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.grant_id, grant_eq, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.issuer, visibility_exact _ _ _ ordered, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.method, method_eq, + sequence_floor_exact, AuthsStatusSelection.auths_model.GrantStatusStatement.impl.sequence, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.valid_until, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.observed_at, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.valid_until, + freshness_exact, stale_test, AuthsStatusSelection.auths_model.GrantStatusStatement.impl.state, + grant_not_active, timestamp_min_exact, + AuthsStatusSelection.auths_model.Timestamp.get, AuthsStatusSelection.auths_model.FreshnessLimit.get, + AuthsStatusSelection.auths_model.Timestamp.new, lift, step] + cases subjectMatch : (head.statement.grant_id == subject) <;> + cases visible : Model.visible (rules.val.map ruleView) head.statement.issuer (viewView view) <;> + cases methodMatch : (head.statement.method == method) <;> + simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, grantView, scanView, subjectMatch, visible, methodMatch]) + | skip + all_goals + cases floor : nativeFloor rules method head.statement.issuer <;> + try simp only [bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, grantView, scanView, subjectMatch, visible, methodMatch, + ← native_floor_view rules method head.statement.issuer, floor]) + | skip + all_goals + cases maximum <;> try simp only [bind_tc_ok] + all_goals + repeat' (split_ifs <;> try simp (config := { zeta := true, zetaHave := true }) only [bind_tc_ok]) + all_goals try simp only [result_ite, bind_tc_ok, boolean_or] + all_goals + exact advance _ _ _ _ _ _ _ (by + clear ih advance + simp only [scanView] + repeat' rw [minimum_value] + simp_all [Model.record, Model.contribute, grantView, Model.deadline, + ← native_floor_view rules method head.statement.issuer, + saturation_exact, UScalar.lt_equiv, UScalar.eq_equiv, Nat.min_assoc, beq_iff_eq] <;> + (split_ifs <;> simp_all <;> omega)) + +theorem principal_selector_all_views + (id : String) (policy : AuthsStatusSelection.auths_model.StatusPolicy) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (view : AuthsStatusSelection.auths_model.StatusView) (ordered : rulesOrdered snapshot.trust.val) + (subject : String) (now : Std.U64) : + select_principal_from_snapshot id policy snapshot subject view now ⦃ actual => + evaluationView actual = Model.evaluateScan id (policyView policy) snapshot.observed_at.val + snapshot.valid_until.val (snapshot.trust.val.map ruleView) + (snapshot.statements.val.map principalView) subject (viewView view) now.val ⦄ := by + cases policyEquation : policy with + | ExpiryOnly => + simp [select_principal_from_snapshot, AuthsStatusSelection.auths_model.Timestamp.new, + AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, policyView, + Model.evaluateScan, Model.wordMaximum, core.num.U64.MAX, UScalar.ofNat, UScalar.ofNatCore_val_eq, + U64.rMax] + | SnapshotRequired method age => + simp only [select_principal_from_snapshot, method_ne, bind_tc_ok, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.observed_at, timestamp_gt, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.valid_until, timestamp_lt, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.statements, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.trust, alloc.vec.Vec.deref] + by_cases mismatch : (method != id) = true + · simp [mismatch, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView] + · simp only [mismatch] + by_cases future : snapshot.observed_at.val > now.val + · simp [future, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch] + · simp only [future, decide_false, Bool.false_eq_true, ↓reduceIte] + by_cases expired : snapshot.valid_until.val < now.val + · simp [expired, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch, future] + · simp only [expired, decide_false, Bool.false_eq_true, ↓reduceIte] + have loop := principal_loop_all_views snapshot.statements.val snapshot.statements snapshot.trust + method subject age now snapshot view ordered (false, false, false, none, false, false, snapshot.valid_until) + 0#usize (by simp) + apply spec_bind loop + intro actual meaning + rcases actual with ⟨seen, matched, rollback, maximum, stale, revoked, through⟩ + change scanView (seen, matched, rollback, maximum, stale, revoked, through) = + Model.scan snapshot.valid_until.val age.val now.val method (snapshot.trust.val.map ruleView) + subject (viewView view) (snapshot.statements.val.map principalView) (Model.initial snapshot.valid_until.val) at meaning + simp only [Model.evaluateScan, policyView, mismatch, future, expired, decide_false, + Bool.false_or, Bool.false_eq_true, ↓reduceIte] + rw [← meaning] + cases seenEquation : seen <;> cases matchedEquation : matched <;> + cases rollbackEquation : rollback <;> cases maximumEquation : maximum <;> + cases staleEquation : stale <;> cases revokedEquation : revoked <;> + simp [AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.finish, + scanView, core.option.Option.is_none] + +theorem principal_method_all_views + (implementation : ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (subject : String) (view : AuthsStatusSelection.auths_model.StatusView) + (now : Std.U64) (ordered : rulesOrdered snapshot.trust.val) : + ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy snapshot subject view now + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluate implementation.id (policyView policy) snapshot.observed_at.val snapshot.valid_until.val + (snapshot.trust.val.map ruleView) (snapshot.statements.val.map principalView) subject (viewView view) now.val ⦄ := by + unfold ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + apply spec_bind (principal_selector_all_views implementation.id policy snapshot view ordered subject now) + intro evaluation meaning + simp only [spec_ok] + exact ⟨evaluation, rfl, meaning.trans (Algebra.evaluateScan_eq_evaluate ..)⟩ + +theorem grant_selector_all_views + (id : String) (policy : AuthsStatusSelection.auths_model.StatusPolicy) (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (view : AuthsStatusSelection.auths_model.StatusView) (ordered : rulesOrdered snapshot.trust.val) + (subject : AuthsStatusSelection.auths_model.GrantId) (now : Std.U64) : + select_grant_from_snapshot id policy snapshot subject view now ⦃ actual => + evaluationView actual = Model.evaluateScan id (policyView policy) snapshot.observed_at.val + snapshot.valid_until.val (snapshot.trust.val.map ruleView) + (snapshot.statements.val.map grantView) subject (viewView view) now.val ⦄ := by + cases policyEquation : policy with + | ExpiryOnly => + simp [select_grant_from_snapshot, AuthsStatusSelection.auths_model.Timestamp.new, + AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, policyView, + Model.evaluateScan, Model.wordMaximum, core.num.U64.MAX, UScalar.ofNat, UScalar.ofNatCore_val_eq, + U64.rMax] + | SnapshotRequired method age => + simp only [select_grant_from_snapshot, method_ne, bind_tc_ok, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.observed_at, timestamp_gt, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.valid_until, timestamp_lt, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.statements, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.trust, alloc.vec.Vec.deref] + by_cases mismatch : (method != id) = true + · simp [mismatch, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView] + · simp only [mismatch] + by_cases future : snapshot.observed_at.val > now.val + · simp [future, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch] + · simp only [future, decide_false, Bool.false_eq_true, ↓reduceIte] + by_cases expired : snapshot.valid_until.val < now.val + · simp [expired, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch, future] + · simp only [expired, decide_false, Bool.false_eq_true, ↓reduceIte] + have loop := grant_loop_all_views snapshot.statements.val snapshot.statements snapshot.trust + method subject age now snapshot view ordered (false, false, false, none, false, false, snapshot.valid_until) + 0#usize (by simp) + apply spec_bind loop + intro actual meaning + rcases actual with ⟨seen, matched, rollback, maximum, stale, revoked, through⟩ + change scanView (seen, matched, rollback, maximum, stale, revoked, through) = + Model.scan snapshot.valid_until.val age.val now.val method (snapshot.trust.val.map ruleView) + subject (viewView view) (snapshot.statements.val.map grantView) (Model.initial snapshot.valid_until.val) at meaning + simp only [Model.evaluateScan, policyView, mismatch, future, expired, decide_false, + Bool.false_or, Bool.false_eq_true, ↓reduceIte] + rw [← meaning] + cases seenEquation : seen <;> cases matchedEquation : matched <;> + cases rollbackEquation : rollback <;> cases maximumEquation : maximum <;> + cases staleEquation : stale <;> cases revokedEquation : revoked <;> + simp [AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.finish, + scanView, core.option.Option.is_none] + +theorem grant_method_all_views + (implementation : ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (subject : AuthsStatusSelection.auths_model.GrantId) (view : AuthsStatusSelection.auths_model.StatusView) + (now : Std.U64) (ordered : rulesOrdered snapshot.trust.val) : + ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy snapshot subject view now + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluate implementation.id (policyView policy) snapshot.observed_at.val snapshot.valid_until.val + (snapshot.trust.val.map ruleView) (snapshot.statements.val.map grantView) subject (viewView view) now.val ⦄ := by + unfold ExactStatusMethod.Insts.Auths_portsStatusMethod.grant + apply spec_bind (grant_selector_all_views implementation.id policy snapshot view ordered subject now) + intro evaluation meaning + simp only [spec_ok] + exact ⟨evaluation, rfl, meaning.trans (Algebra.evaluateScan_eq_evaluate ..)⟩ + +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusAnchorExamples.lean b/formal/Auths/Verifier/StatusAnchorExamples.lean new file mode 100644 index 000000000..4752b2f91 --- /dev/null +++ b/formal/Auths/Verifier/StatusAnchorExamples.lean @@ -0,0 +1,73 @@ +import Auths.Verifier.StatusAllViews +import Auths.Verifier.StatusExamples +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.StatusSelection + +theorem ordered_of_pairwise (values : List String) + (ordered : values.Pairwise (fun left right => (compare left right).isLE)) : Search.Ordered values := by + intro i j left right before atLeft atRight + obtain ⟨leftBound, leftValue⟩ := List.getElem?_eq_some_iff.mp atLeft + obtain ⟨rightBound, rightValue⟩ := List.getElem?_eq_some_iff.mp atRight + subst left right + by_cases same : i = j + · subst j; simp + · exact List.pairwise_iff_getElem.mp ordered i j leftBound rightBound (by omega) + +namespace AnchorExamples + +def anchors : AuthsStatusSelection.auths_model.StatusScopeAnchors := + ⟨["anchor:a", "anchor:c"], by scalar_tac⟩ + +theorem anchors_ordered : Search.Ordered anchors.val := + ordered_of_pairwise _ (by decide) + +theorem first_listed_anchor : + AuthsStatusSelection.auths_model.StatusScopeAnchors.contains anchors "anchor:a" = ok true := by + simpa [anchors] using Search.scope_contains anchors "anchor:a" anchors_ordered + +theorem last_listed_anchor : + AuthsStatusSelection.auths_model.StatusScopeAnchors.contains anchors "anchor:c" = ok true := by + simpa [anchors] using Search.scope_contains anchors "anchor:c" anchors_ordered + +theorem unlisted_anchor_refused : + AuthsStatusSelection.auths_model.StatusScopeAnchors.contains anchors "anchor:b" = ok false := by + simpa [anchors] using Search.scope_contains anchors "anchor:b" anchors_ordered + +def ownSnapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot := + let snapshot := Examples.snapshot [Examples.principalStatement .Active 2#u64 40#u64] (by scalar_tac) + {snapshot with trust := ⟨[{Examples.rule with scope := .OwnAnchor}], by scalar_tac⟩} + +def anchor (base : AuthsStatusSelection.auths_model.TrustAnchor) (principal : String) : AuthsStatusSelection.auths_model.TrustAnchor := + {base with id := "anchor:a", principal := principal} + +theorem own_ordered : rulesOrdered ownSnapshot.trust.val := by + intro rule member + simp only [ownSnapshot, List.mem_singleton] at member + subst rule + trivial + +theorem own_anchor_active (base : AuthsStatusSelection.auths_model.TrustAnchor) : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + Examples.implementation Examples.required ownSnapshot "raw:actor" (.Anchor (anchor base "raw:issuer")) 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.active, 60⟩ ⦄ := by + have result := principal_method_all_views Examples.implementation Examples.required ownSnapshot "raw:actor" + (.Anchor (anchor base "raw:issuer")) 50#u64 own_ordered + simpa [Examples.implementation, Examples.required, ownSnapshot, Examples.snapshot, Examples.rule, + Examples.principalStatement, ruleView, principalView, principalActive, policyView, scopeView, viewView, + anchor, Model.evaluate, Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.fresh, Model.deadline, + Model.wordMaximum] using result + +theorem other_anchor_hidden (base : AuthsStatusSelection.auths_model.TrustAnchor) : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + Examples.implementation Examples.required ownSnapshot "raw:actor" (.Anchor (anchor base "raw:other")) 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.missing, 100⟩ ⦄ := by + have result := principal_method_all_views Examples.implementation Examples.required ownSnapshot "raw:actor" + (.Anchor (anchor base "raw:other")) 50#u64 own_ordered + simpa [Examples.implementation, Examples.required, ownSnapshot, Examples.snapshot, Examples.rule, + Examples.principalStatement, ruleView, principalView, principalActive, policyView, scopeView, viewView, + anchor, Model.evaluate, Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.fresh, Model.deadline, + Model.wordMaximum] using result + +end AnchorExamples +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusAnchorVisibility.lean b/formal/Auths/Verifier/StatusAnchorVisibility.lean new file mode 100644 index 000000000..f06e43592 --- /dev/null +++ b/formal/Auths/Verifier/StatusAnchorVisibility.lean @@ -0,0 +1,88 @@ +import Auths.Verifier.StatusSearchContains +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection + +def scopeOrdered : AuthsStatusSelection.auths_model.StatusScope → Prop + | .Anchors values => Search.Ordered values.val + | _ => True + +def rulesOrdered (rules : List AuthsStatusSelection.auths_model.StatusTrustRule) : Prop := + ∀ rule ∈ rules, scopeOrdered rule.scope + +theorem scope_covers (scope : AuthsStatusSelection.auths_model.StatusScope) + (issuer : String) (anchor : AuthsStatusSelection.auths_model.TrustAnchor) + (ordered : scopeOrdered scope) : + AuthsStatusSelection.auths_model.StatusScope.covers scope issuer anchor = + ok (Model.scopeCovers (scopeView scope) issuer (.anchor anchor.id anchor.principal)) := by + cases scope <;> + simp only [AuthsStatusSelection.auths_model.StatusScope.covers, + AuthsStatusSelection.auths_model.TrustAnchor.impl.principal, + AuthsStatusSelection.auths_model.TrustAnchor.impl.id, principal_eq, bind_tc_ok, + scopeView, Model.scopeCovers] + exact Search.scope_contains _ _ ordered + +theorem anchor_visibility_stopped (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (issuer : String) (anchor : AuthsStatusSelection.auths_model.TrustAnchor) (position : Std.Usize) : + AuthsStatusSelection.auths_model.status_issuer_in_scope_loop rules issuer anchor false position = ok false := by + rw [AuthsStatusSelection.auths_model.status_issuer_in_scope_loop.eq_def] + simp + +theorem anchor_visibility_loop_refines (remainingRules : List AuthsStatusSelection.auths_model.StatusTrustRule) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (issuer : String) + (anchor : AuthsStatusSelection.auths_model.TrustAnchor) (position : Std.Usize) + (remaining : rules.val.drop position.val = remainingRules) (ordered : rulesOrdered remainingRules) : + AuthsStatusSelection.auths_model.status_issuer_in_scope_loop rules issuer anchor true position ⦃ actual => + actual = Model.visible (remainingRules.map ruleView) issuer (.anchor anchor.id anchor.principal) ⦄ := by + induction remainingRules generalizing position with + | nil => + have finished : ¬ position < rules.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + rw [AuthsStatusSelection.auths_model.status_issuer_in_scope_loop.eq_def] + simp [finished, Model.visible] + | cons head tail ih => + have headOrdered : scopeOrdered head.scope := ordered head (by simp) + have tailOrdered : rulesOrdered tail := by + intro rule member; exact ordered rule (by simp [member]) + obtain ⟨guard, atHead⟩ := indexed_head rules position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next rules position head tail remaining + rw [AuthsStatusSelection.auths_model.status_issuer_in_scope_loop.eq_def] + simp only [guard, ↓reduceIte, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.StatusTrustRule.impl.issuer, principal_eq] + cases matched : (head.issuer == issuer) with + | false => + simp only [Bool.false_eq_true, ↓reduceIte, step, bind_tc_ok] + simpa only [List.map_cons, Model.visible_cons, ruleView, matched, Bool.false_eq_true, ↓reduceIte] using + ih next nextRemaining tailOrdered + | true => + simp only [↓reduceIte, AuthsStatusSelection.auths_model.StatusTrustRule.impl.scope, + scope_covers _ _ _ headOrdered, bind_tc_ok, step] + cases covered : Model.scopeCovers (scopeView head.scope) issuer (.anchor anchor.id anchor.principal) with + | false => + simp [anchor_visibility_stopped, Model.visible_cons, ruleView, matched, covered] + | true => + simpa [Model.visible_cons, ruleView, matched, covered] using ih next nextRemaining tailOrdered + +theorem visibility_refines (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (issuer : String) (view : AuthsStatusSelection.auths_model.StatusView) (ordered : rulesOrdered rules.val) : + AuthsStatusSelection.auths_model.status_issuer_visible rules issuer view ⦃ actual => + actual = Model.visible (rules.val.map ruleView) issuer (viewView view) ⦄ := by + cases viewEquation : view with + | Approver => exact approver_visibility_refines rules issuer + | Anchor anchor => + simpa [AuthsStatusSelection.auths_model.status_issuer_visible, + AuthsStatusSelection.auths_model.status_issuer_in_scope, viewView] using + anchor_visibility_loop_refines rules.val rules issuer anchor 0#usize (by simp) ordered + +theorem visibility_exact (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (issuer : String) (view : AuthsStatusSelection.auths_model.StatusView) (ordered : rulesOrdered rules.val) : + AuthsStatusSelection.auths_model.status_issuer_visible rules issuer view = + ok (Model.visible (rules.val.map ruleView) issuer (viewView view)) := by + obtain ⟨actual, equation, meaning⟩ := spec_imp_exists (visibility_refines rules issuer view ordered) + exact equation.trans (congrArg Result.ok meaning) + +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusExamples.lean b/formal/Auths/Verifier/StatusExamples.lean new file mode 100644 index 000000000..fe193b4e5 --- /dev/null +++ b/formal/Auths/Verifier/StatusExamples.lean @@ -0,0 +1,126 @@ +import Auths.Verifier.StatusGrant +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.StatusSelection.Examples +open Auths.StatusSelection + +def zeroDigest : AuthsStatusSelection.auths_model.Digest := + ⟨List.replicate 32 0#u8, by decide⟩ + +def signature : AuthsStatusSelection.auths_model.SignatureEnvelope := + ⟨⟨"raw-key-v1", "raw:issuer#key-1", "ed25519-v1"⟩, ⟨List.replicate 64 1#u8, by scalar_tac⟩⟩ + +def principalStatement (state : AuthsStatusSelection.auths_model.PrincipalState) + (sequence observed : Std.U64) : AuthsStatusSelection.auths_model.SignedPrincipalStatus := + ⟨⟨1#u16, "auths-principal-status-v1", "raw:actor", state, sequence, observed, 100#u64, "raw:issuer", ⟨[], by scalar_tac⟩⟩, signature⟩ + +def rule : AuthsStatusSelection.auths_model.StatusTrustRule := + ⟨"auths-principal-status-v1", "raw:issuer", 1#u64, .AnyAnchor⟩ + +def snapshot (rows : List AuthsStatusSelection.auths_model.SignedPrincipalStatus) + (bounded : rows.length ≤ Usize.max) : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot := + ⟨zeroDigest, 40#u64, 100#u64, ⟨rows, bounded⟩, ⟨[], by scalar_tac⟩, ⟨[rule], by scalar_tac⟩⟩ + +def required : AuthsStatusSelection.auths_model.StatusPolicy := .SnapshotRequired "auths-principal-status-v1" 20#u64 + +def implementation : AuthsStatusSelection.ExactStatusMethod := ⟨"auths-principal-status-v1"⟩ + +-- These shape-valid signature bytes are synthetic. The actual pure selector +-- consumes evidence authenticated by its caller; these component witnesses +-- assert selection and deadline behavior, not cryptographic authenticity. +-- Native parity tests separately construct the same carriers through Rust APIs. +def unknownIssuer : AuthsStatusSelection.auths_model.SignedPrincipalStatus := + let signed := principalStatement .Active 2#u64 40#u64 + {signed with statement := {signed.statement with issuer := "raw:unknown"}} + +theorem active_selected_horizon : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [principalStatement .Active 2#u64 40#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.active, 60⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [principalStatement .Active 2#u64 40#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem revoked_selected_horizon : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [principalStatement .Revoked 2#u64 40#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.revoked, 60⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [principalStatement .Revoked 2#u64 40#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem stale_selected_refused : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [principalStatement .Active 2#u64 0#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.stale, 50⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [principalStatement .Active 2#u64 0#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem rollback_despite_newer : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [principalStatement .Active 0#u64 40#u64, principalStatement .Active 3#u64 40#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.rollback, 50⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [principalStatement .Active 0#u64 40#u64, principalStatement .Active 3#u64 40#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem newer_discards_old_stale_revocation : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [principalStatement .Revoked 1#u64 0#u64, principalStatement .Active 2#u64 40#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.active, 60⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [principalStatement .Revoked 1#u64 0#u64, principalStatement .Active 2#u64 40#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem latest_ties_conservatively_revoke : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [principalStatement .Active 2#u64 40#u64, principalStatement .Superseded 2#u64 40#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.revoked, 60⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [principalStatement .Active 2#u64 40#u64, principalStatement .Superseded 2#u64 40#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem wrong_method_refused : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation (.SnapshotRequired "other-status-v1" 20#u64) (snapshot [principalStatement .Active 2#u64 40#u64] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.wrongMethod, 50⟩ ⦄ := by + have result := principal_method_approver_refines implementation (.SnapshotRequired "other-status-v1" 20#u64) (snapshot [principalStatement .Active 2#u64 40#u64] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem missing_uses_snapshot_window : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.missing, 100⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +theorem unknown_issuer_refused : + AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + implementation required (snapshot [unknownIssuer] (by scalar_tac)) "raw:actor" .Approver 50#u64 + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = ⟨.untrusted, 50⟩ ⦄ := by + have result := principal_method_approver_refines implementation required (snapshot [unknownIssuer] (by scalar_tac)) "raw:actor" 50#u64 + simpa [implementation, required, snapshot, principalStatement, unknownIssuer, rule, ruleView, scopeView, + policyView, principalView, principalActive, Model.evaluateScan, Model.scan, Model.record, + Model.visible, Model.scopeCovers, Model.sequenceFloor, Model.initial, Model.contribute, + Model.fresh, Model.deadline, Model.wordMaximum, Model.finish] using result + +end Auths.StatusSelection.Examples diff --git a/formal/Auths/Verifier/StatusFloor.lean b/formal/Auths/Verifier/StatusFloor.lean new file mode 100644 index 000000000..2f669bf2b --- /dev/null +++ b/formal/Auths/Verifier/StatusFloor.lean @@ -0,0 +1,65 @@ +import Auths.Verifier.StatusLeaves +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection +set_option maxHeartbeats 2000000 + +theorem sequence_floor_already_found (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (method issuer : String) (value : Std.U64) (position : Std.Usize) : + status_sequence_floor_loop rules method issuer (some value) position = ok (some value) := by + rw [status_sequence_floor_loop.eq_def] + simp [core.option.Option.is_none] + +theorem sequence_floor_loop_refines (remainingRules : List AuthsStatusSelection.auths_model.StatusTrustRule) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String) (position : Std.Usize) + (remaining : rules.val.drop position.val = remainingRules) : + status_sequence_floor_loop rules method issuer none position ⦃ actual => + actual.map (fun value => value.val) = + Model.sequenceFloor (remainingRules.map ruleView) method issuer ⦄ := by + induction remainingRules generalizing position with + | nil => + have finished : ¬ position < rules.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + rw [status_sequence_floor_loop.eq_def] + simp [finished, Model.sequenceFloor] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := indexed_head rules position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next rules position head tail remaining + rw [status_sequence_floor_loop.eq_def] + simp only [guard, ↓reduceIte, core.option.Option.is_none, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.StatusTrustRule.impl.method, method_eq] + cases matchedMethod : (head.method == method) <;> + cases matchedIssuer : (head.issuer == issuer) <;> + simp only [matchedIssuer, Bool.false_eq_true, ↓reduceIte, + AuthsStatusSelection.auths_model.StatusTrustRule.impl.issuer, principal_eq, + AuthsStatusSelection.auths_model.StatusTrustRule.impl.sequence_floor, bind_tc_ok, step] + all_goals + first + | simpa [Model.sequenceFloor, ruleView, matchedMethod, matchedIssuer] using ih next nextRemaining + | simp [sequence_floor_already_found, Model.sequenceFloor, ruleView, matchedMethod, matchedIssuer] + +theorem sequence_floor_refines (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String) : + status_sequence_floor rules method issuer ⦃ actual => + actual.map (fun value => value.val) = Model.sequenceFloor (rules.val.map ruleView) method issuer ⦄ := by + simpa [status_sequence_floor] using + sequence_floor_loop_refines rules.val rules method issuer 0#usize (by simp) +def nativeFloor (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String) : Option Std.U64 := + (rules.val.find? (fun rule => rule.method == method && rule.issuer == issuer)).map (fun rule => rule.sequence_floor) + +theorem native_floor_view (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String) : + (nativeFloor rules method issuer).map (fun value => value.val) = Model.sequenceFloor (rules.val.map ruleView) method issuer := by + simp [nativeFloor, Model.sequenceFloor, ruleView, Function.comp_def] + +theorem sequence_floor_exact (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String) : + status_sequence_floor rules method issuer = ok (nativeFloor rules method issuer) := by + obtain ⟨actual, equation, meaning⟩ := spec_imp_exists (sequence_floor_refines rules method issuer) + have same : actual = nativeFloor rules method issuer := by + apply Option.map_injective (fun _ _ equality => UScalar.eq_of_val_eq equality) + exact meaning.trans (native_floor_view rules method issuer).symm + exact equation.trans (congrArg Result.ok same) + +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusFold.lean b/formal/Auths/Verifier/StatusFold.lean new file mode 100644 index 000000000..9cc679ac8 --- /dev/null +++ b/formal/Auths/Verifier/StatusFold.lean @@ -0,0 +1,40 @@ +import Auths.Verifier.StatusAdequacy +namespace Auths.StatusSelection.Algebra +open Model + +theorem maximum_foldl {α : Type} (rows : List α) (value : α → Nat) (initial : Nat) : + rows.foldl (fun maximum row => max maximum (value row)) initial = + max initial (rows.foldr (fun row maximum => max (value row) maximum) 0) := by + induction rows generalizing initial with + | nil => simp + | cons row rest ih => simp [ih, Nat.max_assoc] + +theorem minimum_foldr_seed {α : Type} (rows : List α) (value : α → Nat) (left right : Nat) : + rows.foldr (fun row horizon => min (value row) horizon) (min left right) = + min left (rows.foldr (fun row horizon => min (value row) horizon) right) := by + induction rows with + | nil => rfl + | cons row rest ih => simp [ih, Nat.min_left_comm] + +theorem minimum_foldl {α : Type} (rows : List α) (value : α → Nat) (initial : Nat) : + rows.foldl (fun horizon row => min horizon (value row)) initial = + rows.foldr (fun row horizon => min (value row) horizon) initial := by + induction rows generalizing initial with + | nil => rfl + | cons row rest ih => + simp only [List.foldl_cons, List.foldr_cons, ih] + rw [Nat.min_comm initial, minimum_foldr_seed] + +theorem capped_minimum {Subject : Type} (rows : List (Statement Subject × Nat)) + (cap age : Nat) : + rows.foldr (fun pair horizon => min (min cap (deadline age pair.1.observed pair.1.expiresAt)) horizon) cap = + rows.foldr (fun pair horizon => min (deadline age pair.1.observed pair.1.expiresAt) horizon) cap := by + induction rows with + | nil => rfl + | cons row rest ih => + simp only [List.foldr_cons] + rw [ih, Nat.min_assoc, Nat.min_left_comm cap] + rw [← minimum_foldr_seed rest (fun pair => deadline age pair.1.observed pair.1.expiresAt) cap cap] + simp only [Nat.min_self] + +end Auths.StatusSelection.Algebra diff --git a/formal/Auths/Verifier/StatusGrant.lean b/formal/Auths/Verifier/StatusGrant.lean new file mode 100644 index 000000000..eb813cce0 --- /dev/null +++ b/formal/Auths/Verifier/StatusGrant.lean @@ -0,0 +1,163 @@ +import Auths.Verifier.StatusPublic +import Auths.Verifier.StatusGrantLeaves +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection +set_option maxHeartbeats 4000000 + +def grantLoop (method : String) (age : Std.U64) (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (subject : AuthsStatusSelection.auths_model.GrantId) (now : Std.U64) (statements : Slice AuthsStatusSelection.auths_model.SignedGrantStatus) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (state : NativeScan) (position : Std.Usize) := + select_grant_from_snapshot_loop method age snapshot subject .Approver now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position + +theorem grant_loop_refines (records : List AuthsStatusSelection.auths_model.SignedGrantStatus) + (statements : Slice AuthsStatusSelection.auths_model.SignedGrantStatus) (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (method : String) (subject : AuthsStatusSelection.auths_model.GrantId) (age now : Std.U64) (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (state : NativeScan) (position : Std.Usize) + (remaining : statements.val.drop position.val = records) : + AuthsStatusSelection.select_grant_from_snapshot_loop method age snapshot subject .Approver now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject .approver (records.map grantView) (scanView state) ⦄ := by + change Aeneas.Std.WP.spec (grantLoop method age snapshot subject now statements rules state position) _ + induction records generalizing state position with + | nil => + have finished : ¬ position < statements.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold grantLoop + rw [select_grant_from_snapshot_loop.eq_def] + simp [finished, Model.scan] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := indexed_head statements position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next statements position head tail remaining + rcases state with ⟨seen, methodSeen, rollback, maximum, stale, revoked, through⟩ + by_cases stopped : rollback = true + · + unfold grantLoop + rw [select_grant_from_snapshot_loop.eq_def] + simp [guard, stopped, Model.scan, scanView] + · have running : rollback = false := by simpa using stopped + subst rollback + have advance (nextSeen nextMethod nextRollback : Bool) (nextMaximum : Option Std.U64) + (nextStale nextRevoked : Bool) (nextThrough : Std.U64) + (meaning : scanView (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) = Model.record snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject .approver (grantView head) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through))) : + select_grant_from_snapshot_loop method age snapshot subject .Approver now statements rules + nextSeen nextMethod nextRollback nextMaximum nextStale nextRevoked nextThrough next ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject .approver ((head :: tail).map grantView) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through)) ⦄ := by + have contract := ih (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) next nextRemaining + rw [meaning] at contract + simpa only [grantLoop, List.map_cons, Model.scan, Bool.false_eq_true, ↓reduceIte, scanView] using contract + unfold grantLoop + rw [select_grant_from_snapshot_loop.eq_def] + simp only [guard, ↓reduceIte, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.SignedGrantStatus.impl.statement, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.grant_id, grant_eq, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.issuer, approver_visibility_exact, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.method, method_eq, + sequence_floor_exact, AuthsStatusSelection.auths_model.GrantStatusStatement.impl.sequence, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.valid_until, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.observed_at, + AuthsStatusSelection.auths_model.GrantStatusStatement.impl.valid_until, + freshness_exact, stale_test, AuthsStatusSelection.auths_model.GrantStatusStatement.impl.state, + grant_not_active, timestamp_min_exact, + AuthsStatusSelection.auths_model.Timestamp.get, AuthsStatusSelection.auths_model.FreshnessLimit.get, + AuthsStatusSelection.auths_model.Timestamp.new, lift, step] + cases subjectMatch : (head.statement.grant_id == subject) <;> + cases visible : Model.visible (rules.val.map ruleView) head.statement.issuer .approver <;> + cases methodMatch : (head.statement.method == method) <;> + simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, grantView, scanView, subjectMatch, visible, methodMatch]) + | skip + all_goals + cases floor : nativeFloor rules method head.statement.issuer <;> + try simp only [bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, grantView, scanView, subjectMatch, visible, methodMatch, + ← native_floor_view rules method head.statement.issuer, floor]) + | skip + all_goals + cases maximum <;> try simp only [bind_tc_ok] + all_goals + repeat' (split_ifs <;> try simp (config := { zeta := true, zetaHave := true }) only [bind_tc_ok]) + all_goals try simp only [result_ite, bind_tc_ok, boolean_or] + all_goals + exact advance _ _ _ _ _ _ _ (by + clear ih advance + simp only [scanView] + repeat' rw [minimum_value] + simp_all [Model.record, Model.contribute, grantView, Model.deadline, + ← native_floor_view rules method head.statement.issuer, + saturation_exact, UScalar.lt_equiv, UScalar.eq_equiv, Nat.min_assoc, beq_iff_eq] <;> + (split_ifs <;> simp_all <;> omega)) + +theorem grant_selector_approver_refines + (id : String) (policy : AuthsStatusSelection.auths_model.StatusPolicy) (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) + (subject : AuthsStatusSelection.auths_model.GrantId) (now : Std.U64) : + select_grant_from_snapshot id policy snapshot subject .Approver now ⦃ actual => + evaluationView actual = Model.evaluateScan id (policyView policy) snapshot.observed_at.val + snapshot.valid_until.val (snapshot.trust.val.map ruleView) + (snapshot.statements.val.map grantView) subject .approver now.val ⦄ := by + cases policyEquation : policy with + | ExpiryOnly => + simp [select_grant_from_snapshot, AuthsStatusSelection.auths_model.Timestamp.new, + AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, policyView, + Model.evaluateScan, Model.wordMaximum, core.num.U64.MAX, UScalar.ofNat, UScalar.ofNatCore_val_eq, + U64.rMax] + | SnapshotRequired method age => + simp only [select_grant_from_snapshot, method_ne, bind_tc_ok, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.observed_at, timestamp_gt, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.valid_until, timestamp_lt, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.statements, + AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.trust, alloc.vec.Vec.deref] + by_cases mismatch : (method != id) = true + · simp [mismatch, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView] + · simp only [mismatch] + by_cases future : snapshot.observed_at.val > now.val + · simp [future, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch] + · simp only [future, decide_false, Bool.false_eq_true, ↓reduceIte] + by_cases expired : snapshot.valid_until.val < now.val + · simp [expired, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch, future] + · simp only [expired, decide_false, Bool.false_eq_true, ↓reduceIte] + have loop := grant_loop_refines snapshot.statements.val snapshot.statements snapshot.trust + method subject age now snapshot (false, false, false, none, false, false, snapshot.valid_until) + 0#usize (by simp) + apply spec_bind loop + intro actual meaning + rcases actual with ⟨seen, matched, rollback, maximum, stale, revoked, through⟩ + change scanView (seen, matched, rollback, maximum, stale, revoked, through) = + Model.scan snapshot.valid_until.val age.val now.val method (snapshot.trust.val.map ruleView) + subject .approver (snapshot.statements.val.map grantView) (Model.initial snapshot.valid_until.val) at meaning + simp only [Model.evaluateScan, policyView, mismatch, future, expired, decide_false, + Bool.false_or, Bool.false_eq_true, ↓reduceIte] + rw [← meaning] + cases seenEquation : seen <;> cases matchedEquation : matched <;> + cases rollbackEquation : rollback <;> cases maximumEquation : maximum <;> + cases staleEquation : stale <;> cases revokedEquation : revoked <;> + simp [AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.finish, + scanView, core.option.Option.is_none] + +theorem grant_method_approver_refines + (implementation : ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId) (now : Std.U64) : + ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy snapshot subject .Approver now + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluateScan implementation.id (policyView policy) snapshot.observed_at.val snapshot.valid_until.val + (snapshot.trust.val.map ruleView) (snapshot.statements.val.map grantView) subject .approver now.val ⦄ := by + unfold ExactStatusMethod.Insts.Auths_portsStatusMethod.grant + apply spec_bind (grant_selector_approver_refines implementation.id policy snapshot subject now) + intro evaluation meaning + simp only [spec_ok] + exact ⟨evaluation, rfl, meaning⟩ +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusGrantLeaves.lean b/formal/Auths/Verifier/StatusGrantLeaves.lean new file mode 100644 index 000000000..3aa5bf6c3 --- /dev/null +++ b/formal/Auths/Verifier/StatusGrantLeaves.lean @@ -0,0 +1,44 @@ +import Auths.Verifier.StatusSelection +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +namespace Auths.StatusSelection +set_option maxHeartbeats 2000000 + +theorem byte_array_comparison {N : Std.Usize} (left right : Array Std.U8 N) : + core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 left right = ok (left == right) := by + have sameComputation : core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 left right = + core.slice.cmp.PartialEqSlice.eq core.cmp.PartialEqU8 left.to_slice right.to_slice := by + simp [core.array.equality.PartialEqArray.eq, core.slice.cmp.PartialEqSlice.eq, + Array.to_slice, Array.length, Slice.length] + have contract := core.slice.cmp.PartialEqSlice.eq_homo_spec core.cmp.PartialEqU8 + left.to_slice right.to_slice (by + intro x y + simp [liftFun2]) + obtain ⟨actual, equation, meaning⟩ := spec_imp_exists contract + rw [sameComputation, equation] + congr 1 + apply Bool.eq_iff_iff.mpr + simpa [beq_iff_eq, Slice.eq_iff, Array.to_slice, Aeneas.Std.Array, Subtype.ext_iff] using meaning + +theorem grant_eq (left right : AuthsStatusSelection.auths_model.GrantId) : + AuthsStatusSelection.auths_model.GrantId.Insts.CoreCmpPartialEqGrantId.eq left right = ok (left == right) := by + simp [AuthsStatusSelection.auths_model.GrantId.Insts.CoreCmpPartialEqGrantId.eq, + AuthsStatusSelection.auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq, byte_array_comparison] + +def grantActive : AuthsStatusSelection.auths_model.GrantState → Bool + | .Active => true + | _ => false + +def grantView (signed : AuthsStatusSelection.auths_model.SignedGrantStatus) : + Model.Statement AuthsStatusSelection.auths_model.GrantId := + let row := signed.statement + ⟨row.grant_id, row.method, row.issuer, row.sequence.val, row.observed_at.val, + row.valid_until.val, grantActive row.state⟩ + +theorem grant_not_active (state : AuthsStatusSelection.auths_model.GrantState) : + core.cmp.PartialEq.ne.trait_default AuthsStatusSelection.auths_model.GrantState.Insts.CoreCmpPartialEqGrantState + state .Active = ok (!grantActive state) := by + cases state <;> simp [core.cmp.PartialEq.ne.trait_default, core.cmp.PartialEq.ne.default, + AuthsStatusSelection.auths_model.GrantState.Insts.CoreCmpPartialEqGrantState.eq, + grantActive, AuthsStatusSelection.auths_model.GrantState.read_discriminant] +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusIndependent.lean b/formal/Auths/Verifier/StatusIndependent.lean new file mode 100644 index 000000000..70f83919b --- /dev/null +++ b/formal/Auths/Verifier/StatusIndependent.lean @@ -0,0 +1,90 @@ +import Auths.Verifier.StatusFold +namespace Auths.StatusSelection.Algebra +open Model + +def trustedMaximum {Subject : Type} (rows : List (Statement Subject × Nat)) : Nat := + rows.foldl (fun maximum pair => max maximum pair.1.sequence) 0 + +def trustedLatest {Subject : Type} (rows : List (Statement Subject × Nat)) : List (Statement Subject × Nat) := + rows.filter (fun pair => pair.1.sequence == trustedMaximum rows) + +theorem latest_map_maximum {Subject : Type} (rows : List (Statement Subject × Nat)) (cap age now : Nat) : + sequenceMaximum (rows.map (latestRow cap age now)) = trustedMaximum rows := by + simp [sequenceMaximum, List.foldr_map, trustedMaximum, maximum_foldl, latestRow] + +theorem latest_map_filter {Subject : Type} (rows : List (Statement Subject × Nat)) (cap age now sequence : Nat) : + atSequence (rows.map (latestRow cap age now)) sequence = + (rows.filter (fun pair => pair.1.sequence == sequence)).map (latestRow cap age now) := by + simp [atSequence, List.filter_map, Function.comp_def, latestRow] + +theorem latest_map_summary {Subject : Type} (rows : List (Statement Subject × Nat)) (cap age now : Nat) : + collectLatest (rows.map (latestRow cap age now)) = + if rows.isEmpty then none else + some ⟨trustedMaximum rows, + (trustedLatest rows).any (fun pair => !fresh age pair.1.observed pair.1.expiresAt now), + (trustedLatest rows).any (fun pair => !pair.1.active), + (trustedLatest rows).foldl (fun horizon pair => min horizon (deadline age pair.1.observed pair.1.expiresAt)) cap⟩ := by + rw [collectLatest_exact cap _ (by + intro row member + obtain ⟨pair, _, equal⟩ := List.mem_map.mp member + subst row + exact Nat.min_le_left _ _)] + simp only [listSummary, List.isEmpty_map, latest_map_maximum, latest_map_filter] + split_ifs + · rfl + · congr 2 + · simp [List.any_map, latestRow, trustedLatest] + · simp [List.any_map, latestRow, trustedLatest] + · simp only [List.foldr_map, latestRow] + rw [capped_minimum, minimum_foldl] + rfl + +def listFinish {Subject : Type} (cap age now : Nat) (selected exact : List (Statement Subject)) + (admitted : List (Statement Subject × Nat)) : Evaluation := + if selected.isEmpty then ⟨.missing, cap⟩ + else if exact.isEmpty then ⟨.wrongMethod, now⟩ + else if admitted.isEmpty then ⟨.untrusted, now⟩ + else if admitted.any (fun pair => pair.1.sequence < pair.2) then ⟨.rollback, now⟩ + else if (trustedLatest admitted).any (fun pair => !fresh age pair.1.observed pair.1.expiresAt now) then ⟨.stale, now⟩ + else ⟨if (trustedLatest admitted).any (fun pair => !pair.1.active) then .revoked else .active, + (trustedLatest admitted).foldl (fun horizon pair => min horizon (deadline age pair.1.observed pair.1.expiresAt)) cap⟩ + +theorem summaryFinish_independent {Subject : Type} [BEq Subject] (cap age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (rows : List (Statement Subject)) : + summaryFinish cap now (independentAggregate cap age now method rules subject view rows) = + listFinish cap age now (candidates rules subject view rows) + (matching method (candidates rules subject view rows)) + (trusted method rules (matching method (candidates rules subject view rows))) := by + by_cases noCandidates : candidates rules subject view rows = [] + · simp [independentAggregate, noCandidates, matching, trusted, summaryFinish, listFinish, collectLatest] + · by_cases noMatches : matching method (candidates rules subject view rows) = [] + · simp [independentAggregate, noMatches, trusted, summaryFinish, listFinish, collectLatest, noCandidates] + · by_cases noTrusted : trusted method rules (matching method (candidates rules subject view rows)) = [] + · simp [independentAggregate, noTrusted, summaryFinish, listFinish, collectLatest, noCandidates, noMatches] + · simp only [independentAggregate, latest_map_summary] + simp only [List.isEmpty_iff, noTrusted, ↓reduceIte] + split_ifs <;> simp_all [summaryFinish, listFinish, List.isEmpty_iff] + +/-- The accumulator and independent filter/max/tie-set specification agree + for every finite input, every view and every policy, with no validity premise. -/ +theorem evaluateScan_eq_evaluate {Subject : Type} [BEq Subject] + (id : String) (policy : Policy) (observed cap : Nat) + (rules : List Rule) (rows : List (Statement Subject)) + (subject : Subject) (view : View) (now : Nat) : + evaluateScan id policy observed cap rules rows subject view now = + evaluate id policy observed cap rules rows subject view now := by + cases policy with + | expiryOnly => rfl + | required method age => + simp only [evaluateScan, evaluate] + by_cases mismatch : (method != id) = true + · simp only [mismatch, ↓reduceIte] + · simp only [mismatch] + by_cases stale : (decide (observed > now) || decide (cap < now)) = true + · simp only [stale, ↓reduceIte] + · simp only [stale] + rw [scan_finish_independent, summaryFinish_independent] + rfl + +end Auths.StatusSelection.Algebra diff --git a/formal/Auths/Verifier/StatusLatest.lean b/formal/Auths/Verifier/StatusLatest.lean new file mode 100644 index 000000000..046b4dfb9 --- /dev/null +++ b/formal/Auths/Verifier/StatusLatest.lean @@ -0,0 +1,90 @@ +import Auths.Verifier.StatusAlgebra +namespace Auths.StatusSelection.Algebra + +def sequenceMaximum (rows : List Latest) : Nat := + rows.foldr (fun row maximum => max row.sequence maximum) 0 + +@[simp] theorem sequenceMaximum_nil : sequenceMaximum [] = 0 := rfl +@[simp] theorem sequenceMaximum_cons (head : Latest) (rest : List Latest) : + sequenceMaximum (head :: rest) = max head.sequence (sequenceMaximum rest) := rfl + +theorem sequenceMaximum_upper (rows : List Latest) (row : Latest) (member : row ∈ rows) : + row.sequence ≤ sequenceMaximum rows := by + induction rows with + | nil => simp at member + | cons head rest ih => + simp only [List.mem_cons] at member + simp only [sequenceMaximum_cons] + rcases member with equal | member + · subst row; exact Nat.le_max_left _ _ + · exact Nat.le_trans (ih member) (Nat.le_max_right _ _) + +theorem sequenceMaximum_attained (rows : List Latest) (nonempty : rows ≠ []) : + ∃ row ∈ rows, row.sequence = sequenceMaximum rows := by + induction rows with + | nil => contradiction + | cons head rest ih => + by_cases empty : rest = [] + · subst rest; exact ⟨head, by simp, by simp⟩ + · obtain ⟨row, member, equal⟩ := ih empty + by_cases larger : head.sequence ≤ sequenceMaximum rest + · exact ⟨row, by simp [member], by simp [max_eq_right larger, equal]⟩ + · exact ⟨head, by simp, by simp [max_eq_left (by omega : sequenceMaximum rest ≤ head.sequence)]⟩ + +def atSequence (rows : List Latest) (sequence : Nat) : List Latest := + rows.filter (fun row => row.sequence == sequence) + +def listSummary (cap : Nat) (rows : List Latest) : Option Latest := + if rows.isEmpty then none else + let maximum := sequenceMaximum rows + let latest := atSequence rows maximum + some ⟨maximum, latest.any Latest.stale, latest.any Latest.revoked, + latest.foldr (fun row horizon => min row.through horizon) cap⟩ + +def collectLatest : List Latest → Option Latest + | [] => none + | row :: rest => mergeLatest (some row) (collectLatest rest) + +theorem atSequence_above (rows : List Latest) (sequence : Nat) + (above : sequenceMaximum rows < sequence) : atSequence rows sequence = [] := by + apply List.filter_eq_nil_iff.mpr + intro row member + have upper := sequenceMaximum_upper rows row member + simp only [beq_iff_eq] + omega + +theorem collectLatest_exact (cap : Nat) (rows : List Latest) + (bounded : ∀ row ∈ rows, row.through ≤ cap) : collectLatest rows = listSummary cap rows := by + induction rows with + | nil => rfl + | cons head rest ih => + have headBound := bounded head (by simp) + have restBound : ∀ row ∈ rest, row.through ≤ cap := by + intro row member; exact bounded row (by simp [member]) + rw [collectLatest, ih restBound] + by_cases empty : rest = [] + · subst rest + simp [listSummary, atSequence, mergeLatest, + Nat.min_eq_left headBound] + · have notEmpty : rest.isEmpty = false := by simpa using empty + have attained := sequenceMaximum_attained rest empty + by_cases lower : head.sequence < sequenceMaximum rest + · have maximum : max head.sequence (sequenceMaximum rest) = sequenceMaximum rest := max_eq_right (by omega) + have unequal : (head.sequence == sequenceMaximum rest) = false := by simp; omega + simp [listSummary, notEmpty, mergeLatest, lower, atSequence, + maximum, unequal] + · by_cases higher : sequenceMaximum rest < head.sequence + · have maximum : max head.sequence (sequenceMaximum rest) = head.sequence := max_eq_left (by omega) + have above := atSequence_above rest head.sequence higher + simp only [listSummary, notEmpty, Bool.false_eq_true, ↓reduceIte, + List.isEmpty_cons, sequenceMaximum_cons] + change mergeLatest (some head) (some _) = some _ + simp only [mergeLatest, lower, higher, ↓reduceIte, maximum] + simp only [atSequence, List.filter_cons, beq_self_eq_true, ↓reduceIte] at above ⊢ + rw [above] + simp [Nat.min_eq_left headBound] + · have equal : head.sequence = sequenceMaximum rest := by omega + simp [listSummary, notEmpty, mergeLatest, + atSequence, equal] + +end Auths.StatusSelection.Algebra diff --git a/formal/Auths/Verifier/StatusLeaves.lean b/formal/Auths/Verifier/StatusLeaves.lean new file mode 100644 index 000000000..ab1a25daf --- /dev/null +++ b/formal/Auths/Verifier/StatusLeaves.lean @@ -0,0 +1,89 @@ +import Auths.Verifier.StatusModel +import qualification.aeneas.generated.status_selection.Funs +import Mathlib.Tactic +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +set_option maxHeartbeats 2000000 +namespace Auths.StatusSelection + +def scopeView : AuthsStatusSelection.auths_model.StatusScope → Model.Scope + | .OwnAnchor => .ownAnchor + | .Anchors ids => .anchors ids.val + | .AnyAnchor => .anyAnchor + +def ruleView (rule : AuthsStatusSelection.auths_model.StatusTrustRule) : Model.Rule := + ⟨rule.method, rule.issuer, rule.sequence_floor.val, scopeView rule.scope⟩ + +def viewView : AuthsStatusSelection.auths_model.StatusView → Model.View + | .Anchor anchor => .anchor anchor.id anchor.principal + | .Approver => .approver + +theorem principal_eq (left right : AuthsStatusSelection.auths_model.PrincipalId) : + AuthsStatusSelection.auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq left right = ok (left == right) := rfl + +theorem method_eq (left right : AuthsStatusSelection.auths_model.StatusMethodId) : + AuthsStatusSelection.auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq left right = ok (left == right) := rfl + +theorem timestamp_lt (left right : AuthsStatusSelection.auths_model.Timestamp) : + core.cmp.PartialOrd.lt.default AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp left right = + ok (decide (left.val < right.val)) := by + simp [AuthsStatusSelection.core.cmp.PartialOrd.lt.default, + Aeneas.Std.core.cmp.PartialOrd.lt.default, Aeneas.Std.core.cmp.PartialOrd.lt_body, + AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp, + AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpOrd.cmp, core.cmp.impls.OrdU64.cmp, Nat.compare_eq_lt] + +theorem timestamp_gt (left right : AuthsStatusSelection.auths_model.Timestamp) : + core.cmp.PartialOrd.gt.default AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp left right = + ok (decide (left.val > right.val)) := by + simp [AuthsStatusSelection.core.cmp.PartialOrd.gt.default, + Aeneas.Std.core.cmp.PartialOrd.gt.default, Aeneas.Std.core.cmp.PartialOrd.gt_body, + AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp, + AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpOrd.cmp, core.cmp.impls.OrdU64.cmp, Nat.compare_eq_gt] + +theorem saturation_sub_exact (left right : Std.U64) : + (core.num.U64.saturating_sub left right).val = left.val - right.val := by + change (max 0 (left.val - right.val)) % 2^64 = _ + rw [Nat.max_eq_right (Nat.zero_le _)] + apply Nat.mod_eq_of_lt + exact lt_of_le_of_lt (Nat.sub_le _ _) left.hBounds + +theorem freshness_exact (method : AuthsStatusSelection.auths_model.StatusMethodId) (age : AuthsStatusSelection.auths_model.FreshnessLimit) + (observed expiresAt now : AuthsStatusSelection.auths_model.Timestamp) : + ExactStatusMethod.freshness (.SnapshotRequired method age) observed expiresAt now = + ok (if Model.fresh age.val observed.val expiresAt.val now.val then .Active else .Stale) := by + simp only [ExactStatusMethod.freshness, timestamp_gt, timestamp_lt, bind_tc_ok, + AuthsStatusSelection.auths_model.Timestamp.get, AuthsStatusSelection.auths_model.FreshnessLimit.get, lift] + simp only [UScalar.lt_equiv, saturation_sub_exact] + split_ifs <;> simp_all [Model.fresh] <;> omega + +theorem indexed_next {T : Type} (values : Slice T) (position : Std.Usize) + (head : T) (tail : List T) (remaining : values.val.drop position.val = head :: tail) : + ∃ next, position + 1#usize = ok next ∧ next.val = position.val + 1 ∧ + values.val.drop next.val = tail := by + have within : position.val < values.val.length := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_cons] at size + omega + have incrementFits : position.val + 1 ≤ Usize.max := by have := values.property; omega + obtain ⟨next, step, meaning⟩ := spec_imp_exists (Usize.add_spec (x := position) (y := 1#usize) incrementFits) + refine ⟨next, step, ?_, ?_⟩ + · simpa using meaning + · have drop := congrArg (List.drop 1) remaining + simpa [meaning, List.drop_drop, Nat.add_comm] using drop + +theorem indexed_head {T : Type} (values : Slice T) (position : Std.Usize) + (head : T) (tail : List T) (remaining : values.val.drop position.val = head :: tail) : + position < values.len ∧ Slice.index_usize values position = ok head := by + have within : position.val < values.val.length := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_cons] at size + omega + have headEq : values.val[position.val] = head := by + have split := List.drop_eq_getElem_cons within + rw [remaining] at split + exact (List.cons.inj split).1.symm + constructor + · simpa only [UScalar.lt_equiv, Slice.len_val] using within + · simp [Slice.index_usize, List.getElem?_eq_getElem within, headEq] +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusModel.lean b/formal/Auths/Verifier/StatusModel.lean new file mode 100644 index 000000000..d1019085d --- /dev/null +++ b/formal/Auths/Verifier/StatusModel.lean @@ -0,0 +1,166 @@ +import Std.Tactic +namespace Auths.StatusSelection.Model + +inductive Scope where + | ownAnchor + | anchors (ids : List String) + | anyAnchor + deriving DecidableEq +structure Rule where + method : String + issuer : String + floor : Nat + scope : Scope + deriving DecidableEq +inductive View where + | anchor (id principal : String) + | approver + deriving DecidableEq + +def scopeCovers (scope : Scope) (issuer : String) : View → Bool + | .anchor id principal => match scope with + | .ownAnchor => principal == issuer + | .anchors ids => ids.contains id + | .anyAnchor => true + | .approver => match scope with + | .anyAnchor => true + | _ => false + +def visible (rules : List Rule) (issuer : String) (view : View) : Bool := + rules.all (fun rule => rule.issuer != issuer || scopeCovers rule.scope issuer view) + +theorem visible_cons (rule : Rule) (rules : List Rule) (issuer : String) (view : View) : + visible (rule :: rules) issuer view = + if rule.issuer == issuer then scopeCovers rule.scope issuer view && visible rules issuer view + else visible rules issuer view := by + cases matched : (rule.issuer == issuer) <;> simp_all [visible, bne_eq] + +def sequenceFloor (rules : List Rule) (method issuer : String) : Option Nat := + (rules.find? (fun rule => rule.method == method && rule.issuer == issuer)).map Rule.floor + +def floorScan (rules : List Rule) (method issuer : String) (found : Option Nat) : Option Nat := + match found with + | some value => some value + | none => sequenceFloor rules method issuer + +inductive Decision where + | active | revoked | missing | stale | rollback | untrusted | wrongMethod + deriving DecidableEq +structure Evaluation where + decision : Decision + through : Nat + deriving DecidableEq +inductive Policy where + | expiryOnly + | required (method : String) (maximumAge : Nat) + deriving DecidableEq +structure Statement (Subject : Type) where + subject : Subject + method : String + issuer : String + sequence : Nat + observed : Nat + expiresAt : Nat + active : Bool + deriving DecidableEq + +def fresh (age observed expiresAt now : Nat) : Bool := + decide (observed ≤ now ∧ now ≤ expiresAt ∧ now - observed ≤ age) + +def wordMaximum : Nat := 2^64 - 1 + +def deadline (age observed expiresAt : Nat) : Nat := + min expiresAt (min wordMaximum (observed + age)) + +/-- Independent list/filter specification: trust uses the first exact rule; + rollback considers every trusted candidate; only the highest sequence's + entire tie set supplies freshness, revocation and the inclusive horizon. -/ +def evaluate {Subject : Type} [BEq Subject] + (id : String) (policy : Policy) (observed expiresAt : Nat) + (rules : List Rule) (statements : List (Statement Subject)) + (subject : Subject) (view : View) (now : Nat) : Evaluation := + match policy with + | .expiryOnly => ⟨.active, wordMaximum⟩ + | .required method age => + if method != id then ⟨.wrongMethod, now⟩ + else if observed > now || expiresAt < now then ⟨.stale, now⟩ + else + let candidates := statements.filter (fun row => row.subject == subject && visible rules row.issuer view) + let matching := candidates.filter (fun row => row.method == method) + let trusted := matching.filterMap (fun row => (sequenceFloor rules method row.issuer).map (fun floor => (row, floor))) + if candidates.isEmpty then ⟨.missing, expiresAt⟩ + else if matching.isEmpty then ⟨.wrongMethod, now⟩ + else if trusted.isEmpty then ⟨.untrusted, now⟩ + else if trusted.any (fun (row, floor) => row.sequence < floor) then ⟨.rollback, now⟩ + else + let maximum := trusted.foldl (fun maximum (row, _) => max maximum row.sequence) 0 + let latest := trusted.filter (fun (row, _) => row.sequence == maximum) + if latest.any (fun (row, _) => !fresh age row.observed row.expiresAt now) then ⟨.stale, now⟩ + else + ⟨if latest.any (fun (row, _) => !row.active) then .revoked else .active, + latest.foldl (fun horizon (row, _) => min horizon (deadline age row.observed row.expiresAt)) expiresAt⟩ + +/-- Operational accumulator, to be related to the independent filter/max spec. -/ +structure Scan where + candidateSeen : Bool + methodSeen : Bool + rollback : Bool + maximum : Option Nat + stale : Bool + revoked : Bool + through : Nat + deriving DecidableEq + +def initial (expiresAt : Nat) : Scan := ⟨false, false, false, none, false, false, expiresAt⟩ + +def contribute {Subject : Type} (expiresAt age now : Nat) (row : Statement Subject) (state : Scan) : Scan := + let newer := match state.maximum with | none => true | some previous => decide (previous < row.sequence) + let equal := match state.maximum with | none => false | some previous => row.sequence == previous + let base := if newer then {state with maximum := some row.sequence, stale := false, revoked := false, through := expiresAt} else state + if newer || equal then + {base with + stale := (base.stale || !(fresh age row.observed row.expiresAt now)), + revoked := (base.revoked || !row.active), + through := min base.through (deadline age row.observed row.expiresAt)} + else base + +def record {Subject : Type} [BEq Subject] (expiresAt age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (row : Statement Subject) (state : Scan) : Scan := + if row.subject == subject && visible rules row.issuer view then + let seen := {state with candidateSeen := true} + if row.method == method then + let matched := {seen with methodSeen := true} + match sequenceFloor rules method row.issuer with + | none => matched + | some floor => if row.sequence < floor then {matched with rollback := true} + else contribute expiresAt age now row matched + else seen + else state + +def scan {Subject : Type} [BEq Subject] (expiresAt age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) : + List (Statement Subject) → Scan → Scan + | [], state => state + | row :: rest, state => if state.rollback then state + else scan expiresAt age now method rules subject view rest (record expiresAt age now method rules subject view row state) + +def finish (expiresAt now : Nat) (state : Scan) : Evaluation := + let decision := if state.rollback then .rollback + else if !state.candidateSeen then .missing + else if !state.methodSeen then .wrongMethod + else if state.maximum.isNone then .untrusted + else if state.stale then .stale + else if state.revoked then .revoked else .active + ⟨decision, match decision with | .missing => expiresAt | .active | .revoked => state.through | _ => now⟩ +def evaluateScan {Subject : Type} [BEq Subject] + (id : String) (policy : Policy) (observed expiresAt : Nat) + (rules : List Rule) (statements : List (Statement Subject)) + (subject : Subject) (view : View) (now : Nat) : Evaluation := + match policy with + | .expiryOnly => ⟨.active, wordMaximum⟩ + | .required method age => + if method != id then ⟨.wrongMethod, now⟩ + else if observed > now || expiresAt < now then ⟨.stale, now⟩ + else finish expiresAt now (scan expiresAt age now method rules subject view statements (initial expiresAt)) +end Auths.StatusSelection.Model diff --git a/formal/Auths/Verifier/StatusPublic.lean b/formal/Auths/Verifier/StatusPublic.lean new file mode 100644 index 000000000..c71057e57 --- /dev/null +++ b/formal/Auths/Verifier/StatusPublic.lean @@ -0,0 +1,89 @@ +import Auths.Verifier.StatusSelection +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection +set_option maxHeartbeats 2000000 + +def policyView : AuthsStatusSelection.auths_model.StatusPolicy → Model.Policy + | .ExpiryOnly => .expiryOnly + | .SnapshotRequired method age => .required method age.val + +def decisionView : AuthsStatusSelection.auths_ports.StatusDecision → Model.Decision + | .Active => .active + | .Revoked => .revoked + | .Missing => .missing + | .Stale => .stale + | .Rollback => .rollback + | .UntrustedIssuer => .untrusted + | .WrongMethod => .wrongMethod + +def evaluationView (evaluation : AuthsStatusSelection.auths_ports.StatusEvaluation) : Model.Evaluation := + ⟨decisionView evaluation.decision, evaluation.valid_through.val⟩ + +theorem method_ne (left right : String) : + core.cmp.impls.PartialEqShared.ne AuthsStatusSelection.auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId left right = + ok (left != right) := by + simp [core.cmp.impls.PartialEqShared.ne, + core.cmp.PartialEq.ne.default, + method_eq, bne_eq] + +theorem principal_selector_approver_refines + (id : String) (policy : AuthsStatusSelection.auths_model.StatusPolicy) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (subject : String) (now : Std.U64) : + select_principal_from_snapshot id policy snapshot subject .Approver now ⦃ actual => + evaluationView actual = Model.evaluateScan id (policyView policy) snapshot.observed_at.val + snapshot.valid_until.val (snapshot.trust.val.map ruleView) + (snapshot.statements.val.map principalView) subject .approver now.val ⦄ := by + cases policyEquation : policy with + | ExpiryOnly => + simp [select_principal_from_snapshot, AuthsStatusSelection.auths_model.Timestamp.new, + AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, policyView, + Model.evaluateScan, Model.wordMaximum, core.num.U64.MAX, UScalar.ofNat, UScalar.ofNatCore_val_eq, + U64.rMax] + | SnapshotRequired method age => + simp only [select_principal_from_snapshot, method_ne, bind_tc_ok, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.observed_at, timestamp_gt, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.valid_until, timestamp_lt, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.statements, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.trust, alloc.vec.Vec.deref] + by_cases mismatch : (method != id) = true + · simp [mismatch, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView] + · simp only [mismatch] + by_cases future : snapshot.observed_at.val > now.val + · simp [future, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch] + · simp only [future, decide_false, Bool.false_eq_true, ↓reduceIte] + by_cases expired : snapshot.valid_until.val < now.val + · simp [expired, AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.evaluateScan, policyView, mismatch, future] + · simp only [expired, decide_false, Bool.false_eq_true, ↓reduceIte] + have loop := principal_loop_refines snapshot.statements.val snapshot.statements snapshot.trust + method subject age now snapshot (false, false, false, none, false, false, snapshot.valid_until) + 0#usize (by simp) + apply spec_bind loop + intro actual meaning + rcases actual with ⟨seen, matched, rollback, maximum, stale, revoked, through⟩ + change scanView (seen, matched, rollback, maximum, stale, revoked, through) = + Model.scan snapshot.valid_until.val age.val now.val method (snapshot.trust.val.map ruleView) + subject .approver (snapshot.statements.val.map principalView) (Model.initial snapshot.valid_until.val) at meaning + simp only [Model.evaluateScan, policyView, mismatch, future, expired, decide_false, + Bool.false_or, Bool.false_eq_true, ↓reduceIte] + rw [← meaning] + cases seenEquation : seen <;> cases matchedEquation : matched <;> + cases rollbackEquation : rollback <;> cases maximumEquation : maximum <;> + cases staleEquation : stale <;> cases revokedEquation : revoked <;> + simp [AuthsStatusSelection.auths_ports.StatusEvaluation.new, evaluationView, decisionView, Model.finish, + scanView, core.option.Option.is_none] + +theorem principal_method_approver_refines + (implementation : ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String) (now : Std.U64) : + ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy snapshot subject .Approver now + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluateScan implementation.id (policyView policy) snapshot.observed_at.val snapshot.valid_until.val + (snapshot.trust.val.map ruleView) (snapshot.statements.val.map principalView) subject .approver now.val ⦄ := by + unfold ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + apply spec_bind (principal_selector_approver_refines implementation.id policy snapshot subject now) + intro evaluation meaning + simp only [spec_ok] + exact ⟨evaluation, rfl, meaning⟩ +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusSearchContains.lean b/formal/Auths/Verifier/StatusSearchContains.lean new file mode 100644 index 000000000..1163d8126 --- /dev/null +++ b/formal/Auths/Verifier/StatusSearchContains.lean @@ -0,0 +1,48 @@ +import Auths.Verifier.StatusSearchLoop +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection.Search + +theorem usize_conversion (value : Nat) (fits : value ≤ Usize.max) : + ∃ converted : Std.Usize, UScalar.tryMk .Usize value = ok converted := by + have maximum : Usize.max < 2 ^ UScalarTy.Usize.numBits := by + simp only [Usize.max, Usize.numBits] + exact Nat.sub_lt (Nat.two_pow_pos _) (by decide) + have within : value < 2 ^ UScalarTy.Usize.numBits := Nat.lt_of_le_of_lt fits maximum + simp only [UScalar.tryMk, UScalar.tryMkOpt, UScalar.check_bounds, within, decide_true, ↓reduceDIte, + Result.ofOption] + exact ⟨_, rfl⟩ + +theorem found_full (values : List String) (target : String) : + Found values target 0 values.length ↔ target ∈ values := by + simp only [Found, Nat.zero_add, Nat.zero_le, true_and, List.mem_iff_getElem?] + constructor + · rintro ⟨index, _, value⟩; exact ⟨index, value⟩ + · rintro ⟨index, value⟩ + obtain ⟨within, _⟩ := List.getElem?_eq_some_iff.mp value + exact ⟨index, within, value⟩ + +theorem scope_contains (values : AuthsStatusSelection.auths_model.StatusScopeAnchors) + (target : String) (ordered : Ordered values.val) : + AuthsStatusSelection.auths_model.StatusScopeAnchors.contains values target = ok (values.val.contains target) := by + unfold AuthsStatusSelection.auths_model.StatusScopeAnchors.contains + simp only [alloc.vec.Vec.deref] + unfold AuthsStatusSelection.core.slice.Slice.binary_search + by_cases empty : values.val = [] + · simp [empty, core.result.Result.is_ok] + · have positive : 0 < values.val.length := List.length_pos_iff.mpr empty + obtain ⟨result, equation, meaning, bound⟩ := search_loop values.val target (values.val.length + 1) 0 values.val.length + ordered positive (by omega) (by omega) + have notEmpty : values.val.isEmpty = false := by simpa using empty + simp only [notEmpty, Bool.false_eq_true, ↓reduceIte, equation, bind_tc_ok] + have fits : index result ≤ Usize.max := Nat.le_trans (by simpa using bound) values.property + obtain ⟨converted, conversion⟩ := usize_conversion (index result) fits + have correct : hit result = values.val.contains target := by + apply Bool.eq_iff_iff.mpr + exact meaning.trans ((found_full values.val target).trans List.contains_iff_mem.symm) + cases result <;> + simp only [index] at conversion <;> + simp only [conversion, bind_tc_ok, core.result.Result.is_ok, ← correct, hit] + +end Auths.StatusSelection.Search diff --git a/formal/Auths/Verifier/StatusSearchFound.lean b/formal/Auths/Verifier/StatusSearchFound.lean new file mode 100644 index 000000000..ed01efc1d --- /dev/null +++ b/formal/Auths/Verifier/StatusSearchFound.lean @@ -0,0 +1,58 @@ +import Mathlib.Tactic +namespace Auths.StatusSelection.Search + +def Ordered {α : Type} [Ord α] (values : List α) : Prop := + ∀ (i j : Nat) (left right : α), i ≤ j → values[i]? = some left → values[j]? = some right → + (compare left right).isLE + +def Found {α : Type} (values : List α) (target : α) (base size : Nat) : Prop := + ∃ index, base ≤ index ∧ index < base + size ∧ values[index]? = some target + +theorem found_step {α : Type} [Ord α] [Std.TransOrd α] [Std.LawfulEqOrd α] + (values : List α) (target value : α) (base size : Nat) + (ordered : Ordered values) (large : 1 < size) + (atMid : values[base + size / 2]? = some value) : + Found values target base size ↔ + Found values target (if compare value target = .gt then base else base + size / 2) (size - size / 2) := by + cases comparison : compare value target with + | lt => + simp only [reduceCtorEq, ↓reduceIte] + constructor + · rintro ⟨index, lower, upper, atTarget⟩ + have after : base + size / 2 < index := by + by_contra before + have ordering := ordered index (base + size / 2) target value (by omega) atTarget atMid + exact Std.OrientedCmp.not_lt_of_isLE ordering comparison + exact ⟨index, by omega, by omega, atTarget⟩ + · rintro ⟨index, lower, upper, atTarget⟩ + exact ⟨index, by omega, by omega, atTarget⟩ + | eq => + have same : value = target := Std.compare_eq_iff_eq.mp comparison + subst value + simp only [reduceCtorEq, ↓reduceIte] + have original : Found values target base size := ⟨base + size / 2, by omega, by omega, atMid⟩ + have next : Found values target (base + size / 2) (size - size / 2) := + ⟨base + size / 2, by omega, by omega, atMid⟩ + exact ⟨fun _ => next, fun _ => original⟩ + | gt => + simp only [↓reduceIte] + constructor + · rintro ⟨index, lower, upper, atTarget⟩ + have before : index < base + size / 2 := by + by_contra after + have ordering := ordered (base + size / 2) index value target (by omega) atMid atTarget + simp [comparison] at ordering + exact ⟨index, lower, by omega, atTarget⟩ + · rintro ⟨index, lower, upper, atTarget⟩ + exact ⟨index, lower, by omega, atTarget⟩ + +theorem found_one {α : Type} (values : List α) (target value : α) (base : Nat) + (atBase : values[base]? = some value) : Found values target base 1 ↔ value = target := by + constructor + · rintro ⟨index, lower, upper, atTarget⟩ + have equal : index = base := by omega + subst index + exact Option.some.inj (atBase.symm.trans atTarget) + · intro equal; subst value; exact ⟨base, by omega, by omega, atBase⟩ + +end Auths.StatusSelection.Search diff --git a/formal/Auths/Verifier/StatusSearchLoop.lean b/formal/Auths/Verifier/StatusSearchLoop.lean new file mode 100644 index 000000000..b76422181 --- /dev/null +++ b/formal/Auths/Verifier/StatusSearchLoop.lean @@ -0,0 +1,59 @@ +import Auths.Verifier.StatusGrant +import Auths.Verifier.StatusSearchFound +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection.Search + +def hit : Aeneas.Std.core.result.Result Nat Nat → Bool + | .Ok _ => true + | .Err _ => false + +def index : Aeneas.Std.core.result.Result Nat Nat → Nat + | .Ok value => value + | .Err value => value + +theorem anchor_compare (left right : String) : + AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp left right = + ok (compare left right) := rfl + +theorem search_loop (values : List String) (target : String) (fuel base size : Nat) + (ordered : Ordered values) (positive : 0 < size) (enough : size < fuel) + (bounded : base + size ≤ values.length) : + ∃ result, + AuthsStatusSelection.binarySearchLoop AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpOrd + values target fuel base size = ok result ∧ + (hit result = true ↔ Found values target base size) ∧ index result ≤ base + size := by + induction fuel generalizing base size with + | zero => omega + | succ fuel ih => + rw [AuthsStatusSelection.binarySearchLoop] + by_cases large : 1 < size + · have midBound : base + size / 2 < values.length := by omega + let value := values[base + size / 2] + have atMid : values[base + size / 2]? = some value := List.getElem?_eq_getElem midBound + simp only [large, ↓reduceIte, atMid, bind_tc_ok, anchor_compare] + let nextBase := if compare value target = .gt then base else base + size / 2 + have nextPositive : 0 < size - size / 2 := by omega + have nextEnough : size - size / 2 < fuel := by omega + have nextBound : nextBase + (size - size / 2) ≤ values.length := by + dsimp only [nextBase]; split_ifs <;> omega + obtain ⟨result, equation, meaning, resultBound⟩ := ih nextBase (size - size / 2) + nextPositive nextEnough nextBound + refine ⟨result, equation, meaning.trans (found_step values target value base size ordered large atMid).symm, ?_⟩ + dsimp only [nextBase] at resultBound + split_ifs at resultBound <;> omega + · have one : size = 1 := by omega + have baseBound : base < values.length := by omega + let value := values[base] + have atBase : values[base]? = some value := List.getElem?_eq_getElem baseBound + simp only [large, ↓reduceIte, atBase, bind_tc_ok, anchor_compare] + have meaning : (compare value target = .eq) ↔ Found values target base size := by + rw [one, found_one values target value base atBase, Std.compare_eq_iff_eq] + cases comparison : compare value target <;> + simp only [reduceCtorEq, ↓reduceIte] + · exact ⟨.Err (base + 1), rfl, by simpa [hit, comparison] using meaning, by simp only [index]; omega⟩ + · exact ⟨.Ok base, rfl, by simpa [hit, comparison] using meaning, by simp only [index]; omega⟩ + · exact ⟨.Err base, by simp, by simpa [hit, comparison] using meaning, by simp only [index]; omega⟩ + +end Auths.StatusSelection.Search diff --git a/formal/Auths/Verifier/StatusSelection.lean b/formal/Auths/Verifier/StatusSelection.lean new file mode 100644 index 000000000..ed1f667b6 --- /dev/null +++ b/formal/Auths/Verifier/StatusSelection.lean @@ -0,0 +1,172 @@ +import Auths.Verifier.StatusVisibility +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection +set_option maxHeartbeats 4000000 + +def principalActive : AuthsStatusSelection.auths_model.PrincipalState → Bool + | .Active => true + | _ => false + +def principalView (signed : AuthsStatusSelection.auths_model.SignedPrincipalStatus) : Model.Statement String := + let row := signed.statement + ⟨row.principal, row.method, row.issuer, row.sequence.val, row.observed_at.val, + row.valid_until.val, principalActive row.state⟩ + +def scanView (state : Bool × Bool × Bool × Option Std.U64 × Bool × Bool × AuthsStatusSelection.auths_model.Timestamp) : Model.Scan := + ⟨state.1, state.2.1, state.2.2.1, state.2.2.2.1.map (fun value => value.val), + state.2.2.2.2.1, state.2.2.2.2.2.1, state.2.2.2.2.2.2.val⟩ + +theorem principal_not_active (state : AuthsStatusSelection.auths_model.PrincipalState) : + core.cmp.PartialEq.ne.trait_default AuthsStatusSelection.auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState + state .Active = ok (!principalActive state) := by + cases state <;> simp [core.cmp.PartialEq.ne.trait_default, core.cmp.PartialEq.ne.default, + + AuthsStatusSelection.auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState.eq, + principalActive, AuthsStatusSelection.auths_model.PrincipalState.read_discriminant] + +theorem stale_comparison (fresh : Bool) : + (do let value ← ok (if fresh then AuthsStatusSelection.auths_ports.StatusDecision.Active else .Stale) + AuthsStatusSelection.auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq value .Stale) = ok (!fresh) := by + cases fresh <;> simp [AuthsStatusSelection.auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq, + AuthsStatusSelection.auths_ports.StatusDecision.read_discriminant] + +theorem timestamp_min_exact (left right : AuthsStatusSelection.auths_model.Timestamp) : + core.cmp.Ord.min.trait_default AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpOrd left right = + ok (if left.val < right.val then left else right) := by + simp [core.cmp.Ord.min.trait_default, core.cmp.Ord.min.default, core.cmp.Ord.min_body, + Aeneas.Std.core.cmp.PartialOrd.lt.default, Aeneas.Std.core.cmp.PartialOrd.lt_body, + AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp, + AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpOrd.cmp, core.cmp.impls.OrdU64.cmp, Nat.compare_eq_lt] + split <;> rfl + +theorem minimum_value (left right : Std.U64) : + (if left.val < right.val then left else right).val = min left.val right.val := by + split + · rename_i ordered + exact (Nat.min_eq_left (Nat.le_of_lt ordered)).symm + · rename_i ordered + exact (Nat.min_eq_right (Nat.le_of_not_gt ordered)).symm + +theorem saturation_exact (left right : Std.U64) : + (core.num.U64.saturating_add left right).val = min Model.wordMaximum (left.val + right.val) := by + change (min (UScalar.max .U64) (left.val + right.val)) % (2^64) = _ + rw [UScalar.max_UScalarTy_U64_eq, U64.max_eq] + unfold Model.wordMaximum + apply Nat.mod_eq_of_lt + have bounded := Nat.min_le_left (18446744073709551615 : Nat) (left.val + right.val) + omega + +theorem stale_test (fresh : Bool) : + AuthsStatusSelection.auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq + (if fresh then .Active else .Stale) .Stale = ok (!fresh) := by + cases fresh <;> simp [AuthsStatusSelection.auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq, + AuthsStatusSelection.auths_ports.StatusDecision.read_discriminant] + +theorem result_ite {T : Type} (condition : Prop) [Decidable condition] (left right : T) : + (if condition then Result.ok left else Result.ok right) = Result.ok (if condition then left else right) := by + by_cases condition <;> simp_all + +theorem boolean_or (left right : Bool) : (if left then true else right) = (left || right) := by + cases left <;> rfl + +abbrev NativeScan := Bool × Bool × Bool × Option Std.U64 × Bool × Bool × AuthsStatusSelection.auths_model.Timestamp + +def principalLoop (method : String) (age : Std.U64) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (subject : String) (now : Std.U64) (statements : Slice AuthsStatusSelection.auths_model.SignedPrincipalStatus) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (state : NativeScan) (position : Std.Usize) := + select_principal_from_snapshot_loop method age snapshot subject .Approver now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position + +theorem principal_loop_refines (records : List AuthsStatusSelection.auths_model.SignedPrincipalStatus) + (statements : Slice AuthsStatusSelection.auths_model.SignedPrincipalStatus) (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (method subject : String) (age now : Std.U64) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) + (state : NativeScan) (position : Std.Usize) + (remaining : statements.val.drop position.val = records) : + AuthsStatusSelection.select_principal_from_snapshot_loop method age snapshot subject .Approver now statements rules + state.1 state.2.1 state.2.2.1 state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject .approver (records.map principalView) (scanView state) ⦄ := by + change Aeneas.Std.WP.spec (principalLoop method age snapshot subject now statements rules state position) _ + induction records generalizing state position with + | nil => + have finished : ¬ position < statements.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + unfold principalLoop + rw [select_principal_from_snapshot_loop.eq_def] + simp [finished, Model.scan] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := indexed_head statements position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next statements position head tail remaining + rcases state with ⟨seen, methodSeen, rollback, maximum, stale, revoked, through⟩ + by_cases stopped : rollback = true + · + unfold principalLoop + rw [select_principal_from_snapshot_loop.eq_def] + simp [guard, stopped, Model.scan, scanView] + · have running : rollback = false := by simpa using stopped + subst rollback + have advance (nextSeen nextMethod nextRollback : Bool) (nextMaximum : Option Std.U64) + (nextStale nextRevoked : Bool) (nextThrough : Std.U64) + (meaning : scanView (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) = Model.record snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject .approver (principalView head) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through))) : + select_principal_from_snapshot_loop method age snapshot subject .Approver now statements rules + nextSeen nextMethod nextRollback nextMaximum nextStale nextRevoked nextThrough next ⦃ actual => + scanView actual = Model.scan snapshot.valid_until.val age.val now.val method + (rules.val.map ruleView) subject .approver ((head :: tail).map principalView) + (scanView (seen, methodSeen, false, maximum, stale, revoked, through)) ⦄ := by + have contract := ih (nextSeen, nextMethod, nextRollback, nextMaximum, nextStale, nextRevoked, nextThrough) next nextRemaining + rw [meaning] at contract + simpa only [principalLoop, List.map_cons, Model.scan, Bool.false_eq_true, ↓reduceIte, scanView] using contract + unfold principalLoop + rw [select_principal_from_snapshot_loop.eq_def] + simp only [guard, ↓reduceIte, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.SignedPrincipalStatus.impl.statement, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.principal, principal_eq, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.issuer, approver_visibility_exact, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.method, method_eq, + sequence_floor_exact, AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.sequence, + AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.valid_until, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.observed_at, + AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.valid_until, + freshness_exact, stale_test, AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.state, + principal_not_active, timestamp_min_exact, + AuthsStatusSelection.auths_model.Timestamp.get, AuthsStatusSelection.auths_model.FreshnessLimit.get, + AuthsStatusSelection.auths_model.Timestamp.new, lift, step] + cases subjectMatch : (head.statement.principal == subject) <;> + cases visible : Model.visible (rules.val.map ruleView) head.statement.issuer .approver <;> + cases methodMatch : (head.statement.method == method) <;> + simp only [Bool.false_eq_true, ↓reduceIte, bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, principalView, scanView, subjectMatch, visible, methodMatch]) + | skip + all_goals + cases floor : nativeFloor rules method head.statement.issuer <;> + try simp only [bind_tc_ok] + all_goals + first + | exact advance _ _ _ _ _ _ _ (by simp [Model.record, principalView, scanView, subjectMatch, visible, methodMatch, + ← native_floor_view rules method head.statement.issuer, floor]) + | skip + all_goals + cases maximum <;> try simp only [bind_tc_ok] + all_goals + repeat' (split_ifs <;> try simp (config := { zeta := true, zetaHave := true }) only [bind_tc_ok]) + all_goals try simp only [result_ite, bind_tc_ok, boolean_or] + all_goals + exact advance _ _ _ _ _ _ _ (by + clear ih advance + simp only [scanView] + repeat' rw [minimum_value] + simp_all [Model.record, Model.contribute, principalView, Model.deadline, + ← native_floor_view rules method head.statement.issuer, + saturation_exact, UScalar.lt_equiv, UScalar.eq_equiv, Nat.min_assoc, beq_iff_eq] <;> + (split_ifs <;> simp_all <;> omega)) + +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusSemantics.lean b/formal/Auths/Verifier/StatusSemantics.lean new file mode 100644 index 000000000..b93fa5623 --- /dev/null +++ b/formal/Auths/Verifier/StatusSemantics.lean @@ -0,0 +1,32 @@ +import Auths.Verifier.StatusIndependent +import Auths.Verifier.StatusGrant +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection + +/-- Actual principal port result against the independent filter/max/tie-set + specification. Evidence authentication remains a separate caller boundary. -/ +theorem principal_method_approver_independent + (implementation : ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String) (now : Std.U64) : + ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy snapshot subject .Approver now + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluate implementation.id (policyView policy) snapshot.observed_at.val snapshot.valid_until.val + (snapshot.trust.val.map ruleView) (snapshot.statements.val.map principalView) subject .approver now.val ⦄ := by + simpa only [Algebra.evaluateScan_eq_evaluate] using + principal_method_approver_refines implementation policy snapshot subject now + +/-- Actual grant port result against the independent filter/max/tie-set + specification, including the exact decision and inclusive horizon. -/ +theorem grant_method_approver_independent + (implementation : ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy) + (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId) (now : Std.U64) : + ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy snapshot subject .Approver now + ⦃ actual => ∃ evaluation, actual = .Ok evaluation ∧ evaluationView evaluation = + Model.evaluate implementation.id (policyView policy) snapshot.observed_at.val snapshot.valid_until.val + (snapshot.trust.val.map ruleView) (snapshot.statements.val.map grantView) subject .approver now.val ⦄ := by + simpa only [Algebra.evaluateScan_eq_evaluate] using + grant_method_approver_refines implementation policy snapshot subject now + +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/StatusSummary.lean b/formal/Auths/Verifier/StatusSummary.lean new file mode 100644 index 000000000..9c9703c7a --- /dev/null +++ b/formal/Auths/Verifier/StatusSummary.lean @@ -0,0 +1,61 @@ +import Auths.Verifier.StatusLatest +namespace Auths.StatusSelection.Algebra +open Model + +def candidates {Subject : Type} [BEq Subject] (rules : List Rule) (subject : Subject) + (view : View) (rows : List (Statement Subject)) : List (Statement Subject) := + rows.filter (fun row => row.subject == subject && visible rules row.issuer view) + +def matching {Subject : Type} (method : String) (rows : List (Statement Subject)) : List (Statement Subject) := + rows.filter (fun row => row.method == method) + +def trusted {Subject : Type} (method : String) (rules : List Rule) + (rows : List (Statement Subject)) : List (Statement Subject × Nat) := + rows.filterMap (fun row => (sequenceFloor rules method row.issuer).map (fun floor => (row, floor))) + +def latestRow {Subject : Type} (cap age now : Nat) (pair : Statement Subject × Nat) : Latest := + ⟨pair.1.sequence, !fresh age pair.1.observed pair.1.expiresAt now, !pair.1.active, + min cap (deadline age pair.1.observed pair.1.expiresAt)⟩ + +def independentAggregate {Subject : Type} [BEq Subject] (cap age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (rows : List (Statement Subject)) : Summary := + let selected := candidates rules subject view rows + let exact := matching method selected + let admitted := trusted method rules exact + if admitted.any (fun pair => pair.1.sequence < pair.2) then .rollback + else .details ⟨!selected.isEmpty, !exact.isEmpty, + collectLatest (admitted.map (latestRow cap age now))⟩ + +theorem aggregate_independent {Subject : Type} [BEq Subject] (cap age now : Nat) + (method : String) (rules : List Rule) (subject : Subject) (view : View) + (rows : List (Statement Subject)) : + aggregate cap age now method rules subject view rows = + independentAggregate cap age now method rules subject view rows := by + induction rows with + | nil => rfl + | cons row rest ih => + rw [aggregate, ih] + unfold prepared independentAggregate candidates matching trusted + by_cases candidate : (row.subject == subject && visible rules row.issuer view) = true + · simp only [List.filter_cons, candidate, ↓reduceIte] + by_cases matched : (row.method == method) = true + · simp only [matched, ↓reduceIte] + cases floorEquation : sequenceFloor rules method row.issuer with + | none => + simp only [List.filterMap_cons, floorEquation, Option.map_none, + List.isEmpty_cons] + split_ifs <;> simp [combine, mergeLatest_none_left] + | some floor => + simp only [List.filterMap_cons, floorEquation, Option.map_some, + List.map_cons, List.isEmpty_cons, List.any_cons, collectLatest] + by_cases below : row.sequence < floor + · simp [below, combine] + · simp only [below, decide_false, Bool.false_or, ↓reduceIte] + split_ifs <;> simp [combine, latestRow] + · simp only [matched, Bool.false_eq_true, ↓reduceIte, List.isEmpty_cons] + split_ifs <;> simp [combine, mergeLatest_none_left] + · simp only [candidate, Bool.false_eq_true, ↓reduceIte, List.filter_cons] + exact combine_empty_left _ + +end Auths.StatusSelection.Algebra diff --git a/formal/Auths/Verifier/StatusVisibility.lean b/formal/Auths/Verifier/StatusVisibility.lean new file mode 100644 index 000000000..f3474fe43 --- /dev/null +++ b/formal/Auths/Verifier/StatusVisibility.lean @@ -0,0 +1,66 @@ +import Auths.Verifier.StatusFloor +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsStatusSelection +namespace Auths.StatusSelection +set_option maxHeartbeats 2000000 + +theorem approver_visibility_stopped (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) + (issuer : String) (position : Std.Usize) : + AuthsStatusSelection.auths_model.status_issuer_visible_loop rules issuer false position = ok false := by + rw [AuthsStatusSelection.auths_model.status_issuer_visible_loop.eq_def] + simp + +theorem approver_visibility_loop_refines (remainingRules : List AuthsStatusSelection.auths_model.StatusTrustRule) + (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (issuer : String) (position : Std.Usize) + (remaining : rules.val.drop position.val = remainingRules) : + AuthsStatusSelection.auths_model.status_issuer_visible_loop rules issuer true position ⦃ actual => + actual = Model.visible (remainingRules.map ruleView) issuer .approver ⦄ := by + induction remainingRules generalizing position with + | nil => + have finished : ¬ position < rules.len := by + have size := congrArg List.length remaining + simp only [List.length_drop, List.length_nil] at size + simp only [UScalar.lt_equiv, Slice.len_val, Slice.length] + omega + rw [AuthsStatusSelection.auths_model.status_issuer_visible_loop.eq_def] + simp [finished, Model.visible] + | cons head tail ih => + obtain ⟨guard, atHead⟩ := indexed_head rules position head tail remaining + obtain ⟨next, step, nextValue, nextRemaining⟩ := indexed_next rules position head tail remaining + rw [AuthsStatusSelection.auths_model.status_issuer_visible_loop.eq_def] + simp only [guard, ↓reduceIte, atHead, bind_tc_ok, + AuthsStatusSelection.auths_model.StatusTrustRule.impl.issuer, principal_eq] + cases matched : (head.issuer == issuer) with + | false => + have different : head.issuer ≠ issuer := by simpa using matched + simp only [Bool.false_eq_true, ↓reduceIte, step, bind_tc_ok] + simpa only [List.map_cons, Model.visible_cons, ruleView, matched, Bool.false_eq_true, ↓reduceIte] using ih next nextRemaining + | true => + have same : head.issuer = issuer := by simpa using matched + simp only [↓reduceIte, AuthsStatusSelection.auths_model.StatusTrustRule.impl.scope] + cases scope : head.scope <;> + simp only [bind_tc_ok, step] + · simp [approver_visibility_stopped, Model.visible, ruleView, bne_eq, same, scope, scopeView, Model.scopeCovers] + · simp [approver_visibility_stopped, Model.visible, ruleView, bne_eq, same, scope, scopeView, Model.scopeCovers] + · simpa [Model.visible, ruleView, bne_eq, same, scope, scopeView, Model.scopeCovers] using ih next nextRemaining + +theorem approver_visibility_refines (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (issuer : String) : + AuthsStatusSelection.auths_model.status_issuer_visible rules issuer .Approver ⦃ actual => + actual = Model.visible (rules.val.map ruleView) issuer .approver ⦄ := by + simpa [AuthsStatusSelection.auths_model.status_issuer_visible] using + approver_visibility_loop_refines rules.val rules issuer 0#usize (by simp) + +theorem approver_visibility_exact (rules : Slice AuthsStatusSelection.auths_model.StatusTrustRule) (issuer : String) : + AuthsStatusSelection.auths_model.status_issuer_visible rules issuer .Approver = + ok (Model.visible (rules.val.map ruleView) issuer .approver) := by + obtain ⟨actual, equation, meaning⟩ := spec_imp_exists (approver_visibility_refines rules issuer) + exact equation.trans (congrArg Result.ok meaning) + +theorem unknown_issuer_visible (rules : List Model.Rule) (issuer : String) (view : Model.View) + (unknown : ∀ rule ∈ rules, rule.issuer ≠ issuer) : Model.visible rules issuer view = true := by + simp only [Model.visible, List.all_eq_true] + intro rule member + have different := unknown rule member + simp [different] +end Auths.StatusSelection diff --git a/formal/Auths/Verifier/TemporalAssurance.lean b/formal/Auths/Verifier/TemporalAssurance.lean new file mode 100644 index 000000000..eac68673e --- /dev/null +++ b/formal/Auths/Verifier/TemporalAssurance.lean @@ -0,0 +1,83 @@ +import Auths.Verifier.TemporalNative +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open AuthsTemporalWitness +namespace Auths.TemporalWitness +set_option maxHeartbeats 2000000 + +theorem minimum_value (left right : Std.U64) : + (if left.val < right.val then left else right).val = min left.val right.val := by + split + · rename_i ordered + exact (Nat.min_eq_left (Nat.le_of_lt ordered)).symm + · rename_i ordered + exact (Nat.min_eq_right (Nat.le_of_not_gt ordered)).symm + +theorem assurance_loop_refines (records : List auths_model.AssuranceSatisfaction) + (iterator : core.slice.iter.Iter auths_model.AssuranceSatisfaction) + (context : auths_model.TrustedContext) (initial : auths_model.Timestamp) + (remaining : iterator.slice.val.drop iterator.i = records) : + assurance_horizon_loop iterator context initial ⦃ actual => + AssuranceRefines (assuranceHorizon (policyView context) (records.map witnessView) initial.val) actual ⦄ := by + induction records generalizing iterator initial with + | nil => + rw [assurance_horizon_loop.eq_def, + Auths.Composition.IteratorFacts.next_nil iterator remaining] + simp [assuranceHorizon, AssuranceRefines] + | cons record rest ih => + obtain ⟨next, advances, nextRemaining⟩ := + Auths.Composition.IteratorFacts.next_cons iterator record rest remaining + rw [assurance_horizon_loop.eq_def, advances] + simp only [bind_tc_ok, + auths_model.TrustedContext.impl.assurance_policy, + auths_model.AssurancePolicy.impl.requirements, + auths_model.AssuranceSatisfaction.impl.requirement_index, + lift, requirement_lookup, alloc.vec.Vec.deref] + cases selected : context.assurance_policy.requirements.val[record.requirement_index.val]? with + | none => + simp [selected, AuthsTemporalWitness.core.option.Option.ok_or, + _root_.core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, + assuranceHorizon, policyView, witnessView, AssuranceRefines] + | some requirement => + simp only [AuthsTemporalWitness.core.option.Option.ok_or, + _root_.core.option.Option.ok_or, core.result.Result.Insts.CoreOpsTry.branch, + bind_tc_ok, auths_model.AssuranceRequirement.impl.maximum_age] + cases age : requirement.maximum_age with + | none => + simpa [age, assuranceHorizon, policyView, witnessView, selected] using + ih next initial nextRemaining + | some ageValue => + simp only [bind_tc_ok, auths_model.AssuranceSatisfaction.impl.claim, + auths_model.AssuranceClaim.impl.observed_at] + cases observed : record.claim.observed_at with + | none => + simp [observed, + + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual, + core.convert.FromSame.from, + assuranceHorizon, policyView, witnessView, selected, age, AssuranceRefines] + | some atTime => + simp only [ + + bind_tc_ok, auths_model.Timestamp.get, auths_model.FreshnessLimit.get, + auths_model.Timestamp.new, timestamp_min_exact] + have nextProof := + ih next (if initial.val < (core.num.U64.saturating_add atTime ageValue).val then + initial else core.num.U64.saturating_add atTime ageValue) nextRemaining + rw [minimum_value] at nextProof + simp only [saturation_exact] at nextProof + simpa [assuranceHorizon, policyView, witnessView, selected, age, observed, + saturation_exact] using nextProof + +theorem assurance_entry_refines (records : Slice auths_model.AssuranceSatisfaction) + (context : auths_model.TrustedContext) : + assurance_horizon records context ⦃ actual => + AssuranceRefines (assuranceHorizon (policyView context) (records.val.map witnessView) wordMaximum) actual ⦄ := by + have contract := assurance_loop_refines records.val ⟨records, 0⟩ context core.num.U64.MAX (by simp) + simpa [assurance_horizon, auths_model.Timestamp.new, + SharedSlice.Insts.CoreIterTraitsCollectIntoIteratorSharedIter.into_iter, + core.num.U64.MAX, UScalar.ofNat, UScalar.ofNatCore_val_eq, U64.rMax, wordMaximum] using contract + +end Auths.TemporalWitness diff --git a/formal/Auths/Verifier/TemporalConsequences.lean b/formal/Auths/Verifier/TemporalConsequences.lean new file mode 100644 index 000000000..2a08c675c --- /dev/null +++ b/formal/Auths/Verifier/TemporalConsequences.lean @@ -0,0 +1,31 @@ +import Auths.Verifier.TemporalAssurance +import Auths.Verifier.TemporalProperties +import Auths.Verifier.TemporalStatus +open Aeneas Aeneas.Std Result +open AuthsTemporalWitness +namespace Auths.TemporalWitness + +theorem successful_native_horizon_exact (records : Slice auths_model.AssuranceSatisfaction) + (context : auths_model.TrustedContext) (horizon : auths_model.Timestamp) + (accepted : assurance_horizon records context = ok (.Ok horizon)) : + assuranceHorizon (policyView context) (records.val.map witnessView) wordMaximum = .ok horizon.val := by + have contract := assurance_entry_refines records context + rw [accepted] at contract + simp only [Aeneas.Std.WP.spec_ok] at contract + cases model : assuranceHorizon (policyView context) (records.val.map witnessView) wordMaximum with + | error reason => simp [AssuranceRefines, model] at contract + | ok value => + have meaning : horizon.val = value := by + simpa [AssuranceRefines, model] using contract + simp [meaning] + +theorem native_horizon_permits_iff (records : Slice auths_model.AssuranceSatisfaction) + (context : auths_model.TrustedContext) (horizon : auths_model.Timestamp) + (accepted : assurance_horizon records context = ok (.Ok horizon)) (now : Nat) : + now ≤ horizon.val ↔ now ≤ wordMaximum ∧ + ∀ record ∈ records.val, selectedExpiryAllows (policyView context) (witnessView record) now := by + have result := assurance_permits_iff (policyView context) (records.val.map witnessView) wordMaximum now + rw [successful_native_horizon_exact records context horizon accepted] at result + simpa using result + +end Auths.TemporalWitness diff --git a/formal/Auths/Verifier/TemporalExamples.lean b/formal/Auths/Verifier/TemporalExamples.lean new file mode 100644 index 000000000..5c79f802e --- /dev/null +++ b/formal/Auths/Verifier/TemporalExamples.lean @@ -0,0 +1,37 @@ +import Auths.Verifier.TemporalConsequences +open Aeneas Aeneas.Std Result +open AuthsTemporalWitness +namespace Auths.TemporalWitness.Examples + +theorem inclusive_status_endpoint : + status_horizon ⟨.Active, 100#u64⟩ 100#u64 = ok (.Ok 100#u64) := by + rw [status_horizon_exact] + simp [UScalar.ofNatCore_val_eq] + +theorem expired_status_refused : + status_horizon ⟨.Active, 100#u64⟩ 101#u64 = ok (.Err (.Indeterminate .StaleStatus)) := by + rw [status_horizon_exact] + simp [UScalar.ofNatCore_val_eq] + +theorem revoked_principal_refused : + status_decision .Revoked true = ok (.Err (.Denied .PrincipalRevoked)) := rfl + +theorem revoked_grant_refused : + status_decision .Revoked false = ok (.Err (.Denied .GrantRevoked)) := rfl + +theorem selected_expiry_admitted : + assuranceHorizon [some 20] [⟨0, some 100⟩] wordMaximum = .ok 120 := by decide + +theorem missing_requirement_refused : + assuranceHorizon [some 20] [⟨1, some 100⟩] wordMaximum = .error () := by decide + +theorem missing_observation_refused : + assuranceHorizon [some 20] [⟨0, none⟩] wordMaximum = .error () := by decide + +theorem unbounded_requirement_needs_no_observation : + assuranceHorizon [none] [⟨0, none⟩] wordMaximum = .ok wordMaximum := by decide + +theorem overflowing_expiry_saturates : + assuranceHorizon [some 20] [⟨0, some wordMaximum⟩] wordMaximum = .ok wordMaximum := by decide + +end Auths.TemporalWitness.Examples diff --git a/formal/Auths/Verifier/TemporalModel.lean b/formal/Auths/Verifier/TemporalModel.lean new file mode 100644 index 000000000..245328469 --- /dev/null +++ b/formal/Auths/Verifier/TemporalModel.lean @@ -0,0 +1,48 @@ +import Std.Tactic + +-- Independent expiry and status semantics; no generated Rust import. +namespace Auths.TemporalWitness + +def wordMaximum : Nat := 2 ^ 64 - 1 + +def statusHorizon (horizon evaluatedAt : Nat) : Except Unit Nat := + if evaluatedAt ≤ horizon then .ok horizon else .error () + +structure Witness where + requirementIndex : Nat + observedAt : Option Nat + +def assuranceHorizon (maximumAges : List (Option Nat)) : List Witness → Nat → Except Unit Nat + | [], initial => .ok initial + | witness :: rest, initial => + match maximumAges[witness.requirementIndex]? with + | none => .error () + | some none => assuranceHorizon maximumAges rest initial + | some (some age) => + match witness.observedAt with + | none => .error () + | some observed => + assuranceHorizon maximumAges rest (min initial (min wordMaximum (observed + age))) + + +namespace Status + +inductive State where + | active | revoked | missing | stale | rollback | untrustedIssuer | wrongMethod + +inductive Failure where + | principalRevoked | grantRevoked | missingPrincipal | missingGrant + | stale | rollback | untrustedIssuer | wrongMethod + +def evaluate (principal : Bool) : State → Except Failure Unit + | .active => .ok () + | .revoked => .error (if principal then .principalRevoked else .grantRevoked) + | .missing => .error (if principal then .missingPrincipal else .missingGrant) + | .stale => .error .stale + | .rollback => .error .rollback + | .untrustedIssuer => .error .untrustedIssuer + | .wrongMethod => .error .wrongMethod + +end Status + +end Auths.TemporalWitness diff --git a/formal/Auths/Verifier/TemporalNative.lean b/formal/Auths/Verifier/TemporalNative.lean new file mode 100644 index 000000000..f0428543e --- /dev/null +++ b/formal/Auths/Verifier/TemporalNative.lean @@ -0,0 +1,95 @@ +import Auths.Verifier.TemporalModel +import qualification.aeneas.generated.temporal_witness.Funs +import Auths.Composition.IteratorFacts +import Mathlib.Tactic + +open Aeneas Aeneas.Std Result +open AuthsTemporalWitness +set_option maxHeartbeats 2000000 + +namespace Auths.TemporalWitness + +def policyView (context : auths_model.TrustedContext) : List (Option Nat) := + context.assurance_policy.requirements.val.map (fun requirement => + requirement.maximum_age.map (fun age => age.val)) + +def witnessView (record : auths_model.AssuranceSatisfaction) : Witness := + ⟨record.requirement_index.val, record.claim.observed_at.map (fun observed => observed.val)⟩ + +def AssuranceRefines (expected : Except Unit Nat) + (actual : core.result.Result auths_model.Timestamp VerificationFailure) : Prop := + match expected with + | .error _ => actual = .Err (.Indeterminate .AssuranceRequirementNotMet) + | .ok horizon => ∃ output, actual = .Ok output ∧ output.val = horizon + +theorem timestamp_lt (left right : auths_model.Timestamp) : + core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp left right = + ok (decide (left.val < right.val)) := by + simp [AuthsTemporalWitness.core.cmp.PartialOrd.lt.default, + Aeneas.Std.core.cmp.PartialOrd.lt.default, Aeneas.Std.core.cmp.PartialOrd.lt_body, + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp, + auths_model.Timestamp.Insts.CoreCmpOrd.cmp, core.cmp.impls.OrdU64.cmp, Nat.compare_eq_lt] + +theorem status_horizon_exact (evaluation : auths_ports.StatusEvaluation) + (evaluatedAt : auths_model.Timestamp) : + status_horizon evaluation evaluatedAt = + ok (if evaluatedAt.val ≤ evaluation.valid_through.val then + .Ok evaluation.valid_through else .Err (.Indeterminate .StaleStatus)) := by + simp only [status_horizon, auths_ports.StatusEvaluation.impl.valid_through, + bind_tc_ok, timestamp_lt] + split <;> rename_i comparison <;> simp_all + +theorem status_horizon_accepts_iff (evaluation : auths_ports.StatusEvaluation) + (evaluatedAt output : auths_model.Timestamp) : + status_horizon evaluation evaluatedAt = ok (.Ok output) ↔ + output = evaluation.valid_through ∧ evaluatedAt.val ≤ output.val := by + rw [status_horizon_exact] + split + · rename_i within + constructor + · intro accepted + have same : evaluation.valid_through = output := by simpa using accepted + subst output + exact ⟨rfl, within⟩ + · rintro ⟨rfl, _⟩ + rfl + · simp_all + +theorem status_horizon_stale_refused (evaluation : auths_ports.StatusEvaluation) + (evaluatedAt : auths_model.Timestamp) + (stale : evaluation.valid_through.val < evaluatedAt.val) : + status_horizon evaluation evaluatedAt = ok (.Err (.Indeterminate .StaleStatus)) := by + rw [status_horizon_exact] + simp [Nat.not_le_of_gt stale] + +theorem status_decision_accepts_iff (decision : auths_ports.StatusDecision) (principal : Bool) : + status_decision decision principal = ok (.Ok ()) ↔ decision = .Active := by + cases decision <;> cases principal <;> simp [status_decision] + +theorem timestamp_min_exact (left right : auths_model.Timestamp) : + core.cmp.Ord.min.trait_default auths_model.Timestamp.Insts.CoreCmpOrd left right = + ok (if left.val < right.val then left else right) := by + simp [core.cmp.Ord.min.trait_default, core.cmp.Ord.min.default, core.cmp.Ord.min_body, + Aeneas.Std.core.cmp.PartialOrd.lt.default, Aeneas.Std.core.cmp.PartialOrd.lt_body, + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp, + auths_model.Timestamp.Insts.CoreCmpOrd.cmp, core.cmp.impls.OrdU64.cmp, Nat.compare_eq_lt] + split <;> rfl + +theorem requirement_lookup (requirements : Slice auths_model.AssuranceRequirement) + (index : Std.U16) : + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice auths_model.AssuranceRequirement) + requirements (core.convert.num.FromUsizeU16.from index) = + ok (requirements.val[index.val]?) := by + simp [core.slice.Slice.get, core.convert.num.FromUsizeU16.from_val_eq] + +theorem saturation_exact (left right : Std.U64) : + (core.num.U64.saturating_add left right).val = min wordMaximum (left.val + right.val) := by + change (min (UScalar.max .U64) (left.val + right.val)) % (2 ^ 64) = _ + rw [UScalar.max_UScalarTy_U64_eq, U64.max_eq] + unfold wordMaximum + apply Nat.mod_eq_of_lt + have bounded := Nat.min_le_left (18446744073709551615 : Nat) (left.val + right.val) + omega + +end Auths.TemporalWitness diff --git a/formal/Auths/Verifier/TemporalProperties.lean b/formal/Auths/Verifier/TemporalProperties.lean new file mode 100644 index 000000000..5a7971d5d --- /dev/null +++ b/formal/Auths/Verifier/TemporalProperties.lean @@ -0,0 +1,42 @@ +import Auths.Verifier.TemporalModel +import Mathlib.Tactic +namespace Auths.TemporalWitness + +/-- This checks expiry only. The evaluator separately establishes observation +time ordering, claim validity, and which records satisfy the policy. -/ +def selectedExpiryAllows (ages : List (Option Nat)) (record : Witness) (now : Nat) : Prop := + match ages[record.requirementIndex]? with + | none => False + | some none => True + | some (some age) => + match record.observedAt with + | none => False + | some observed => now ≤ min wordMaximum (observed + age) + +theorem assurance_permits_iff (ages : List (Option Nat)) (records : List Witness) + (initial now : Nat) : + (∃ horizon, assuranceHorizon ages records initial = .ok horizon ∧ now ≤ horizon) ↔ + now ≤ initial ∧ ∀ record ∈ records, selectedExpiryAllows ages record now := by + induction records generalizing initial with + | nil => simp [assuranceHorizon] + | cons record rest ih => + cases selected : ages[record.requirementIndex]? with + | none => simp [assuranceHorizon, selectedExpiryAllows, selected] + | some age => + cases age with + | none => + simpa [assuranceHorizon, selectedExpiryAllows, selected] using ih initial + | some age => + cases observed : record.observedAt with + | none => simp [assuranceHorizon, selectedExpiryAllows, selected, observed] + | some atTime => + simpa [assuranceHorizon, selectedExpiryAllows, selected, observed, + le_min_iff, and_assoc, and_left_comm, and_comm] using + ih (min initial (min wordMaximum (atTime + age))) + +theorem successful_horizon_bounded (ages : List (Option Nat)) (records : List Witness) + (initial horizon : Nat) (accepted : assuranceHorizon ages records initial = .ok horizon) : + horizon ≤ initial ∧ ∀ record ∈ records, selectedExpiryAllows ages record horizon := + (assurance_permits_iff ages records initial horizon).mp ⟨horizon, accepted, Nat.le_refl _⟩ + +end Auths.TemporalWitness diff --git a/formal/Auths/Verifier/TemporalStatus.lean b/formal/Auths/Verifier/TemporalStatus.lean new file mode 100644 index 000000000..64661fd29 --- /dev/null +++ b/formal/Auths/Verifier/TemporalStatus.lean @@ -0,0 +1,27 @@ +import Auths.Verifier.TemporalNative +open Aeneas Aeneas.Std Result +open AuthsTemporalWitness +namespace Auths.TemporalWitness.Status + +def stateView : auths_ports.StatusDecision → State + | .Active => .active | .Revoked => .revoked | .Missing => .missing | .Stale => .stale + | .Rollback => .rollback | .UntrustedIssuer => .untrustedIssuer | .WrongMethod => .wrongMethod + +def errorValue : Failure → VerificationFailure + | .principalRevoked => .Denied .PrincipalRevoked + | .grantRevoked => .Denied .GrantRevoked + | .missingPrincipal => .Indeterminate .MissingPrincipalStatus + | .missingGrant => .Indeterminate .MissingGrantStatus + | .stale => .Indeterminate .StaleStatus + | .rollback => .Denied .StatusSequenceRollback + | .untrustedIssuer => .Denied .StatusIssuerUntrusted + | .wrongMethod => .Denied .StatusMethodMismatch + +def resultValue : Except Failure Unit → core.result.Result Unit VerificationFailure + | .ok value => .Ok value | .error reason => .Err (errorValue reason) + +theorem decision_refines (decision : auths_ports.StatusDecision) (principal : Bool) : + status_decision decision principal = ok (resultValue (evaluate principal (stateView decision))) := by + cases decision <;> cases principal <;> rfl + +end Auths.TemporalWitness.Status diff --git a/formal/README.md b/formal/README.md index c94b8ae7d..f3b00df6e 100644 --- a/formal/README.md +++ b/formal/README.md @@ -1,9 +1,11 @@ # Auths-Proof formal model -This Lean 4 project proves properties of the target V1 authority ordering and -three-valued composition algebra. It deliberately excludes codecs, -cryptography, adapters, clocks, networking, storage, and complete verifier -control flow. +This Lean 4 project proves properties of target V1 authority ordering, +three-valued composition, and selected shipping codec and enforcement functions. +The complete verifier, complete protocol-object codecs, cryptographic +integration, backend implementations, adapters, physical clocks and networking +remain outside the completed proof surface. Each component's exact scope is +recorded below and in the assurance manifest. Every public theorem claim is listed in [`assurance-manifest-v1.toml`](assurance-manifest-v1.toml). The compiled @@ -12,6 +14,29 @@ declaration name, statement, transitive axiom set, source closure, and required evidence. This prevents a renamed, weakened, deleted, or `sorry`-backed theorem from satisfying the repository gate through a textual look-alike. +The latest qualified development checkpoint has 917 compiled claims, 18/18 +qualification cases, 25 reviewed external models and two byte-identical full +translation reproductions. Its latest batch proves exact payload, UTF-8, collection +and protocol-field decoding, including bounds, error categories and cursor +behavior. Full protocol-object codecs and inverse completeness remain open. The +preceding batch proves the complete record validator +under the explicit portable String bound, closes concrete String/profile ordering +premises, and proves exact decoder cursor, integer, null and type-query behavior. +Completion length and input identity remain distinct caller obligations. Earlier +batches prove durable-record temporal shape and administrative preservation, and +directly prove +owned-String constructors under the existing +reviewed portable UTF-8 representation bound. Earlier batches prove +recovery-credential selection, terminal revocation and +monotone administrative state/time guards consumed by five actual record methods. +The preceding batch proves complete connection text validation, actual profile +construction and exact connection-key preimages. +Earlier components cover reservation construction/admission, connection-entry +membership, counter framing, principal/scope construction, field/identity +binding, admission histories and frontier search. See the +[implementation ledger](../docs/assurance/AP_SPEC_069_STATUS.md) for exact scope +and remaining work. Hosted evidence on the pushed revision remains required. + ## Mechanical Rust–Lean boundary [`algebra-contract-v1.toml`](algebra-contract-v1.toml) is the single source for @@ -35,16 +60,17 @@ translation source closure, and reproduces the generated artifacts twice byte-for-byte. The reviewed decision is recorded in [`ADR 0011`](../docs/adr/0011-rich-authority-rust-lean-link.md). -That qualification translates selected shipping authority, attenuation, -lifecycle, and bounded-policy predicates to Lean and refines them under stated +That qualification translates selected shipping codec, identifier, authority, +attenuation, lifecycle and bounded-policy functions to Lean and refines them under stated representation and external-model assumptions. The rich authority and transition relations are no longer only a disclosed trust boundary around a proved Boolean aggregation: their scoped refinement claims are listed in [`assurance-manifest-v1.toml`](assurance-manifest-v1.toml), each with its scope and residual assumptions. This is **not** a formally verified end-to-end -verifier. Canonical decoding, cryptography, storage, clocks, networking, -adapter behavior, and the complete verifier control flow remain outside this -proof surface. +verifier. Complete codec totality/completeness, cryptographic integration, +backend behavior, clocks, networking, adapters and the complete verifier control +flow remain open obligations. Selected codec and enforcement claims must not +be presented as completion of those larger boundaries. ## Commands @@ -125,3 +151,418 @@ the translation, toolchain, source, and evidence inputs still match. Changes to those inputs require two fresh, byte-identical reproductions. The complete qualified path remains in hosted CI; contributors do not need to install the formal toolchains locally to receive proof diagnostics. + +## Canonical-action byte binding + +The complete shipping canonical-action decoder and encoder, including their +Auths constructors, are now in the extraction closure. No Auths function in +that closure is opaque. `Auths.Codec.Action.decode_encode_exact` states that +every successful decode re-encodes to the accepted bytes; +`accepted_encoding_unique` derives one accepted encoding per decoded action. +Neither theorem assumes injective hashes. + +The parser folds a bounded owned attachment state, and the encoder folds its +owned writer. Named error converters and explicit borrowed-result matches keep +those transitions visible to translation and source coverage. Native tests +compare against the former implementation, retained only as a test oracle, +including valid randomized actions, mutations, truncation, duplicate and +aggregate attachment bounds, and optional budgets. + +Reviewed transparent standard-library models supply checked conversions, +Option/Result, UTF-8 validation, copying, collection projections and the sole +pure digest-key sorting call. The exact stateless callback has a source proof. +The string representation bridge derives the Unicode stream from validated +strings; it does not assume arbitrary byte carriers are UTF-8. Cases include +valid strings, overlong UTF-8 and surrogate encodings. + +`Auths.Codec.Examples` additionally proves acceptance and exact encoding of a +complete nonempty action. The same shipping decoder refuses duplicate keys, +nonminimal integers, invalid UTF-8, truncation, trailing input and a byte limit +one below the accepted input; it accepts the exact byte boundary. Evaluation +uses kernel-proved portable scalar/vector equalities, with the original checked +behavior retained outside each conservative branch. It adds no native axiom. +The action is opaque codec data, not an application authorization witness. + +`Auths.Codec.Constructors` gives exact decisions for the five string constructors +on validated bounded UTF-8 carriers and the complete action body constructor. +`Auths.Codec.ActionValidity` connects successful decoding to a nonempty body +within both the 8 MiB protocol ceiling and the declared deployment body limit. +These accepted-result implications do not establish parser totality. + +These are scoped component results. Full constructor validity, action inverse +completeness and work bounds, every other protocol object, and AP-SPEC-069's +remaining verifier, driver, history and cryptographic obligations are still +required. See the [implementation ledger](../docs/assurance/AP_SPEC_069_STATUS.md). + + +## Shared signing-frame refinement + +`Auths.Crypto.Refinement` connects the actual `hash::signing_preimage` to the +independent `Auths.Crypto.Framing` byte grammar. Successful calls supply their +own validated length/tag premises. Equal returned bytes bind every framed +input; different registered object kinds have different preimages. Output +length and oversized-profile refusal are proved, with ordinary and multibyte +positive examples. These are preimage properties, without a hash-injectivity +assumption. + +The shared helper is in the qualified codec extraction, with no opaque Auths +algorithm. Its checked capacity and error transitions have one shipping path; +the previous helper is a test-only parity oracle. Public caller encodings, +signature descriptors, cryptographic suite/dispatch behavior and commitment +preimages remain outside this slice. AP-SPEC-069 E5 and the complete composed +claim remain open. + + +## Finite child-summary refinement + +The shipping composition engine now accumulates child outcomes in constant +space. Its translated update and finalizers refine an independent finite-list +specification of counts, minimum diagnostics, conjunctions and thresholds. +Every bounded sequence of actual updates has the exact specified summary; +threshold classification includes saturating unsigned arithmetic. Independent +byte tables establish lexical precedence for every denial/requirement pair, +with exhaustive native catalog/string parity and nine Lean/native witnesses. + +At the child-summary checkpoint, the source had four local and five imported +composition functions, with no opaque Auths functions. Its 418-declaration audit +kept every prior 387 record unchanged, with only the existing foundational +axioms. Qualification passed all 11 modules, native cases and two identical +translations. +The inventory records a naming-only discriminant normalization that reuses the +pinned generator and changes only anonymous instance namespaces. + +The following slice extends this child-sequence result to recursive traversal. +Public plan validation, callback implementations, the complete staged verifier +and sealed result projection remain AP-SPEC-069 E2 obligations. + +## Recursive inner-plan refinement + +`Auths.Composition.Traversal.evaluator_refines` compares the actual shipping +inner evaluator with an independently recursive all/any/k specification for +all finite represented plans. Its explicit contracts relate each stateful +leaf callback and observer call to their model operations. The equality fixes +the outcome and both final states, including every child and post-order event. +Separate corollaries prove exact event count and leaf order. Nonempty plans +have at most depth times leaf-count events; explicit depth-16 and 128-leaf +premises give 2,048 events. This is a semantic-event bound, not a bound on the +complete verifier, callback cost, allocation or host stack. + +The extraction uses the pinned official `-loops-to-rec` pass for composition +and a strictly positive bounded-vector carrier. The carrier has exactly the +pinned Vec's usize bound, both conversion round trips and injectivity are +proved, and deref delegates to the pinned model. No generated Auths function +body is rewritten. The reviewed external inventory additionally gives exact +Option-default and existing numeric/Result links; external axiom templates +are retained as uncompiled inventory artifacts. + +The source witnesses cover successful two-leaf conjunction, denial without +short-circuiting, authorization without short-circuiting, and indeterminate +and denied thresholds with exact event sequences. Native cases mirror them +through the public validating wrapper and exercise 128 leaves at depth 16. +The constructor rejects oversized member counts before sorting, preserving +invalid-threshold/empty-input error precedence and the accepted canonical form. + +The expanded qualification passes all 435 compiled statements, all 11 modules, +native cases and two byte-identical translations. All prior 418 records are +unchanged, and only the existing foundational axioms occur. The exact pushed +revision requires its hosted authoritative gates. The inner evaluator theorem does not prove public validation, +leaf cryptography, closed registry/stage behavior, or sealed-result projection; +it does not complete E2 or the composed AP-SPEC-069 claim. + + +### Public observed-composition refinement + +The production `evaluate_observed` entry point now refines independent +structural validation followed by the recursive plan semantics. Its validator +accepts exactly an independently valid plan under explicit protocol-sized +limits; valid means well-formed nonempty operators and thresholds, per-node +width, bounded depth and distinct bounded leaves. A validation result is not +assumed. Invalid structure leaves both callback states unchanged without +callback contracts. Successful evaluation fixes the result and both states +under the displayed exact stateful branch/observer contracts. + +The source validator's set accumulation and consuming collection preserve the +ordered reference set and computed depth state. Reviewed bounded set/iterator +models expose that standard-library boundary and its lawful byte-order +premise; the Rust tree and allocation implementation is not proved. Native +positive and rejection cases mirror the kernel-checked public witnesses. +The actual source child loop is shared, and the public result conversion is +an explicit match. No generated Auths function body is rewritten. + +The expanded qualification passes 471 statements with all prior 435 records +unchanged, all 11 cases, native parity and two identical clean translations. +The only foundations remain `propext`, `Classical.choice` and `Quot.sound`; +there are ten reviewed library models and zero compiled external axioms. +Split-line axiom declarations are both counted in uncompiled templates and +refused in compiled bridges. The full E2/M3 verifier and AP-SPEC-069 composed +claim remain open; callback implementations, facade/getter coverage, +registered stages, crypto, projection and complete work bounds are separate +obligations. Hosted evidence is still required on the exact pushed revision. + + +### Shipping signature encoding guards + +`Auths.Crypto.Encoding` connects the actual Ed25519 field/sign and P-256 +compressed-form guards to independent numeric/length specifications. Both +source refinements are total on their displayed carriers. The finite byte +scan is proved equal to the base-256 coordinate condition; no curve arithmetic +or signature equation is implemented in the proof bridge. This additional +extraction has three local functions, no external functions and no opaque +Auths algorithm. It adds no primitive axiom or custom library model. + +The 490-statement construction audit preserves all 471 previous full records. +Accepted/refused kernel witnesses are encoding examples, including canonical +weak-key encodings whose signatures the native strict verifier still refuses. +The exact-source qualification passes 12/12 cases, native parity, two +byte-identical fresh translations and all 490 audited statements. Complete +suite glue, caller preimages, principal binding, dispatch and commitment +integration remain separate AP-SPEC-069 E5 obligations. Hosted evidence is +still required on this exact revision. + + +### Public composition facade + +`Auths.Composition.Facade` refines the shipping `evaluate` wrapper against +independent validation/evaluation and proves the exact event accessor. It +discharges the actual stateless observer, preserves the exact branch state, +and refuses structurally invalid plans without callback premises. The 500 +compiled statements preserve all 490 previous full records. All ten +handwritten composition functions now lie in the audited closure; registered +branch/stage implementations and full verifier assurance remain open. + +One explicit, single-site FnMut dictionary binding restores an erased unit +output. The Result adapter has both general round-trip proofs and no axioms; +no translated Rust function body is rewritten. Compiler-generated closure +call shims remain in the call graph and are reported separately from +handwritten Rust functions. Eleven reviewed library/representation models +introduce zero compiled external axioms. Exact-source qualification passes +12/12 cases, native parity, two identical fresh translations and the compiled +500-statement audit. Hosted verification remains required on this revision. + + +### Concrete strict signature glue + +`Auths.Crypto.Strict` proves the shipping parameterized Ed25519 and P-256 +algorithms against independent accepted-input relations under explicit exact +total primitive contracts. Canonical key form, width, weak-coordinate/R form, +numeric low-S, error order and exact message forwarding are concrete source +properties. P-256's low-S decision is an extracted bounded byte comparison; +it is not a primitive premise. Both accepted-input equivalences include +useful acceptance as well as soundness. + +The 14-function signature extraction has no external function record, opaque +Auths algorithm or custom crypto model. The construction audit has 536 +statements with all prior 500 full records unchanged and only the existing +foundations. Eight kernel examples are form/guard witnesses, not claims of +signature authenticity. Concrete native-library/default-wrapper binding, +suite/principal dispatch, caller preimages and complete commitments remain +E5 obligations. Fresh qualification passes all 12 cases, native parity and two byte-identical translations with all 536 audited statements and no additional axioms. Hosted evidence remains required on the exact pushed revision. + + +### Public Ed25519 binding + +`Auths.Crypto.NativeContract` proves the actual public verify/key-validation +wrappers and selected library adapters, including exact results and independent +acceptance iff. An explicit `Ed25519Primitives` parameter has three foreign +calls; `Ed25519Contract` supplies their exact total contracts as theorem premises. +There is no global instance or new axiom. A section-only codegen normalization +threads this parameter through dependent generated definitions and preserves +all Rust function bodies. Its strict regression checks byte-for-byte recovery. +The construction inventory has 545 claims, all previous 536 records unchanged. +`NativeExamples` supplies explicit mock call-binding and primitive-independent +malformed-key witnesses; mock success is not signature authenticity. +The 23-local/five-external extraction retains four anonymous closure shims. +Fresh qualification passes all 12 cases, native parity, two byte-identical +translations and the 545-statement audit, with thirteen reviewed external +models and zero compiled external axioms. Exact-revision hosted gates remain +required. +The pinned tools still cannot qualify the P-256 public library-wrapper closure; +its generic algorithm and concrete low-S proof remain the smaller earned claim. + + +### One-shot SHA-256 and commitment framing + +The locally qualified inventory has 567 statements. New source results cover the +signed-capacity allocation guard, exact successful application/identifier +preimages, and the native one-shot hash wrapper under explicit foreign digest +and output-conversion contracts. Independent frame relations prove lengths, +unambiguity and domain separation; kernel witnesses supply useful admitted +frames and early refusals. All previous 545 statement records are unchanged. + +The extra monomorphic codec unit keeps its actual Rust crate identity. A +strict foreign-name adapter works around the pinned emitter's inability to +print Instantiated paths. It retains original names in a generated ledger and +checks every Auths name, body, signature, generic, layout, source span and +call/type ID unchanged. The two explicit foreign operations add no global +instance or crypto axiom. Local qualification passes two byte-identical fresh +translations, 13/13 cases and the complete statement/axiom audit. Exact-revision +hosted gates remain required. +Successful-output exactness is a component claim: general framing totality, +all admitted-input completeness, callers' unsigned-object encoding, every +commitment and complete E5 remain separate obligations. + +### Complete shared-framer bounds + +`Auths.Crypto.FramingTotality` relates every represented input of the actual +signing/application/identifier framers to independent numeric domains. Its +nine source claims establish termination in the qualified Result semantics, +acceptance iff the domain holds, and exactly `LimitExceeded` otherwise. +Previous exact-byte, validity, length and input-binding results remain in the +same closure. Local qualification passes 582 audited statements, all prior +573 complete records unchanged, with only the permitted foundations, 13/13 +cases and two byte-identical fresh translations. Exact-revision hosted gates +remain required. Physical allocation, caller object +construction, every commitment and the complete E5 claim remain separate. + +### Native P-256 wrapper construction + +`Auths.Crypto.P256Native` proves the actual public native P-256 verification and +key-validation results and independent acceptance equivalence under explicit +point-decoder, scalar-parser and P-256/SHA-256 equation contracts. The native +low-S and key-form algorithms have concrete total source refinements. No +primitive law or implementation instance is installed globally. Forwarding +mocks bind exact inputs and changed-input refusals without asserting signature +authenticity. The monomorphic source unit contains 14 local functions, ten +explicit foreign/standard interfaces and zero opaque Auths functions. + +Local exact-source qualification passes 599 statements: 17 new and three +explicitly reviewed P-256 primitive-interface statement changes; all other 579 +records are unchanged. All 14 cases and two byte-identical fresh translations +pass, with 19 reviewed models and zero compiled external axioms. Exact-revision +hosted gates remain required. This does not complete dispatch, caller construction, commitment +integration, full verification or the whole AP-SPEC-069 program. + +### Linked suite verification adapters + +The shipping Ed25519 and P-256 suite verification methods refine the independent +suite result and acceptance models through exact field forwarding and error +conversion. Each imported core call has a checked link to its transparent +qualified native owner and a compiled delegation equality. Kernel statement +constants, including implicit implementation instances, are now included in +the reviewed audit digest. The construction audit has 613 claims; all 599 +previous readable statement texts and axiom sets are unchanged. Positive and +changed-message witnesses use explicit forwarding mocks without authenticity +claims. Focused qualification rejection tests pass. Fresh qualification passes +613 claims, 15/15 cases, 21 reviewed models, zero compiled external axioms and +two byte-identical translations. Exact-revision hosted gates remain required. Constructors, registry dispatch, +principal binding, caller preimages and complete E5 remain separate obligations. + +### Shared independent P-256 vectors + +The complete pinned Wycheproof P1363/SHA-256 input is vendored under +`core/fixtures/crypto`, with an offline hash-pinned adapter that retains every +upstream case and makes Auths low-S policy explicit. A shared 653-case corpus +checks 173 accepted signatures across 98 distinct keys, scalar/point/width +errors, high-S twins and exact-message refusal. Rust checks the native and +suite-port results; Go and TypeScript supply independent verdicts. The source +and release inventories bind the corpus and adapters. Fresh qualification +passes 613 unchanged complete audit records, 15/15 cases, 21 reviewed models +and two byte-identical translations. Native tests, lint and both independent +implementations pass; exact-revision hosted evidence remains required. +This is conformance evidence for the displayed primitive contracts, not a +proof of cryptographic arithmetic/security or completion of M2. + +### Native selected-witness expiry + +`Auths.Verifier.TemporalModel` defines status and selected-expiry semantics +without a generated-Rust import. The native verifier helpers refine exact +status results, inclusive deadlines and total selected-assurance expiry +calculation, including missing metadata and saturating arithmetic. The loop +and entry helper have complete Result refinements; successful horizons admit +exactly all selected expiry constraints. The construction audit has 634 +claims, preserving all previous 613 complete records and the axiom policy. +Native boundary tests, focused lint and context rejection tests pass. Fresh +qualification passes 634 claims, 16/16 cases, 22 reviewed models, zero compiled +external axioms and two byte-identical translations. Exact-revision hosted +evidence remains required. Selection, +observation-time ordering, full verification and runtime consumption remain +separate obligations. + + +## Approval-view status-selection source refinement + +The actual principal and grant selectors now use one indexed scan each, +without temporary collections. Shipping first-rule lookup and approval-view +visibility refine independent list rules. Both actual public port methods +have total Result refinements against an operational accumulator, including +all policies, snapshot refusal order and complete decision/horizon results. +Nine kernel-checked witnesses exercise the actual principal port. The pure +filter/max/tie-set specification is separate; its equivalence to the scan is +still an open obligation, as are anchor-view refinement, evidence authenticity +and complete verifier composition. + +The prior algorithms remain test-only independent references. More than +19,000 constructor-valid snapshot pairs compare both selectors in three views, +with dedicated word-limit, saturation, rollback and latest-tie cases. Focused +native parity, lint and generated-context rejection checks pass. The standard +binary-search model follows the pinned standard library's size/base/half +transitions; sorted-scope membership is not yet claimed. + +Fresh source qualification passes 658 compiled claims, all 634 preceding +complete records unchanged, 17/17 cases, 23 reviewed models, zero unreviewed +models, zero compiled external axioms and two byte-identical clean translations. +Qualified production closure: +`597b19ee0354614b37b9f048c7248e5684e69cf2c0d05a92a8b224a0b1172c7f`. +The preceding 634-claim revision `e4770a2b` passed all ten hosted workflows, +including [main CI](https://github.com/auths-dev/auths-proof/actions/runs/38931405294). +The new source slice requires exact-revision hosted gates. E1–E5/M6 remain open. + + +## Independent status-selection adequacy + +The operational accumulator now equals the independent filter/max/tie-set +specification for every finite input, subject equality operation, view and +policy, without an input-validity or source-success premise. The proof earns +an attained maximum, preserves every highest-sequence tie, treats rollback +as absorbing, and connects exact minimum horizons to the independent fold. +Its semantic modules import no generated Rust. + +Both actual principal and grant approval-view port methods now refine that +independent specification, returning the exact decision and horizon. This +closes the scan-versus-specification gap recorded in the preceding checkpoint. +Anchor-view source refinement, evidence authentication, closed dispatch and +complete verifier/runtime consumption remain open. No whole E2/E4/M6 +milestone is complete. + +Fresh qualification passes 661 compiled claims, all 658 preceding complete +records unchanged, 17/17 cases, 23 reviewed models, zero unreviewed models, +zero compiled external axioms and two byte-identical fresh translations. +Qualified production closure: +`678c19c1155869c45fed1cb7e849c147bca5bde0e07df567f413487335ab6669`. +Only the permitted foundational axioms occur. Exact-revision hosted gates +remain required. + +Hosted implementation checking of `85bc1e0f` found that the gateway checksum +still described the differential test file before its final lint cleanup. +The generated artifact is refreshed in this checkpoint; its focused native +check must pass again. No gate or checksum input is excluded to accommodate +the change. Other hosted results for that revision remain separately recorded. + + +## All-view status source refinement on ordered scopes + +The actual principal and grant ports now refine the independent status +specification in every view. The proof includes the existing binary-search +lookup: its reviewed pinned-standard model terminates, preserves membership +through each interval reduction, and returns a bounded index; the actual Auths +contains wrapper returns exact list membership. Actual visibility then agrees +with the per-issuer OwnAnchor, listed-anchor and AnyAnchor rules. + +The all-view statements require ordered listed-anchor scopes. This is a +legitimate representation invariant, not a desired-result premise; derivation +from the actual sorting/validation constructor remains open. Approval-view +statements retain their earlier unrestricted represented-input contracts. +Five new cases check first/last listed anchors, an absent anchor, active status +through the issuer own anchor and hidden status through another anchor. The +last two quantify over unrelated anchor fields and assert selection only; +their synthetic evidence is not an authentication witness. + +Fresh exact-source qualification passes 671 claims, all 661 preceding complete +records unchanged, 17/17 cases, 23 reviewed models, zero unreviewed models and +zero compiled external axioms. Two clean translations are byte-identical. +Production closure: +`0e96ae702036cbe01af7fe60060ac560482b17fc4f473bb24e653ca35a6b5b60`. +Only the three permitted foundational axioms occur. Exact-revision hosted +verification remains required. Constructor validity, evidence authenticity, +closed dispatch, full verifier composition and runtime/history consumption +remain separate E1/E2/E4/M6 obligations. diff --git a/formal/assurance-manifest-v1.toml b/formal/assurance-manifest-v1.toml index cce988bec..2327eb8f9 100644 --- a/formal/assurance-manifest-v1.toml +++ b/formal/assurance-manifest-v1.toml @@ -1,8 +1,8 @@ schema = "auths-proof-formal-assurance/v1" lean_toolchain = "leanprover/lean4:v4.31.0" toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -statement_review = "native-k-of-n-approvals-2026-09-30" -statement_inventory_sha256 = "717939bc5edda0732568a53e598d571b4c3e7584267b23dd1536de29ca0b9838" +statement_review = "ap-spec-069-payload-and-fields-2026-10-17" +statement_inventory_sha256 = "0925d275cd5b9885ad2598fc031238737b8e5f2c7ed04ed3226a5bfd02e81d84" allowed_axioms = [ "Classical.choice", "Quot.sound", @@ -10,13 +10,13 @@ allowed_axioms = [ ] [[claims]] -claim_id = "AP-FORMAL-RICH-001" -claim_text = "Lean proves the rich authority property: finiteSet subset refl." -claim_status = "proved" -lean_declaration = "Auths.Rich.finiteSet_subset_refl" -lean_statement_sha256 = "cac9d4b80390ce990484b56aee1f0d20fcb8d1b2b2b8f07ef1fa819caca6982c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-732" +claim_text = "The actual framing helper appends the exact eight-byte big-endian u64 word within the displayed allocation bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.word_exact" +lean_statement_sha256 = "2e8f5a049ef7ca9f282394e6036ba5ca43a6f554cc4f4880c0d151c9687dfccc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::append_word"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24,37 +24,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -67,38 +250,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-002" -claim_text = "Lean proves the rich authority property: finiteSet subset trans." -claim_status = "proved" -lean_declaration = "Auths.Rich.finiteSet_subset_trans" -lean_statement_sha256 = "620ac85f39efb4108727cc41c2b3b7663eea53ffde7ef5d782ee2e5897e161da" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-733" +claim_text = "The actual component helper appends the exact checked eight-byte length and unchanged bytes within the displayed allocation bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.component_exact" +lean_statement_sha256 = "23659c577b02e91a9786e526bd2209ece92a75399dfe1a59f7d9857140ac25c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::append_component"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -106,37 +347,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -149,38 +573,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-003" -claim_text = "Lean proves the rich authority property: finiteSet subset antisymm." -claim_status = "proved" -lean_declaration = "Auths.Rich.finiteSet_subset_antisymm" -lean_statement_sha256 = "04c8f87dfb0552e7abf656cf19ca4e29a5a81369e1178eb7d9aa634966a115be" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-734" +claim_text = "The actual coordinate helper appends the exact window and window index as two big-endian u64 words." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.coordinates_exact" +lean_statement_sha256 = "88f00087e8549a0fe3736298702a5e9f3088b78c2eab92c6d86e275443882639" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::append_coordinates"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -188,37 +670,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -231,38 +896,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-004" -claim_text = "Lean proves the rich authority property: finiteSet membership monotone." -claim_status = "proved" -lean_declaration = "Auths.Rich.finiteSet_membership_monotone" -lean_statement_sha256 = "526bdf55ccea3aa1a07aef06197ef303b18a5c083994c97056422713106028a2" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-735" +claim_text = "The actual count-counter builder returns exactly the independent domain-separated framing on the production namespace, subject and evaluator size domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.count_exact" +lean_statement_sha256 = "55f61e86d8ca7affc35bf772e97a2c81b119ea26e74f1f29fb1c9bd5a98f27f3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::count_counter_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -270,37 +993,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -313,38 +1219,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-005" -claim_text = "Lean proves the rich authority property: window contained refl." -claim_status = "proved" -lean_declaration = "Auths.Rich.window_contained_refl" -lean_statement_sha256 = "52b61c239b76a3ec75ebc375c19ba060e170f9c88ab845652188da7e1f32c715" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-736" +claim_text = "The actual sum-counter builder returns exactly the independent framing including the partition on the production size domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.sum_exact" +lean_statement_sha256 = "31e1e72815ff811c1bd3a27d97d13014d72a4319a63c1396d86a9684a21f49ff" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::sum_counter_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -352,37 +1316,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -395,35 +1542,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-006" -claim_text = "Lean proves the rich authority property: window contained trans." -claim_status = "proved" -lean_declaration = "Auths.Rich.window_contained_trans" -lean_statement_sha256 = "ed63f2b8060617d8e042f212bea8d9df13b58494cd94ef01081d7c849e19de7b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-737" +claim_text = "The actual count-slot builder returns exactly the count-slot domain, typed 32-byte counter and big-endian slot word on every represented input." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.count_slot_exact" +lean_statement_sha256 = "704e677eebc9ef4ef12f3754f8bef0a6a44590b1fd64206f9b17c2438729dfd9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::count_slot_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -431,37 +1639,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -474,19 +1865,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -496,17 +1934,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-007" -claim_text = "Lean proves the rich authority property: window contained antisymm." -claim_status = "proved" -lean_declaration = "Auths.Rich.window_contained_antisymm" -lean_statement_sha256 = "a263d89be575fd98940d6a3324ec862360cfe26b2024dd38a13b828b763aa74a" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-738" +claim_text = "The actual sum-slot builder returns exactly the sum-slot domain, typed 32-byte counter and big-endian slot word on every represented input." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.sum_slot_exact" +lean_statement_sha256 = "013815e60962813a7c0c630bdc3bca29957687cfe8d1ab592bf591f533c59692" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::sum_slot_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -514,37 +1962,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -557,19 +2188,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -579,17 +2257,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-008" -claim_text = "Lean proves the rich authority property: window coverage monotone." -claim_status = "proved" -lean_declaration = "Auths.Rich.window_coverage_monotone" -lean_statement_sha256 = "e8d8a9503bde767273a9b55883a18365323b88ae798ebd4de744ffd822ee9dd7" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-739" +claim_text = "Any two actual count-counter builds whose bytes agree have identical namespace, subject, evaluator, window and window index. This concerns exact preimages, not SHA-256 collisions." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.count_source_binds_inputs" +lean_statement_sha256 = "af70a653bb7de6fbd06ad910f06e90c8e62bbea855668fdd63a8b8da2c436734" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::count_counter_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -597,37 +2285,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -640,19 +2511,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -662,16 +2580,349 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-009" -claim_text = "Lean proves the rich authority property: action constraint refl." +claim_id = "AP-FORMAL-RICH-740" +claim_text = "Any two actual sum-counter builds whose bytes agree have identical namespace, subject, evaluator, partition, window and window index. This concerns exact preimages, not SHA-256 collisions." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs" +lean_statement_sha256 = "3fdab8ab4aa9bbddf76d2ead0ccf4bd807c5389695a8650fcd5662ac09398608" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_preimages::sum_counter_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CounterRefinement.lean" +sha256 = "7b28651fd73d45f63c8c5cca8d9c67af41e583fe8b3ca46930a3896df08d6b73" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-741" +claim_text = "Lean proves the bounded product-policy property: fields cancel." claim_status = "proved" -lean_declaration = "Auths.Rich.action_constraint_refl" -lean_statement_sha256 = "6b41a97add7b56d69dde91e7008ca41e34f568ca4081d8b81ca5b728342e5c1d" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.fields_cancel" +lean_statement_sha256 = "6fd8b2eed8c4cb0004c519bb8bb3a0ae34a3a6ead4957523432af88aff094973" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -680,37 +2931,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -723,18 +3157,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -744,16 +3221,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-010" -claim_text = "Lean proves the rich authority property: action constraint trans." +claim_id = "AP-FORMAL-RICH-742" +claim_text = "Lean proves the bounded product-policy property: encode injective." claim_status = "proved" -lean_declaration = "Auths.Rich.action_constraint_trans" -lean_statement_sha256 = "1510dabf7d9cf6d4c1bdb99de295ced7f32f3c44678519aef38aa3fb58dcdee0" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.encode_injective" +lean_statement_sha256 = "d1abc3edd418fcc0e3169555da0bd40c8f5671258261e96030c019207eab8053" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -762,37 +3239,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -805,38 +3465,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-011" -claim_text = "Lean proves the rich authority property: action constraint antisymm." +claim_id = "AP-FORMAL-RICH-743" +claim_text = "Lean proves the bounded product-policy property: slot injective." claim_status = "proved" -lean_declaration = "Auths.Rich.action_constraint_antisymm" -lean_statement_sha256 = "59a7fb2812568c3a9eabd67248452de770baf4d2e1daf9ebf2dbea0baa42c81d" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.slot_injective" +lean_statement_sha256 = "9153b0d82f428e4ee2997cbb97bedad92605896f37306c91508205ed1768a517" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -845,37 +3547,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -888,38 +3773,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-092" -claim_text = "Lean proves the rich authority property: action constraint canonical antisymm." +claim_id = "AP-FORMAL-RICH-744" +claim_text = "Lean proves the bounded product-policy property: fields length." claim_status = "proved" -lean_declaration = "Auths.Rich.action_constraint_canonical_antisymm" -lean_statement_sha256 = "47d8802981c338d34dedf567e68555c3cca9f298dd13c681ba4b3baa927a6813" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.fields_length" +lean_statement_sha256 = "55e89ef00ed985ed0406155fd4629ce4d52d0c78383beb7ebf9c0cf9b97ce27d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -928,37 +3855,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -971,38 +4081,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-012" -claim_text = "Lean proves the rich authority property: action constraint allows monotone." +claim_id = "AP-FORMAL-RICH-745" +claim_text = "Lean proves the bounded product-policy property: count frame length." claim_status = "proved" -lean_declaration = "Auths.Rich.action_constraint_allows_monotone" -lean_statement_sha256 = "49927a15dec0e627c64244b981bd81ca171589f5ada904616bcec9811746efe2" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.count_frame_length" +lean_statement_sha256 = "89bd2fa1c35cf0e1a1282d1b2e9e7fdac902f5c8ab532539192ab61de25c7aa9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1011,37 +4163,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1054,18 +4389,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -1076,16 +4454,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-013" -claim_text = "Lean proves the rich authority property: budget refl." +claim_id = "AP-FORMAL-RICH-746" +claim_text = "Lean proves the bounded product-policy property: sum frame length." claim_status = "proved" -lean_declaration = "Auths.Rich.budget_refl" -lean_statement_sha256 = "54ffb1f592e48a7292cb925afd2f0e1c4c2412a46b7b5d8aeec7113fe58fc09a" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.sum_frame_length" +lean_statement_sha256 = "9c8e768817234029119818c436416454b69bfafa46b7e73b3c96f07f78da72e5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1094,37 +4472,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1137,34 +4698,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-014" -claim_text = "Lean proves the rich authority property: budget trans." +claim_id = "AP-FORMAL-RICH-747" +claim_text = "Lean proves the bounded product-policy property: slot frame length." claim_status = "proved" -lean_declaration = "Auths.Rich.budget_trans" -lean_statement_sha256 = "313fe44a88fa3efd9bc1800bf0e6169039c5bcec051b847ea86c71d27318e0ae" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterFrames.slot_frame_length" +lean_statement_sha256 = "4fea24303726b2bc5f57dc70ddec20e8e1f7cc1b0915d7f93298a9df2c4f7338" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1173,37 +4781,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1216,35 +5007,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/CounterFrames.lean" +sha256 = "c49096feac6cadd8097807685805821baf53ff6d8922524d383125377f038d1a" [[claims]] -claim_id = "AP-FORMAL-RICH-015" -claim_text = "Lean proves the rich authority property: budget antisymm." -claim_status = "proved" -lean_declaration = "Auths.Rich.budget_antisymm" -lean_statement_sha256 = "569b03bd90e823b38193e8a9681faf27341786455644132e4861c779c8c3395b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-662" +claim_text = "The actual slot-frontier constructor returns precisely the independent initial interval on every u64 bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.Frontier.Refinement.start_exact" +lean_statement_sha256 = "6f207ac1a73a082192dbb8c4483428787d63a968696c3426d83a7b13d5c09152" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -1252,37 +5086,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1295,35 +5312,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Frontier/Refinement.lean" +sha256 = "6c35732e27da9b00ef5ba4296a38ebaebbeaffd1576021a4e80dc80692ea4cc3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-016" -claim_text = "Lean proves the rich authority property: budget coverage monotone." -claim_status = "proved" -lean_declaration = "Auths.Rich.budget_coverage_monotone" -lean_statement_sha256 = "594cf3b8740d3b68643756cf665f0be72b2b5b010227f5efc0407ce78fc91520" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-663" +claim_text = "The actual frontier probe terminates safely and returns exactly the independent midpoint or terminal absence on every represented source state." +claim_status = "qualified" +lean_declaration = "Auths.Product.Frontier.Refinement.probe_exact" +lean_statement_sha256 = "f50b93bff05148424569483bd2e1a087f914e0c8692d2e0fe2b06d90bc8e182b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -1331,37 +5409,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1374,35 +5635,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Frontier/Refinement.lean" +sha256 = "6c35732e27da9b00ef5ba4296a38ebaebbeaffd1576021a4e80dc80692ea4cc3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-124" -claim_text = "Lean proves the rich authority property: budget action coverage monotone." -claim_status = "proved" -lean_declaration = "Auths.Rich.budget_action_coverage_monotone" -lean_statement_sha256 = "986470888869bfa94623fd5d5f4a7a72820170912004d0710b39127565ab0379" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-664" +claim_text = "The actual occupied/free-read transition terminates safely and returns exactly the independent frontier transition; no caller-provided validity or result premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.Frontier.Refinement.observe_exact" +lean_statement_sha256 = "971dff51ba08bb5a944aee3375ddc3b5f85e7043cf02c091d99fe2956e790887" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -1410,37 +5732,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1453,34 +5958,414 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Frontier/Refinement.lean" +sha256 = "6c35732e27da9b00ef5ba4296a38ebaebbeaffd1576021a4e80dc80692ea4cc3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-665" +claim_text = "The actual candidate projection returns precisely the independent lower endpoint." +claim_status = "qualified" +lean_declaration = "Auths.Product.Frontier.Refinement.candidate_exact" +lean_statement_sha256 = "2921d626851905da56473fad6d00a5c1b7242155496dfaa7a8dcc5fc474e2adf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = ["propext"] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Frontier/Refinement.lean" +sha256 = "6c35732e27da9b00ef5ba4296a38ebaebbeaffd1576021a4e80dc80692ea4cc3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-261" -claim_text = "An expressible profile with no budget request under a bounded ceiling does not cover the action." +claim_id = "AP-FORMAL-RICH-666" +claim_text = "Lean proves the bounded product-policy property: sixty four reads suffice." claim_status = "proved" -lean_declaration = "Auths.Rich.budgetCoversAction_expressible_absent_bounded" -lean_statement_sha256 = "9b30941cc8a5c3b3aa4c70e4703fb0e902ed07d7d0f5d07536f087234423a0b4" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.Frontier.Model.sixty_four_reads_suffice" +lean_statement_sha256 = "26edb311a56b08be8b82bd47c3ad0c7c781723d4a9118e1650dd5940413cf5f5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1489,37 +6374,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1532,34 +6600,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 budget coverage over opaque identity carriers." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Product/Frontier/Model.lean" +sha256 = "22f3a1229b78ca82efdfce48eeff36763b137a084b97f8f6bc4662a819c540f4" [[claims]] -claim_id = "AP-FORMAL-RICH-093" -claim_text = "Lean proves the rich authority property: extensions refl." +claim_id = "AP-FORMAL-RICH-667" +claim_text = "Lean proves the bounded product-policy property: candidate conservative." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_refl" -lean_statement_sha256 = "3deb6e01a441a7e322859de8eadaec18124a1cb370b09a38322fb4e17dfcb4cf" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.Frontier.Model.candidate_conservative" +lean_statement_sha256 = "27877dda784067f8223ce2d055628ca58dbaad862b1ea38a30395b54cd8098e3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1568,37 +6683,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1611,34 +6909,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/Frontier/Model.lean" +sha256 = "22f3a1229b78ca82efdfce48eeff36763b137a084b97f8f6bc4662a819c540f4" [[claims]] -claim_id = "AP-FORMAL-RICH-094" -claim_text = "Lean proves the rich authority property: extensions trans." +claim_id = "AP-FORMAL-RICH-668" +claim_text = "Lean proves the bounded product-policy property: successful insertion is at frontier." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_trans" -lean_statement_sha256 = "90aa05bf5d3bdaa2f0a8df2b7738628d66fdc848f306b392a015a2e1e12ba9e4" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.Frontier.Model.successful_insertion_is_at_frontier" +lean_statement_sha256 = "1cc27af9d04a47750f54f569858d3148930d21d20828e1a1da99f1e3918f0cc8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1647,37 +6991,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1690,34 +7217,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/Frontier/Model.lean" +sha256 = "22f3a1229b78ca82efdfce48eeff36763b137a084b97f8f6bc4662a819c540f4" [[claims]] -claim_id = "AP-FORMAL-RICH-096" -claim_text = "Lean proves the rich authority property: extensions le pinned iff." +claim_id = "AP-FORMAL-RICH-669" +claim_text = "Lean proves the bounded product-policy property: source work bound." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_pinned_iff" -lean_statement_sha256 = "98fe643cba56dcda0d75b3dc27de128995feff749567004d74f0bf6a8ecf7e37" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.Frontier.Refinement.source_work_bound" +lean_statement_sha256 = "22f2b3e52c37d5110c50335e16f24bf1e2bf837e79d11333d77d959a09899c7a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1726,37 +7299,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1769,34 +7525,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Frontier/Refinement.lean" +sha256 = "6c35732e27da9b00ef5ba4296a38ebaebbeaffd1576021a4e80dc80692ea4cc3" [[claims]] -claim_id = "AP-FORMAL-RICH-097" -claim_text = "Lean proves the rich authority property: extensions le false of dropped." +claim_id = "AP-FORMAL-RICH-670" +claim_text = "Lean proves the bounded product-policy property: every history preserves." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_false_of_dropped" -lean_statement_sha256 = "46a605cf7dea5af58e69b6f0bbc4ffed2ed34084cda7ea99b680ca975ac47f3a" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.every_history_preserves" +lean_statement_sha256 = "6e48e30ded59b26f1d8baf71b6dcf764a63da0b377421fd0c62aae8a481ed2ae" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1805,37 +7608,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1848,34 +7834,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-153" -claim_text = "Lean proves a child that strips a pinned critical-extension identifier is refused, whatever the laws." +claim_id = "AP-FORMAL-RICH-671" +claim_text = "Lean proves the bounded product-policy property: every history count bound." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_false_of_stripped" -lean_statement_sha256 = "92f064c6de7f9415d2483d26e88473b421a0b266b431f939de9f4178952ef6cd" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.every_history_count_bound" +lean_statement_sha256 = "7378b1256f94837e2a443a006e76ad648bfdbaf2ffa27fd52b9e9b26ec1296c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1884,37 +7916,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -1927,34 +8142,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-154" -claim_text = "Lean proves a child whose payload for a pinned identifier its law refuses is refused." +claim_id = "AP-FORMAL-RICH-672" +claim_text = "Lean proves the bounded product-policy property: every history sum bound." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_false_of_refused" -lean_statement_sha256 = "4639baf3f61027f8833b78149c26c0af128dc39852f0360464e854e34acb944d" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.every_history_sum_bound" +lean_statement_sha256 = "9df9ae52851ca1566e58bc6986c695ee4f55e30fd242cde859aff582fea25afb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -1963,37 +8224,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2006,34 +8450,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-155" -claim_text = "Lean proves a child that adds an identifier whose law refuses addition is refused." +claim_id = "AP-FORMAL-RICH-673" +claim_text = "Lean proves the bounded product-policy property: every history one owner." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_false_of_refused_addition" -lean_statement_sha256 = "7c57bc9d5691c1cb44f74f95653c02818b7a982cc8ed01c05d43aaed876b38a6" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.every_history_one_owner" +lean_statement_sha256 = "198e9117f0b1114b43b2643d4b55875f49d348941cf0a485fa310987ad59f0db" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2042,37 +8532,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2085,34 +8758,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-105" -claim_text = "Lean proves the rich authority property: extensions le refuses a dropped singleton." +claim_id = "AP-FORMAL-RICH-674" +claim_text = "Lean proves the bounded product-policy property: replay preserves counters." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_refuses_a_dropped_singleton" -lean_statement_sha256 = "b0e6555b3ea818523fe6e8df539811645a6a7ee61e8a03c464b8852fb184829a" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.replay_preserves_counters" +lean_statement_sha256 = "66cfec19da21b8dd54eea5c0c5b3f38a7aafcceef6386eeacbf480c548f16759" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2121,37 +8840,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2164,18 +9066,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -2185,16 +9130,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-156" -claim_text = "Lean proves per-identifier extension attenuation admits no world the parent refuses, given that every handler law narrows." +claim_id = "AP-FORMAL-RICH-675" +claim_text = "Lean proves the bounded product-policy property: closed window cannot charge." claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_le_narrows" -lean_statement_sha256 = "b84fc2cf70c513867276c1398608b399a6e3ca9f2c01905b3c339810dd1496d8" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.closed_window_cannot_charge" +lean_statement_sha256 = "a8b63018a031a8c0e62b90bdfee05c03ecbfaecb397b9514729374c5b7039dc2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2203,37 +9148,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2246,34 +9374,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-017" -claim_text = "Lean proves the rich authority property: status refl." +claim_id = "AP-FORMAL-RICH-676" +claim_text = "Lean proves the bounded product-policy property: useful delegation shares capacity." claim_status = "proved" -lean_declaration = "Auths.Rich.status_refl" -lean_statement_sha256 = "7d5310e68d00575620e99f894080ddc254f48770537a07e1a7e4acdae0090d63" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.Examples.useful_delegation_shares_capacity" +lean_statement_sha256 = "e80be07db728afc1d83ba2448adf8c8f9a10c63f810d6b219a06b95c74b6c32e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2282,37 +9456,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2325,34 +9682,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-018" -claim_text = "Lean proves the rich authority property: status trans." +claim_id = "AP-FORMAL-RICH-677" +claim_text = "Lean proves the bounded product-policy property: recovery cannot reissue lost handle." claim_status = "proved" -lean_declaration = "Auths.Rich.status_trans" -lean_statement_sha256 = "7e9d6580025807c2b2c984e8b167029b84ac610f9dcd280179e4c176872a04a1" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.BoundedClaimHistory.Examples.recovery_cannot_reissue_lost_handle" +lean_statement_sha256 = "0435f652a41e886bcdaf2bd04e2058abba61b805b70c8bc94df67aa6e433877b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2361,37 +9764,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2404,35 +9990,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/BoundedClaimHistory.lean" +sha256 = "225cc2a105565b2afbd73b3bc8c92885cab49977fbff2422f8e1b1744ed3b2d8" [[claims]] -claim_id = "AP-FORMAL-RICH-019" -claim_text = "Lean proves the rich authority property: status antisymm." -claim_status = "proved" -lean_declaration = "Auths.Rich.status_antisymm" -lean_statement_sha256 = "a3badc32c1fcd22da760494c3c6eb256e637312f34fa7691591e7283f504867e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-678" +claim_text = "The actual PrincipalId constructor returns the exact accepted string or InvalidPrincipal refusal on every represented Rust string, combining Unicode character/byte bounds with the independent URI-scheme grammar; no success premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.PrincipalConstructor.parse_exact" +lean_statement_sha256 = "7435ea0f0213417921c3587f85192258bd93cb31b7032813ee7ad017ed0099a0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::PrincipalId}::parse"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -2440,37 +10072,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2483,37 +10298,418 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/PrincipalConstructor.lean" +sha256 = "78de67c84b2b4245dca2b489e3801cda10c94552fbff50f36a8b40549d6252f1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-020" -claim_text = "Lean proves the rich authority property: status satisfaction monotone." +claim_id = "AP-FORMAL-RICH-679" +claim_text = "Native successful namespace validation earns unambiguous separators, so equal actual logical-operation preimages bind the exact namespace and operation bytes on the real size domain; this is not a claim of collision-free hashes." +claim_status = "qualified" +lean_declaration = "Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity" +lean_statement_sha256 = "b86457471187a196b8379befc54e7df3d1f066305f3dbbc85900e9fd84317b23" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::identity::logical_operation_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/OperationIdentity.lean" +sha256 = "0a56f3f51a97eb4eceee8c176a8cb3e5dd5ea133ad6c2ce6b7f0d289b77948c8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-680" +claim_text = "Lean proves the bounded product-policy property: failure before commit can retry." claim_status = "proved" -lean_declaration = "Auths.Rich.status_satisfaction_monotone" -lean_statement_sha256 = "7f5f3cfc2e90f4a2bdf90499b6b596a0711d27f3668d3d99bcf8c5a0a146e022" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.failure_before_commit_can_retry" +lean_statement_sha256 = "638a206f2b2b83f7551debeaee16a9d84d47f1d6adf8af3e5563728d32dfe038" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2522,37 +10718,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2565,34 +10944,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-021" -claim_text = "Lean proves the rich authority property: profile refl." +claim_id = "AP-FORMAL-RICH-681" +claim_text = "Lean proves the bounded product-policy property: terminal refusal retains claim without capacity." claim_status = "proved" -lean_declaration = "Auths.Rich.profile_refl" -lean_statement_sha256 = "c256b640094e0458a6cb336c78c358b8f35906d7838c86142f649c4d7c3cf9ea" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.terminal_refusal_retains_claim_without_capacity" +lean_statement_sha256 = "39ead2d239a95bc1ba1908c20cc117f60d64c2984b04d945ff8760334474fe27" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -2601,37 +11027,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2644,38 +11253,82 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-022" -claim_text = "Lean proves the rich authority property: profile trans." -claim_status = "proved" -lean_declaration = "Auths.Rich.profile_trans" -lean_statement_sha256 = "bc702fae63c302ea1b30323b66eaa633f2c489dd14a84bda0802852888da4e5d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-682" +claim_text = "The actual bounded ASCII principal-scheme scanner terminates and returns exactly the independent first-letter, scheme-tail, colon and nonempty-remainder grammar." +claim_status = "qualified" +lean_declaration = "Auths.PrincipalScheme.scheme_refines" +lean_statement_sha256 = "14958dc8bf5c180328433c72e38e3680a21557324e0819215594b83205951696" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::identifier::principal_scheme_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -2683,37 +11336,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2726,38 +11562,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/PrincipalScheme.lean" +sha256 = "6e67043c5614630b14419a38a2316dba77fd8cf0e0677db7add012a6e03c7be5" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-023" -claim_text = "Lean proves the rich authority property: profile antisymm." -claim_status = "proved" -lean_declaration = "Auths.Rich.profile_antisymm" -lean_statement_sha256 = "306251093aa948294a625b5fd0e2707c52d9d391f172185ca36949ee0bd022ba" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-683" +claim_text = "Every successfully decoded actual status trust rule carries a constructor-valid scope." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.accepted_rule_valid" +lean_statement_sha256 = "a0fdb523470567afe9de6338d42c42cdab9585ac11cdd0de84177d2a283cd3e1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_trust_rule"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -2765,37 +11659,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2808,38 +11885,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeTrustSafety.lean" +sha256 = "9d1b16c6210c7fa52d12c4a103ed1edbfb48eb3807f1f26755df07e758352047" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-024" -claim_text = "Lean proves the rich authority property: profile coverage monotone." -claim_status = "proved" -lean_declaration = "Auths.Rich.profile_coverage_monotone" -lean_statement_sha256 = "fa6e1ec9008031df18e845bb6457030c5169bff159a30e5a30e4be9d7b445c16" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-684" +claim_text = "Every successfully decoded actual status trust collection preserves constructor-valid scopes for every rule, with no rule position excluded." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.accepted_trust_valid" +lean_statement_sha256 = "01df1eb6f89813cd1930cfb5ea61016b4bace594c057a440a5eb1109b9fcd2d6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_trust"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -2847,37 +11982,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2890,38 +12208,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeTrustCollection.lean" +sha256 = "ba69373b4121426994cf605fa50d935879b36a9125a61385b5012a3e185b3e98" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-025" -claim_text = "Lean proves the rich authority property: structural scope le refl." -claim_status = "proved" -lean_declaration = "Auths.Rich.structural_scope_le_refl" -lean_statement_sha256 = "d62dc8e9720475e1f9aef453def070f12382d75b5d1836e28810c50a123fe1b4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-685" +claim_text = "Actual successful trust-field decoding earns every ordering invariant for the actual principal port, whose complete decision and horizon equal the independent all-view specification." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.decoded_trust_principal" +lean_statement_sha256 = "05005e6055959bb9dab777f4dc579d444bb2e2ad4ba5d08c3d7f85b91f8cb07a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_trust"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -2929,37 +12305,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -2972,38 +12531,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeTrustSelectors.lean" +sha256 = "53dad6978f0c1132d498dd91d28944214629c80d9f49be2ac27e8a46f0b76e26" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-026" -claim_text = "Lean proves the rich authority property: structural scope le trans." -claim_status = "proved" -lean_declaration = "Auths.Rich.structural_scope_le_trans" -lean_statement_sha256 = "6cbce72d938dea6cd1a9f4814ba78cb52e8c5f4c7cddd2469a6526bb1662bb94" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-686" +claim_text = "Actual successful trust-field decoding earns every ordering invariant for the actual grant port, whose complete decision and horizon equal the independent all-view specification." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.decoded_trust_grant" +lean_statement_sha256 = "88d15b9796f915211df567017fd7862c85a79284b51540332b0c69a1be89854b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_trust"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -3011,37 +12628,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3054,19 +12854,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -3076,17 +12923,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeTrustSelectors.lean" +sha256 = "53dad6978f0c1132d498dd91d28944214629c80d9f49be2ac27e8a46f0b76e26" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-027" -claim_text = "Lean proves the rich authority property: scope le canonical antisymmetry." -claim_status = "proved" -lean_declaration = "Auths.Rich.scope_le_canonical_antisymmetry" -lean_statement_sha256 = "197fe00cdc067ce9188485dd0e9b76f9561669b95ca225396561d8ce855f4542" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-687" +claim_text = "The actual field-name comparison terminates and returns exact byte equality on every represented input pair." +claim_status = "qualified" +lean_declaration = "Auths.Product.SchemaIndex.Refinement.field_name_equal_spec" +lean_statement_sha256 = "18aa504cd50648a313be36671105b8d7d7fc4cf245ce2992662652d6599b8c87" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::construct::field_name_equal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -3094,37 +12951,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3137,19 +13177,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -3158,18 +13245,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/SchemaIndex.lean" +sha256 = "b467f63f5152b55f7bff784ace06358b06f918d45572f633b7455b4f43a2f1ec" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-028" -claim_text = "Lean proves the rich authority property: action coverage downward closed." -claim_status = "proved" -lean_declaration = "Auths.Rich.action_coverage_downward_closed" -lean_statement_sha256 = "f76fefd95f4dae279b6fcfbe014a5e8fdd7a9a7c1641f42c19045b7b16a9c486" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-688" +claim_text = "The actual indexed field lookup terminates and returns exactly the independent first-match schema position or absence." +claim_status = "qualified" +lean_declaration = "Auths.Product.SchemaIndex.Refinement.field_index_spec" +lean_statement_sha256 = "7e2af234c8aeaae67b4158060b8d304e235c4f629a72ae407551a1f63fdcb8b1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::construct::field_index"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -3177,37 +13274,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3220,19 +13500,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -3241,18 +13568,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/SchemaIndex.lean" +sha256 = "b467f63f5152b55f7bff784ace06358b06f918d45572f633b7455b4f43a2f1ec" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-029" -claim_text = "Lean proves the rich authority property: evidence requirements downward closed." -claim_status = "proved" -lean_declaration = "Auths.Rich.evidence_requirements_downward_closed" -lean_statement_sha256 = "3fca86b2826d0c6807da5e6d6c742bb51084ff7bd9914f1cc40003a0eaae08b4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-689" +claim_text = "The actual logical-operation preimage has the exact registered domain, validated namespace, NUL separator and logical operation bytes on the stated constructor-valid size domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.OperationIdentity.Refinement.logical_preimage_exact" +lean_statement_sha256 = "fff73b6a9adf7345cc89e6c853484cdbe742cfef712e012eb66be04897ca743d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::identity::logical_operation_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -3260,37 +13597,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3303,37 +13823,418 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/OperationIdentity.lean" +sha256 = "0a56f3f51a97eb4eceee8c176a8cb3e5dd5ea133ad6c2ce6b7f0d289b77948c8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-030" -claim_text = "Lean proves the rich authority property: complete admission downward closed." +claim_id = "AP-FORMAL-RICH-690" +claim_text = "The actual bounded token validator terminates and returns exactly the independent ASCII first/rest grammar and byte limit." +claim_status = "qualified" +lean_declaration = "Auths.Product.OperationIdentity.Refinement.token_exact" +lean_statement_sha256 = "a25e4a1bb4b308ba1c0d7f39b912b944bd44a5fc8170731924009dfc14bdadc6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::identity::valid_token"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/OperationIdentity.lean" +sha256 = "0a56f3f51a97eb4eceee8c176a8cb3e5dd5ea133ad6c2ce6b7f0d289b77948c8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-691" +claim_text = "Lean proves the bounded product-policy property: every history preserves capacity." claim_status = "proved" -lean_declaration = "Auths.Rich.complete_admission_downward_closed" -lean_statement_sha256 = "4894f6f4a2eb7bef73ad797ae1601d7c07994e4d1bff74e873b8f1df4ba6657b" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.every_history_preserves_capacity" +lean_statement_sha256 = "a0956b7adc1deb4652093d6b958cd8740c207ac34735dba87fe3e30d870a08ab" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3342,37 +14243,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3385,38 +14469,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionHistory.lean" +sha256 = "af2a047a8ebe742fa62c0493752d2de656fc3a0f31bab8500f830a6b491cd86b" [[claims]] -claim_id = "AP-FORMAL-RICH-031" -claim_text = "Lean proves the rich authority property: semantic attenuation preorder refl." +claim_id = "AP-FORMAL-RICH-692" +claim_text = "Lean proves the bounded product-policy property: claim has one owner." claim_status = "proved" -lean_declaration = "Auths.Rich.semantic_attenuation_preorder_refl" -lean_statement_sha256 = "7ae1373433d76ff6136509d9662dab1b8e34867c4b4b067f1242499fb06ba0fd" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.claim_has_one_owner" +lean_statement_sha256 = "a74e8840d45156be92a2d3d5b76beeba133e1c6c4aaaa3b7d3ce754c51f048f3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3425,37 +14551,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3468,18 +14777,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -3489,16 +14841,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionOwnership.lean" +sha256 = "a58efbc54c37c0ca5f440de1cc724c71afe2c3f4fca8082d6a6492e46d6a3298" [[claims]] -claim_id = "AP-FORMAL-RICH-032" -claim_text = "Lean proves the rich authority property: semantic attenuation preorder trans." +claim_id = "AP-FORMAL-RICH-693" +claim_text = "Lean proves the bounded product-policy property: unacknowledged has no new handle." claim_status = "proved" -lean_declaration = "Auths.Rich.semantic_attenuation_preorder_trans" -lean_statement_sha256 = "9b916eba63a367eacf049d8c8cb710908e7ca06d6e624f1b3d474bf6cb3fced9" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.unacknowledged_has_no_new_handle" +lean_statement_sha256 = "6ef82057cf7a3b563f8d571f5cd64f3a754c2f58f168e1c889ea0e76424eac11" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3507,37 +14859,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3550,37 +15085,382 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/AdmissionOwnership.lean" +sha256 = "a58efbc54c37c0ca5f440de1cc724c71afe2c3f4fca8082d6a6492e46d6a3298" + +[[claims]] +claim_id = "AP-FORMAL-RICH-694" +claim_text = "Lean proves the bounded product-policy property: recovery mints no handle." +claim_status = "proved" +lean_declaration = "Auths.Product.AdmissionHistory.recovery_mints_no_handle" +lean_statement_sha256 = "0d59ca585d99adbab3ec44ecad7ec03d241846cb0da5a9ac6b6d103a09b62f25" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionOwnership.lean" +sha256 = "a58efbc54c37c0ca5f440de1cc724c71afe2c3f4fca8082d6a6492e46d6a3298" [[claims]] -claim_id = "AP-FORMAL-RICH-033" -claim_text = "Lean proves the rich authority property: structural scope le implies semantic attenuation." +claim_id = "AP-FORMAL-RICH-695" +claim_text = "Lean proves the bounded product-policy property: available capacity admits." claim_status = "proved" -lean_declaration = "Auths.Rich.structural_scope_le_implies_semantic_attenuation" -lean_statement_sha256 = "5218e5c6169c0fc0af43cb425d0a837930029032da4962d4168fd025f932d431" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.available_capacity_admits" +lean_statement_sha256 = "5e021dd1cba32e7c52a75b09edfc6ca74062b974c3af086fca3c2ea323dfe7e3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3589,37 +15469,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3632,18 +15695,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -3654,16 +15760,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-034" -claim_text = "Lean proves the rich authority property: scope semantic equivalence." +claim_id = "AP-FORMAL-RICH-696" +claim_text = "Lean proves the bounded product-policy property: lost acknowledgement preserves claim." claim_status = "proved" -lean_declaration = "Auths.Rich.scope_semantic_equivalence" -lean_statement_sha256 = "ab0d42af5b5cf85e211b3660953239b56f008cd416570dd57f51d3d0c60175d2" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.lost_acknowledgement_preserves_claim" +lean_statement_sha256 = "1098a29204c379929b625de7952fcbe771e6c71404429a689c8676ce710a3703" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3672,37 +15778,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3715,37 +16004,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-035" -claim_text = "Lean proves the rich authority property: structural scope le decides declared v1 relation." +claim_id = "AP-FORMAL-RICH-697" +claim_text = "Lean proves the bounded product-policy property: lost acknowledgement cannot enter." claim_status = "proved" -lean_declaration = "Auths.Rich.structural_scope_le_decides_declared_v1_relation" -lean_statement_sha256 = "d21c9865f8d29bd1fef0778402eddb386af93dcea402725cc09a63a41c590529" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.lost_acknowledgement_cannot_enter" +lean_statement_sha256 = "d577024bdff84bf665c9b18ad495997292541b204455afd98c8a0935527b807c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3754,37 +16087,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3797,18 +16313,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -3819,16 +16378,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-036" -claim_text = "Lean proves the rich authority property: delegate implies scope le." +claim_id = "AP-FORMAL-RICH-698" +claim_text = "Lean proves the bounded product-policy property: replay cannot change owner." claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_implies_scope_le" -lean_statement_sha256 = "492a39565c693001c3f03fbb40573d3d3c6f08ddacf36e7b5f996ab04df0109f" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.replay_cannot_change_owner" +lean_statement_sha256 = "ff88d15f6e77fdf7fa3b5324f498eca9814c00ad70c1f4b5e7e638bf0ac54dca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3837,37 +16396,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3880,37 +16622,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-037" -claim_text = "Lean proves the rich authority property: delegate preserves root." +claim_id = "AP-FORMAL-RICH-699" +claim_text = "Lean proves the bounded product-policy property: two entries consume shared capacity." claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_preserves_root" -lean_statement_sha256 = "6b5a9d3d8a41d6753cf6787bd5df8afeffa2c2679fa0217b2fdfa59d8a1f46b2" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.two_entries_consume_shared_capacity" +lean_statement_sha256 = "e6895fabb27c5ad817252418fa94d64ce310f3b26fcffecd6c5929a94ea611d7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -3919,37 +16705,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -3962,37 +16931,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-038" -claim_text = "Lean proves the rich authority property: delegate updates subject and parent." +claim_id = "AP-FORMAL-RICH-700" +claim_text = "Lean proves the bounded product-policy property: crash cannot refund capacity." claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_updates_subject_and_parent" -lean_statement_sha256 = "73aea20a45df311686451843eb0a05632aee895859fd5b12a91d950b9f30b581" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.crash_cannot_refund_capacity" +lean_statement_sha256 = "2df4e1078f6d1560bc90d792dd1810d8d696a2dff7d976ff456e826171462983" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4001,37 +17014,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4044,37 +17240,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-125" -claim_text = "Lean proves the rich authority property: anchored chain preserves provenance." +claim_id = "AP-FORMAL-RICH-701" +claim_text = "Lean proves the bounded product-policy property: collected window cannot reopen." claim_status = "proved" -lean_declaration = "Auths.Rich.anchored_chain_preserves_provenance" -lean_statement_sha256 = "854d2853a17bef32a429e1da533bb6ea9dec3428bf7a6649fc0dc5711331b9ee" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.collected_window_cannot_reopen" +lean_statement_sha256 = "4bcb9cbb1b789c82dd5c885a4c582575589e8690456d9d2d29022b1f2cb7460e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4083,37 +17323,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4126,37 +17549,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-139" -claim_text = "Lean proves the rich authority property: singleton context selects fresh self rooted start." +claim_id = "AP-FORMAL-RICH-702" +claim_text = "Lean proves the bounded product-policy property: write handle is one use." claim_status = "proved" -lean_declaration = "Auths.Rich.singleton_context_selects_fresh_self_rooted_start" -lean_statement_sha256 = "f110660181e70518b73b5360585a5eab8dad1d5ec2af11ac92b85c15569aabc8" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.AdmissionHistory.Examples.write_handle_is_one_use" +lean_statement_sha256 = "4300f525a7300492b8600e9da080e76ab7ef0921389abd5c2d8dae250082cb12" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4165,37 +17632,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4208,37 +17858,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/AdmissionExamples.lean" +sha256 = "9a49bdd8f52ae1f8e7f3d4c0cae10d84633d0cc3d84eb3d844c1bf835bba308d" [[claims]] -claim_id = "AP-FORMAL-RICH-126" -claim_text = "Lean proves the rich authority property: chain descends from one root." +claim_id = "AP-FORMAL-RICH-703" +claim_text = "Lean proves the bounded product-policy property: indexed argument is named." claim_status = "proved" -lean_declaration = "Auths.Authority.chain_descends_from_one_root" -lean_statement_sha256 = "854d2853a17bef32a429e1da533bb6ea9dec3428bf7a6649fc0dc5711331b9ee" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SchemaIndex.indexed_argument_is_named" +lean_statement_sha256 = "66d3f38589fe17a5215cb82b73431c6fad1708d7d4663f32fe9b783cb91f7f43" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4247,37 +17941,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4290,37 +18167,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Authority.lean" -sha256 = "ad4757a4a8c19fd1626d3f2ad04a7fa0188e4ea445ca2c849369127d31b5b062" +artifact = "formal/Auths/Product/SchemaIndex.lean" +sha256 = "174d2a15b26a9849c5067cac30c35ef53f9769f09f2c432eec77da1231ddc656" [[claims]] -claim_id = "AP-FORMAL-RICH-039" -claim_text = "Lean proves the rich authority property: delegate strict depth." +claim_id = "AP-FORMAL-RICH-704" +claim_text = "Lean proves the bounded product-policy property: lowered field uses exact name." claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_strict_depth" -lean_statement_sha256 = "996384a43e290522990e26bb761fc181d37e551f3b2c11190e7ef4a55cd5a930" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SchemaIndex.lowered_field_uses_exact_name" +lean_statement_sha256 = "45e7e0332236d03ceebe2dcf8cc722eb6b8a4423c6be5b8466332815d3a18adc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4329,37 +18250,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4372,37 +18476,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/SchemaIndex.lean" +sha256 = "174d2a15b26a9849c5067cac30c35ef53f9769f09f2c432eec77da1231ddc656" [[claims]] -claim_id = "AP-FORMAL-RICH-040" -claim_text = "Lean proves the rich authority property: delegate never widens." +claim_id = "AP-FORMAL-RICH-705" +claim_text = "Lean proves the bounded product-policy property: undeclared field refused." claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_never_widens" -lean_statement_sha256 = "492a39565c693001c3f03fbb40573d3d3c6f08ddacf36e7b5f996ab04df0109f" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SchemaIndex.undeclared_field_refused" +lean_statement_sha256 = "f8e54cc278ea3dc43c03ae5a6591696dda1bc0e4a8fb49423febbbf5608d6b77" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4411,37 +18559,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4454,37 +18785,386 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SchemaIndex.lean" +sha256 = "174d2a15b26a9849c5067cac30c35ef53f9769f09f2c432eec77da1231ddc656" + +[[claims]] +claim_id = "AP-FORMAL-RICH-706" +claim_text = "Lean proves the bounded product-policy property: field rendering preserved." +claim_status = "proved" +lean_declaration = "Auths.Product.SchemaIndex.field_rendering_preserved" +lean_statement_sha256 = "f12d822aab75f5f7c994da23c9af2cddc6d4f3ee4a36ab12c2a2af064f67e259" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/SchemaIndex.lean" +sha256 = "174d2a15b26a9849c5067cac30c35ef53f9769f09f2c432eec77da1231ddc656" [[claims]] -claim_id = "AP-FORMAL-RICH-041" -claim_text = "Lean proves the rich authority property: remaining depth well founded." +claim_id = "AP-FORMAL-RICH-707" +claim_text = "Lean proves the bounded product-policy property: preimage injective." claim_status = "proved" -lean_declaration = "Auths.Rich.remaining_depth_well_founded" -lean_statement_sha256 = "dcf9ed58cbeb7f0b6d9c7fa332d1b3f696f0114cee5ab770d2ad31b27d8698eb" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.OperationIdentity.preimage_injective" +lean_statement_sha256 = "67c99772253856019154d3b7d737c2bfcabef6cab20a74cb1c08f69dbfa4cc64" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4493,37 +19173,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4536,18 +19399,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -4557,16 +19463,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/OperationIdentity.lean" +sha256 = "2141a43cfba45b6b53817f581577e39b636a635595c19ecbf7652690ae4ad34c" [[claims]] -claim_id = "AP-FORMAL-RICH-042" -claim_text = "Lean proves the rich authority property: finite delegation chain." +claim_id = "AP-FORMAL-RICH-708" +claim_text = "Lean proves the bounded product-policy property: valid tokens bind identity." claim_status = "proved" -lean_declaration = "Auths.Rich.finite_delegation_chain" -lean_statement_sha256 = "c54457dda6f3f87e19a7224a424211e04f7da7706c7a6b950084ba630f0741f5" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.OperationIdentity.valid_tokens_bind_identity" +lean_statement_sha256 = "fbb6587837635925142fa42387d53f616ce6d516ff84350a664c8f358fb00c5b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4575,37 +19481,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4618,18 +19707,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -4639,16 +19771,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Product/OperationIdentity.lean" +sha256 = "2141a43cfba45b6b53817f581577e39b636a635595c19ecbf7652690ae4ad34c" [[claims]] -claim_id = "AP-FORMAL-RICH-043" -claim_text = "Lean proves the rich authority property: chain transitive attenuation." +claim_id = "AP-FORMAL-RICH-709" +claim_text = "Lean proves the rich authority property: evaluate iff grammar." claim_status = "proved" -lean_declaration = "Auths.Rich.chain_transitive_attenuation" -lean_statement_sha256 = "941e203039eef42df31f5c80208d2de0ac1345ff01f73b04ce139c9d57995c83" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.PrincipalScheme.Model.evaluate_iff_grammar" +lean_statement_sha256 = "875edc2f69f3766744a229393b5b7d39f372ef65d6850a2a72daa9ca0d633b81" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4657,37 +19789,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4700,38 +20015,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/PrincipalSchemeModel.lean" +sha256 = "cf71b319692ae9b8c88d0c3f8788a4db246804639410e4b18fe28f1d6e461c75" [[claims]] -claim_id = "AP-FORMAL-RICH-044" -claim_text = "Lean proves the rich authority property: authorized action covered." +claim_id = "AP-FORMAL-RICH-710" +claim_text = "Lean proves the rich authority property: grammar minimum." claim_status = "proved" -lean_declaration = "Auths.Rich.authorized_action_covered" -lean_statement_sha256 = "7a3a3213af6f0aed9678912e472e816a9bbfb0f9b0040452f3fcde79d32152b0" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.PrincipalScheme.Model.grammar_minimum" +lean_statement_sha256 = "043eeb957f90622623a212550263466bc3a3d2c4d781dae68895afd55478d16f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -4740,37 +20097,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4783,39 +20323,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/PrincipalSchemeModel.lean" +sha256 = "cf71b319692ae9b8c88d0c3f8788a4db246804639410e4b18fe28f1d6e461c75" [[claims]] -claim_id = "AP-FORMAL-RICH-099" -claim_text = "Lean proves the rich authority property: extensions dimension is exact." -claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_dimension_is_exact" -lean_statement_sha256 = "ade313b34026661e080eb2b6ae656b39acb694efc597028eb0352fcc3c119bb8" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-711" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list" +lean_statement_sha256 = "858dad62e77c3bf7702f44214b948473ecafed83565f6e36cfb113c4013fa973" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -4823,37 +20405,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -4866,19 +20631,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -4888,100 +20699,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" -[[claims]] -claim_id = "AP-FORMAL-RICH-157" -claim_text = "Lean proves the generated extension dimension is false for a grant that strips a pinned identifier." -claim_status = "proved" -lean_declaration = "Auths.Rich.extensions_dimension_false_of_stripped" -lean_statement_sha256 = "978bd5383ecf2efee06ce1391d5355821d353f4e454cbe15d8a0bec2d925aea2" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-101" -claim_text = "Lean proves the rich authority property: altered extensions deny every projection." -claim_status = "proved" -lean_declaration = "Auths.Rich.altered_extensions_deny_every_projection" -lean_statement_sha256 = "02f306f478ccb5919a689482ba1e101e9723e5d365d3f7bd4c71d303a37c5383" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-712" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list" +lean_statement_sha256 = "04d65809815fd3cce23ec4913c6313f03e75fd573414090b34d5986776a90c99" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -4989,37 +20727,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5032,19 +20953,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5054,99 +21021,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" -[[claims]] -claim_id = "AP-FORMAL-RICH-158" -claim_text = "Lean proves every accepted edge carries the grant's extension set, which attenuates every pinned parent identifier under its law." -claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_attenuates_pinned_extensions" -lean_statement_sha256 = "24acb38fc7066db51bd66b9e07dd5b6376010f969e2466acd191d080bbf01040" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-159" -claim_text = "Lean proves every state reachable along a delegation chain carries every critical-extension identifier pinned at its start." -claim_status = "proved" -lean_declaration = "Auths.Rich.chain_retains_pinned_extension_identifiers" -lean_statement_sha256 = "cd2cd919349232f6b3b498154eae98ab6070edd0936d891646946968b3cc6ac4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-713" +claim_text = "An actual successful scope decode earns the ordering invariant required by the actual scope-coverage function, whose complete Boolean result matches independent scope semantics. The translation-context bridge preserves each enum variant and the exact listed vector." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.decoded_scope_covers" +lean_statement_sha256 = "7e92eb1fb6fe8203588f63bc02cbea0216cee49ffc36d8c696fde7acff234daa" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5154,37 +21049,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5197,38 +21275,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Source decoder success implies a structurally valid scope. Listed output invariants are earned from the actual constructor rather than assumed from a carrier type. This closes no whole E1/E2/M6 milestone." +residual_assumptions = [ + "Trust Lean's kernel, pinned source translation and reviewed standard-library interfaces. All Auths decoder and constructor bodies are transparent; no Auths algorithm or ordering outcome is opaque.", + "The premise records actual successful decoding for a legitimate partial-correctness safety property. It is not a total parser, resource-bound, all-input rejection, identifier-language completeness or canonical round-trip theorem. Separate positive/refusal source witnesses guard against vacuous acceptance claims. Full verification, evidence authentication and runtime/history consumption remain open.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodedUse.lean" +sha256 = "122f77bff411290ca1073790333899fad73e728a9a0195dcc9bae7f89367863c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-160" -claim_text = "Lean proves an accepted delegation never widens authority, including every critical-extension payload, given that every handler law is a narrowing preorder." -claim_status = "proved" -lean_declaration = "Auths.Rich.delegate_never_widens_authority" -lean_statement_sha256 = "459fd80f79b0474a17b23f31d1ea894170a59be8af9ca849fa17b930850855f5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-714" +claim_text = "Every successful actual status-scope decode returns OwnAnchor, AnyAnchor, or a nonempty, bounded, unique and ordered listed-anchor scope. The actual constructor earns the invariant on every successful listed-scope path." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.accepted_scope_valid" +lean_statement_sha256 = "304c28ff3aee37bd76a49915911e527705870dd5782cd6109578f99ce91bae45" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5236,37 +21371,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5279,19 +21597,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Source decoder success implies a structurally valid scope. Listed output invariants are earned from the actual constructor rather than assumed from a carrier type. This closes no whole E1/E2/M6 milestone." +residual_assumptions = [ + "Trust Lean's kernel, pinned source translation and reviewed standard-library interfaces. All Auths decoder and constructor bodies are transparent; no Auths algorithm or ordering outcome is opaque.", + "The premise records actual successful decoding for a legitimate partial-correctness safety property. It is not a total parser, resource-bound, all-input rejection, identifier-language completeness or canonical round-trip theorem. Separate positive/refusal source witnesses guard against vacuous acceptance claims. Full verification, evidence authentication and runtime/history consumption remain open.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5301,17 +21665,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeSafety.lean" +sha256 = "2e35531665aa1956e3de1a925536f3ec46b691d1b52ff41fd5229556dc8ea9d1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-161" -claim_text = "Lean proves no state reachable along a delegation chain admits an authorization fact its start refuses, given that every handler law is a narrowing preorder." -claim_status = "proved" -lean_declaration = "Auths.Rich.chain_never_widens_authority" -lean_statement_sha256 = "badba34df0ad02950772de9a16a08ed704b00d13161ca3adb9690156fa9528d9" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-715" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.accepts_own" +lean_statement_sha256 = "f7f0f9c50a0741e88d19883d8a1b5da3966e517fcaa52cbd82430023d8c36c1c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5319,37 +21693,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5362,19 +21919,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5384,17 +21987,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-045" -claim_text = "Lean proves the rich authority property: rich projection accepts iff root preservation and scope depth checks." -claim_status = "proved" -lean_declaration = "Auths.Rich.rich_projection_accepts_iff_root_and_scope_depth_checks" -lean_statement_sha256 = "8701007d8b4c42f2059cd7e02a841fe632ae4380470f3b2a396d0702e8371f46" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-716" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.accepts_any" +lean_statement_sha256 = "a2a4dd9de5184a6dbbcdc5a074a733ff8b55280702c9c08edebe718438221fcc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5402,37 +22015,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5445,19 +22241,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5467,17 +22309,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-046" -claim_text = "Lean proves the rich authority property: apply grant success iff linked and projection." -claim_status = "proved" -lean_declaration = "Auths.Rich.apply_grant_success_iff_linked_and_projection" -lean_statement_sha256 = "d1e837214c3e2d92a11750a81de8f7a132d3615cd87b3d826e3952408a44d1b5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-717" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag" +lean_statement_sha256 = "2ad88feabf96ffb972c4afc58df51f7a0337da47ed5742f3cd98df4a2168e9dc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5485,37 +22337,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5528,19 +22563,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5550,17 +22631,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-047" -claim_text = "Lean proves the rich authority property: apply grant success iff delegates." -claim_status = "proved" -lean_declaration = "Auths.Rich.apply_grant_success_iff_delegates" -lean_statement_sha256 = "60adbaa9a7b69216f9a63e2d01e0d46c696e2e5c06b47a6b4b4a0bdac13e6550" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-718" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.refuses_truncation" +lean_statement_sha256 = "02f6aabb6eee362d9aff906320ec265dfd570ecb4d445208cc2c292245fa1680" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5568,37 +22659,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5611,19 +22885,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5633,17 +22953,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-048" -claim_text = "Lean proves the rich authority property: apply grant success unique." -claim_status = "proved" -lean_declaration = "Auths.Rich.apply_grant_success_unique" -lean_statement_sha256 = "e5f71557dd61f8b0a5479564c6418fd399bf7ab28dc31f18d2fcb8acd3ee169d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-719" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.accepts_listed" +lean_statement_sha256 = "bc549e7769d12c769768e845e9376ecfac073244df83a9e8dc1d3216ebb4567b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5651,37 +22981,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5694,19 +23207,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5716,17 +23275,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-049" -claim_text = "Lean proves the rich authority property: authority delegate diagnostic sound complete." -claim_status = "proved" -lean_declaration = "Auths.Rich.authority_delegate_diagnostic_sound_complete" -lean_statement_sha256 = "1b03026088d20c617111ac18f843d1a98eff2a0d88aee42703c1f9bbfbfc6202" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-720" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.refuses_empty_list" +lean_statement_sha256 = "324aa67a27dd22c86f73ba67acbd14e34811c3b8f743bd223f8901acb51572b7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5734,37 +23303,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5777,19 +23529,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5799,17 +23597,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-050" -claim_text = "Lean proves the rich authority property: authority delegate first failure." -claim_status = "proved" -lean_declaration = "Auths.Rich.authority_delegate_first_failure" -lean_statement_sha256 = "4520e0f85b7efe3d629a9e1beaf601ea16ba7d9728759bab9dfbd2f208ddffcf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-721" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id" +lean_statement_sha256 = "06e1fa70ccc7aac97232bb98b55ade42b1ca081dc48d102e70219f845c0d9705" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5817,37 +23625,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5860,19 +23851,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5882,17 +23919,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-051" -claim_text = "Lean proves the rich authority property: author planning diagnostic sound complete." -claim_status = "proved" -lean_declaration = "Auths.Rich.author_planning_diagnostic_sound_complete" -lean_statement_sha256 = "b6e9eff61245c569032bf56f08d2e4024342839385feca01eec87393f6fb6e58" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-722" +claim_text = "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit" +lean_statement_sha256 = "79d0d77c83e841352a386351df8b71499a8c12b0cea25740e44a964b593c6ceb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::status_scope"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5900,37 +23947,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -5943,19 +24173,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit." +residual_assumptions = [ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -5965,17 +24241,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeDecodeExamples.lean" +sha256 = "5906bbd098b7fab933f082bca50fdb896d38836612374af8f8ec186ae20f2fd7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-052" -claim_text = "Lean proves the rich authority property: coverage decision ok iff covers." -claim_status = "proved" -lean_declaration = "Auths.Rich.coverage_decision_ok_iff_covers" -lean_statement_sha256 = "bba6affe418888d125471704869356f8eda4861176df0aa5e75b72e873bb4a31" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-723" +claim_text = "The actual constructor earns the ordering conditions for the actual principal or grant status port in every view when its constructed list is assigned to each supplied rule. The complete port result equals the independent filter/max/tie-set specification; no source-success or caller-ordering premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.constructed_grant_selection" +lean_statement_sha256 = "f68f921930ec402703fd907717ed6c05334dee6acbaa00adb128bac2b0ac3cf3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -5983,37 +24269,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6026,38 +24495,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeSelectors.lean" +sha256 = "06b138c72078ab012a580bfdc4670d899dee24c25de997570d12bdd7e5d7f9d2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-140" -claim_text = "Lean proves the rich authority property: rooted of origin." -claim_status = "proved" -lean_declaration = "Auths.Rich.rooted_of_origin" -lean_statement_sha256 = "273f922682334f0d8d4d60194e8517e3c842a615da43e0ec829e231893fbed43" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-724" +claim_text = "The actual constructor earns the ordering conditions for the actual principal or grant status port in every view when its constructed list is assigned to each supplied rule. The complete port result equals the independent filter/max/tie-set specification; no source-success or caller-ordering premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.constructed_principal_selection" +lean_statement_sha256 = "7059c8edd3b8c5927acd6abfcce50b29fc5fe4745fed9cc0cf838a9a3d4c1334" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6065,37 +24592,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6108,38 +24818,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Codec/ScopeSelectors.lean" +sha256 = "06b138c72078ab012a580bfdc4670d899dee24c25de997570d12bdd7e5d7f9d2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-141" -claim_text = "Lean proves the rich authority property: reachable accepted." -claim_status = "proved" -lean_declaration = "Auths.Rich.reachable_accepted" -lean_statement_sha256 = "9072a66c7332af7b2d27fea1b83fae0893fc14f9158106ce72fd5c7fb60cce48" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-725" +claim_text = "The actual scope constructor terminates and returns exactly the complete typed result of independent nonempty, maximum-length and uniqueness validation, sorting every admitted list." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.constructor_refines" +lean_statement_sha256 = "9ad1639e71cbd3f4d1500b1597edc44ad61443f5302d39f12992bd40d901134a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6147,37 +24915,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6190,38 +25141,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Codec/ScopeConstructor.lean" +sha256 = "424fe6465ea693eb29ccf51739e3510421e67f465c0555a3eadd9f48e9996d70" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-142" -claim_text = "Lean proves the rich authority property: rooted of reachable." -claim_status = "proved" -lean_declaration = "Auths.Rich.rooted_of_reachable" -lean_statement_sha256 = "ff692ede01812e450cc8984ab3fef696b0e1d71fb93086a53dd1117c27eefdd9" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-726" +claim_text = "Every successful actual construction earns ordered scope lookup, preserves exactly the original list as a permutation and enforces the 1024-element limit; every failure is the exact typed invalid-snapshot error on an inadmissible list." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.constructor_validity" +lean_statement_sha256 = "372abd5047168f78b20654a6a38760c6fbd9d8cfd3f56852f0cca5afce566b15" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6229,37 +25238,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6272,38 +25464,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Codec/ScopeConsequences.lean" +sha256 = "d9e21a1b38e0e6ed28fa9465ce678bdd9ed547180fe002e52bee7d5f9b59f140" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-127" -claim_text = "Lean proves the rich authority property: registry coverage decision ok iff covers." -claim_status = "proved" -lean_declaration = "Auths.Rich.registry_coverage_decision_ok_iff_covers" -lean_statement_sha256 = "75c5f00e47dfec8a229951c0220026fd984afd3ffce7b03b32f61bcc8a50672c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-727" +claim_text = "Successful actual construction feeds the actual Auths binary-search wrapper and yields exact membership in the original list, with no caller ordering or desired-success premise." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.constructed_lookup" +lean_statement_sha256 = "8c062961247892db48133560dd096563132185aa691345757b08c0bd060e6d60" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6311,37 +25561,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6354,38 +25787,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Codec/ScopeConsequences.lean" +sha256 = "d9e21a1b38e0e6ed28fa9465ce678bdd9ed547180fe002e52bee7d5f9b59f140" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-122" -claim_text = "Lean proves the rich authority property: extensions not forgeable." -claim_status = "proved" -lean_declaration = "Auths.Rich.CertifiedProjection.extensions_not_forgeable" -lean_statement_sha256 = "77fa3bfc160297a578bb99027f43b51d5f93820a10000030043dbcb37f577bcf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-728" +claim_text = "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.Examples.accepts_unsorted" +lean_statement_sha256 = "4e2a04e5866c19cfdbfa93ac4107cce3e64610029f197bbc37c8ece8b599d255" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6393,37 +25884,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6436,19 +26110,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -6458,17 +26179,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Codec/ScopeExamples.lean" +sha256 = "d0dbb8fb766ff59f2193f57256eb2c5e327cc270d56131eae3b0af7557b4ae9b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-123" -claim_text = "Lean proves the rich authority property: root not forgeable." -claim_status = "proved" -lean_declaration = "Auths.Rich.CertifiedProjection.root_not_forgeable" -lean_statement_sha256 = "5e5412a76d954a30bb8e5581001dc229b77ddde589cfc4209756972e667e02a6" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-729" +claim_text = "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.Examples.rejects_duplicate" +lean_statement_sha256 = "4712780e6e9ff64a7fcb63f3f20f0b83212e820eb097959cf831067cec2e5121" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6476,37 +26207,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6519,19 +26433,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -6541,17 +26502,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Codec/ScopeExamples.lean" +sha256 = "d0dbb8fb766ff59f2193f57256eb2c5e327cc270d56131eae3b0af7557b4ae9b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-109" -claim_text = "Lean proves the rich authority property: validity start direction." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.validity_start_direction" -lean_statement_sha256 = "b131c8323adfe2d1fdfb276e8b57d8ecbeeadc7ba76c42e142e9e60a1c7c8bd0" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-730" +claim_text = "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.Examples.rejects_empty" +lean_statement_sha256 = "793a385c3459f5f586dde0fe28bd51b0a8006ee8b083efed7d721002d33273d0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6559,37 +26530,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6602,19 +26756,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -6624,17 +26825,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Codec/ScopeExamples.lean" +sha256 = "d0dbb8fb766ff59f2193f57256eb2c5e327cc270d56131eae3b0af7557b4ae9b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-110" -claim_text = "Lean proves the rich authority property: validity end direction." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.validity_end_direction" -lean_statement_sha256 = "64a8422660d220c34ccf2286b3d2b656caee30d180efb50390b98109f012cb9b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-731" +claim_text = "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." +claim_status = "qualified" +lean_declaration = "Auths.ScopeConstructor.Examples.rejects_oversized" +lean_statement_sha256 = "bb745cb1a61aeb53bbfcf33c5fbd2b38cd37aff02743e9cfe3849598880379e1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6642,37 +26853,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6685,19 +27079,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed." +residual_assumptions = [ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -6707,16 +27148,26 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Codec/ScopeExamples.lean" +sha256 = "d0dbb8fb766ff59f2193f57256eb2c5e327cc270d56131eae3b0af7557b4ae9b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/scope_codec/Funs.lean" +sha256 = "7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-128" -claim_text = "Lean proves the rich authority property: permission subset direction." +claim_id = "AP-FORMAL-RICH-652" +claim_text = "The transparent pinned standard-search model terminates on a positive, bounded sorted interval with sufficient fuel; its exact success Boolean is target membership in that interval and its returned index stays within the interval endpoint." claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.permission_subset_direction" -lean_statement_sha256 = "460b9c2c8b40e2c47974aa6f40439a0921401af0a741e636dca7e8ce1e1128cb" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.StatusSelection.Search.search_loop" +lean_statement_sha256 = "9650079d9ec2e99cb4201dedb4af24e64a55c2b2d4b18ccdbdad687e119ec437" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -6725,37 +27176,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6768,18 +27402,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Reviewed standard-library model proof for arbitrary finite String lists under a genuine ordering invariant, index bounds and sufficient fuel. It proves no Rust standard-library machine code or sorting constructor. Actual Auths contains/visibility/port source binding is earned by separate audited statements; evidence authenticity, constructor validity and complete E2/M6 remain open." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -6790,17 +27467,17 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusSearchLoop.lean" +sha256 = "7a579365aa8fe0007b465628d7f1570f2c0c0f3fc567c87d89183a229b5013aa" [[claims]] -claim_id = "AP-FORMAL-RICH-129" -claim_text = "Lean proves the rich authority property: audience subset direction." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.audience_subset_direction" -lean_statement_sha256 = "1efdeced0d7cc63e210e3eed78bf72af7188d0b4b89988645067c065df38d4ca" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-653" +claim_text = "The actual listed-anchor contains wrapper terminates and returns exact list membership on an ordered represented scope." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Search.scope_contains" +lean_statement_sha256 = "5762e18f0ca5efd48414f51439b5f184a58a628a3e84bee30fd8990e38670149" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::contains"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6808,37 +27485,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -6851,19 +27711,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -6873,99 +27780,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusSearchContains.lean" +sha256 = "351a8dc2a6958bd4d870683af5e0ae4ee8b6e48fac30cb0250787779aad49aa8" -[[claims]] -claim_id = "AP-FORMAL-RICH-130" -claim_text = "Lean proves the rich authority property: permission membership decision." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.permission_membership_decision" -lean_statement_sha256 = "5562c113f4b1600e9fa2e351daefdf7ad676c95399913cfaf5366a4d02693859" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-131" -claim_text = "Lean proves the rich authority property: audience membership decision." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.audience_membership_decision" -lean_statement_sha256 = "5562c113f4b1600e9fa2e351daefdf7ad676c95399913cfaf5366a4d02693859" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-654" +claim_text = "The actual issuer visibility function terminates and matches the independent per-issuer scope rules in every view on ordered listed scopes." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.visibility_refines" +lean_statement_sha256 = "5cc130303f1a216c5e17845b486c71ee1623dedaf3c76f183ccc6ae8f61f6ffe" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::status_issuer_visible"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -6973,37 +27808,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7016,38 +28034,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAnchorVisibility.lean" +sha256 = "96312db230060b2f0ff5bde98a2a4988ef6628e541af3fad408d8c1f50fdc058" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-132" -claim_text = "Lean proves the rich authority property: body digest membership decision." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.body_digest_membership_decision" -lean_statement_sha256 = "40e8f579841509c93f52d9b1e8ceeb0068d9deee142398402b148d5dcab74f52" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-655" +claim_text = "The actual principal port terminates and returns the independent filter/max/tie-set decision and horizon in every view on ordered listed scopes." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.principal_method_all_views" +lean_statement_sha256 = "c80536fe0ffa43c4c25a588b239df837372da02e71619ea07eab0d266664842a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7055,37 +28131,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7098,38 +28357,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAllViews.lean" +sha256 = "59d3f98a4912f98f83006c690bbd1d901ebc5644b4cde1b2fd28f46079989b5f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-133" -claim_text = "Lean proves the rich authority property: body digest subset direction." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.body_digest_subset_direction" -lean_statement_sha256 = "6f6d71aafc31d6e2f5f5d6b41450fab50ccbcc47ea24ff1a4d10a06f547e7a3b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-656" +claim_text = "The actual grant port terminates and returns the independent filter/max/tie-set decision and horizon in every view on ordered listed scopes." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.grant_method_all_views" +lean_statement_sha256 = "25040e785711766989d51987a6e6d6ca68c46c5fa3887a72f8b0e5c7d730b7ab" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7137,37 +28454,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7180,19 +28680,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7202,17 +28749,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAllViews.lean" +sha256 = "59d3f98a4912f98f83006c690bbd1d901ebc5644b4cde1b2fd28f46079989b5f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-134" -claim_text = "Lean proves the rich authority property: action exact equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.action_exact_equality" -lean_statement_sha256 = "12d3ee8161fd73a2b9a4c289c074a70dbe838e01889bae915eb1a28a5e0b5cbf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-657" +claim_text = "The actual sorted-scope lookup has the displayed exact present or absent result on the concrete two-anchor carrier." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.AnchorExamples.first_listed_anchor" +lean_statement_sha256 = "caf4ef6f858a35c35fe0b5bd3680a46356603217e6ceb0b23ba5259ab75b4fb3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::contains"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7220,37 +28777,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7263,38 +29003,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAnchorExamples.lean" +sha256 = "c80653b369c43a745400e795307ea5b29c88808818b0b0b871e54c5ee1960106" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-135" -claim_text = "Lean proves the rich authority property: action constructor fallback." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.action_constructor_fallback" -lean_statement_sha256 = "52a8700eb9047be465715d24eb7cce83a544f68beb675fc0ca746b20adcef29d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-658" +claim_text = "The actual sorted-scope lookup has the displayed exact present or absent result on the concrete two-anchor carrier." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.AnchorExamples.last_listed_anchor" +lean_statement_sha256 = "4fae0545437fc679412be80cf31bc00e5ff01692115f98daad4072da406537d5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::contains"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7302,37 +29100,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7345,19 +29326,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7367,100 +29395,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAnchorExamples.lean" +sha256 = "c80653b369c43a745400e795307ea5b29c88808818b0b0b871e54c5ee1960106" -[[claims]] -claim_id = "AP-FORMAL-RICH-136" -claim_text = "Lean proves the rich authority property: action singleton exact rejection." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.action_singleton_exact_rejection" -lean_statement_sha256 = "f748a54bcd87a1105b376fd789d539dcba915c55b382c4d84d0764697544e403" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-111" -claim_text = "Lean proves the rich authority property: budget value direction." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.budget_value_direction" -lean_statement_sha256 = "e5c3c785f61156754ca58b613f917897b7204e66cf2904be240c6ae56dc234d5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-659" +claim_text = "The actual sorted-scope lookup has the displayed exact present or absent result on the concrete two-anchor carrier." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.AnchorExamples.unlisted_anchor_refused" +lean_statement_sha256 = "e41f0eff130fb5715f5c311de6b12774c528a8b861a37ef96e30680c5c9db4ef" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::StatusScopeAnchors}::contains"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7468,37 +29423,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7511,19 +29649,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7533,17 +29718,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAnchorExamples.lean" +sha256 = "c80653b369c43a745400e795307ea5b29c88808818b0b0b871e54c5ee1960106" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-112" -claim_text = "Lean proves the rich authority property: budget algebra equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.budget_algebra_equality" -lean_statement_sha256 = "856f719d1d4fe6a2b19dab9c3bcfd40873e74a55abaf10f945308fbb05b95652" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-660" +claim_text = "The actual principal port admits active status through its issuer own anchor and hides that same evidence from a different anchor, with the displayed exact horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.AnchorExamples.own_anchor_active" +lean_statement_sha256 = "1b59d80eab48bcfa7de81f82e35b03b93f72108c9e6578897f25e5e795f64a73" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7551,37 +29746,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7594,19 +29972,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7616,17 +30041,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAnchorExamples.lean" +sha256 = "c80653b369c43a745400e795307ea5b29c88808818b0b0b871e54c5ee1960106" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-113" -claim_text = "Lean proves the rich authority property: optional budget bounded parent." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.optional_budget_bounded_parent" -lean_statement_sha256 = "35b7c28a001e2386a652f5e174baa301a265a3eadd74a8c68c3b43d6d0cde025" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-661" +claim_text = "The actual principal port admits active status through its issuer own anchor and hides that same evidence from a different anchor, with the displayed exact horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.AnchorExamples.other_anchor_hidden" +lean_statement_sha256 = "f34f4c85bf333f77d6a3113bec6a98edace3748a632dd2ee632ebbf39f277582" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7634,37 +30069,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7677,19 +30295,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7699,16 +30364,26 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusAnchorExamples.lean" +sha256 = "c80653b369c43a745400e795307ea5b29c88808818b0b0b871e54c5ee1960106" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-114" -claim_text = "Lean proves the rich authority property: optional budget no request." +claim_id = "AP-FORMAL-RICH-649" +claim_text = "For every finite input, subject equality operation, view and policy, the operational accumulator equals the independent filter/max/tie-set status specification, including the complete decision and horizon." claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.optional_budget_no_request" -lean_statement_sha256 = "b661893af19ee64775f156871b07d71fd53478d22876735146530e3d0d624299" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.StatusSelection.Algebra.evaluateScan_eq_evaluate" +lean_statement_sha256 = "85e197820235acb38137235e8f1f9fbb88f13ff37884d1dbfda5251626f474fc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -7717,37 +30392,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7760,38 +30618,82 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure semantic equivalence without an input-validity or desired-result premise. The proof uses attained maxima, complete tie sets, associative record combination and exact minimum horizons. This module imports no generated Rust. Native source binding is earned only by separately audited port statements; anchor-view source correspondence, evidence authenticity and full E2/M6 remain open." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusIndependent.lean" +sha256 = "db687b8bfdb673f6b116130dc0c3a8d646362e779d6885d0f1b821f9d93e813c" [[claims]] -claim_id = "AP-FORMAL-RICH-115" -claim_text = "Lean proves the rich authority property: delegation depth strictness." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.delegation_depth_strictness" -lean_statement_sha256 = "7c203a21398399f9e247a106c21958e147051c105775efb5696c6103d3fcef53" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-650" +claim_text = "The actual principal approval-view port terminates and returns the exact independent filter/max/tie-set decision and horizon, without a source-success premise." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.principal_method_approver_independent" +lean_statement_sha256 = "727bbb48ea70e1a6602d0b03b70a5c500603668b402571ce66cd769ed5b97ed1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7799,37 +30701,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7842,19 +30927,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input and policy in the approval view. The independent model filters candidates, exact methods and trusted issuers, refuses any rollback, and uses the complete maximum-sequence tie set. Its kernel-checked operational equivalence has no validity or desired-result premise. Anchor-view source refinement, evidence authentication, registry dispatch and complete verifier/runtime consumption remain open." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7864,17 +30996,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusSemantics.lean" +sha256 = "3241f4d6eb65d3f5cd3717514aee14cdcb621a3bb0e2d8b5925d9bd8c3e66ed4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-116" -claim_text = "Lean proves the rich authority property: status age direction." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.status_age_direction" -lean_statement_sha256 = "bcd2dc8a61a687aa05525983f0a82d8eb2c30f82bd8714e98f4538219ffa4018" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-651" +claim_text = "The actual grant approval-view port terminates and returns the exact independent filter/max/tie-set decision and horizon, without a source-success premise." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.grant_method_approver_independent" +lean_statement_sha256 = "747f03dd643ed1dc312e24a07170e07b0da9a81d793427663e3f94b404317cb7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7882,37 +31024,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -7925,19 +31250,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input and policy in the approval view. The independent model filters candidates, exact methods and trusted issuers, refuses any rollback, and uses the complete maximum-sequence tie set. Its kernel-checked operational equivalence has no validity or desired-result premise. Anchor-view source refinement, evidence authentication, registry dispatch and complete verifier/runtime consumption remain open." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -7947,17 +31319,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusSemantics.lean" +sha256 = "3241f4d6eb65d3f5cd3717514aee14cdcb621a3bb0e2d8b5925d9bd8c3e66ed4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-117" -claim_text = "Lean proves the rich authority property: status method equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.status_method_equality" -lean_statement_sha256 = "65eb51069ff53dc4a198806e1fd34df0d06c718b805fe98af2c9ce6b81818c8f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-625" +claim_text = "The actual first-rule scan terminates and returns the independent first exact method/issuer rule sequence floor." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.sequence_floor_refines" +lean_statement_sha256 = "c629bf2ee042cb4673b443f6d343be2cc376023a5199446b55d047cd6bedf3d4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::status_sequence_floor"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -7965,37 +31347,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8008,19 +31573,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -8030,17 +31642,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusFloor.lean" +sha256 = "437094c24d82563b068f823a42f900b4801b1196a0e4f649617ec33a2373d324" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-118" -claim_text = "Lean proves the rich authority property: assurance equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.assurance_equality" -lean_statement_sha256 = "682a5d15cb1ed38aafddcb2a5e0e987609428320b263e5bbae4cbea456d9d8ca" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-626" +claim_text = "The actual approval-view visibility scan terminates and agrees with every matching issuer rule having universal scope." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.approver_visibility_refines" +lean_statement_sha256 = "44e1ea02579d2f6cc5ee72b4c66af308367cc9c2b23821cf9d4bd22236c7f560" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::status_issuer_visible"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8048,37 +31670,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8091,19 +31896,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -8113,17 +31965,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusVisibility.lean" +sha256 = "115a960891dba4d7d8a5f8dbfee557a4c9e1fbde88d8559f10f1a37c0d140bcd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-163" -claim_text = "Lean kills the mutation that accepts a child critical extension without applying its identifier's law." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.critical_extension_law" -lean_statement_sha256 = "23f565b7d27ba7241114c8362d3604ec74ed08a4e05b82d5a97dce2500c87970" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-627" +claim_text = "The actual snapshot-required freshness helper returns Active iff observation ordering, inclusive expiry and maximum age hold." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.freshness_exact" +lean_statement_sha256 = "d26c284cff52d375b0b47485c7f8171d3de67572e2eb668c7541c178d420a534" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{auths_registries::ExactStatusMethod}::freshness"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8131,37 +31993,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8174,39 +32219,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusLeaves.lean" +sha256 = "9d85d39bbd7d5157eb7538fa1d1ba3cbe50ca42d47a5443eb7a7a480c4396cc0" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-138" -claim_text = "Lean proves the rich authority property: critical extensions reversed not sorted." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.critical_extensions_reversed_not_sorted" -lean_statement_sha256 = "1ac76c3db510279b30c76d84b5538b47ad6c5f46fd2e3ae71a45976fea3131dc" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-628" +claim_text = "The actual principal status loop terminates and preserves every field of the implementation-facing approval-view accumulator." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.principal_loop_refines" +lean_statement_sha256 = "5e7b37917ce9d456f15feb2c3779dc68aedd487a5ff07f22b8d87e726258c2fa" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::select_principal_from_snapshot"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8214,37 +32315,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8257,35 +32541,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusSelection.lean" +sha256 = "81ea075990fa59a5fa4e5c6d9f0463568179eaaee94234287ecad344db26caf5" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-119" -claim_text = "Lean proves the rich authority property: profile version equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.profile_version_equality" -lean_statement_sha256 = "d061c3229df6d475f2f0dfc7a492dc1dce9c34555a20bd03b530e579a1b34d72" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-629" +claim_text = "The actual principal selector agrees with the implementation-facing approval-view scan, including all policy/header/result fields." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.principal_selector_approver_refines" +lean_statement_sha256 = "c7f40fa9db98d6f206d52e0ef4829955260fc08350eb0a08e6a00f41fbc5e930" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::select_principal_from_snapshot"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8293,37 +32638,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8336,19 +32864,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -8358,17 +32933,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusPublic.lean" +sha256 = "5845251a75185b05ba14a0256b90df3b6f9b8ce28ba04a1f2ad6fe8fbbd9ba4a" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-120" -claim_text = "Lean proves the rich authority property: principal linkage equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.principal_linkage_equality" -lean_statement_sha256 = "399766c14541a0cf9533a13cbb97e40432b86f182ea9b99bfc835aa86556998d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-630" +claim_text = "The shipping principal port method returns the exact typed approval-view scan result without a caller-supplied desired result." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.principal_method_approver_refines" +lean_statement_sha256 = "d65da938cc913481144336236eccbd3b155a47c709909c1d24753bec9d9f52d4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8376,37 +32961,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8419,19 +33187,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -8441,17 +33256,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusPublic.lean" +sha256 = "5845251a75185b05ba14a0256b90df3b6f9b8ce28ba04a1f2ad6fe8fbbd9ba4a" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-121" -claim_text = "Lean proves the rich authority property: grant linkage equality." -claim_status = "proved" -lean_declaration = "Auths.Rich.Mutations.grant_linkage_equality" -lean_statement_sha256 = "78a60f2b43f1db4ae1ea88249aa8edab996999d314cc0d09a55151ae5170fb0c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-631" +claim_text = "The actual grant status loop terminates and preserves every field of the implementation-facing approval-view accumulator." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.grant_loop_refines" +lean_statement_sha256 = "46adbad3f21adab7001c48de1517cd29d37d2c3a843e09f044b16abe0a6d9d62" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::select_grant_from_snapshot"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8459,37 +33284,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8502,19 +33510,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -8524,17 +33579,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Mutations.lean" -sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" +artifact = "formal/Auths/Verifier/StatusGrant.lean" +sha256 = "54ca1ee151313b7eb72bf2c2982d8749c86ec987799e2cdac20bf3c9a483d55a" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-053" -claim_text = "Lean proves the rich authority property: coverage diagnostic sound complete." -claim_status = "proved" -lean_declaration = "Auths.Rich.coverage_diagnostic_sound_complete" -lean_statement_sha256 = "77658775391d0d2d6b38529f58c690b9aa08a5146284dbb022765523106519e5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-632" +claim_text = "The actual grant selector agrees with the implementation-facing approval-view scan, including all policy/header/result fields." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.grant_selector_approver_refines" +lean_statement_sha256 = "9faeff3a13349e6b40b3445565c89dd9aa62ef9b89988afb048b7e9e01e5b03e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::select_grant_from_snapshot"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8542,37 +33607,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8585,57 +33833,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Theorems.lean" -sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" +artifact = "formal/Auths/Verifier/StatusGrant.lean" +sha256 = "54ca1ee151313b7eb72bf2c2982d8749c86ec987799e2cdac20bf3c9a483d55a" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-054" -claim_text = "The mechanically translated production author-scope evaluator returns exactly the rich target-V1 decision and first failing authority dimension." +claim_id = "AP-FORMAL-RICH-633" +claim_text = "The shipping grant port method returns the exact typed approval-view scan result without a caller-supplied desired result." claim_status = "qualified" -lean_declaration = "Auths.Refinement.translated_rust_refines_rich_spec" -lean_statement_sha256 = "195ddcaa796803794574579d593c5a78f7fbd9611d32492de2a095e044fe2ca8" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_authority::evaluate_author_scope_view", - "auths_model::profile_ref_equal", - "auths_model::permission_set_is_subset", - "auths_model::validity_window_contains", - "auths_model::audience_set_is_subset", - "auths_model::action_constraint_attenuates", - "auths_model::optional_budget_attenuates", - "auths_model::status_policy_attenuates", - "auths_model::assurance_policy_id_equal", - "auths_authority::critical_extensions_attenuate", - "auths_authority::parent_extensions_retained", - "auths_authority::child_extensions_admitted", - "auths_authority::parent_extension_retained", - "auths_authority::child_extension_admitted", - "auths_model::critical_extension_entries", - "auths_model::critical_extension_find", - "auths_model::critical_extension_id", - "auths_model::critical_extension_payload", -] +lean_declaration = "Auths.StatusSelection.grant_method_approver_refines" +lean_statement_sha256 = "cf6277a17c5f35a1b96eef91051c06717b50421201d7cb26a3ac92c786d42f52" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8643,37 +33930,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8686,22 +34156,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The exact translated pre-signing scope evaluator over validated bounded views, including all ten scope/depth dimensions and ordered diagnostics, for every set of critical-extension laws." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises are trusted.", - "Canonical decoding and cryptographic authenticity precede this pure evaluator and are outside this theorem.", - "The critical-extension handler laws live in auths-registries, outside the translated kernel. The theorem holds for every law the translated handler-law instance computes without failing (premise LawsRefine); that each registered law is a narrowing preorder is proved separately over decoded payloads, and the byte-level handlers' agreement with those decoded laws rests on the canonical codec.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -8711,53 +34224,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" - -[[claims.evidence]] -kind = "lean-generated-vectors" -artifact = "core/formal-vectors/v1/rich-authority.json" -sha256 = "8f560ad3afa1ae5f0ef7dc5a8b77779e5da79c59d94d39bf2d2a005edac25a92" - -[[claims.evidence]] -kind = "mutation-matrix" -artifact = "formal/refinement-mutations-v1.json" -sha256 = "fa6aaad59e5628e4017f1bb69195d8bb83785121c295276ea4ab37d8f8771be4" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/StatusGrant.lean" +sha256 = "54ca1ee151313b7eb72bf2c2982d8749c86ec987799e2cdac20bf3c9a483d55a" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/authority/Funs.lean" -sha256 = "2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-055" -claim_text = "The mechanically translated terminal-coverage evaluator returns exactly the rich ordered decision for the supplied trusted budget-expression context." -claim_status = "qualified" -lean_declaration = "Auths.Refinement.translated_coverage_refines_rich_spec" -lean_statement_sha256 = "e8deba0035a09886221c46411be908f1ac8c30e0e3755ca956a62884a416a0fa" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_authority::evaluate_action_coverage_view", - "auths_authority::root_linkage", - "auths_authority::selected_profile_attenuates", - "auths_algebra_kernel::root_preserved", - "auths_model::principal_id_equal", - "auths_model::optional_grant_id_equal", - "auths_model::profile_ref_equal", - "auths_model::profile_slice_contains", - "auths_model::permission_set_contains", - "auths_model::validity_window_contains", - "auths_model::audience_set_contains", - "auths_model::action_constraint_allows", - "auths_model::budget_ceiling_covers_action", - "auths_model::optional_budget_covers", -] +claim_id = "AP-FORMAL-RICH-634" +claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds." +claim_status = "proved" +lean_declaration = "Auths.StatusSelection.byte_array_comparison" +lean_statement_sha256 = "09b413d428f68ba817fe2544b2e5c6fc7aa6a2c52b61423b2483b32152d666b9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8765,37 +34253,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8808,22 +34479,62 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The crate-private raw translated evaluator over validated authority/action views. The public EffectiveAuthority::authorizes boundary resolves budget expressibility from AcceptedRegistries and the exact action profile before calling it." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises are trusted.", - "The AcceptedRegistries lookup-to-kernel composition is enforced by the Rust public API and adversarial tests; the registry collection's provenance and canonical decoding are outside this translated raw-view theorem.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -8832,66 +34543,18 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" - -[[claims.evidence]] -kind = "lean-generated-vectors" -artifact = "core/formal-vectors/v1/rich-authority.json" -sha256 = "8f560ad3afa1ae5f0ef7dc5a8b77779e5da79c59d94d39bf2d2a005edac25a92" - -[[claims.evidence]] -kind = "mutation-matrix" -artifact = "formal/refinement-mutations-v1.json" -sha256 = "fa6aaad59e5628e4017f1bb69195d8bb83785121c295276ea4ab37d8f8771be4" - -[[claims.evidence]] -kind = "translated-rust" -artifact = "formal/qualification/aeneas/generated/authority/Funs.lean" -sha256 = "2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/StatusGrantLeaves.lean" +sha256 = "b364f56bc280bf7053363dba0fdfba9366b3a5ba1a342db73806fbd082b8874b" [[claims]] -claim_id = "AP-FORMAL-RICH-056" -claim_text = "The mechanically translated delegation evaluator returns exactly the rich linkage, eleven-dimension attenuation decision, diagnostic, and accepted transition." -claim_status = "qualified" -lean_declaration = "Auths.Refinement.translated_delegation_refines_rich_spec" -lean_statement_sha256 = "45782f85b6ded4714d9ca4e4b6a8ee2dc0e70c99395691101d834087a89c2fe1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_authority::evaluate_grant_view", - "auths_authority::root_linkage", - "auths_authority::depth_decreases", - "auths_authority::selected_profile_attenuates", - "auths_authority::extensions_attenuate", - "auths_algebra_kernel::root_preserved", - "auths_algebra_kernel::generated::attenuation_checks_accept", - "auths_model::principal_id_equal", - "auths_model::optional_grant_id_equal", - "auths_model::profile_ref_equal", - "auths_model::profile_slice_contains", - "auths_model::permission_set_is_subset", - "auths_model::validity_window_contains", - "auths_model::audience_set_is_subset", - "auths_model::action_constraint_attenuates", - "auths_model::optional_budget_attenuates", - "auths_model::status_policy_attenuates", - "auths_model::assurance_policy_id_equal", - "auths_authority::critical_extensions_attenuate", - "auths_authority::parent_extensions_retained", - "auths_authority::child_extensions_admitted", - "auths_authority::parent_extension_retained", - "auths_authority::child_extension_admitted", - "auths_model::critical_extension_entries", - "auths_model::critical_extension_find", - "auths_model::critical_extension_id", - "auths_model::critical_extension_payload", -] +claim_id = "AP-FORMAL-RICH-635" +claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds." +claim_status = "proved" +lean_declaration = "Auths.StatusSelection.native_floor_view" +lean_statement_sha256 = "279a5bee6065ced2fea87093bc73fc8a73d74821f686e65a0a632b71ca1906d2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -8899,37 +34562,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -8942,62 +34788,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The crate-private raw evaluator over validated parent/grant views, including root linkage, strict depth, every attenuation dimension, and the unique accepted transition, for every set of critical-extension laws." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises are trusted.", - "The critical-extension handler laws live in auths-registries, outside the translated kernel. The theorem holds for every law the translated handler-law instance computes without failing (premise LawsRefine); that each registered law is a narrowing preorder is proved separately over decoded payloads, and the byte-level handlers' agreement with those decoded laws rests on the canonical codec.", - "A present last-grant marker is representation data, not ancestry proof. Shipping Rust seals raw views; historical provenance is stated separately by Lean's AnchoredChain theorem from a fresh anchor through accepted transitions.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] - -[[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" - -[[claims.evidence]] -kind = "lean-generated-vectors" -artifact = "core/formal-vectors/v1/rich-authority.json" -sha256 = "8f560ad3afa1ae5f0ef7dc5a8b77779e5da79c59d94d39bf2d2a005edac25a92" - -[[claims.evidence]] -kind = "mutation-matrix" -artifact = "formal/refinement-mutations-v1.json" -sha256 = "fa6aaad59e5628e4017f1bb69195d8bb83785121c295276ea4ab37d8f8771be4" - -[[claims.evidence]] -kind = "translated-rust" -artifact = "formal/qualification/aeneas/generated/authority/Funs.lean" -sha256 = "2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7" +axioms = ["propext"] [[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/StatusFloor.lean" +sha256 = "437094c24d82563b068f823a42f900b4801b1196a0e4f649617ec33a2373d324" [[claims]] -claim_id = "AP-FORMAL-RICH-104" -claim_text = "The regenerated Aeneas translation of optional_budget_covers answers false for a present ceiling with an absent request, matching the shipping Rust. Lean records this positively: an action declaring no bound on what it may spend is exactly the authority a ceiling exists to deny. This replaces the former staleness claim, which recorded the opposite as checked evidence while the pinned translation was stale." +claim_id = "AP-FORMAL-RICH-636" +claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds." claim_status = "proved" -lean_declaration = "Auths.Refinement.translated_bounded_ceiling_denies_absent_request" -lean_statement_sha256 = "9c4ea11fa46f39a993ab4038263180284eca394df782a70259346c8167d7e4fc" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.StatusSelection.unknown_issuer_visible" +lean_statement_sha256 = "881a031ec709afa369f7bb286c8f8cd02e18c3ce3be5c989f20da2ac8220471d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -9006,37 +34867,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9049,38 +35093,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/StatusVisibility.lean" +sha256 = "115a960891dba4d7d8a5f8dbfee557a4c9e1fbde88d8559f10f1a37c0d140bcd" [[claims]] -claim_id = "AP-FORMAL-RICH-106" -claim_text = "Lean proves the rich authority property: translated expressible absent request is denied." +claim_id = "AP-FORMAL-RICH-637" +claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds." claim_status = "proved" -lean_declaration = "Auths.Refinement.translated_expressible_absent_request_is_denied" -lean_statement_sha256 = "90aa025faf3b73862f51432d5b07d0ef69c1bd67826d739083b6e42d65f00e4a" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "AuthsStatusSelection.lt_default_delegates" +lean_statement_sha256 = "fc44b60339ef3b465a4e401a6fc72bee7add86d93f7f101be4b3647cb4918371" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -9089,37 +35175,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9132,38 +35401,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] +axioms = [] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean" +sha256 = "ab31a23d08c92fa08a669eb9103b9a40aacb6b7e77adb13c4674f72e28851f6f" [[claims]] -claim_id = "AP-FORMAL-RICH-107" -claim_text = "Lean proves the rich authority property: translated inexpressible absent request is covered." +claim_id = "AP-FORMAL-RICH-638" +claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds." claim_status = "proved" -lean_declaration = "Auths.Refinement.translated_inexpressible_absent_request_is_covered" -lean_statement_sha256 = "294ac2be47b25a2f72d528f66b974cb3acc2dfd8a330a8c6696b8dad12fb8d97" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "AuthsStatusSelection.gt_default_delegates" +lean_statement_sha256 = "046cdd7f5a8b5827ba9b5a02ac339f23301388b03ebac3480063422353d8b8b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -9172,37 +35480,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9215,38 +35706,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] +axioms = [] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean" +sha256 = "ab31a23d08c92fa08a669eb9103b9a40aacb6b7e77adb13c4674f72e28851f6f" [[claims]] -claim_id = "AP-FORMAL-RICH-108" -claim_text = "Lean proves the rich authority property: translated absent ceiling covers anything." +claim_id = "AP-FORMAL-RICH-639" +claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds." claim_status = "proved" -lean_declaration = "Auths.Refinement.translated_absent_ceiling_covers_anything" -lean_statement_sha256 = "90df3548fb3d56bed30812c94acb18b2d6b0028f77aff11cd44aade8e2889961" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "AuthsStatusSelection.max_default_delegates" +lean_statement_sha256 = "5bf4b21a60e4b2c1de5abd185f6ef898688549feffca64a88e999e2d592f5df2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -9255,37 +35785,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9298,20 +36011,372 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean" +sha256 = "ab31a23d08c92fa08a669eb9103b9a40aacb6b7e77adb13c4674f72e28851f6f" + +[[claims]] +claim_id = "AP-FORMAL-RICH-640" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.active_selected_horizon" +lean_statement_sha256 = "192b89105749b72bac293677c8ff8c8ff94dd09fe05065817dbee00ac2b0ddc8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", "Classical.choice", @@ -9319,18 +36384,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Production.lean" -sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-057" -claim_text = "Lean proves the bounded product-policy property: configuration match refl." -claim_status = "proved" -lean_declaration = "Auths.Product.configuration_match_refl" -lean_statement_sha256 = "1d3b3a5ed6156f4e5616d877b35e9942f824f876e6db3aa3cd39729305a8ed4e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-641" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.revoked_selected_horizon" +lean_statement_sha256 = "9f98758daf5f82e01551eae46696ad8a90609bdd581633e06c49db370d831161" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9338,37 +36413,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9381,35 +36639,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Commitment.lean" -sha256 = "b94e57002d8b8c31906dab9e0f84c3ee38b01450f607f4fbb15ffffcb6a18221" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-058" -claim_text = "Lean proves the bounded product-policy property: configuration match deterministic." -claim_status = "proved" -lean_declaration = "Auths.Product.configuration_match_deterministic" -lean_statement_sha256 = "0b97aea7619fab2ffebd442c8d6376a02779d0e4c9673837e48f45c99488c8e0" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-642" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.stale_selected_refused" +lean_statement_sha256 = "1895ebdee73d11e88c7aad0bdb9ca901def5c1f0f28b159d989cdca07e6e38cd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9417,37 +36736,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9460,35 +36962,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Commitment.lean" -sha256 = "b94e57002d8b8c31906dab9e0f84c3ee38b01450f607f4fbb15ffffcb6a18221" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-059" -claim_text = "Lean proves the bounded product-policy property: checked add never wraps." -claim_status = "proved" -lean_declaration = "Auths.Product.checked_add_never_wraps" -lean_statement_sha256 = "f2e86c112c2021bab2444682e85973ad5b3f3de473bf5e093a47c65ebd74cf06" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-643" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.rollback_despite_newer" +lean_statement_sha256 = "ba85c61c869f7504b2608b05cc0d5a09ce215c15420c29eae2526b1807003021" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9496,37 +37059,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9539,35 +37285,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Arithmetic.lean" -sha256 = "6e08fc3a8b059f5e86807f25972a5f4f97cce4c6729344f75752b7e30d913c47" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-060" -claim_text = "Lean proves the bounded product-policy property: checked sub never underflows." -claim_status = "proved" -lean_declaration = "Auths.Product.checked_sub_never_underflows" -lean_statement_sha256 = "fc97e83a1f988edafe17d5d775cafb333138ff36e1ee3ac65609f48844129fa5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-644" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.newer_discards_old_stale_revocation" +lean_statement_sha256 = "3426ecbf0acf9e7e19ff6c4a2d0cab739a7effe6ac4cce335999f7167aedcc7e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9575,37 +37382,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9618,35 +37608,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Arithmetic.lean" -sha256 = "6e08fc3a8b059f5e86807f25972a5f4f97cce4c6729344f75752b7e30d913c47" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-061" -claim_text = "Lean proves the bounded product-policy property: checked div rejects zero." -claim_status = "proved" -lean_declaration = "Auths.Product.checked_div_rejects_zero" -lean_statement_sha256 = "004c9c8a21f3a6416181d4d561ae3dd38aebca10d640f288eb8af0e4bba34ba4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-645" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.latest_ties_conservatively_revoke" +lean_statement_sha256 = "d9cf81dcdca4e635caedc302148554b7707b7aa62112fc1a61a50f025256cd2e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9654,37 +37705,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9697,35 +37931,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Arithmetic.lean" -sha256 = "6e08fc3a8b059f5e86807f25972a5f4f97cce4c6729344f75752b7e30d913c47" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-062" -claim_text = "Lean proves the bounded product-policy property: three way partition." -claim_status = "proved" -lean_declaration = "Auths.Product.three_way_partition" -lean_statement_sha256 = "fa4bfacdd689bfe94265f7c2627598a8d758ae6ac3667bc6270f581219151e3e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-646" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.wrong_method_refused" +lean_statement_sha256 = "14e39d2be83eaa843702c94b5e67a790bdf6ed119e7287e8d248c92976cd4c8f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9733,37 +38028,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9776,35 +38254,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Eligibility.lean" -sha256 = "7dd0c6d987bc8684430f0bc2a7244c4965990a5278cc0d0dce0d63795e86d4f1" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-063" -claim_text = "Lean proves the bounded product-policy property: product contract configuration safety." -claim_status = "proved" -lean_declaration = "Auths.Product.product_contract_configuration_safety" -lean_statement_sha256 = "18957d267951e86ccae5c49b3b704e2e45d87c427d023f4e0a3684b895e461d5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-647" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.missing_uses_snapshot_window" +lean_statement_sha256 = "dcca6335ec63a3bc97133cb0da4df65e83b07b85acef2ff6ebdc5791ff28d21c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9812,37 +38351,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9855,35 +38577,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Theorems.lean" -sha256 = "7c05061876df3a8d71c86e7ea07cf9db89f9e1c1eb32ecf45899008c8fade154" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-064" -claim_text = "Lean proves the bounded product-policy property: product contract output completeness." -claim_status = "proved" -lean_declaration = "Auths.Product.product_contract_output_completeness" -lean_statement_sha256 = "b4fa5d97dd43b72133cc583f8834921ed1c968fde6ac3eb4f7c4b5ecc49f1c08" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-648" +claim_text = "The actual pure principal selector has the displayed exact accepted/refused decision and horizon." +claim_status = "qualified" +lean_declaration = "Auths.StatusSelection.Examples.unknown_issuer_refused" +lean_statement_sha256 = "fadcc4392284dad32033fbaa5a847c8e8888fc2a6b356b15bd4971c480501c04" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -9891,37 +38674,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -9934,117 +38900,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/Theorems.lean" -sha256 = "7c05061876df3a8d71c86e7ea07cf9db89f9e1c1eb32ecf45899008c8fade154" +artifact = "formal/Auths/Verifier/StatusExamples.lean" +sha256 = "6201d2503c31d09819012fe2657a5d2aa53d45d66edb1f5ff774d01b54999bfe" -[[claims]] -claim_id = "AP-FORMAL-RICH-065" -claim_text = "Lean proves the bounded product-policy property: translated configuration refines projection." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_configuration_refines_projection" -lean_statement_sha256 = "a988d91b2f65fea6451fdbe5ebc0b75ea7324b27c0b4031b1b49144eb15ef297" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/status_selection/Funs.lean" +sha256 = "4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb" [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-066" -claim_text = "Lean proves the bounded product-policy property: translated checked add refines nat." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_checked_add_refines_nat" -lean_statement_sha256 = "eed21c6bdc5e0ba56c0c8dd9249ee1d51053fa42b8df3958a762399ba0bf7ab5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-604" +claim_text = "The shipping status-horizon helper returns the exact inclusive deadline or StaleStatus refusal." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.status_horizon_exact" +lean_statement_sha256 = "3b2b496fac8add20400958414384214d5380ed0530325a9c1a56c5621930ab7f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10052,37 +38997,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10095,39 +39223,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalNative.lean" +sha256 = "f823c8a405672293e1a175c665420355802335c3d25594a7ebf35b0ee26094a3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-067" -claim_text = "Lean proves the bounded product-policy property: translated checked sub refines nat." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_checked_sub_refines_nat" -lean_statement_sha256 = "fed19d1701dac7a6f928957a78799fcf63eaf80d24ea0cbed66d77e490ed879c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-605" +claim_text = "The shipping status-horizon helper accepts exactly its supplied current inclusive horizon." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.status_horizon_accepts_iff" +lean_statement_sha256 = "a999096485f4740192c5e18cd74aa008738377bc7bd889f707e13b1c566fa08b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10135,37 +39319,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10178,39 +39545,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalNative.lean" +sha256 = "f823c8a405672293e1a175c665420355802335c3d25594a7ebf35b0ee26094a3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-068" -claim_text = "Lean proves the bounded product-policy property: translated checked mul refines nat." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_checked_mul_refines_nat" -lean_statement_sha256 = "f2e5d31dcc8e7f7651c0223bfdabccadc850be49cb8431aebf966aee9f7acc35" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-606" +claim_text = "The shipping status-horizon helper refuses a deadline before the supplied evaluation time." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.status_horizon_stale_refused" +lean_statement_sha256 = "ee1acb2b15be143942af8e33c109000831df4689881d3602ab25b63cb2b4f6f0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10218,37 +39641,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10261,39 +39867,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalNative.lean" +sha256 = "f823c8a405672293e1a175c665420355802335c3d25594a7ebf35b0ee26094a3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-069" -claim_text = "Lean proves the bounded product-policy property: translated checked div rejects zero." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_checked_div_rejects_zero" -lean_statement_sha256 = "cb30a894abfc0b326ba704c9d0979adb434cb7fc94f0134e14442c313e8670fb" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-607" +claim_text = "The shipping status-decision helper admits exactly Active." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.status_decision_accepts_iff" +lean_statement_sha256 = "96cf4816390fe540e63d59496b695dded99385737b16c04f79cc15430fc5ae2e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_decision"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10301,37 +39963,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10344,39 +40189,92 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalNative.lean" +sha256 = "f823c8a405672293e1a175c665420355802335c3d25594a7ebf35b0ee26094a3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-262" -claim_text = "The mechanically translated window index returns exactly the natural-number quotient of the time by the window length, and none for a zero-length window." +claim_id = "AP-FORMAL-RICH-608" +claim_text = "Every shipping status decision preserves the independent complete principal/grant result and stable failure class." claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.translated_window_index_refines_nat" -lean_statement_sha256 = "2d4076b355c9fd4faad8b9663b8a68e1c49f619da2cf11c74e9bdb30f7d480da" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_bounded_policy::kernel::window_index"] +lean_declaration = "Auths.TemporalWitness.Status.decision_refines" +lean_statement_sha256 = "382bb6a6c5cea652520bd15f31b38e0fb63b9054699fa57d6c5df3180bb9f1f6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_decision"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10384,37 +40282,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10427,52 +40508,92 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of u64 time and window length." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "Reading the gateway clock and choosing the window length from the policy are outside this theorem; the clock is unauthenticated and assumed.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] +axioms = [] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalStatus.lean" +sha256 = "5ffc48f83a2ac3f628ad6c73ee24913364e592bb9939096cda6b586091edaf02" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" -sha256 = "ba7aea214063b8a698fbd2c9c8cd95a717bf0ec0eaef70a92844444bf7e9f22e" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-263" -claim_text = "The mechanically translated digest comparison returns exactly the equality of the digests' byte values." +claim_id = "AP-FORMAL-RICH-609" +claim_text = "The actual assurance-horizon loop terminates and refines the independent selected-expiry model." claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model" -lean_statement_sha256 = "d8411964df44b9e93b4d097961e55e60bef00a8ef71c89d7b3bec08963599b85" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::bounded_policy::digest_equal"] +lean_declaration = "Auths.TemporalWitness.assurance_loop_refines" +lean_statement_sha256 = "589950e2a6d056faecda5d2b7939c08c3076b086f1ef9e8205d0752eb9c70063" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::assurance_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10480,37 +40601,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10523,21 +40827,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of 32-byte digests." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, and the listed foundational axioms are trusted; the theorem has no premise.", - "Decoding the bounded-policy extension, computing the digest of the parent's extension bytes, and the verifier's stage orchestration are outside this theorem.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -10547,31 +40895,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/BoundedPolicy.lean" -sha256 = "a6914db63c0b7ed3efc94b19e312ceb3718cb181968ebbedfafb9e060c207de5" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalAssurance.lean" +sha256 = "b5ea7f65c3fcc7fb9b686d1fa3311cc46ad3aadf3defaccf0b34b1ef4d2ec397" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-264" -claim_text = "The mechanically translated parent-link check returns exactly the model's link rule: a kept extension links exactly its parent's extension digest, and an added one carries no link." +claim_id = "AP-FORMAL-RICH-610" +claim_text = "The shipping assurance-horizon helper returns exactly the independent selected-expiry result from the maximum word bound." claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model" -lean_statement_sha256 = "7c7c5aec926901e72f22a2b9c4b1c6c4bb833c010440f657fcb79d7e827144d7" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::bounded_policy::bounded_policy_link_accepts", - "auths_model::bounded_policy::digest_equal", -] +lean_declaration = "Auths.TemporalWitness.assurance_entry_refines" +lean_statement_sha256 = "15a14f3caf3f3a8364d074aea2cc2b2f14b436c14c90257ab1721da3f82fa389" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::assurance_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10579,37 +40924,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10622,21 +41150,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every optional child link and optional parent digest." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, and the listed foundational axioms are trusted; the theorem has no premise.", - "Decoding the bounded-policy extension, computing the digest of the parent's extension bytes, and the verifier's stage orchestration are outside this theorem.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -10646,28 +41218,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/BoundedPolicy.lean" -sha256 = "a6914db63c0b7ed3efc94b19e312ceb3718cb181968ebbedfafb9e060c207de5" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalAssurance.lean" +sha256 = "b5ea7f65c3fcc7fb9b686d1fa3311cc46ad3aadf3defaccf0b34b1ef4d2ec397" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-186" -claim_text = "Lean proves the translated argument-ceiling evaluation leaf computes exactly the model decision." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_ceiling_count_refines_model" -lean_statement_sha256 = "ada2be3af3def88e58de1ff9aef4485651996241a5c2a0f8ce0dd50d27728b1e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-611" +claim_text = "A successful shipping assurance-horizon result is the exact independent selected-expiry result." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.successful_native_horizon_exact" +lean_statement_sha256 = "1036c1c48e38871f4d3f80d51de1983979441f33ba58c195d72ae0e3d5ffd801" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::assurance_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10675,37 +41247,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10718,38 +41473,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The Aeneas-translated argument-ceiling window-count leaves of auths-bounded-policy, under the pinned translation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalConsequences.lean" +sha256 = "ee9b96ed62806de95ae527a89f5f622c95f3278cfa3e97b927673573adad8216" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-187" -claim_text = "Lean proves the translated argument-ceiling tightening leaf computes exactly the model decider." -claim_status = "proved" -lean_declaration = "Auths.Product.Refinement.translated_ceiling_count_tightens_refines_model" -lean_statement_sha256 = "9477f8ea177a765c5ac61d23ce7032ca8156309063f5963bad218c829d08981c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-612" +claim_text = "A successful shipping assurance horizon admits exactly the maximum word bound and every selected expiry." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.native_horizon_permits_iff" +lean_statement_sha256 = "3646a36fb8023b17ecfd73a138d3360faf7ba97e20ade985571cf0add4803f86" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::assurance_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10757,37 +41570,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10800,38 +41796,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The Aeneas-translated argument-ceiling window-count leaves of auths-bounded-policy, under the pinned translation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalConsequences.lean" +sha256 = "ee9b96ed62806de95ae527a89f5f622c95f3278cfa3e97b927673573adad8216" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-236" -claim_text = "The mechanically translated count leaf returns exactly the model's count part of chain admission: every distinct counter of the fixed window below its capacity." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.translated_chain_counts_admit_refines_model" -lean_statement_sha256 = "f71baa54d41b494f3c2a69f250c2183339389bbe1d5d94fd64d8b5ed9afb7d67" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_bounded_policy::kernel::chain_counts_admit"] +claim_id = "AP-FORMAL-RICH-613" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "Auths.TemporalWitness.assurance_permits_iff" +lean_statement_sha256 = "c8616187666285b955e38aaa8713a5bd65db4f2a873007510045f841fea64c07" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10839,37 +41893,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10882,52 +42119,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of u64 slices of counter values and capacities, including slices of different lengths." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" -sha256 = "ba7aea214063b8a698fbd2c9c8cd95a717bf0ec0eaef70a92844444bf7e9f22e" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalProperties.lean" +sha256 = "8549e9a55b4087ba3cf235721eb4475e297ed50d39dd1ed70830291fffd12d4e" [[claims]] -claim_id = "AP-FORMAL-RICH-237" -claim_text = "The mechanically translated sum leaf returns exactly the model's sum part of chain admission: every distinct running sum of the fixed window plus the argument within its capacity, with an overflowing addition refused." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.translated_chain_sums_admit_refines_model" -lean_statement_sha256 = "c75fcec112558e4eca8125e5996cd4dea6d1e2a76cd45bf1b1accbf1c0dfc5ee" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_bounded_policy::kernel::chain_sums_admit"] +claim_id = "AP-FORMAL-RICH-614" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "Auths.TemporalWitness.successful_horizon_bounded" +lean_statement_sha256 = "42c73b83b06a995862c7a655fbd98484634253eedf0269082a417da3fd1d7492" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -10935,37 +42201,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -10978,55 +42427,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every u64 argument and pair of u64 slices of running sums and capacities, including slices of different lengths." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" -sha256 = "ba7aea214063b8a698fbd2c9c8cd95a717bf0ec0eaef70a92844444bf7e9f22e" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalProperties.lean" +sha256 = "8549e9a55b4087ba3cf235721eb4475e297ed50d39dd1ed70830291fffd12d4e" [[claims]] -claim_id = "AP-FORMAL-RICH-238" -claim_text = "The mechanically translated tightening decider of policy /2 returns exactly the model's decider: the same argument, the unchanged ceiling and count rule, and the sum, partition, and scope rules." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.translated_argument_policy_tightens_refines_model" -lean_statement_sha256 = "f20279e5c8f3b5e9d3f9e56408c91d6f0151b2106434969f9890a5ef5389c337" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_bounded_policy::kernel::argument_policy_tightens", - "auths_bounded_policy::kernel::ceiling_count_tightens", -] +claim_id = "AP-FORMAL-RICH-615" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "AuthsTemporalWitness.lt_default_delegates" +lean_statement_sha256 = "1cfd24d920f1ab1274efe33a4a4b8c61220ee1f38d5983012c35314cb5c0b775" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11034,37 +42509,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11077,52 +42735,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of policy members: argument names, ceilings, windows, counts, optional sums with optional partitions, and optional scopes with value lists of any length." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "Decoding the canonical policy bytes and projecting them onto the decider's members is outside this theorem; it is covered by the policy codec tests and the bounds fixtures.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] - -[[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement.lean" -sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" -sha256 = "ba7aea214063b8a698fbd2c9c8cd95a717bf0ec0eaef70a92844444bf7e9f22e" +axioms = [] [[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean" +sha256 = "7a089e9c112c58d531dc092d78e2a09d15e81466ef38ef46731102b426d8d4f8" [[claims]] -claim_id = "AP-FORMAL-RICH-175" -claim_text = "Lean proves the argument-ceiling evaluation is eligible exactly when the value is within the ceiling and the fixed window's counter has room." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.code_eligible_iff" -lean_statement_sha256 = "ca2f3dfef380a22f6280465f8320e1aca773e3ca0290cc38f7babe12f6642e63" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-616" +claim_text = "The shipping temporal helper has the displayed exact admitted or refused boundary witness." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.Examples.inclusive_status_endpoint" +lean_statement_sha256 = "4ab87a7c6483432d1fe3ff86a1a73f1fa422b08a26be16909eaae03a713f24ab" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11130,37 +42814,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11173,35 +43040,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-176" -claim_text = "Lean proves the argument-ceiling tightening decider of policy /2 decides exactly semantic tightening, including the sum, partition, and scope rules." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.decider_iff_tightens" -lean_statement_sha256 = "ae8a39a1e41e905d9464cc4dad8638cf1047017ff0ad58d77cceba6498a1a2a3" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-617" +claim_text = "The shipping temporal helper has the displayed exact admitted or refused boundary witness." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.Examples.expired_status_refused" +lean_statement_sha256 = "c3d64ce2364c76bf383c596135e27afa525420c6078dce5085a8696407d075f7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_horizon"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11209,37 +43137,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11252,38 +43363,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-177" -claim_text = "Lean proves a tighter argument-ceiling policy never admits a context its parent refuses." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.tightening_never_admits_more" -lean_statement_sha256 = "fbdda26118f2596fdad003444f236e79a1bf12754a1a6beb0d61e30dd66e6287" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-618" +claim_text = "The shipping temporal helper has the displayed exact admitted or refused boundary witness." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.Examples.revoked_principal_refused" +lean_statement_sha256 = "6b0fa86a449f8516978417cbc4628ce81a485457e79b26916fab8554fe346c10" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_decision"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11291,37 +43460,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11334,39 +43686,92 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-178" -claim_text = "Lean proves the argument-ceiling tightening decider is sound: a child it accepts admits only contexts its parent admits." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.decider_sound" -lean_statement_sha256 = "9be80ea95233697c96ff6a9b5dce9aca5f84988261dcb57119c5e7bf0b7af0e8" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-619" +claim_text = "The shipping temporal helper has the displayed exact admitted or refused boundary witness." +claim_status = "qualified" +lean_declaration = "Auths.TemporalWitness.Examples.revoked_grant_refused" +lean_statement_sha256 = "ed9354d0bd701f5d481aa3915eb081b3688a334b7f43eff2b89bf61c402b6561" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_verifier::status_decision"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11374,37 +43779,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11417,38 +44005,91 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", ] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/temporal_witness/Funs.lean" +sha256 = "05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-179" -claim_text = "Lean proves a smaller argument ceiling never authorizes more." +claim_id = "AP-FORMAL-RICH-620" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.smaller_ceiling_never_authorizes_more" -lean_statement_sha256 = "9e56daaf4f09d2a01150daf784d6584c590f59545639139ae91bfa6be4025690" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.TemporalWitness.Examples.selected_expiry_admitted" +lean_statement_sha256 = "a5e9fe84dbdba3b8822ac8acbb6cfdec40267136bd89a0648c9b664109142f1f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -11457,37 +44098,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11500,20 +44324,1592 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims]] +claim_id = "AP-FORMAL-RICH-621" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "Auths.TemporalWitness.Examples.missing_requirement_refused" +lean_statement_sha256 = "e36a8ad4954b8221d74a8b6afc19f4e9d4fcab775d61cd09445d3b895c26afb8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims]] +claim_id = "AP-FORMAL-RICH-622" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "Auths.TemporalWitness.Examples.missing_observation_refused" +lean_statement_sha256 = "8eef69598b49fbfc49951b2720acb6664ad70a58fdee93b682890d8573412b47" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims]] +claim_id = "AP-FORMAL-RICH-623" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "Auths.TemporalWitness.Examples.unbounded_requirement_needs_no_observation" +lean_statement_sha256 = "fa7d12e0197c48144bd16b35bf38caef791764571b251b445395f8ddc5660af0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims]] +claim_id = "AP-FORMAL-RICH-624" +claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness." +claim_status = "proved" +lean_declaration = "Auths.TemporalWitness.Examples.overflowing_expiry_saturates" +lean_statement_sha256 = "82e5d1e6c4cf99b22407b15aa11f2d11a783ccfb4c20c5944c396dc1d01b5c66" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Verifier/TemporalExamples.lean" +sha256 = "b7e03fb1f621a1df5a337608365d9f4e9e27b9c65fd37cd2cf2d24bbc85076cd" + +[[claims]] +claim_id = "AP-FORMAL-RICH-590" +claim_text = "The actual Ed25519 suite adapter forwards exact input fields to the qualified owning API and preserves the independent complete result." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapters.ed_public_refines" +lean_statement_sha256 = "cd04c053040166dceb2411e51ada67b8f4fedb317f03308b7af2f8af31957cd0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented suite instance and SignatureInput under the displayed primitive contracts. Key, complete signing preimage and signature are projected from the exact named input fields; all three core refusal classes map to the correct port errors. Self.id is not inspected by this method; constructor validity, installed suite identity and registry selection are separate obligations." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", "Classical.choice", @@ -11522,17 +45918,184455 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +artifact = "formal/Auths/Crypto/SuiteAdapters.lean" +sha256 = "f8925cbf7a3d60cbf1990b1a3a28c3ea370724cb1c107bfd74eb7c644357465c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-180" -claim_text = "Lean proves a smaller count per fixed window never authorizes more." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.smaller_count_never_authorizes_more" -lean_statement_sha256 = "ddcd9f8d9141338018e9fb5a68fca37b7e157619f0ca917c0550cef5c8a828a6" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-591" +claim_text = "The actual Ed25519 suite adapter accepts iff the independent accepted-input relation holds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapters.ed_accepts_iff" +lean_statement_sha256 = "6ca3d7bcc07bc1e2b6789df18d3b67620eb8008767a2f5873303ecd2b2b4b3b0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented suite/input under the displayed primitive contracts. This composes source field projection and exact error conversion with the mechanically translated owning public API. No opaque Auths algorithm or desired suite result is a premise. Constructor and registry-selection validity, principal binding, caller preimage construction and whole E5 remain separate." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapters.lean" +sha256 = "f8925cbf7a3d60cbf1990b1a3a28c3ea370724cb1c107bfd74eb7c644357465c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-592" +claim_text = "The actual Ed25519 adapter retains the concrete exact fields on a useful admitted path." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted" +lean_statement_sha256 = "17303847ca606f3527c9529e6d60dec86cb227b8f5c776317454e44486716911" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapterExamples.lean" +sha256 = "26607dbf7c789384ab32050b12b8bbf0d7c245afbf77b9e8d69a6bf7f8195eec" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-593" +claim_text = "The actual Ed25519 adapter refuses the displayed changed signing preimage with the correct port error." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused" +lean_statement_sha256 = "a6738b487467a8611729fb7114ef920ca832b6bdf8bc9f2e99f81358ec194cfd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapterExamples.lean" +sha256 = "26607dbf7c789384ab32050b12b8bbf0d7c245afbf77b9e8d69a6bf7f8195eec" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-594" +claim_text = "The actual P-256/SHA-256 suite adapter forwards exact input fields to the qualified owning API and preserves the independent complete result." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapters.p256_public_refines" +lean_statement_sha256 = "19dd049411130c6c304d5cf40c130d5cf22e2d3ea0c0efed9d6d156b0b3d4924" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented suite instance and SignatureInput under the displayed primitive contracts. Key, complete signing preimage and signature are projected from the exact named input fields; all three core refusal classes map to the correct port errors. Self.id is not inspected by this method; constructor validity, installed suite identity and registry selection are separate obligations." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapters.lean" +sha256 = "f8925cbf7a3d60cbf1990b1a3a28c3ea370724cb1c107bfd74eb7c644357465c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-595" +claim_text = "The actual P-256/SHA-256 suite adapter accepts iff the independent accepted-input relation holds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapters.p256_accepts_iff" +lean_statement_sha256 = "c7e9712f6ca7e489cdff0f3171d20f7afc9b1c838e321b28f16335e787544076" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented suite/input under the displayed primitive contracts. This composes source field projection and exact error conversion with the mechanically translated owning public API. No opaque Auths algorithm or desired suite result is a premise. Constructor and registry-selection validity, principal binding, caller preimage construction and whole E5 remain separate." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapters.lean" +sha256 = "f8925cbf7a3d60cbf1990b1a3a28c3ea370724cb1c107bfd74eb7c644357465c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-596" +claim_text = "The actual P-256/SHA-256 adapter retains the concrete exact fields on a useful admitted path." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted" +lean_statement_sha256 = "53dd6111dc50a9124450f4e6ea3cc40febab4e71f08299760c6656a5be672fe4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapterExamples.lean" +sha256 = "26607dbf7c789384ab32050b12b8bbf0d7c245afbf77b9e8d69a6bf7f8195eec" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-597" +claim_text = "The actual P-256/SHA-256 adapter refuses the displayed changed signing preimage with the correct port error." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused" +lean_statement_sha256 = "cd099e49c67a7f11dc336c5d3ca645d583f7686096e5b4cc453a824e3d075918" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/SuiteAdapterExamples.lean" +sha256 = "26607dbf7c789384ab32050b12b8bbf0d7c245afbf77b9e8d69a6bf7f8195eec" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/suite_adapter/Funs.lean" +sha256 = "431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-598" +claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism." +claim_status = "proved" +lean_declaration = "AuthsSuiteAdapters.ed_error_to_from" +lean_statement_sha256 = "71e6d12fdb92ea11ce81efb720aa5dd711aff490cccbb42f9671f5a9c313c02a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +sha256 = "62a23024b0f5b1f991343494eb360394cc496fb27579f1fde8cda6a51b07b3bf" + +[[claims]] +claim_id = "AP-FORMAL-RICH-599" +claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism." +claim_status = "proved" +lean_declaration = "AuthsSuiteAdapters.ed_error_from_to" +lean_statement_sha256 = "cf88f37705785d6913d078a8bff9b71d136197a72e422960455fb8f974372279" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +sha256 = "62a23024b0f5b1f991343494eb360394cc496fb27579f1fde8cda6a51b07b3bf" + +[[claims]] +claim_id = "AP-FORMAL-RICH-600" +claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism." +claim_status = "proved" +lean_declaration = "AuthsSuiteAdapters.p256_error_to_from" +lean_statement_sha256 = "1f125de45e67153a3bd0dbc982d3c13a42640a3451d65991ef1a19509244de7a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +sha256 = "62a23024b0f5b1f991343494eb360394cc496fb27579f1fde8cda6a51b07b3bf" + +[[claims]] +claim_id = "AP-FORMAL-RICH-601" +claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism." +claim_status = "proved" +lean_declaration = "AuthsSuiteAdapters.p256_error_from_to" +lean_statement_sha256 = "057c9929f4dec93aafca0872223be2cf70639c77589e60e996f76c815c713411" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +sha256 = "62a23024b0f5b1f991343494eb360394cc496fb27579f1fde8cda6a51b07b3bf" + +[[claims]] +claim_id = "AP-FORMAL-RICH-602" +claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism." +claim_status = "proved" +lean_declaration = "AuthsSuiteAdapters.ed25519_delegates" +lean_statement_sha256 = "a71af918978d6243b1d11d44582a11817390f99d2c79f4b4d9c038ed57715678" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +sha256 = "62a23024b0f5b1f991343494eb360394cc496fb27579f1fde8cda6a51b07b3bf" + +[[claims]] +claim_id = "AP-FORMAL-RICH-603" +claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism." +claim_status = "proved" +lean_declaration = "AuthsSuiteAdapters.p256_delegates" +lean_statement_sha256 = "5d8a01eb2fe5d0482a32176b65dc9dcdefe8b69eb27d26c062d319bfb7efd2cb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +sha256 = "62a23024b0f5b1f991343494eb360394cc496fb27579f1fde8cda6a51b07b3bf" + +[[claims]] +claim_id = "AP-FORMAL-RICH-573" +claim_text = "The native P-256 unit enforces exactly the independent compressed key-form predicate." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Encoding.guard_refines" +lean_statement_sha256 = "17ddcf89c6650a92095e6b9678ffb08464673571919826870fb719f22ee47c3e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_key_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, with no cryptographic premise: length 33 and initial tag 2 or 3. Point recovery and curve validity remain separate foreign operations." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Encoding.lean" +sha256 = "e0b9c6c07d0eb2aba8dd216fde35d37bf099635c5b9aa0c97fee3e77b1db2a4f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-574" +claim_text = "The native P-256 scalar loop terminates and compares exactly the stated suffixes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256LowScan.loop_refines" +lean_statement_sha256 = "fbbbe59757064a6df3689e5c3e02bbb8629bd3723da4d95768d33cfb4c597bf2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every 64-byte array and index/remaining count summing to 32, including all array and arithmetic bounds. This is the source-linked monomorphic loop component." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256LowScan.lean" +sha256 = "e9c6103681640a6c88acf0b79b87e6a6b02b7e6e5ab78c1868a4499934790adc" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-575" +claim_text = "The native P-256 low-S guard returns exactly the independent secp256r1 half-order condition." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256LowContract.guard_refines" +lean_statement_sha256 = "8c3dbd16ca0720d345dbc7af27525d41fa976a0ce18fe9a728d177582fdc91ae" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every 64-byte form without a primitive contract. Numeric big-endian s is at most floor(n/2); scalar validity and the signature equation remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256LowContract.lean" +sha256 = "4358f505dbb1408323aa0be12e667848c149a82c98dfb258b6235c8c45d901d6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-576" +claim_text = "The native P-256 low-S decision is independent of the r bytes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256LowContract.r_bytes_irrelevant" +lean_statement_sha256 = "8b46316d63769117e5e5cc5d5fbbc53083b67e298ff0218af6dd4bce897deb8c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of 64-byte forms with identical final 32 bytes. This is source input noninterference, not signature validity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256LowContract.lean" +sha256 = "4358f505dbb1408323aa0be12e667848c149a82c98dfb258b6235c8c45d901d6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-577" +claim_text = "The actual native P-256 point adapter forwards exactly its input and preserves the specified decoder outcome." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.decode_leaf_refines" +lean_statement_sha256 = "a85dab5d87f9f296afcf6bedce2282729599247190f0130d113ee9593a0a5946" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::decode_p256_point"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key slice and explicit P256Primitives implementation satisfying the displayed three foreign functional contracts. No Auths key guard or desired suite result occurs in those contracts." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-578" +claim_text = "The actual native P-256 scalar adapter forwards the complete fixed-width signature bytes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.parse_leaf_refines" +lean_statement_sha256 = "9c0a8ffcbbe96611eb38a2a196c758ff51944ecbf2dfc707e3243ff5aa955798" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::parse_p256_signature"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented 64-byte array under the displayed foreign contracts. The exact byte list reaches the selected foreign from_slice operation and its returned parse outcome is preserved." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-579" +claim_text = "The actual native P-256 equation adapter binds the selected key, complete message and parsed signature." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.equation_leaf_refines" +lean_statement_sha256 = "47e9da0b33120a00e522b6920f15272f773fcea287f8e3a4d1a45a37eb1e227c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_equation"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every key/message/signature carrier of the explicit implementation under the displayed P-256/SHA-256 functional equation contract. No curve arithmetic or cryptographic security is proved." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-580" +claim_text = "The actual monomorphic P-256 key path refines compressed-form validation followed by the specified native decoder." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.decode_refines" +lean_statement_sha256 = "8d8daaf6d2244fc0c2b4b9132dca77c73d251b53049d23e775749dae29c142bc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::decode_p256_point", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key slice under explicit foreign contracts. The concrete form guard, exact decoder bytes, successful key and InvalidKey refusal precedence are fixed by the translated shipping source." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-581" +claim_text = "The public P-256/SHA-256 verification API refines the independent complete suite result and refusal precedence." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.public_verify_refines" +lean_statement_sha256 = "c0b16b46374dc00afef34647c459e906d0c4fd36fe058be16bae58e1cf4b63bf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::verify_p256_sha256", + "auths_signature_core::verify_p256_sha256_with", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key/message/signature slice and explicit implementation satisfying the named foreign decoder/parser/equation contracts. Covers the actual public wrapper, native adapters, compressed form, owned 64-byte copy, scalar parse, concrete numeric low-S guard and exact message. Primitive correctness, arithmetic, authenticity and dispatch remain outside this statement." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-582" +claim_text = "The actual public P-256 API accepts iff the independent P256Accepts relation holds under its explicit primitive contracts." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.public_accepts_iff" +lean_statement_sha256 = "5af76ae7145cbc4b82a5bc59dcc7f33868d1a3afb869d18ab2d48c6d28b30d39" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte input. The relation independently requires compressed form, decoded point, exactly 64 signature bytes, parsed scalar, numeric low-S and exact-message equation. Neither source success nor the complete desired suite result is assumed." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-583" +claim_text = "The public P-256 key-validation API returns exactly the independent key decision and stable error." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Native.public_validate_refines" +lean_statement_sha256 = "840f1bf48b601ac06d1e5a4ab02356cd4df8e0d6a052e1b862fad2cb8a963402" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::validate_p256_key", + "auths_signature_core::decode_p256_key", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key slice under the named foreign contracts. The shipping validator now projects its result with an explicit match; no unit callback, callback assumption or modeled Auths function is used." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Native.lean" +sha256 = "46ed1ce0a51297cf94583a48ef5a8fd2551b81409e727007e2ebb2c73491576d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-584" +claim_text = "The public native P-256 wrapper forwards the exact stated key, message and signature through an explicit mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Examples.public_call_forwards_exact_bytes" +lean_statement_sha256 = "f9e2d5637b42b3e036fb4529edf1e2057410b720fbd4d2120b5a421afc9637ac" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed forwardingPrimitive and byte forms. This is a useful inhabited-contract/call-binding witness, not a P-256 signature, curve membership or authenticity claim." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Examples.lean" +sha256 = "db49177ef5fd5fc84f0ce5812c3df647ab2f0acb512abd3173913483e0f44757" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-585" +claim_text = "The public P-256 wrapper refuses the displayed changed message through the explicit forwarding mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Examples.changed_message_is_refused" +lean_statement_sha256 = "da147f2d2a8b3bc93e2266836021157793c28180b49cb25f6341a4ac6a930cbb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed changed message and explicit mock. It checks message binding, not primitive correctness or authenticity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Examples.lean" +sha256 = "db49177ef5fd5fc84f0ce5812c3df647ab2f0acb512abd3173913483e0f44757" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-586" +claim_text = "The public P-256 wrapper refuses the displayed changed compressed-form key through the forwarding mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Examples.changed_key_is_refused" +lean_statement_sha256 = "a4523bdee5806c7e14d6eed04159b8233ef18893cbf981e235bd549a9d77d75c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed changed key and explicit mock. It checks that the decoded key reaches the equation, not curve validity." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Examples.lean" +sha256 = "db49177ef5fd5fc84f0ce5812c3df647ab2f0acb512abd3173913483e0f44757" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-587" +claim_text = "The public P-256 wrapper refuses the displayed changed signature bytes through the forwarding mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Examples.changed_signature_is_refused" +lean_statement_sha256 = "d656e534fc8ea4dbf178d6562d9164dcadbbae5c0b38f3b027389f6a8577d38d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed changed low-S form and explicit mock. It checks that the parser result and complete signature bytes are retained, not cryptographic security." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Examples.lean" +sha256 = "db49177ef5fd5fc84f0ce5812c3df647ab2f0acb512abd3173913483e0f44757" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-588" +claim_text = "The public P-256 wrapper refuses the empty key without a foreign primitive contract." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract" +lean_statement_sha256 = "d41bed17dc72563a8c6090b5bc00079394f9951f5731996b1322b7f26e122cf0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every supplied message/signature and arbitrary explicit primitive implementation, with the exact empty key. No foreign call correctness premise is required for this early source refusal." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Examples.lean" +sha256 = "db49177ef5fd5fc84f0ce5812c3df647ab2f0acb512abd3173913483e0f44757" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/p256/Funs.lean" +sha256 = "d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-589" +claim_text = "The explicitly supplied forwarding mock satisfies its stated call-binding contracts." +claim_status = "proved" +lean_declaration = "Auths.Crypto.P256Examples.forwarding_contract" +lean_statement_sha256 = "f8c062ab0a247dc73a7f24fc88292b4139c497748b7cfcf2b5bbcc271ab5a2cf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed mock implementation, decoder, signature representation and message/signature equality predicate. This is an inhabited-contract witness; it makes no claim that any cryptographic library is correct or that any signature is authentic." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/P256Examples.lean" +sha256 = "db49177ef5fd5fc84f0ce5812c3df647ab2f0acb512abd3173913483e0f44757" + +[[claims]] +claim_id = "AP-FORMAL-RICH-564" +claim_text = "The shipping identifier framer terminates on every represented input and classifies success versus typed LimitExceeded against independent numeric bounds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.identifier_total" +lean_statement_sha256 = "1fdd01e5e703dd52f9452e80d91073508d163ac431fd231fc9f75301af694b32" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All nine registered tags, every represented payload and actual 32/64-bit capacity bounds: eight-byte payload length and total frame length 20 plus payload fitting both unsigned and signed pointer-size limits." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-565" +claim_text = "The shipping identifier framer admits exactly the independent numeric domain; no deny-all implementation satisfies this equivalence." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.identifier_accepts_iff" +lean_statement_sha256 = "a175765bfbf242c575854b38188db5b78a01c932da8036037a71ef850b81f369" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All nine registered tags, every represented payload and actual 32/64-bit capacity bounds: eight-byte payload length and total frame length 20 plus payload fitting both unsigned and signed pointer-size limits." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-566" +claim_text = "The shipping identifier framer returns LimitExceeded exactly outside the independent numeric domain." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.identifier_refuses_iff" +lean_statement_sha256 = "dbe4e527fe56a0d653c25ea28a59a33c61c0852cde478581ace45e319d6e01eb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All nine registered tags, every represented payload and actual 32/64-bit capacity bounds: eight-byte payload length and total frame length 20 plus payload fitting both unsigned and signed pointer-size limits." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-567" +claim_text = "The shipping application framer terminates on every represented input and classifies success versus typed LimitExceeded against independent numeric bounds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.application_total" +lean_statement_sha256 = "196415cde99a5b257a978532fbcb154572555978f272d4b00c1811e2de17f8d9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented UTF-8 domain/payload: nonempty domain at most 128 bytes, eight-byte payload length and total frame length 28 plus domain/payload fitting unsigned and signed pointer-size limits." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-568" +claim_text = "The shipping application framer admits exactly the independent numeric domain; no deny-all implementation satisfies this equivalence." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.application_accepts_iff" +lean_statement_sha256 = "00b77711c6df0e23e31adcb5c26c03e61661aa8d2ed0cc3808d5f8b60f83924a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented UTF-8 domain/payload: nonempty domain at most 128 bytes, eight-byte payload length and total frame length 28 plus domain/payload fitting unsigned and signed pointer-size limits." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-569" +claim_text = "The shipping application framer returns LimitExceeded exactly outside the independent numeric domain." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.application_refuses_iff" +lean_statement_sha256 = "35c7261ab25ffe0ba652ce8435f9fec9852dc89ffe6715de5cfa2c48f354f1cc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented UTF-8 domain/payload: nonempty domain at most 128 bytes, eight-byte payload length and total frame length 28 plus domain/payload fitting unsigned and signed pointer-size limits." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-570" +claim_text = "The shipping signing framer terminates on every represented input and classifies success versus typed LimitExceeded against independent numeric bounds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.signing_total" +lean_statement_sha256 = "231542d84c053c27612c8d5c0144e16da484615610d2e4a761464c0e1677cea7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All six signing tags, every profile/version/payload: two-byte profile length, eight-byte payload length and total frame length 21 plus profile/payload fitting unsigned and signed pointer-size limits. Empty profiles are admitted where these bounds permit them; object-specific caller policy remains separate." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-571" +claim_text = "The shipping signing framer admits exactly the independent numeric domain; no deny-all implementation satisfies this equivalence." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.signing_accepts_iff" +lean_statement_sha256 = "bf134802c6facb0a51311b5d6124dd9455120a60a4f7336deac091bc89497498" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All six signing tags, every profile/version/payload: two-byte profile length, eight-byte payload length and total frame length 21 plus profile/payload fitting unsigned and signed pointer-size limits. Empty profiles are admitted where these bounds permit them; object-specific caller policy remains separate." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-572" +claim_text = "The shipping signing framer returns LimitExceeded exactly outside the independent numeric domain." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.FramingTotality.signing_refuses_iff" +lean_statement_sha256 = "ccac460cdb30b2be7829983fc4107fd20cfb916324c23296dba9eb0ba263cdc3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All six signing tags, every profile/version/payload: two-byte profile length, eight-byte payload length and total frame length 21 plus profile/payload fitting unsigned and signed pointer-size limits. Empty profiles are admitted where these bounds permit them; object-specific caller policy remains separate." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/FramingTotality.lean" +sha256 = "8b24d9a4f52c3bf35134e319f85cb3bc8916e09751f4ff8e3076b6b4b71ac4cd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-558" +claim_text = "Every accepted shipping application preimage supplies the independent valid-frame premises." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentValidity.application_accepted_frame_valid" +lean_statement_sha256 = "9319116c7f1dbfcf5f9a9995f4ce50196cd025ba1556ceb4804fcbd3b5618540" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented domain, payload and accepted result: nonempty domain at most 128 bytes, 64-bit payload length and valid byte carriers. Acceptance alone establishes these premises; no caller-supplied validity flag is trusted." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentValidity.lean" +sha256 = "892f412ed3f1ad6c383db5ee1d838d7b47515e8f3a090c6f90a7b8bf90da1af4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-559" +claim_text = "Every accepted shipping identifier preimage supplies the independent valid-frame premises." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid" +lean_statement_sha256 = "13ba78270cf045c6474a8a24afe873a08803378dde545e099a93efae4fdc47ec" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every registered identifier tag, represented payload and accepted result. The tag is within its two-byte range, the payload length fits eight bytes, and every frame byte is valid." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentValidity.lean" +sha256 = "892f412ed3f1ad6c383db5ee1d838d7b47515e8f3a090c6f90a7b8bf90da1af4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-560" +claim_text = "Equal accepted shipping application preimages bind exactly the same domain and payload." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind" +lean_statement_sha256 = "66f618bd8924be4ddfabb20edbc241a2000b8054c0b3dc2d45129c107a995074" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of represented domains, payloads and accepted outputs. Equality is at the complete preimage-byte level and implies equality of both original inputs, with no separately assumed frame-validity premise. This does not assert hash injectivity or collision resistance." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentValidity.lean" +sha256 = "892f412ed3f1ad6c383db5ee1d838d7b47515e8f3a090c6f90a7b8bf90da1af4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-561" +claim_text = "Equal accepted shipping identifier preimages bind exactly the same registered tag and payload." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind" +lean_statement_sha256 = "07a96f2cfdd3a0184a23fa12547cdc26d06fbb684ad1f15f8c60cad0d719dcc1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All nine registered tags and every pair of represented payloads and accepted outputs. Equality is at the complete preimage-byte level and implies equality of both original inputs. This does not assert hash injectivity or collision resistance." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentValidity.lean" +sha256 = "892f412ed3f1ad6c383db5ee1d838d7b47515e8f3a090c6f90a7b8bf90da1af4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-562" +claim_text = "Every accepted shipping application preimage has the exact framed output length." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentValidity.application_output_length" +lean_statement_sha256 = "21b55c74d000413ba9ba4d07a53ef9e20627ecd129d9c7d00cac67f14a2c8e9c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every accepted result: output length equals 28 plus the UTF-8 domain byte length plus payload length. This is a successful-result length theorem, not an all-input allocation/work or physical-memory guarantee." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentValidity.lean" +sha256 = "892f412ed3f1ad6c383db5ee1d838d7b47515e8f3a090c6f90a7b8bf90da1af4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-563" +claim_text = "Every accepted shipping identifier preimage has the exact framed output length." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentValidity.identifier_output_length" +lean_statement_sha256 = "f703963c9ae55eabb1685d1f72b20781b440309f53f9a8b53a45fc6842b20be0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every registered tag and accepted result: output length equals 20 plus payload length. This is a successful-result length theorem, not an all-input allocation/work or physical-memory guarantee." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentValidity.lean" +sha256 = "892f412ed3f1ad6c383db5ee1d838d7b47515e8f3a090c6f90a7b8bf90da1af4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-536" +claim_text = "The shipping preimage buffer guard returns exactly the signed-capacity decision and an empty buffer or typed limit refusal." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.BufferAllocation.buffer_refines" +lean_statement_sha256 = "f5ae924238f1a006b759e9f014fe26ba72f3c078cf95ae8831665ca144d4cdb9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::preimage_buffer"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented usize capacity. Admission is equivalent to fitting the signed pointer-size maximum before Vec allocation. This proves the abstract allocation request guard/result, not physical allocation success, memory exhaustion handling or the standard allocator implementation." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/BufferAllocation.lean" +sha256 = "59e2e262ea2e384c53e8854e31aa3e6c511905f06f8957c7388a71286818c1f3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-537" +claim_text = "A successful shipping preimage buffer starts with no bytes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.BufferAllocation.accepted_empty" +lean_statement_sha256 = "eb65619f9bfd114215337bedeb159ace0b1accc16d0242b1d8a23ab91d83f471" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::preimage_buffer"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented capacity and accepted buffer. This is a successful-result projection used by exact framing proofs, not a whole-function resource bound." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/BufferAllocation.lean" +sha256 = "59e2e262ea2e384c53e8854e31aa3e6c511905f06f8957c7388a71286818c1f3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-538" +claim_text = "A successful shipping preimage buffer request fits the signed pointer-size capacity range." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.BufferAllocation.accepted_capacity_fits" +lean_statement_sha256 = "8383eb79c4a03bf2578fe17f3ef78537334eb4775b54e04b96597e2e188c7adc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::preimage_buffer"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented capacity and successful result. A usize sum alone is insufficient; the actual signed conversion has succeeded before the standard allocator is called." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/BufferAllocation.lean" +sha256 = "59e2e262ea2e384c53e8854e31aa3e6c511905f06f8957c7388a71286818c1f3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-539" +claim_text = "Every successful shipping application-commitment preimage contains exactly the independent prefix, protocol, domain and payload frames." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentRefinement.application_preimage_exact" +lean_statement_sha256 = "de8a9b3a80772a32a3e38a25adb5ac822e57a4fa74f0c74eb74ddf7c46a1d08b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented domain/payload slice and successful result. Includes exact big-endian widths, length framing and all domain/payload bytes. This is successful-output exactness; it does not establish complete totality, all admissible-input acceptance, caller canonicalization, business meaning or hash collision resistance." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentRefinement.lean" +sha256 = "97cdb7e0ee0a8f89a622d572cd64b42739fce3528b2c5a1c56f67a76a10cd377" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-540" +claim_text = "Every successful shipping content-identifier preimage contains exactly its independent registered tag and payload frame." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentRefinement.identifier_preimage_exact" +lean_statement_sha256 = "948f7ffefab6f045a7afee9408a124d394b1355f910cfb0aae557484adb0342c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented payload, successful output and all nine registered identifier tags. Includes the fixed identifier prefix, protocol, exact tag, 64-bit payload length and complete payload bytes. Caller unsigned-object encoding and complete totality remain separate obligations." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentRefinement.lean" +sha256 = "97cdb7e0ee0a8f89a622d572cd64b42739fce3528b2c5a1c56f67a76a10cd377" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-541" +claim_text = "The shipping native one-shot SHA-256 wrapper forwards exactly its supplied bytes and returns the specified fixed-width digest under explicit foreign contracts." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Sha256Native.raw_hash_refines" +lean_statement_sha256 = "fad00be6c2231a9089432debfa80699d4461fe1093a189deff5fdf85318a3599" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::raw_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and explicit Sha256Primitives implementation satisfying the displayed Contract for the supplied SHA-256 specification function. Covers the actual digest call, selected Into<[u8;32]> conversion and translated Digest constructor. Primitive functional correctness and output conversion remain explicit premises; collision resistance, preimage resistance, caller integration and complete E5 are not proved." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Sha256Native.lean" +sha256 = "462508cdc71f126c4b7379c0cdc14c6bfd987e6a36b8951751bbe59c437276ea" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/sha256/Funs.lean" +sha256 = "ac717d96e3eb922e16e6fe25f5d64076a9c3adc0a0b9be20e0966e136b81100a" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-542" +claim_text = "The actual application framing rejects the empty domain for arbitrary payloads." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentExamples.empty_domain_refused" +lean_statement_sha256 = "3a6c031192c5146516f013d64ea580134088f713a9e5e416dd2a907cf7b37d82" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented payload and the exact empty domain. No allocator or cryptographic primitive correctness premise is used." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentExamples.lean" +sha256 = "920b56f77d319f2263b48e071b725b6456272312c98db484c672296b41eaa77b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-543" +claim_text = "The actual application framing rejects the displayed 129-byte domain for arbitrary payloads." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentExamples.oversized_domain_refused" +lean_statement_sha256 = "828c61ae17324b305c155befac1322c7f84c6214e011a37099a28c15adc996a0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented payload and the exact oversized ASCII domain. This is a concrete refusal witness, not the complete domain-bound classification." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentExamples.lean" +sha256 = "920b56f77d319f2263b48e071b725b6456272312c98db484c672296b41eaa77b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-544" +claim_text = "A concrete useful application frame is accepted by the actual shipping source." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentExamples.application_sample_admitted" +lean_statement_sha256 = "dfb5c3a73b51bb3b3f78641dd797398e7726fe84fa7f1ad4d1af1e6e94046203" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::commitment_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed demo domain and two payload bytes. This prevents a deny-all implementation from satisfying the successful-output theorem; it is not an authorization or hash-security claim." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentExamples.lean" +sha256 = "920b56f77d319f2263b48e071b725b6456272312c98db484c672296b41eaa77b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-545" +claim_text = "Every registered identifier tag accepts the concrete payload through the actual shipping framing source." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted" +lean_statement_sha256 = "977318b488b0170f1e3662f7080f4ca6d57a0fed33ed04be4d393b1da7a17e9a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::identifier_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All nine registered tags and the exact displayed two-byte payload. This is a family of useful acceptance witnesses, not general encoding/decoding or hash-security completeness." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentExamples.lean" +sha256 = "920b56f77d319f2263b48e071b725b6456272312c98db484c672296b41eaa77b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-546" +claim_text = "The actual native hash wrapper forwards the stated input through an explicit byte-echo mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest" +lean_statement_sha256 = "b71b6842f0396cf75363db0a8e23678c9101e769b9953355f1e6ed43819a9f4e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::raw_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed explicit forwardingPrimitive, exact input and repeated output. The mock is not SHA-256, no global instance is installed, and no cryptographic correctness or security is claimed." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Sha256Examples.lean" +sha256 = "e534a788caf27a4a267fff85b284bd4aa93741d45f6a3aa643b8371110d06259" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/sha256/Funs.lean" +sha256 = "ac717d96e3eb922e16e6fe25f5d64076a9c3adc0a0b9be20e0966e136b81100a" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-547" +claim_text = "The actual native hash wrapper forwards a changed input to the selected explicit byte-echo mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest" +lean_statement_sha256 = "2dae1a684f608ddf8606fb789914db2d26be3435f4997158bd43657a1ab687f3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::raw_sha256"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed changed input and explicit mock. It witnesses exact input forwarding and retained output conversion, not hash collision resistance or primitive correctness." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Sha256Examples.lean" +sha256 = "e534a788caf27a4a267fff85b284bd4aa93741d45f6a3aa643b8371110d06259" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/sha256/Funs.lean" +sha256 = "ac717d96e3eb922e16e6fe25f5d64076a9c3adc0a0b9be20e0966e136b81100a" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-548" +claim_text = "The independent commitment/representation model proves signed_bounds_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.BufferAllocation.signed_bounds_iff" +lean_statement_sha256 = "34ec541e608119fdc1661d7a36d73740701ee6bdfe62dbc7edecad061e92af99" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/BufferAllocation.lean" +sha256 = "59e2e262ea2e384c53e8854e31aa3e6c511905f06f8957c7388a71286818c1f3" + +[[claims]] +claim_id = "AP-FORMAL-RICH-549" +claim_text = "The independent commitment/representation model proves application_length." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.application_length" +lean_statement_sha256 = "f2e94cd27e2c6235386070d475b5a1be5698cd369c122899635d332536f24acf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-550" +claim_text = "The independent commitment/representation model proves identifier_length." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.identifier_length" +lean_statement_sha256 = "507c2f232117a36000af470cf3f12c0607322d1f0af8dccfd13ac0378e6844f1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-551" +claim_text = "The independent commitment/representation model proves application_unambiguous." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.application_unambiguous" +lean_statement_sha256 = "055fe3627f1bcfbd9850ab12e4ade543187500f3b349cf54183af0d624172a9e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-552" +claim_text = "The independent commitment/representation model proves identifier_unambiguous." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.identifier_unambiguous" +lean_statement_sha256 = "6e0e41e72862fbfb722b1d20ee785aed97a46f2c12aab196d21428e7a54fa560" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-553" +claim_text = "The independent commitment/representation model proves application_identifier_separate." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.application_identifier_separate" +lean_statement_sha256 = "248a6f4a7b29dddca7a420d16eadbb8ad97cc9442274b1640f38985faf0253a2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-554" +claim_text = "The independent commitment/representation model proves signing_application_separate." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.signing_application_separate" +lean_statement_sha256 = "bd5a5168fe739db430db1435809f78c9d84403a9d4721ed12182219403038579" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-555" +claim_text = "The independent commitment/representation model proves signing_identifier_separate." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentFrames.signing_identifier_separate" +lean_statement_sha256 = "26d772f095f134ad6d0db4113f395089cdbdb6cd9580b56da77eaeed6f814315" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentFrames.lean" +sha256 = "692caed528e971d22a62d5e7adf67263167b069eb0dc7dfae177a7a71886c308" + +[[claims]] +claim_id = "AP-FORMAL-RICH-556" +claim_text = "The independent commitment/representation model proves identifier_tag_word." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CommitmentRefinement.identifier_tag_word" +lean_statement_sha256 = "e40573b869017640b1b14def27ed36d743691da91eaf4e16bd36aef2b5ae6062" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/CommitmentRefinement.lean" +sha256 = "97cdb7e0ee0a8f89a622d572cd64b42739fce3528b2c5a1c56f67a76a10cd377" + +[[claims]] +claim_id = "AP-FORMAL-RICH-557" +claim_text = "The independent commitment/representation model proves forwarding_contract." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Sha256Examples.forwarding_contract" +lean_statement_sha256 = "ed94a8733eaa28092210db7d8ca0820aff0802816a1c53199df0ab8941b1c762" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Sha256Examples.lean" +sha256 = "e534a788caf27a4a267fff85b284bd4aa93741d45f6a3aa643b8371110d06259" + +[[claims]] +claim_id = "AP-FORMAL-RICH-527" +claim_text = "The actual Ed25519 library-decoding adapter returns the exact specified decoded key under its explicit primitive contract." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Native.decode_leaf_refines" +lean_statement_sha256 = "8ca9d65afc053351cf4197a7bf8b06e37ab36d8fefb07d6d2a9ce77519957b70" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::decode_ed25519_point"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every 32-byte array, explicit foreign implementation, decoder specification, signature representation and equation satisfying the displayed Ed25519Contract. This proves the adapter and Result-to-Option projection; it does not prove point recovery." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeContract.lean" +sha256 = "a9ab7a5f24c65c309583f33a4c3230dcf0a8fbd3cd7ef737fa6df37bbdb448d1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-528" +claim_text = "The actual Ed25519 equation adapter constructs the specified signature and passes the exact key and message to the selected foreign verification call." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Native.equation_leaf_refines" +lean_statement_sha256 = "ff4c8cde8779666b59df202beaf7da4eb924fc2564641fa6e721e31b40b0cdc0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519_equation"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every implementation key, message slice and 64-byte signature under the explicit constructor and equation contracts. The exact native call sequence and Result-to-bool projection are proved; curve arithmetic, S validity, equation security and library implementation correctness remain explicit primitive obligations." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeContract.lean" +sha256 = "a9ab7a5f24c65c309583f33a4c3230dcf0a8fbd3cd7ef737fa6df37bbdb448d1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-529" +claim_text = "The public Ed25519 verification API returns exactly the independent suite model under explicit foreign primitive contracts." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Native.public_verify_refines" +lean_statement_sha256 = "bfae4186b0f6334ae8cc5f4f5659f4bb8250e1c3076984f42fd371410cdf4863" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key/message/signature slice, including malformed inputs, under the displayed Ed25519Contract. Covers the actual public wrapper, generated closure dictionaries, concrete guards, exact byte forwarding, stable error classes and precedence, with a total result. No global primitive instance is installed." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeContract.lean" +sha256 = "a9ab7a5f24c65c309583f33a4c3230dcf0a8fbd3cd7ef737fa6df37bbdb448d1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-530" +claim_text = "The public Ed25519 verification API succeeds iff the independent suite acceptance relation holds under explicit foreign primitive contracts." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Native.public_verify_accepts_iff" +lean_statement_sha256 = "96ea4782887ee03b36b130495202694d5bd64f9c3b63e9ec3082d6986bafa8af" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key/message/signature slice and explicit implementation satisfying Ed25519Contract. The independent relation requires exact widths, canonical/non-weak key and R, decoded key and the exact-message equation. This proves both acceptance and refusal through the public wrapper, not the primitive contracts or authorization." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeContract.lean" +sha256 = "a9ab7a5f24c65c309583f33a4c3230dcf0a8fbd3cd7ef737fa6df37bbdb448d1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-531" +claim_text = "The public Ed25519 key validator returns exactly the independent canonical point-decoding result under explicit primitive contracts." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Native.public_validate_refines" +lean_statement_sha256 = "804a85f199365b0a6ea845197390a59f16386d0cc5e2cdf02ae586cfb97190c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::validate_ed25519_key", + "auths_signature_core::decode_ed25519_key", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented key byte slice under the displayed foreign decoder contract, including typed malformed-key refusals and exact successful Unit projection. A canonical weak encoding may pass key-format validation; it cannot thereby pass strict signature verification." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeContract.lean" +sha256 = "a9ab7a5f24c65c309583f33a4c3230dcf0a8fbd3cd7ef737fa6df37bbdb448d1" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-532" +claim_text = "A kernel-checked explicit mock witnesses useful exact-byte forwarding through the actual public Ed25519 API." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes" +lean_statement_sha256 = "24792b452a90c58e1bfee25b022c0f361a0c854d38e66b6ccfa6429711bf67a8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed explicit forwardingPrimitive implementation and exact public byte forms. The mock deliberately recognizes one message/signature pair; it is no cryptographic implementation, global instance, authentic signature witness or authorization claim." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeExamples.lean" +sha256 = "c6a68e517bf8056814ad4e2cd129f4ed2a4c30f7b7b23c0b9ec0c32d1cbb0e67" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-533" +claim_text = "The actual public Ed25519 wrapper refuses a changed message against an explicit exact-byte forwarding mock." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.NativeExamples.changed_message_is_refused" +lean_statement_sha256 = "13412d303fded400c2d9833a42f8dd009a3b918fbd5eab37c376fb56abadb3a0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the stated changed message and explicit mock. The result detects message substitution through the real wrapper; it is call-binding evidence, not cryptographic unforgeability." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeExamples.lean" +sha256 = "c6a68e517bf8056814ad4e2cd129f4ed2a4c30f7b7b23c0b9ec0c32d1cbb0e67" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-534" +claim_text = "The public Ed25519 wrapper refuses the empty key without a primitive-correctness or termination premise." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract" +lean_statement_sha256 = "86724421d2bfc90a0944bcdcc7a9e04c64ea2e9de2bcf99bea079b5ea2790f47" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every explicit foreign implementation, arbitrary message/signature slices, and the exact empty key. The concrete width refusal precedes all foreign calls. This is not a full malformed-input classification on its own." +residual_assumptions = [ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeExamples.lean" +sha256 = "c6a68e517bf8056814ad4e2cd129f4ed2a4c30f7b7b23c0b9ec0c32d1cbb0e67" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-535" +claim_text = "The explicitly supplied forwarding mock satisfies its stated call-binding contracts." +claim_status = "proved" +lean_declaration = "Auths.Crypto.NativeExamples.forwarding_contract" +lean_statement_sha256 = "390d785b75827563c7fe49fd64f3d5c707030e8340d32bb66e554974eb805b76" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the displayed mock implementation, decoder, signature representation and message/signature equality predicate. This is an inhabited-contract witness; it makes no claim that any cryptographic library is correct or that any signature is authentic." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/NativeExamples.lean" +sha256 = "c6a68e517bf8056814ad4e2cd129f4ed2a4c30f7b7b23c0b9ec0c32d1cbb0e67" + +[[claims]] +claim_id = "AP-FORMAL-RICH-491" +claim_text = "The independent numeric/relational signature model proves value_bound." +claim_status = "proved" +lean_declaration = "Auths.Crypto.ByteLex.value_bound" +lean_statement_sha256 = "7de7288f0ed3f774050df5b9e7f437dff945bd6d8919e649526136f70ba6a58e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/ByteLex.lean" +sha256 = "5070c0e686cebe156b10f485a11f45933ccf3beebe0f2edd472abaedbd6da1b1" + +[[claims]] +claim_id = "AP-FORMAL-RICH-492" +claim_text = "The independent numeric/relational signature model proves value_cons." +claim_status = "proved" +lean_declaration = "Auths.Crypto.ByteLex.value_cons" +lean_statement_sha256 = "819e04f183080616805378061efd3b449298ff644ca6a096d7f386f02e56f593" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/ByteLex.lean" +sha256 = "5070c0e686cebe156b10f485a11f45933ccf3beebe0f2edd472abaedbd6da1b1" + +[[claims]] +claim_id = "AP-FORMAL-RICH-493" +claim_text = "The independent numeric/relational signature model proves le_numeric." +claim_status = "proved" +lean_declaration = "Auths.Crypto.ByteLex.le_numeric" +lean_statement_sha256 = "4a689305d79f862cd338eb14bb4c0c8aacea0d6d2f51f0e99a247f3f22eac361" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/ByteLex.lean" +sha256 = "5070c0e686cebe156b10f485a11f45933ccf3beebe0f2edd472abaedbd6da1b1" + +[[claims]] +claim_id = "AP-FORMAL-RICH-494" +claim_text = "The shipping P-256 scalar comparison loop terminates and returns the exact suffix comparison." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.LowScan.loop_refines" +lean_statement_sha256 = "fef8d815d72511d52eebd7fb23814b9a71bd00b68fc7627a48909b9a1b786b43" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every 64-byte array and index/remaining count summing to 32. Both scalar and bound reads are in range, additions cannot overflow, and the result equals the finite byte-order model. This is the bounded loop component." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/LowScan.lean" +sha256 = "2f89363956f0357a814a3471ed8e4c263e189f2cef1b00ea60b6a17372751451" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-495" +claim_text = "The independent numeric/relational signature model proves half_order_exact." +claim_status = "proved" +lean_declaration = "Auths.Crypto.LowContract.half_order_exact" +lean_statement_sha256 = "3de1f4d6b658fdc475c544adb51b5374da434ad7d495ad20b372365cbebfaff6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/LowContract.lean" +sha256 = "81e1bf3b20a13be3140fb66eb69e7c12dae165b4f6b7f18ad5aaf11090722633" + +[[claims]] +claim_id = "AP-FORMAL-RICH-496" +claim_text = "The shipping P-256 low-S guard is total and equals the exact numeric half-order condition." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.LowContract.guard_refines" +lean_statement_sha256 = "bf058c773bf9239e0dfe1a740b13637bfa7f1c96f45bb6f5e3f99484359ccad0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented 64-byte signature form, including zero/out-of-range r or s. The result is true iff the big-endian unsigned s bytes encode at most floor(n/2), for the stated secp256r1 order. Scalar validity and the equation remain primitive contracts." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/LowContract.lean" +sha256 = "81e1bf3b20a13be3140fb66eb69e7c12dae165b4f6b7f18ad5aaf11090722633" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-497" +claim_text = "The shipping low-S decision is independent of every encoded r byte." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.LowContract.r_bytes_irrelevant" +lean_statement_sha256 = "996ee23a5035f13ada11e8e4e9de898e486e21a8ea32c756e8b57b56d9bbb5c9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of represented 64-byte arrays with identical last 32 bytes. This is exact input noninterference of the scalar upper-bound decision, not signature validity." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/LowContract.lean" +sha256 = "81e1bf3b20a13be3140fb66eb69e7c12dae165b4f6b7f18ad5aaf11090722633" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-498" +claim_text = "The independent numeric/relational signature model proves ordinate_eq_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.CoordinateModel.ordinate_eq_iff" +lean_statement_sha256 = "b1b6cd53f45db253c76c35ae6260891a29c2ea423ff624105d1d6e86e710d3b6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/CoordinateModel.lean" +sha256 = "a7cd0aaf7ab615f1cd1a56f2b2d5083f146b3e3012d0707b2458ec04dfc524cd" + +[[claims]] +claim_id = "AP-FORMAL-RICH-499" +claim_text = "The shipping Ed25519 coordinate scan is total and compares exactly the remaining coordinate bytes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CoordinateScan.loop_refines" +lean_statement_sha256 = "aa6d94bef1f43b53935d8b8d738f0f33e43ee4b309de2766c68689dd60c862ef" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_same_coordinate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of represented 32-byte arrays and an index/remaining count summing to 31. The result is exact prefix equality; no point-validity assumption is used." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/CoordinateScan.lean" +sha256 = "c8c077b32b14f2751022b4414f8ae6b61783154e91277cfd0ab338286fdf6576" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-500" +claim_text = "The shipping sign-masked Ed25519 coordinate comparator is total and returns exactly equality of independent numeric ordinates." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.CoordinateContract.guard_refines" +lean_statement_sha256 = "4b9aeabfa5728e16fe32e9e047acf825b072a0f17f79deecf453080967c8c372" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_same_coordinate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of 32-byte arrays, including malformed point forms. The sign bit is ignored and all 255 coordinate bits are preserved. This does not identify distinct non-weak public keys or validate a curve point." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/CoordinateContract.lean" +sha256 = "709e9bd986cace93af32ded433d4267e49285238d8af12256516e4dfbc5ee228" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-501" +claim_text = "The independent numeric/relational signature model proves zero_value." +claim_status = "proved" +lean_declaration = "Auths.Crypto.WeakContract.zero_value" +lean_statement_sha256 = "16004e191d7bbc3e7b9c71588132ddec2cb9dc3b1007b52cb83708494b128d13" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/WeakContract.lean" +sha256 = "57d9db01f01cc7291e181754d6f466fa4686beba0bfd9500d991740457aebf26" + +[[claims]] +claim_id = "AP-FORMAL-RICH-502" +claim_text = "The independent numeric/relational signature model proves one_value." +claim_status = "proved" +lean_declaration = "Auths.Crypto.WeakContract.one_value" +lean_statement_sha256 = "3572c40d7a612f568483b0bdc82b35e11b30bb35294c34d559248667196bf984" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/WeakContract.lean" +sha256 = "57d9db01f01cc7291e181754d6f466fa4686beba0bfd9500d991740457aebf26" + +[[claims]] +claim_id = "AP-FORMAL-RICH-503" +claim_text = "The independent numeric/relational signature model proves minus_one_value." +claim_status = "proved" +lean_declaration = "Auths.Crypto.WeakContract.minus_one_value" +lean_statement_sha256 = "b214f8f33722df6e62a1c38364dfebb0aa9621e6be3d1c09888121c06c0f49bd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/WeakContract.lean" +sha256 = "57d9db01f01cc7291e181754d6f466fa4686beba0bfd9500d991740457aebf26" + +[[claims]] +claim_id = "AP-FORMAL-RICH-504" +claim_text = "The independent numeric/relational signature model proves order_eight_a_value." +claim_status = "proved" +lean_declaration = "Auths.Crypto.WeakContract.order_eight_a_value" +lean_statement_sha256 = "7e8fb7b74b79547416371650fd526eabebff3383372dfabb938793dd5e581871" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/WeakContract.lean" +sha256 = "57d9db01f01cc7291e181754d6f466fa4686beba0bfd9500d991740457aebf26" + +[[claims]] +claim_id = "AP-FORMAL-RICH-505" +claim_text = "The independent numeric/relational signature model proves order_eight_b_value." +claim_status = "proved" +lean_declaration = "Auths.Crypto.WeakContract.order_eight_b_value" +lean_statement_sha256 = "bc7cf3b0e91dada8eb22e4d11a2d91ea79367d100392e238b3623896e75ff4fe" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/WeakContract.lean" +sha256 = "57d9db01f01cc7291e181754d6f466fa4686beba0bfd9500d991740457aebf26" + +[[claims]] +claim_id = "AP-FORMAL-RICH-506" +claim_text = "The shipping Ed25519 weak-coordinate filter is total and equals the independent numeric weak-coordinate set." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.WeakContract.guard_refines" +lean_statement_sha256 = "e1031ea67885059e20bf442de9f93cf67f83804bc92d3293351e3c46ab3e27ca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::ed25519_has_small_order_coordinate", + "auths_signature_core::ed25519_same_coordinate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every 32-byte array. The set is y=0,1,p-1 and the two declared order-eight ordinates. Combining it with the separately proved canonical form selects the eight canonical weak encodings; invalid negative-zero forms are rejected by the form guard. No group-arithmetic or cryptographic-security claim is introduced." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/WeakContract.lean" +sha256 = "57d9db01f01cc7291e181754d6f466fa4686beba0bfd9500d991740457aebf26" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-507" +claim_text = "The shipping Ed25519 R-form guard is total and accepts exactly a canonical non-weak encoded first point." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.RContract.guard_refines" +lean_statement_sha256 = "2a74c241cd55631379aba0619de68e7d97c8c7dac7ac92dfa91a278ccf0a299e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::ed25519_signature_r_is_allowed", + "auths_signature_core::ed25519_has_small_order_coordinate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented 64-byte signature form. The first 32 bytes are recovered losslessly and checked for numeric field/sign canonicality and the declared weak-coordinate set. Scalar range and the signature equation remain primitive responsibilities." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/RContract.lean" +sha256 = "d0894271264a9e1b1b5bebd047d0bd17e013f82db5203aff1e9abcf7a595741e" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-508" +claim_text = "The shipping Ed25519 key-form decoder is total and refines the independent length/coordinate/sign contract with exact bytes and errors." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines" +lean_statement_sha256 = "0f920226430f36007a536ed6645020f2fc818f87f3168c2eeb0ee6a7d30c7ab3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::ed25519_key_encoding", + "auths_signature_core::ed25519_point_encoding_is_canonical", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded byte slice. Success returns the identical 32 bytes with canonical field/sign form; every other form is InvalidKey. Point recovery is a subsequent primitive call." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SuiteRefinement.lean" +sha256 = "7c27096aad822436a1921d68405312ceb4c142678a3024d10010bedaaadacfa7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-509" +claim_text = "The shipping parameterized Ed25519 key decoder agrees exactly with form validation followed by the named point decoder." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines" +lean_statement_sha256 = "11f22e8d51eb55c56095a32ff317a5b481f91e5c875981d87dfc728fdd39dbe5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::decode_ed25519_key_with", + "auths_signature_core::ed25519_key_encoding", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded key slice and explicit point-decoder instance. Its exact total call contract is a theorem premise; error precedence and the bytes passed to it are fixed. This does not prove the native library decoder." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SuiteRefinement.lean" +sha256 = "7c27096aad822436a1921d68405312ceb4c142678a3024d10010bedaaadacfa7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-510" +claim_text = "The shipping parameterized P-256 decoder agrees exactly with compressed-form validation followed by the named point decoder." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines" +lean_statement_sha256 = "409ae30b69a2560cf358bd98c193cebe6d087d27e74f72c736c10ecc77bfc3a5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::p256_key_encoding_is_canonical", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded key slice and explicit point-decoder instance under its displayed total exact call contract. Length/tag refusal precedes point decoding; recovery and curve validity remain primitive responsibilities." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SuiteRefinement.lean" +sha256 = "7c27096aad822436a1921d68405312ceb4c142678a3024d10010bedaaadacfa7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-511" +claim_text = "The complete shipping parameterized Ed25519 glue refines the independent key, width, weak-point, R-form and equation model with exact refusal precedence." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines" +lean_statement_sha256 = "b40a3347d90ee1af95598b67aa81668af34a8990b793eba8682ced899dfbefea" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::verify_ed25519_with", + "auths_signature_core::ed25519_key_encoding", + "auths_signature_core::ed25519_signature_r_is_allowed", + "auths_signature_core::ed25519_has_small_order_coordinate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded key/message/signature slice and native decoder/equation dictionaries. Only the displayed exact total point-decoder and equation contracts are premises. Canonical and weak-point guards are proved concrete source algorithms. The exact original message and signature reach the primitive on the admitted path." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SuiteRefinement.lean" +sha256 = "7c27096aad822436a1921d68405312ceb4c142678a3024d10010bedaaadacfa7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-512" +claim_text = "The complete shipping parameterized P-256 glue refines independent compressed-form, signature-width, parser, numeric low-S and equation semantics." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines" +lean_statement_sha256 = "1fccbeb7febf14d222a2bee47d875a0f90942e3a900f09029037f95d28016655" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_signature_core::verify_p256_sha256_with", + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::p256_signature_is_low_s", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded key/message/signature slice and explicit point/scalar-parser/equation instances under their exact total call contracts. The scalar upper bound is a proved concrete byte comparison, not an assumed low-S callback. Parse failures retain precedence and the original message is passed unchanged." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SuiteRefinement.lean" +sha256 = "7c27096aad822436a1921d68405312ceb4c142678a3024d10010bedaaadacfa7" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-513" +claim_text = "The independent numeric/relational signature model proves key_encoding_accepts_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Strict.Acceptance.key_encoding_accepts_iff" +lean_statement_sha256 = "2f710d3d2eaf0009f77fd6abc2bf32460c088920a0171bed9ac6ef5b39ca0ebd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Acceptance.lean" +sha256 = "8e94851910ef8c5f2dc76237dd9ff6fb4fca95cd37310a7ab681a0bccc58f8a4" + +[[claims]] +claim_id = "AP-FORMAL-RICH-514" +claim_text = "The independent numeric/relational signature model proves p256_key_accepts_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Strict.Acceptance.p256_key_accepts_iff" +lean_statement_sha256 = "63e72790e8b685cde3606c31058ad249ce3b57950e48184e179d8466a64839ba" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Acceptance.lean" +sha256 = "8e94851910ef8c5f2dc76237dd9ff6fb4fca95cd37310a7ab681a0bccc58f8a4" + +[[claims]] +claim_id = "AP-FORMAL-RICH-515" +claim_text = "The independent numeric/relational signature model proves ed_accepts_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Strict.Acceptance.ed_accepts_iff" +lean_statement_sha256 = "859cab2705ed2a48118904f38202e37bf42d6ffd8f8e06046bc31a9215af802d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Acceptance.lean" +sha256 = "8e94851910ef8c5f2dc76237dd9ff6fb4fca95cd37310a7ab681a0bccc58f8a4" + +[[claims]] +claim_id = "AP-FORMAL-RICH-516" +claim_text = "The independent numeric/relational signature model proves p256_accepts_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Strict.Acceptance.p256_accepts_iff" +lean_statement_sha256 = "c41ea5d5c7bb753c440b3671b07bca56c2b419546241662101f290ad15b7aaf6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Acceptance.lean" +sha256 = "8e94851910ef8c5f2dc76237dd9ff6fb4fca95cd37310a7ab681a0bccc58f8a4" + +[[claims]] +claim_id = "AP-FORMAL-RICH-517" +claim_text = "The shipping parameterized Ed25519 verifier succeeds iff the independent accepted-input relation holds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff" +lean_statement_sha256 = "9b9838dcc10dfbf04ba06b2bd0bb3533147decb6c12e81b084c780d42929ea24" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_ed25519_with"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded input under the displayed exact total primitive contracts. The relation separately binds key/signature bytes, canonical/non-weak forms, a decoded point and its exact-message equation. Both soundness and useful acceptance are proved; no source-verifier success is assumed." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SourceAcceptance.lean" +sha256 = "0a3406e5ff5dec48f4120163eec7b1367ce1adea2b19a64aec1ce55965005d9f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-518" +claim_text = "The shipping parameterized P-256 verifier succeeds iff the independent accepted-input relation holds." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff" +lean_statement_sha256 = "d7d22238a85e74bad39486699b996344e34af8355436c161cea393e8b169d4bd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::verify_p256_sha256_with"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every bounded input under the displayed point-decoder, scalar-parser and equation contracts. The relation independently requires the compressed form, exact 64-byte width, numeric s at most floor(n/2), decoder/parser results and the exact-message equation. It proves both soundness and acceptance." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/SourceAcceptance.lean" +sha256 = "0a3406e5ff5dec48f4120163eec7b1367ce1adea2b19a64aec1ce55965005d9f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-519" +claim_text = "A kernel-checked execution establishes the zero_s_form_allowed source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.zero_s_form_allowed" +lean_statement_sha256 = "2e88041adcdd90e7aae8e03852b6199d4eec095c886c92df31a117b0b36e4d14" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-520" +claim_text = "A kernel-checked execution establishes the half_s_form_allowed source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.half_s_form_allowed" +lean_statement_sha256 = "08b956b30aedb47369b6d415589f46605bd48853245722602af4c35b6274c067" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-521" +claim_text = "A kernel-checked execution establishes the above_half_s_refused source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.above_half_s_refused" +lean_statement_sha256 = "f286bc5f76bd0d6d33da3628456fba9e171098ff19975827cc6858597f25f454" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-522" +claim_text = "A kernel-checked execution establishes the maximum_s_refused source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.maximum_s_refused" +lean_statement_sha256 = "ff47a79ab5b0442ca99b5cf6eeea95cab51342448ab8d62ffaaa5b998a8fd2c8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_signature_is_low_s"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-523" +claim_text = "A kernel-checked execution establishes the identity_coordinate_is_weak source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.identity_coordinate_is_weak" +lean_statement_sha256 = "7621d460d626f215c12b1caec6efce8ec3461b3bd11cfe0c1bfd4c4bc60e3819" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_has_small_order_coordinate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-524" +claim_text = "A kernel-checked execution establishes the published_key_coordinate_is_not_weak source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak" +lean_statement_sha256 = "3743f5d6a24accc05d62087134ed881f67792fc1b7cb55a38dcdafd4f0a7e71d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_has_small_order_coordinate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-525" +claim_text = "A kernel-checked execution establishes the weak_r_form_refused source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.weak_r_form_refused" +lean_statement_sha256 = "79fb1b97c8ae01e76abf563e5ebf15e079ca6c6dc27c264a0d15c21cfb7ddca4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_signature_r_is_allowed"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-526" +claim_text = "A kernel-checked execution establishes the public_r_form_allowed source-guard witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Strict.Examples.public_r_form_allowed" +lean_statement_sha256 = "493fab5bff05b4fcc042b4bef7c31b28ad4d15f8157211d9829bf28ccc81262d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_signature_r_is_allowed"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Strict/Examples.lean" +sha256 = "a18830ede92eaead9ccabe7d00e33df533921fd6ab37b38ef8f830243da254c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-481" +claim_text = "The transparent unit-output ABI adapter proves erase_restore." +claim_status = "proved" +lean_declaration = "Auths.Support.UnitCallback.erase_restore" +lean_statement_sha256 = "68c75a3d88543b7414f5b0452458da242c3bcc2bb4db2456e5ca40aca157b856" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every typed Result value, including failure, divergence and success, with arbitrary state. Erasing and restoring the unit output are mutual inverses. This is a representation theorem, not a substitute callback algorithm or an authorization claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Support/UnitCallback.lean" +sha256 = "d109873a6dd0b27d2dc8a555b303a1d39adf25543dc9f9a1ba6c970801059d25" + +[[claims]] +claim_id = "AP-FORMAL-RICH-482" +claim_text = "The transparent unit-output ABI adapter proves restore_erase." +claim_status = "proved" +lean_declaration = "Auths.Support.UnitCallback.restore_erase" +lean_statement_sha256 = "75bc2958cfbe588c0d61860522aaf6ab9b5956f3d5212d59a62c4aafa34ef5fa" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every typed Result value, including failure, divergence and success, with arbitrary state. Erasing and restoring the unit output are mutual inverses. This is a representation theorem, not a substitute callback algorithm or an authorization claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Support/UnitCallback.lean" +sha256 = "d109873a6dd0b27d2dc8a555b303a1d39adf25543dc9f9a1ba6c970801059d25" + +[[claims]] +claim_id = "AP-FORMAL-RICH-483" +claim_text = "The shipping event accessor returns exactly the independent event outcome." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Facade.event_outcome_exact" +lean_statement_sha256 = "2910444609cbd339e02e2193069ef90faabbefdb1527d5afbf9f4ff91265e497" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::{auths_composition::EvaluationEvent}::outcome"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every proof or aggregate event, with arbitrary references, counts and branch result. No premise is required." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Facade.lean" +sha256 = "a9c25e6634ab8b6822d3200140df2b556ba4d3a5ef002f75444ef951b642b8e2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-484" +claim_text = "The shipping anonymous observer callback preserves exactly its state and discards the event." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Facade.observer_mut_exact" +lean_statement_sha256 = "18de38b3ea62027468f0c557efd03f2e146bfb443dd5e8a64a22a246bfa6e82e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every branch callback dictionary, unit observer state and event. The branch callback is not invoked and no correctness or totality contract is required." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Facade.lean" +sha256 = "a9c25e6634ab8b6822d3200140df2b556ba4d3a5ef002f75444ef951b642b8e2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-485" +claim_text = "The shipping one-use observer callback returns exactly unit." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Facade.observer_once_exact" +lean_statement_sha256 = "10f99246a767de3e49062f873c5841ca6a1ba0736a7011d03076fff43c22c026" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_once", + "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every branch callback dictionary, unit observer state and event. The state-return ABI adapter is separate and has both general Result round-trip proofs." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Facade.lean" +sha256 = "a9c25e6634ab8b6822d3200140df2b556ba4d3a5ef002f75444ef951b642b8e2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-486" +claim_text = "The complete shipping public facade agrees with independent structural validation and three-valued plan evaluation." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Facade.evaluate_refines" +lean_statement_sha256 = "ff594f9bc94096d40fc471ed2251e6b5c15aad4688fe9585b3541c4ee797c5f4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate", + "auths_composition::evaluate_observed", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan, arbitrary branch state and protocol-sized limits. An exact total stateful branch callback contract is explicit. Validation success/refusal and the exact result/final branch state are fixed; the actual stateless observer contract is discharged by the proof." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Facade.lean" +sha256 = "a9c25e6634ab8b6822d3200140df2b556ba4d3a5ef002f75444ef951b642b8e2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-487" +claim_text = "The shipping public facade refuses independently invalid plans before calling the branch." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Facade.invalid_plan_preserves_callback" +lean_statement_sha256 = "c4c751968624563c9b3219eeb5a5d4ea7c1f6b86e16a27509d7246dff10d9769" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate", + "auths_composition::evaluate_observed", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every independently invalid represented plan under protocol-sized limits and arbitrary native callback and initial state. No callback correctness or totality premise is needed. The result is AuthorizationPlanInvalid with the exact initial state." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Facade.lean" +sha256 = "a9c25e6634ab8b6822d3200140df2b556ba4d3a5ef002f75444ef951b642b8e2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-488" +claim_text = "A kernel-checked execution establishes the concrete conjunction_authorizes public-facade witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.FacadeExamples.conjunction_authorizes" +lean_statement_sha256 = "648e2c43583cded21bc3e6191c9d669a1498d6a8c824b3c8ab31b42476eab462" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed two- or three-leaf plan, protocol-sized limits, actual stateful callback and initial state. Acceptance, indeterminacy or structural refusal fixes the exact final state. These are composition witnesses, not complete proof-authenticity or verifier witnesses." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/FacadeExamples.lean" +sha256 = "4f6f424162dd3a2eb277085bf53f389dedc9b950da0b25ab2f496a70a1fefe61" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-489" +claim_text = "A kernel-checked execution establishes the concrete duplicate_refused public-facade witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.FacadeExamples.duplicate_refused" +lean_statement_sha256 = "4e015051525fd5d6a145a3ed6d2242e2d43b9e17ac9aba13ba20cf4254e6a103" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed two- or three-leaf plan, protocol-sized limits, actual stateful callback and initial state. Acceptance, indeterminacy or structural refusal fixes the exact final state. These are composition witnesses, not complete proof-authenticity or verifier witnesses." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/FacadeExamples.lean" +sha256 = "4f6f424162dd3a2eb277085bf53f389dedc9b950da0b25ab2f496a70a1fefe61" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-490" +claim_text = "A kernel-checked execution establishes the concrete threshold_indeterminate public-facade witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.FacadeExamples.threshold_indeterminate" +lean_statement_sha256 = "c466b88ecc52016b13b10296cd8b25f7022f7845baaf571ca2ace37dff323ca7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed two- or three-leaf plan, protocol-sized limits, actual stateful callback and initial state. Acceptance, indeterminacy or structural refusal fixes the exact final state. These are composition witnesses, not complete proof-authenticity or verifier witnesses." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/FacadeExamples.lean" +sha256 = "4f6f424162dd3a2eb277085bf53f389dedc9b950da0b25ab2f496a70a1fefe61" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-462" +claim_text = "The independent numeric encoding model proves lower_seven." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Byte.lower_seven" +lean_statement_sha256 = "2bc618538905b26271df62992a25127c7072aa81e19069552c4d78b23da6d541" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Byte.lean" +sha256 = "8d746682a49eafcf5b42844d9a4e1cb2f4989dfbc2ceb6e170832e1a3a6b6879" + +[[claims]] +claim_id = "AP-FORMAL-RICH-463" +claim_text = "The independent numeric encoding model proves sign_bit." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Byte.sign_bit" +lean_statement_sha256 = "7cae4c3731f6b8c3f0dabaaa2a3c27b130925a939caa52acae47a7d80c30842b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Byte.lean" +sha256 = "8d746682a49eafcf5b42844d9a4e1cb2f4989dfbc2ceb6e170832e1a3a6b6879" + +[[claims]] +claim_id = "AP-FORMAL-RICH-464" +claim_text = "The independent numeric encoding model proves value_bound." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Digits.value_bound" +lean_statement_sha256 = "4e3e9ff2b44d0442bf8f1a434571ab0c559e773694d8969e1ff1cd7f45337fb4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Digits.lean" +sha256 = "eb2a5060d4e96e7ff322b5c64a6d479fefcb761dbee5845fae4d3f138f9b53f6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-465" +claim_text = "The independent numeric encoding model proves maximum_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Digits.maximum_iff" +lean_statement_sha256 = "4b004494a002811d90dad7580a206045592dc984ef928ec5c65ee16fcee3bff8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Digits.lean" +sha256 = "eb2a5060d4e96e7ff322b5c64a6d479fefcb761dbee5845fae4d3f138f9b53f6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-466" +claim_text = "The independent numeric encoding model proves zero_iff." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Digits.zero_iff" +lean_statement_sha256 = "c303bf2f19e441e2e6e7aa533c0bf6d095415fb23806e3b24e8138f83a451832" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Digits.lean" +sha256 = "eb2a5060d4e96e7ff322b5c64a6d479fefcb761dbee5845fae4d3f138f9b53f6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-467" +claim_text = "The independent numeric encoding model proves encoding_criterion." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Coordinate.encoding_criterion" +lean_statement_sha256 = "da42ff55c70d3081f41fd6d6b2097b841a7173da723ca0f6c5547bc74bea9ef1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Coordinate.lean" +sha256 = "7fda5fde9c5385ae0708e590c2d5ba7df66ec1e8771ce04b58baee4f75cca208" + +[[claims]] +claim_id = "AP-FORMAL-RICH-468" +claim_text = "The actual shipping Ed25519 scan loop terminates and agrees with a finite left fold over exactly the remaining bytes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Scan.loop_refines" +lean_statement_sha256 = "2173fd4d781f9c8ff64eaa0b138b331fa5a3ada7f66079c94f0d8659ef8f79d1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every 32-byte array, Boolean accumulator pair and translated range with start+remaining=end and end at most 31. The proof establishes all reads are in bounds and fixes the exact result; this is a loop component theorem." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Scan.lean" +sha256 = "dae93b5d32b5e60b12847d522e5302f133596eeb8a93ae3dc049d21f6c73bfb0" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-469" +claim_text = "The independent numeric encoding model proves input_decomposes." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Encoded.input_decomposes" +lean_statement_sha256 = "193c9f5e1007183bf20602d4e49230a4b67abbc16a874838ecdef8dd61467511" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Encoded.lean" +sha256 = "73c37fc338a63ba9807326700e5eca42f1c599b534ea80d453a51362e24592be" + +[[claims]] +claim_id = "AP-FORMAL-RICH-470" +claim_text = "The independent numeric encoding model proves ordinate_frame." +claim_status = "proved" +lean_declaration = "Auths.Crypto.Encoding.Encoded.ordinate_frame" +lean_statement_sha256 = "5ea7181acc3e51404433f60442b7d66d0af752b2627c860f33a4eb82bf2f8f94" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Encoded.lean" +sha256 = "73c37fc338a63ba9807326700e5eca42f1c599b534ea80d453a51362e24592be" + +[[claims]] +claim_id = "AP-FORMAL-RICH-471" +claim_text = "The actual shipping Ed25519 scan returns flags with exact independent numeric meanings for the upper-coordinate bytes." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.RootFlags.root_flags" +lean_statement_sha256 = "31f2c9e1886e8e7ecabcb1c5d14dc9242ed50faae5cc037f73a9337f1b401a2f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented 32-byte array. The maximum flag iff the upper-coordinate value is 128*256^30-1, and the zero flag iff it is zero. This is the scan component, not full key or signature validation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/RootFlags.lean" +sha256 = "fcae291f70a79e0603ae7af06f08cb065ffa439e8f28ec4ec9fc3db12dabae65" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-472" +claim_text = "The shipping Ed25519 compressed-point encoding guard is total and returns exactly the independent base-256 coordinate/sign criterion." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Ed25519.guard_refines" +lean_statement_sha256 = "f11f729940b77e3438ea31dd2a6b507afd0b7408dbeda2b2483ef85a5fc71de0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented 32-byte array. Success iff its sign-masked little-endian y-coordinate is below 2^255-19 and a set sign bit is not paired with y=1 or y=p-1. No assumption about a source guard result, curve membership, key strength, signature validity or message authenticity is made." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Ed25519.lean" +sha256 = "04707df8039770a61980fcaf6b91799e7917c5a7a6195f66d96878721a2d28fe" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-473" +claim_text = "The shipping P-256 compressed SEC1 encoding guard is total and returns exactly the independent length/tag criterion." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.P256.guard_refines" +lean_statement_sha256 = "a3ebd38b5d96a7f7a92e4a5952b60488ac57e016469992898e76df8c31c33b86" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_key_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented bounded slice, including empty and malformed lengths. Success iff length is exactly 33 and the first byte is 2 or 3. Point recovery is a separate library operation; form acceptance alone does not validate a curve point." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/P256.lean" +sha256 = "167c57dc69a01e6fb2f4e568e7611d7732b68a712367e6a9ec908eafc18ba1a2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-474" +claim_text = "A kernel-checked execution establishes the concrete rfc_key_encoding_accepted encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted" +lean_statement_sha256 = "030e055576af5979062935dbbc8617dd639ea04ea6b143eb0fdf2710b1d198b0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-475" +claim_text = "A kernel-checked execution establishes the concrete field_alias_refused encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.field_alias_refused" +lean_statement_sha256 = "d701b4eca60580a20e2691fd1db74c037cfad3a6cbf428fab60b1a3e46b6439c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-476" +claim_text = "A kernel-checked execution establishes the concrete negative_zero_refused encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.negative_zero_refused" +lean_statement_sha256 = "f1d75ef4dd9e1d55b37e6746856635dece4afc9603a7786e73b7a49909c81f2f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-477" +claim_text = "A kernel-checked execution establishes the concrete canonical_identity_encoding_accepted encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted" +lean_statement_sha256 = "5b990f9dd33504deff32ef28934e9cb33f9512636bd0442c430db2121aad2f89" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::ed25519_point_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-478" +claim_text = "A kernel-checked execution establishes the concrete compressed_form_accepted encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.compressed_form_accepted" +lean_statement_sha256 = "f58e33797528fd18227bdc2af7651e10d1b6077e6ab1b93c2dc35a5239298eb2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_key_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-479" +claim_text = "A kernel-checked execution establishes the concrete uncompressed_tag_refused encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.uncompressed_tag_refused" +lean_statement_sha256 = "2af93e63b1ea0259e4a93b3c0f7c415233b2660c1c525e9d1ce7193d8afd7562" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_key_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-480" +claim_text = "A kernel-checked execution establishes the concrete short_compressed_refused encoding witness." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Encoding.Examples.short_compressed_refused" +lean_statement_sha256 = "e0149fa0fda99aecb4af30f1ad1f625f77ba7bc23ff9d912dc389b631de6f883" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_signature_core::p256_key_encoding_is_canonical"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Encoding/Examples.lean" +sha256 = "2f23dd3ba99e0396cfc03859a782d53817ba8683afa5eaf292b6f78571755645" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/signature/Funs.lean" +sha256 = "dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-426" +claim_text = "The reviewed standard-container model proves reference_key_injective." +claim_status = "proved" +lean_declaration = "Auths.Composition.Order.reference_key_injective" +lean_statement_sha256 = "af0e9274a8510f0396f0f23df240ff2c5ed41112d3f55a90d76cd9dc2e27347c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Order.lean" +sha256 = "8d83430505589f97970689e4ef5b426f5322c2550d7765a38d37da69ec353e87" + +[[claims]] +claim_id = "AP-FORMAL-RICH-427" +claim_text = "The shipping derived ProofRef comparator returns exactly lexicographic order of its byte values." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Order.reference_comparison" +lean_statement_sha256 = "db562ef60e4ff8095b471ea82811d408285af97e2972b93580da5ea369dad183" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::{impl core::cmp::Ord for auths_model::ProofRef}::cmp", + "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of fixed-width ProofRef carriers. The proof unfolds both translated derived comparators and the reviewed fixed-array comparison model; it introduces no opaque Auths ordering predicate." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Order.lean" +sha256 = "8d83430505589f97970689e4ef5b426f5322c2550d7765a38d37da69ec353e87" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-428" +claim_text = "The reviewed standard-container model proves insert_values." +claim_status = "proved" +lean_declaration = "Auths.Composition.SetModel.insert_values" +lean_statement_sha256 = "357fede6388e078b7430e6493cb877a128603a10d90869a4c5322364c7c05d9f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/SetModel.lean" +sha256 = "e3dc901fc02a6b2de5943ae8cd56a7b97d57f7bf6ad643c97c6c4ace7d6ffa2a" + +[[claims]] +claim_id = "AP-FORMAL-RICH-429" +claim_text = "The reviewed standard-container model proves ordered_nodup." +claim_status = "proved" +lean_declaration = "Auths.Composition.SetModel.ordered_nodup" +lean_statement_sha256 = "a87a8b80a2401f063af9e082eb76a365858bea371bcbac0002de859e76328357" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/SetModel.lean" +sha256 = "e3dc901fc02a6b2de5943ae8cd56a7b97d57f7bf6ad643c97c6c4ace7d6ffa2a" + +[[claims]] +claim_id = "AP-FORMAL-RICH-430" +claim_text = "The reviewed standard-container model proves insert_set." +claim_status = "proved" +lean_declaration = "Auths.Composition.SetModel.insert_set" +lean_statement_sha256 = "6afdd70331b9997707a93e3483b390fca5386f5f48363d5d954c8b773c1aaa35" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/SetModel.lean" +sha256 = "e3dc901fc02a6b2de5943ae8cd56a7b97d57f7bf6ad643c97c6c4ace7d6ffa2a" + +[[claims]] +claim_id = "AP-FORMAL-RICH-431" +claim_text = "The reviewed standard-container model proves push_exact." +claim_status = "proved" +lean_declaration = "Auths.Composition.Collect.push_exact" +lean_statement_sha256 = "a009e7a7f70bac6ad065dcdb1015f084642b2ecbaf9a00074043f932ec309f23" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Collect.lean" +sha256 = "97c0cc0344850e1507fb82e9fc8e1b582623c57988cdb422d75a5d5537764b94" + +[[claims]] +claim_id = "AP-FORMAL-RICH-432" +claim_text = "The shipping validation collection loop terminates and preserves the exact ordered reference sequence." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Collect.collect_exact" +lean_statement_sha256 = "4a1ffee10d27a26b4942ba1778f812076393e7f45525d5d77a8e80a99b57fcce" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::AuthorizationPlan}::validate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every consuming set iterator and initial positive bounded vector whose combined length fits usize. The result sequence is the initial sequence followed by every remaining iterator element. This is the collection loop, not a proof of every operation in the containing Rust function." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Collect.lean" +sha256 = "97c0cc0344850e1507fb82e9fc8e1b582623c57988cdb422d75a5d5537764b94" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-433" +claim_text = "The independent structural plan model proves checker_preserves_capacity." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationCapacity.checker_preserves_capacity" +lean_statement_sha256 = "3c07f9c49284d4dc4208d959bd1ac04df7854153397f2a6f021d8c1d23721652" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationCapacity.lean" +sha256 = "a05578e6c72fb5ab785a878eccfd191a771ea2ee8b80bfa7a166a3cfec735400" + +[[claims]] +claim_id = "AP-FORMAL-RICH-434" +claim_text = "The independent structural plan model proves progress_append." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationProgress.progress_append" +lean_statement_sha256 = "7e385917be03e1de30808fafcab6e91c2591c0ea8cee771f71d4aec16d5de4a8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationProgress.lean" +sha256 = "e2bdea582893b613879ee5f390ddcf1a3913ad5e3d4057e7a8ffc544c7b5f039" + +[[claims]] +claim_id = "AP-FORMAL-RICH-435" +claim_text = "The independent structural plan model proves progress_card." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationProgress.progress_card" +lean_statement_sha256 = "eac93923c9d4b491517f313e80f4c52f72d26b572e060f5caed11e56f73de0c0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationProgress.lean" +sha256 = "e2bdea582893b613879ee5f390ddcf1a3913ad5e3d4057e7a8ffc544c7b5f039" + +[[claims]] +claim_id = "AP-FORMAL-RICH-436" +claim_text = "The independent structural plan model proves checker_progress." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationProgress.checker_progress" +lean_statement_sha256 = "787cedc42e09dfb4f08fb01adefe7c2abccef52244e71735fd0aa57f4da4abc6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationProgress.lean" +sha256 = "e2bdea582893b613879ee5f390ddcf1a3913ad5e3d4057e7a8ffc544c7b5f039" + +[[claims]] +claim_id = "AP-FORMAL-RICH-437" +claim_text = "The independent structural plan model proves checker_shape." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationShape.checker_shape" +lean_statement_sha256 = "6cc49d6f9a1385836ed54c0ffa4c079906fda06ec68e1de2daf349e3cdf79fda" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationShape.lean" +sha256 = "caf036acfb0ac4315bbf05473efaf39c6506da3cce4e37cb0d8e6910a4787a30" + +[[claims]] +claim_id = "AP-FORMAL-RICH-438" +claim_text = "The independent structural plan model proves checker_complete." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationComplete.checker_complete" +lean_statement_sha256 = "56597da8e73125b7f8c9d7af0530cdac765e38c998d2c376e59e8261e311efa9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationComplete.lean" +sha256 = "47561b6ac7f7e8b7cb89399d9e70052415a71729d7932663557746400f047006" + +[[claims]] +claim_id = "AP-FORMAL-RICH-439" +claim_text = "The independent structural plan model proves valid_is_accepted." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationComplete.valid_is_accepted" +lean_statement_sha256 = "5fdd4531a740158f3ce43a6bbfd5addd09bf934d8d84bf26e54d122e58417741" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationComplete.lean" +sha256 = "47561b6ac7f7e8b7cb89399d9e70052415a71729d7932663557746400f047006" + +[[claims]] +claim_id = "AP-FORMAL-RICH-440" +claim_text = "The independent structural plan model proves accepted_is_valid." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationSoundness.accepted_is_valid" +lean_statement_sha256 = "453d07deb11e317dad5dd497f7a8fd3cb386fd672ccf8d52b5782a83d3908a10" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationSoundness.lean" +sha256 = "36e7a828878d17135c55a1c8e8fdba9a52f5df12e42a78f9843137d2074a0755" + +[[claims]] +claim_id = "AP-FORMAL-RICH-441" +claim_text = "The independent structural plan model proves accepted_iff_valid." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationSoundness.accepted_iff_valid" +lean_statement_sha256 = "171b69a21f80078156f7eba1bd9485945d77cd959980bcd6c2340c8b0ef5c40a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationSoundness.lean" +sha256 = "36e7a828878d17135c55a1c8e8fdba9a52f5df12e42a78f9843137d2074a0755" + +[[claims]] +claim_id = "AP-FORMAL-RICH-442" +claim_text = "The independent structural plan model proves operators_are_proper." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationSoundness.operators_are_proper" +lean_statement_sha256 = "c685e995c561b692797e0f206302ec8e21776afb2903992c30231991ba2ee6b3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationSoundness.lean" +sha256 = "36e7a828878d17135c55a1c8e8fdba9a52f5df12e42a78f9843137d2074a0755" + +[[claims]] +claim_id = "AP-FORMAL-RICH-443" +claim_text = "The independent structural plan model proves valid_has_bounded_events." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationSoundness.valid_has_bounded_events" +lean_statement_sha256 = "60fe0c09537c2970289405e750f22c5217e3589f7321199433a1e398e29c69e8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationSoundness.lean" +sha256 = "36e7a828878d17135c55a1c8e8fdba9a52f5df12e42a78f9843137d2074a0755" + +[[claims]] +claim_id = "AP-FORMAL-RICH-444" +claim_text = "The reviewed standard-container model proves word_max_exact." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationLeaves.word_max_exact" +lean_statement_sha256 = "6ef316471351137cc7eb7aa93e2e88668fba5df0d745cda9df666261795fda9f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationLeaves.lean" +sha256 = "d95b45892a9d2c63b0de19698a4866ac921ce01e28bf9a7cd4030348becf14b2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-445" +claim_text = "The shipping proof-leaf validator agrees exactly with the independent duplicate, depth and leaf-capacity decisions." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationLeaves.proof_leaf_exact" +lean_statement_sha256 = "d36b9d0c18062a49176b6a9007e4c36a502edb96cb318d3ed28eafa9613c7c1e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::AuthorizationPlan}::validate::walk"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every reference, word depth, maximum-depth state, limits record and ordered set with one slot of usize headroom. The postcondition fixes the exact refusal category or successful set/depth meaning. It is a leaf component result." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationLeaves.lean" +sha256 = "d95b45892a9d2c63b0de19698a4866ac921ce01e28bf9a7cd4030348becf14b2" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-446" +claim_text = "The complete shipping recursive plan validator refines the independent structural checker." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationRefinement.walk_refines" +lean_statement_sha256 = "cf7abb731376bfbe6bcdee172a943b8dcfef3469885eda809309148095ea31b5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan, limits with leaf/branching caps at most 128 and depth cap at most 16, a current depth at most 17, and an ordered reference set within its declared leaf cap. The exact refusal reason or successful seen-reference set and maximum-depth state are preserved, including first-failure order." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationRefinement.lean" +sha256 = "6ec57f5c6fc9c73b28bd196900d08470737da33c3497edb221fdf658688ff60f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-447" +claim_text = "The public shipping validator is total and agrees with the independent checker and returned shape relation." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationPublic.validator_refines" +lean_statement_sha256 = "0fdfb916a94dc9b08fa88dca71f9467257e669f7fd951b7bc75a763297dd95b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan and explicit protocol-sized limits record. The validator preserves the exact refusal category; success returns an ordered vector with exactly the model reference set and computed maximum depth. The private source collection uses the actual consuming iterator; physical allocations remain the standard-library boundary." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationPublic.lean" +sha256 = "f06149f4724cf17b0d68413f23ae23753754073250587cc7483ff95e6b5346ff" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-448" +claim_text = "The complete public shipping composition evaluator returns exactly independent validation followed by three-valued evaluation." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationPublic.public_evaluator_refines" +lean_statement_sha256 = "f1ec63bfb390198b1b8620acd24c392503c753cd311bfee217c3bd7d33277164" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_composition::evaluate_node", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan and initial callback state under protocol-sized limits. Exact total stateful callback contracts are explicit premises. Both valid and invalid structures are covered; refused plans preserve both states. Successful evaluation preserves all/any/k outcomes, source-order callbacks and postorder aggregate events." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationPublic.lean" +sha256 = "f06149f4724cf17b0d68413f23ae23753754073250587cc7483ff95e6b5346ff" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-449" +claim_text = "The public shipping validator accepts exactly the independently structurally valid bounded plans." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationContract.source_accepts_iff_valid" +lean_statement_sha256 = "5c685c9dbd49878e8f9635551f2bdbbcdab9cc7a20a0ac8440679e7562de0d7b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::AuthorizationPlan}::validate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan and explicit protocol-sized limits. Valid is defined without a checker result: valid nonempty operators and thresholds, per-node width, total structural depth, distinct leaves and total leaf count. The iff proves both soundness and useful acceptance; it assumes no source-validation result." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationContract.lean" +sha256 = "707958fa123a955a2bf264e230f65f39a8645bb0f6267790e649447f9f9387ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-450" +claim_text = "Every independently valid bounded plan reaches the public shipping evaluator with exactly the independent result and both callback states." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationContract.valid_public_evaluator_refines" +lean_statement_sha256 = "8b2a622701e852b0e43eb9cf6a72193b60d5d6da27928165549da4f2e396fcc5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_composition::evaluate_node", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every independently valid finite represented plan and arbitrary initial state under protocol-sized limits. The exact total native/model branch and observer call contracts are explicit; the proof discharges the actual source validator through structural validity instead of assuming validation succeeds." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationContract.lean" +sha256 = "707958fa123a955a2bf264e230f65f39a8645bb0f6267790e649447f9f9387ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-451" +claim_text = "The public shipping evaluator rejects every structurally invalid plan before either callback." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks" +lean_statement_sha256 = "fbea9784577a0b3682651fdee45b5090fe24e6bf2dd8a5da566a33bb81cfddb9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every invalid finite represented plan, protocol-sized limits and arbitrary native callbacks and initial states. No callback correctness or totality premise is required. The result is AuthorizationPlanInvalid with both callback states unchanged." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationContract.lean" +sha256 = "707958fa123a955a2bf264e230f65f39a8645bb0f6267790e649447f9f9387ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-452" +claim_text = "The public shipping evaluator emits at most 2048 events for every independently valid protocol-bounded plan." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationContract.public_event_bound" +lean_statement_sha256 = "73c020374880e6e180bdc521c5fa56f57279cd74ff212f2960d02b2de592b4b5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_composition::evaluate_node", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every independently valid plan under depth at most 16 and at most 128 distinct leaves, with exact total branch and counting-observer contracts. This is a semantic event bound, not a bound on callback cost, allocation, stack or the complete verifier." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationContract.lean" +sha256 = "707958fa123a955a2bf264e230f65f39a8645bb0f6267790e649447f9f9387ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-453" +claim_text = "The independent structural validity contract establishes the concrete conjunction_valid witness." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationExamples.conjunction_valid" +lean_statement_sha256 = "35f730fa88f37857b9f943e1085ffd0351cd0fe55f51e63505941752350cedb0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact finite plan and limits in the statement. Model validity/refusal lemmas support separately qualified public-source execution witnesses; no leaf-proof or cryptographic authority claim follows from structural validity alone." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims]] +claim_id = "AP-FORMAL-RICH-454" +claim_text = "A kernel-checked public composition execution establishes the public_conjunction witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationExamples.public_conjunction" +lean_statement_sha256 = "28a6c49d50cea199acd691e38f486a9f2394fd23a5fab58ded200f18ea23590a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-455" +claim_text = "A kernel-checked public composition execution establishes the duplicate_refused witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationExamples.duplicate_refused" +lean_statement_sha256 = "42589db455503316f95320c9dbb99934bf65c51011fac8ead8e0cdfc38333497" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-456" +claim_text = "A kernel-checked public composition execution establishes the zero_threshold_refused witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationExamples.zero_threshold_refused" +lean_statement_sha256 = "6673aa1dd02e4a1ccb17c27878d310b3f6d6b43d2c5b541d1e3d5ff33453b0a9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-457" +claim_text = "The independent structural validity contract establishes the concrete empty_invalid witness." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationExamples.empty_invalid" +lean_statement_sha256 = "ee03366005042b6050192564179a3af2aa62dd28982dc141f17da58e4c4d9e1f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact finite plan and limits in the statement. Model validity/refusal lemmas support separately qualified public-source execution witnesses; no leaf-proof or cryptographic authority claim follows from structural validity alone." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims]] +claim_id = "AP-FORMAL-RICH-458" +claim_text = "The independent structural validity contract establishes the concrete mixed_threshold_valid witness." +claim_status = "proved" +lean_declaration = "Auths.Composition.ValidationExamples.mixed_threshold_valid" +lean_statement_sha256 = "648e808ae1572d3fbddda76a51cbdda0117ec7386ef2c1ae4900d489f81d6ac8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact finite plan and limits in the statement. Model validity/refusal lemmas support separately qualified public-source execution witnesses; no leaf-proof or cryptographic authority claim follows from structural validity alone." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims]] +claim_id = "AP-FORMAL-RICH-459" +claim_text = "A kernel-checked public composition execution establishes the public_threshold_indeterminate witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationExamples.public_threshold_indeterminate" +lean_statement_sha256 = "916f4499aeabe940c9b74ac19bd8030bd280c9b7a5fc689faeee1ec97232f097" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-460" +claim_text = "A kernel-checked public composition execution establishes the narrow_refused witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationExamples.narrow_refused" +lean_statement_sha256 = "2b8d32ee27baac1041282871c4962da7280bca78fb8bb0e56b55822b09072dbe" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-461" +claim_text = "A kernel-checked public composition execution establishes the shallow_refused witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.ValidationExamples.shallow_refused" +lean_statement_sha256 = "cc8680b35f83362ad370d4d1e4bfeabf39f13eef6cc419151f334824f45d1625" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance." +residual_assumptions = [ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/ValidationExamples.lean" +sha256 = "ad5aa484575461f90eecbd46041fa947ccb66ef0cfb1f65319a367ee86a8bde8" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-409" +claim_text = "The independent nonempty plan model proves node_bound." +claim_status = "proved" +lean_declaration = "Auths.Composition.Bounds.node_bound" +lean_statement_sha256 = "54e66bf400bd8650b2e8458d48f666668c576e9b33590623941f8cfce82a1840" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All finite plans with no empty compound node. Node count is bounded by depth times leaf count; the explicit depth-16 and 128-leaf premises give 2048 events. This is a structural semantic-event bound, not a complete verifier, callback, allocation or host-stack bound." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Bounds.lean" +sha256 = "d9632fcccab7ba6f98bfad776b13f977faba2e23adc89322db78396912275dad" + +[[claims]] +claim_id = "AP-FORMAL-RICH-410" +claim_text = "The independent nonempty plan model proves bounded_events." +claim_status = "proved" +lean_declaration = "Auths.Composition.Bounds.bounded_events" +lean_statement_sha256 = "17d5a3c085b9f9fa5f25312d04d42c3e5eccb846be6b7512bff4991585b24655" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All finite plans with no empty compound node. Node count is bounded by depth times leaf count; the explicit depth-16 and 128-leaf premises give 2048 events. This is a structural semantic-event bound, not a complete verifier, callback, allocation or host-stack bound." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Bounds.lean" +sha256 = "d9632fcccab7ba6f98bfad776b13f977faba2e23adc89322db78396912275dad" + +[[claims]] +claim_id = "AP-FORMAL-RICH-411" +claim_text = "The shipping inner evaluator emits at most 2048 node events for plans satisfying the explicit nonempty, 128-leaf and depth-16 structural premises." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Bounds.source_bounded_events" +lean_statement_sha256 = "b4f7bc5a833a8487fb5533229b7f130c603e002f7b37accbefa4487146f26575" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_node", + "auths_composition::evaluate_members", + "auths_composition::observe_aggregate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented plan whose independently computed view has no empty compound node, at most 128 leaves and depth at most 16, under exact total branch and counting-observer contracts. The theorem checks the actual source evaluator result. Public constructor/validation correspondence and callback/stack/full-verifier cost remain outside the claim; the shape premises are not replaced by a trusted validity flag." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed qualified discriminant names and isomorphic positive bounded-vector model, standard-library models, and listed foundational axioms are trusted. The official recursive-loop extraction flag changes no Rust semantics.", + "The statements quantify over explicit native and model callbacks and require their exact stateful call contracts. They prove the inner plan evaluator, not the implementation of leaf verification, public plan validation, stage/registry composition, sealed result projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Bounds.lean" +sha256 = "d9632fcccab7ba6f98bfad776b13f977faba2e23adc89322db78396912275dad" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-412" +claim_text = "The transparent positive bounded-vector adapter proves toBase_ofBase." +claim_status = "proved" +lean_declaration = "auths_composition.alloc.vec.Vec.toBase_ofBase" +lean_statement_sha256 = "17d494b1582d6cf6e47a2bfb7f6ca521ff72b3c4eb943c237600b177a1ac6ebe" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every vector in the pinned usize-bounded carrier. Both conversion round trips, injectivity and exact deref delegation preserve all elements and their order. This is standard-container model equivalence, not an Auths authorization decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Support/PositiveVec.lean" +sha256 = "246c314719867482a10057612dc199e605e38189c67a59cf4e57a274b5ad0bb5" + +[[claims]] +claim_id = "AP-FORMAL-RICH-413" +claim_text = "The transparent positive bounded-vector adapter proves ofBase_toBase." +claim_status = "proved" +lean_declaration = "auths_composition.alloc.vec.Vec.ofBase_toBase" +lean_statement_sha256 = "244090f0cbede6c0e01c1c3fcd4c5962e43191325186211d3225603997531813" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every vector in the pinned usize-bounded carrier. Both conversion round trips, injectivity and exact deref delegation preserve all elements and their order. This is standard-container model equivalence, not an Auths authorization decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Support/PositiveVec.lean" +sha256 = "246c314719867482a10057612dc199e605e38189c67a59cf4e57a274b5ad0bb5" + +[[claims]] +claim_id = "AP-FORMAL-RICH-414" +claim_text = "The transparent positive bounded-vector adapter proves toBase_injective." +claim_status = "proved" +lean_declaration = "auths_composition.alloc.vec.Vec.toBase_injective" +lean_statement_sha256 = "8b3cf8db00bad7b708fd25892170178560e09ef402f16cb94fa40287539d2b08" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every vector in the pinned usize-bounded carrier. Both conversion round trips, injectivity and exact deref delegation preserve all elements and their order. This is standard-container model equivalence, not an Auths authorization decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Support/PositiveVec.lean" +sha256 = "246c314719867482a10057612dc199e605e38189c67a59cf4e57a274b5ad0bb5" + +[[claims]] +claim_id = "AP-FORMAL-RICH-415" +claim_text = "The transparent positive bounded-vector adapter proves deref_exact." +claim_status = "proved" +lean_declaration = "auths_composition.alloc.vec.Vec.deref_exact" +lean_statement_sha256 = "808cf23462349c46b20d5e73816c83b40ef5061ab08634cc7e9d00d5ad500fdd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every vector in the pinned usize-bounded carrier. Both conversion round trips, injectivity and exact deref delegation preserve all elements and their order. This is standard-container model equivalence, not an Auths authorization decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Support/PositiveVec.lean" +sha256 = "246c314719867482a10057612dc199e605e38189c67a59cf4e57a274b5ad0bb5" + +[[claims]] +claim_id = "AP-FORMAL-RICH-416" +claim_text = "The complete shipping inner plan evaluator returns exactly the independent recursive plan semantics, including final branch state and post-order observer state." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Traversal.evaluator_refines" +lean_statement_sha256 = "d55e4512b0ee2b76dc6024dd21730b5f97c28f7b095237f6566ae10e7bb4a186" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_node", + "auths_composition::evaluate_members", + "auths_composition::observe_aggregate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan, every initial branch/observer state, and every pair of total stateful callbacks satisfying the explicit exact call contracts. All/any/k nodes evaluate all children in source order, with exact counts, diagnostics and aggregate events. This theorem also covers typed shapes that public validation refuses; it does not assert their acceptance." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed qualified discriminant names and isomorphic positive bounded-vector model, standard-library models, and listed foundational axioms are trusted. The official recursive-loop extraction flag changes no Rust semantics.", + "The statements quantify over explicit native and model callbacks and require their exact stateful call contracts. They prove the inner plan evaluator, not the implementation of leaf verification, public plan validation, stage/registry composition, sealed result projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Traversal.lean" +sha256 = "53e541a792c848c1ea0504296fa8d7620842a3f5e3736a51f152dd192b2664f4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-417" +claim_text = "The independent recursive plan model proves event_count." +claim_status = "proved" +lean_declaration = "Auths.Composition.Work.event_count" +lean_statement_sha256 = "83027700e75f617ed92945c5378945d6ac6dd5ed2f8f251b47831bcfd430e5c7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite independent plan and arbitrary total stateful branch function. Counting events gives the node count; recording proof references gives the exact leaf order. Separate source corollaries establish the shipping evaluator connection under explicit callback contracts." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Work.lean" +sha256 = "f1b4dce0dcdb93c14df72f9b478170b527b7d3c44b27175bcca4240d6448608d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-418" +claim_text = "The independent recursive plan model proves leaf_order." +claim_status = "proved" +lean_declaration = "Auths.Composition.Work.leaf_order" +lean_statement_sha256 = "bf33a4b7bbdfff1037db92af167a5cf20b306216f35addb70c4a8ab4182a87c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite independent plan and arbitrary total stateful branch function. Counting events gives the node count; recording proof references gives the exact leaf order. Separate source corollaries establish the shipping evaluator connection under explicit callback contracts." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Work.lean" +sha256 = "f1b4dce0dcdb93c14df72f9b478170b527b7d3c44b27175bcca4240d6448608d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-419" +claim_text = "The shipping inner evaluator terminates and invokes the counting observer exactly once per plan node." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Work.source_event_count" +lean_statement_sha256 = "c24a1b4a04613b2dc6c054b9811e256820381b7e4051eee5fe61a4f2ea2dc61b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_node", + "auths_composition::evaluate_members", + "auths_composition::observe_aggregate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan, arbitrary initial branch state and natural observer count, under the explicit total branch and counting-observer contracts. The exact increment is the independently defined node count. This counts semantic events; it is not a bound on callback cost, host allocation, stack, or complete verifier work." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed qualified discriminant names and isomorphic positive bounded-vector model, standard-library models, and listed foundational axioms are trusted. The official recursive-loop extraction flag changes no Rust semantics.", + "The statements quantify over explicit native and model callbacks and require their exact stateful call contracts. They prove the inner plan evaluator, not the implementation of leaf verification, public plan validation, stage/registry composition, sealed result projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Work.lean" +sha256 = "f1b4dce0dcdb93c14df72f9b478170b527b7d3c44b27175bcca4240d6448608d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-420" +claim_text = "The shipping inner evaluator records exactly the plan's leaf sequence in order, preserving the supplied prefix." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Work.source_leaf_order" +lean_statement_sha256 = "68cb4f4a228c1a41a80aaa01f53d92b4926d197cdb076932ea74542c7df1ebef" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::evaluate_node", + "auths_composition::evaluate_members", + "auths_composition::observe_aggregate", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite represented plan and initial state, under the explicit total branch and leaf-recording observer contracts. Denied or already-authorized intermediate children do not suppress later leaves. The branch implementations and public plan validation remain separate obligations." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed qualified discriminant names and isomorphic positive bounded-vector model, standard-library models, and listed foundational axioms are trusted. The official recursive-loop extraction flag changes no Rust semantics.", + "The statements quantify over explicit native and model callbacks and require their exact stateful call contracts. They prove the inner plan evaluator, not the implementation of leaf verification, public plan validation, stage/registry composition, sealed result projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Work.lean" +sha256 = "f1b4dce0dcdb93c14df72f9b478170b527b7d3c44b27175bcca4240d6448608d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-421" +claim_text = "A kernel-checked execution of the complete shipping inner plan evaluator establishes the two_leaf_conjunction witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.PlanExamples.two_leaf_conjunction" +lean_statement_sha256 = "9a6f06abbe4b61f6c9f9d9023b19609d90ffa52aef8b000da07e0bcc59402737" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate_node"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The concrete represented two- or three-leaf plan and explicit stateful callbacks in this statement, including exact outcomes, callback counts and post-order events for all/any/k. Native tests mirror the mixed-outcome cases through the public validating wrapper. This is not a complete proof or cryptographic acceptance witness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/PlanExamples.lean" +sha256 = "a4680b6c5bd11f597fca473df1876b2b71942b786d30c26802bbcea99c4da78b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-422" +claim_text = "A kernel-checked execution of the complete shipping inner plan evaluator establishes the all_visits_after_denial witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.PlanExamples.all_visits_after_denial" +lean_statement_sha256 = "a93c98e72a769fa8f057897dfcdf4256ad1e67c5da4992016d577127275f5c45" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate_node"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The concrete represented two- or three-leaf plan and explicit stateful callbacks in this statement, including exact outcomes, callback counts and post-order events for all/any/k. Native tests mirror the mixed-outcome cases through the public validating wrapper. This is not a complete proof or cryptographic acceptance witness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/PlanExamples.lean" +sha256 = "a4680b6c5bd11f597fca473df1876b2b71942b786d30c26802bbcea99c4da78b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-423" +claim_text = "A kernel-checked execution of the complete shipping inner plan evaluator establishes the any_visits_after_authorization witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.PlanExamples.any_visits_after_authorization" +lean_statement_sha256 = "d9b8f3a20531b61f10fcbde95ed743a759cbddf1735357067e97a2638cd65bef" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate_node"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The concrete represented two- or three-leaf plan and explicit stateful callbacks in this statement, including exact outcomes, callback counts and post-order events for all/any/k. Native tests mirror the mixed-outcome cases through the public validating wrapper. This is not a complete proof or cryptographic acceptance witness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/PlanExamples.lean" +sha256 = "a4680b6c5bd11f597fca473df1876b2b71942b786d30c26802bbcea99c4da78b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-424" +claim_text = "A kernel-checked execution of the complete shipping inner plan evaluator establishes the threshold_indeterminate witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.PlanExamples.threshold_indeterminate" +lean_statement_sha256 = "38989f7e31d8a16c0d6d540da281c34df3ca7f4799376e83477febd3e9da69b9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate_node"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The concrete represented two- or three-leaf plan and explicit stateful callbacks in this statement, including exact outcomes, callback counts and post-order events for all/any/k. Native tests mirror the mixed-outcome cases through the public validating wrapper. This is not a complete proof or cryptographic acceptance witness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/PlanExamples.lean" +sha256 = "a4680b6c5bd11f597fca473df1876b2b71942b786d30c26802bbcea99c4da78b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-425" +claim_text = "A kernel-checked execution of the complete shipping inner plan evaluator establishes the threshold_refused witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.PlanExamples.threshold_refused" +lean_statement_sha256 = "a71b108b8ebbb6e0ea55bf3d299644c23486c901dd2e0b956fa458a844c93a4f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::evaluate_node"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The concrete represented two- or three-leaf plan and explicit stateful callbacks in this statement, including exact outcomes, callback counts and post-order events for all/any/k. Native tests mirror the mixed-outcome cases through the public validating wrapper. This is not a complete proof or cryptographic acceptance witness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/PlanExamples.lean" +sha256 = "a4680b6c5bd11f597fca473df1876b2b71942b786d30c26802bbcea99c4da78b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-378" +claim_text = "The independent finite child-sequence model proves least_none_iff_empty." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.least_none_iff_empty" +lean_statement_sha256 = "2ee2e852014695ebe2981f2dcb4f102fcb911f9adb28f9ca54ef9487001ff4de" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-379" +claim_text = "The independent finite child-sequence model proves all_children_authorize_iff." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.all_children_authorize_iff" +lean_statement_sha256 = "35f7973f1f26cdaf855b3bbc2ed3355ace5dfc892ad766e1963500755ae91f71" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-380" +claim_text = "The independent finite child-sequence model proves threshold_children_authorize_iff." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.threshold_children_authorize_iff" +lean_statement_sha256 = "a10d907cd7eecea3c4a92e367bf2b5b666b8430ece894c26be4f7b24060aa993" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-381" +claim_text = "The independent finite child-sequence model proves denial_rank_lexical." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.denial_rank_lexical" +lean_statement_sha256 = "faa79fd8f9be63e07b35c73a8cdb74ba79ed94251c1e619cbc518ea402f35b7e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Diagnostics.lean" +sha256 = "f6ae98591910552b689490bb418d856e49b1fbd6d44afc728a8df0377752dc08" + +[[claims]] +claim_id = "AP-FORMAL-RICH-382" +claim_text = "The independent finite child-sequence model proves requirement_rank_lexical." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.requirement_rank_lexical" +lean_statement_sha256 = "e3f181fc2e4c269e7328e807184f0828d7cb75f3fe7faccaca8ae160c4515009" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Diagnostics.lean" +sha256 = "f6ae98591910552b689490bb418d856e49b1fbd6d44afc728a8df0377752dc08" + +[[claims]] +claim_id = "AP-FORMAL-RICH-383" +claim_text = "The independent finite child-sequence model proves retain_minimum_least." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.retain_minimum_least" +lean_statement_sha256 = "be415ad9dfc47dab2ffee986be98e06a423c168a8b2cfe92ac224a2c304fe4a5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-384" +claim_text = "The independent finite child-sequence model proves record_matches." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.record_matches" +lean_statement_sha256 = "f3a3753b8dea81d14f30e6126c97e8adece71689577d3a4abcb8bc892ccf8bca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-385" +claim_text = "The independent finite child-sequence model proves summarize_matches." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.summarize_matches" +lean_statement_sha256 = "a522ee4fb9f314fa611c1e1a0194f98e437cb884476e39959eafb475f51ba9c6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-386" +claim_text = "The independent finite child-sequence model proves threshold_authorized_iff." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.threshold_authorized_iff" +lean_statement_sha256 = "d6d6ad8b55aa028d69e21fdeabb18509796e6b0c644a068fb98d973e31fc3f97" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-387" +claim_text = "The independent finite child-sequence model proves all_authorized_iff." +claim_status = "proved" +lean_declaration = "Auths.Composition.Model.all_authorized_iff" +lean_statement_sha256 = "0b86e865c76bab1c775d3554688a7878714d3384e28fe314a9ef4cf130f467ad" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Model.lean" +sha256 = "4dc4f18ed70b7da33c87cd82d13f00b268d00ff8dca195b9da3bf4035fcad2ee" + +[[claims]] +claim_id = "AP-FORMAL-RICH-388" +claim_text = "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.denial_order_exact" +lean_statement_sha256 = "186d8bc9b48e3296debbe2f5a0d2dd3bf019748c872930e97858b7e8eb0cc6f5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::DenialReason}::code_order"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-389" +claim_text = "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.denial_precedes_exact" +lean_statement_sha256 = "d04c50ca42ce7a6a1be9bf979dc6a57d393dce845cfde6679820b877ebf62ab9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::DenialReason}::code_precedes"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-390" +claim_text = "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.requirement_order_exact" +lean_statement_sha256 = "4766f7ce4821df1d0e2e1dd52ac8a99d0577c08a9560436ddac01c8353ad7d88" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::Requirement}::code_order"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-391" +claim_text = "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.requirement_precedes_exact" +lean_statement_sha256 = "b167b5b6ab7b13d9a47f2d70266f18fc185945c3056be9d5daa9dc82e5a470a0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::Requirement}::code_precedes"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-392" +claim_text = "The shipping constant-space accumulator returns the exact independent natural-number update for each of the four child outcome variants." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.push_exact" +lean_statement_sha256 = "a855071f5ada02b6724cdb43226daa4cb3ab00cca247588d0838b959ff0ce07e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::summary::push"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every typed summary and child outcome whose two counters can each be incremented within usize; the postcondition fixes both counters and both minimum diagnostics." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-393" +claim_text = "The shipping conjunction finalizer returns exactly the independent denial-before-indeterminate decision." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.all_exact" +lean_statement_sha256 = "6cd9e3b81b0919144a80a91ba2fd674b15d00a183b4b6ec0f9968331ce393bf9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::summary::all"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every typed summary, including empty or inconsistent summaries. The separate Matches theorem establishes minimum-code meaning for a complete child sequence." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-394" +claim_text = "The pinned Aeneas unsigned-word saturating-add model equals the minimum of the word maximum and the natural-number sum." +claim_status = "proved" +lean_declaration = "Auths.Composition.Refinement.saturating_add_exact" +lean_statement_sha256 = "0aeb19ea1447c24d4bc142542c3638ecf722e9a23036bbe0eb868cd3557985d5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of unsigned machine-word model values on either supported width. This proves a property of the pinned standard-library model; it is not a new opaque Auths algorithm or a complete verifier theorem." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims]] +claim_id = "AP-FORMAL-RICH-395" +claim_text = "The shipping threshold finalizer returns exactly the independent count decision and selected diagnostic, including saturating addition." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.threshold_exact" +lean_statement_sha256 = "8633a7adbe435e8be1e81e14b431a4c8be044ffb2ce179f96aea270e6dd381ee" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_composition::summary::threshold", + "auths_composition::evaluate_threshold_counts", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u16 threshold and pair of usize counts with arbitrary diagnostic options, on either supported machine width. Zero and out-of-range thresholds are algebra inputs; plan validation rejects them separately." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-396" +claim_text = "The shipping denial comparison returns precisely strict lexical order of the independent stable V1 denial-code bytes." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.denial_precedes_lexical" +lean_statement_sha256 = "a7f1382813c8618bd05cc46f2108fdb65de2058bfa343fe4cfafd41f7d15e097" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::{auths_model::DenialReason}::code_precedes", + "auths_model::{auths_model::DenialReason}::code_order", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of denial variants. The source rank and public string getter share one catalog; exhaustive native tests separately guard string parity, and the borrowed-string getter itself is outside this extraction." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-397" +claim_text = "The shipping requirement comparison returns precisely strict lexical order of the independent stable V1 requirement-code bytes." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.requirement_precedes_lexical" +lean_statement_sha256 = "fd300c50623c86c7f6d6b6c3e23377e850ea69b376715a7adbc920f3c37a4073" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::{auths_model::Requirement}::code_precedes", + "auths_model::{auths_model::Requirement}::code_order", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of requirement variants. The source rank and public string getter share one catalog; exhaustive native tests separately guard string parity, and the borrowed-string getter itself is outside this extraction." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-398" +claim_text = "The shipping threshold finalizer authorizes exactly when the supplied authorized-child count meets the threshold." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.threshold_authorized_exact" +lean_statement_sha256 = "447ea498c59afc88019d8e79e3495196a1971dea67abd3a97b4c6b4da3333e68" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::summary::threshold"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u16 threshold and every typed summary; this is count classification rather than a proof of plan validation, child authenticity or branch selection." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-399" +claim_text = "Every bounded finite sequence of actual shipping accumulator calls returns the exact independent folded summary." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Refinement.source_fold_exact" +lean_statement_sha256 = "ab2de04987448ef9bdf398c435aeb75d2831729efe952bdbcb189e84c9973ade" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_composition::summary::push"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every initial typed summary and child-outcome list for which each initial counter plus list length fits usize. This is the sequence of source updates; it does not prove the recursive evaluator supplied that exact sequence." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Composition/Refinement.lean" +sha256 = "310deb81833e2e2df3153c9035f7211589ecdb97d43e9b845cd2f1f672263d72" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/composition/Funs.lean" +sha256 = "85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-400" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete all_positive witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.all_positive" +lean_statement_sha256 = "0c1e882e0b35723639dcec9c1f6a4e8cf1bb850cf8d76efbca1ca9f0301989e5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-401" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete all_denial_before_missing witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.all_denial_before_missing" +lean_statement_sha256 = "dd9a1335333477561662b7e8c86dacbfc46480a3acb1ce7e345c0de9412f9d23" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-402" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete all_smallest_code witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.all_smallest_code" +lean_statement_sha256 = "b281923aa0122d8bf251a2a72fa397b2a1a46250f692e1e2f91e2918e906b58e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-403" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete any_positive_overrides_invalid witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.any_positive_overrides_invalid" +lean_statement_sha256 = "adb2f5da879080ef8f3ce576f0861b6487fb1b01e55aac918591d4450cf6d68f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-404" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete any_missing_before_denial witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.any_missing_before_denial" +lean_statement_sha256 = "656692ae0b861a481856ef98bfd864bf584f7d44a467dc50b60b3a8f3d659858" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-405" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete any_smallest_requirement witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.any_smallest_requirement" +lean_statement_sha256 = "b8c8a096afceeb2f0bc6e3145263fde06ae199cf352c9abe337e0aebce67fbbc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-406" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete threshold_lower_bound witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.threshold_lower_bound" +lean_statement_sha256 = "b2b31baeb1d0574c483245db11a87b0956b7f8a0a15acfc3db969528ad0a24ed" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-407" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete threshold_reachable witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.threshold_reachable" +lean_statement_sha256 = "1b138c946ea971343c222ad650ae30f88177666d90a57cf150dcc6e527df7714" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-408" +claim_text = "A kernel-checked execution of the shipping summary operations establishes the concrete threshold_impossible witness." +claim_status = "qualified" +lean_declaration = "Auths.Composition.Examples.threshold_impossible" +lean_statement_sha256 = "bf2e0f24b2ea730bdfb647d175641661c9646f0855f0f54c205e6b256b4600d4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition/Examples.lean" +sha256 = "175bcec44c8275814d8aa049b692e81bd2d819d1c4e56951ea6886618aad7639" + +[[claims]] +claim_id = "AP-FORMAL-RICH-365" +claim_text = "The independent signing-frame byte grammar proves length_exact." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Framing.length_exact" +lean_statement_sha256 = "0e52322cfba1921ddf197a534e71a1a2e42332f59557c9658122accedd812118" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number byte lists with the explicitly bounded object tag, profile/statement byte lengths and 16-bit profile version. This independent model result is composed with the qualified source bridge; it is not by itself a Rust implementation claim." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Framing.lean" +sha256 = "857c8bae88702fc417b92866f4aadd9fb8b26a9212a5953010814da55dafe047" + +[[claims]] +claim_id = "AP-FORMAL-RICH-366" +claim_text = "The independent signing-frame byte grammar proves framing_is_unambiguous." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Framing.framing_is_unambiguous" +lean_statement_sha256 = "abecdfc980a447b4fa28f7d04750381b83d17e7c8e904cf561d29bfaa531ca10" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number byte lists with the explicitly bounded object tag, profile/statement byte lengths and 16-bit profile version. This independent model result is composed with the qualified source bridge; it is not by itself a Rust implementation claim." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Framing.lean" +sha256 = "857c8bae88702fc417b92866f4aadd9fb8b26a9212a5953010814da55dafe047" + +[[claims]] +claim_id = "AP-FORMAL-RICH-367" +claim_text = "The independent signing-frame byte grammar proves different_tags_separate." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Framing.different_tags_separate" +lean_statement_sha256 = "b839b000321b7e7c426dc2d34e2b040889abc0356c2abcc516aafb4092c167f9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Natural-number byte lists with the explicitly bounded object tag, profile/statement byte lengths and 16-bit profile version. This independent model result is composed with the qualified source bridge; it is not by itself a Rust implementation claim." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Framing.lean" +sha256 = "857c8bae88702fc417b92866f4aadd9fb8b26a9212a5953010814da55dafe047" + +[[claims]] +claim_id = "AP-FORMAL-RICH-368" +claim_text = "The pinned Aeneas unsigned integer-to-byte interpretation agrees with the independent two-byte big-endian grammar." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Endian.be16_exact" +lean_statement_sha256 = "96ac988cb011f7f84fd12b4d003a924109a5d6c2aab3881d774c39cf18e55538" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated u16 carrier. This proves the backend-library interpretation matches the numeric grammar; the Rust standard-library mapping remains in the declared toolchain boundary." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Endian.lean" +sha256 = "55511569d14410bf5a78e200f052bd99dad490fe50eca90d2ad11941004f78e7" + +[[claims]] +claim_id = "AP-FORMAL-RICH-369" +claim_text = "The pinned Aeneas unsigned integer-to-byte interpretation agrees with the independent eight-byte big-endian grammar." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Endian.be64_exact" +lean_statement_sha256 = "36df6d117bb64b2b242765fc34f484b1e38255de2d600ffdc60ab3d302e33b31" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated u64 carrier. This proves the backend-library interpretation matches the numeric grammar; the Rust standard-library mapping remains in the declared toolchain boundary." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Endian.lean" +sha256 = "55511569d14410bf5a78e200f052bd99dad490fe50eca90d2ad11941004f78e7" + +[[claims]] +claim_id = "AP-FORMAL-RICH-370" +claim_text = "The mechanically translated shipping shared signing framer proves signing_preimage_exact." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Refinement.signing_preimage_exact" +lean_statement_sha256 = "cfbd035c0840fae7a7b8cdd05442c7a1525279656c4fd6cea7aaf5dafc97cba0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The six registered ObjectType variants, arbitrary translated profile byte carriers, u16 profile versions and unsigned byte slices, with the exact accepted-result or oversized-profile premises in the theorem. The source supplies its frame-validity premises. This shared-helper claim excludes construction of canonical unsigned statements/signature descriptors by callers, suite verification/dispatch, commitment hashes and the complete E5 obligation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Crypto/Refinement.lean" +sha256 = "e87040a78dac30436b3ba3cffa18ea8661a5d7e855a7b2ef24a82657fc536d33" + +[[claims]] +claim_id = "AP-FORMAL-RICH-371" +claim_text = "The mechanically translated shipping shared signing framer proves accepted_frame_valid." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Refinement.accepted_frame_valid" +lean_statement_sha256 = "62efb305d4d957e8b25df8f774d7fae4c7ded2f9c7f5fd6009c392d51b5edaa8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The six registered ObjectType variants, arbitrary translated profile byte carriers, u16 profile versions and unsigned byte slices, with the exact accepted-result or oversized-profile premises in the theorem. The source supplies its frame-validity premises. This shared-helper claim excludes construction of canonical unsigned statements/signature descriptors by callers, suite verification/dispatch, commitment hashes and the complete E5 obligation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Crypto/Refinement.lean" +sha256 = "e87040a78dac30436b3ba3cffa18ea8661a5d7e855a7b2ef24a82657fc536d33" + +[[claims]] +claim_id = "AP-FORMAL-RICH-372" +claim_text = "The mechanically translated shipping shared signing framer proves accepted_preimages_bind_inputs." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Refinement.accepted_preimages_bind_inputs" +lean_statement_sha256 = "1016107fb3d2cea1bcb0ab8a21133fa2a4b58df4f98f301392c9206f62981198" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The six registered ObjectType variants, arbitrary translated profile byte carriers, u16 profile versions and unsigned byte slices, with the exact accepted-result or oversized-profile premises in the theorem. The source supplies its frame-validity premises. This shared-helper claim excludes construction of canonical unsigned statements/signature descriptors by callers, suite verification/dispatch, commitment hashes and the complete E5 obligation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Crypto/Refinement.lean" +sha256 = "e87040a78dac30436b3ba3cffa18ea8661a5d7e855a7b2ef24a82657fc536d33" + +[[claims]] +claim_id = "AP-FORMAL-RICH-373" +claim_text = "The mechanically translated shipping shared signing framer proves preimage_length_exact." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Refinement.preimage_length_exact" +lean_statement_sha256 = "9cabd50c8ca50ce67fc4b001ccc96bab7ad43e83d324db7b0f8094474af630f2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The six registered ObjectType variants, arbitrary translated profile byte carriers, u16 profile versions and unsigned byte slices, with the exact accepted-result or oversized-profile premises in the theorem. The source supplies its frame-validity premises. This shared-helper claim excludes construction of canonical unsigned statements/signature descriptors by callers, suite verification/dispatch, commitment hashes and the complete E5 obligation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Crypto/Refinement.lean" +sha256 = "e87040a78dac30436b3ba3cffa18ea8661a5d7e855a7b2ef24a82657fc536d33" + +[[claims]] +claim_id = "AP-FORMAL-RICH-374" +claim_text = "The mechanically translated shipping shared signing framer proves object_domains_separate." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Refinement.object_domains_separate" +lean_statement_sha256 = "9ef37519cb8261521096283862bd854689771ab750bfb7f638252ee010295ddb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The six registered ObjectType variants, arbitrary translated profile byte carriers, u16 profile versions and unsigned byte slices, with the exact accepted-result or oversized-profile premises in the theorem. The source supplies its frame-validity premises. This shared-helper claim excludes construction of canonical unsigned statements/signature descriptors by callers, suite verification/dispatch, commitment hashes and the complete E5 obligation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Crypto/Refinement.lean" +sha256 = "e87040a78dac30436b3ba3cffa18ea8661a5d7e855a7b2ef24a82657fc536d33" + +[[claims]] +claim_id = "AP-FORMAL-RICH-375" +claim_text = "The mechanically translated shipping shared signing framer proves profile_limit_refused." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Refinement.profile_limit_refused" +lean_statement_sha256 = "63351fd8bd50975233830262ad24db3345d56be3c043e4443681611a4d19ac4e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The six registered ObjectType variants, arbitrary translated profile byte carriers, u16 profile versions and unsigned byte slices, with the exact accepted-result or oversized-profile premises in the theorem. The source supplies its frame-validity premises. This shared-helper claim excludes construction of canonical unsigned statements/signature descriptors by callers, suite verification/dispatch, commitment hashes and the complete E5 obligation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Crypto/Refinement.lean" +sha256 = "e87040a78dac30436b3ba3cffa18ea8661a5d7e855a7b2ef24a82657fc536d33" + +[[claims]] +claim_id = "AP-FORMAL-RICH-376" +claim_text = "The shipping shared signing framer proves the concrete exact-byte witness minimal_preimage_exact." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Examples.minimal_preimage_exact" +lean_statement_sha256 = "8be64b1c3b5f807271b85aacbb49f5ccadb8367d5b8325e7cd496bfdff293470" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The declared Grant/Approval frame with an opaque one-byte unsigned payload, including UTF-8 profile bytes and the maximum profile-version value. This is preimage framing, not a proof of a valid grant/approval or signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Examples.lean" +sha256 = "f6ee83e3a505ef7d9e190df37d7b67f456ca180383e9e3cbf7b51b815d00df25" + +[[claims]] +claim_id = "AP-FORMAL-RICH-377" +claim_text = "The shipping shared signing framer proves the concrete exact-byte witness unicode_preimage_exact." +claim_status = "qualified" +lean_declaration = "Auths.Crypto.Examples.unicode_preimage_exact" +lean_statement_sha256 = "c2ef722ce15adda92b9facf722de03580a5e24ee58f0dbe2ac92fc306ee6a56f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::hash::signing_preimage"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The declared Grant/Approval frame with an opaque one-byte unsigned payload, including UTF-8 profile bytes and the maximum profile-version value. This is preimage framing, not a proof of a valid grant/approval or signature authorization." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. The inventoried transparent standard-library models and pinned backend-library definitions supply checked conversions, vectors and integer-to-byte operations. This does not prove their Rust internals or physical allocation behavior.", + "This slice proves syntactic preimage binding and domain separation, not collision-free hashes or cryptographic primitive security. Caller encoding, suite glue, full verifier and execution/history composition remain outside its scope. Exact-release hosted gates remain required.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Crypto/Examples.lean" +sha256 = "f6ee83e3a505ef7d9e190df37d7b67f456ca180383e9e3cbf7b51b815d00df25" + +[[claims]] +claim_id = "AP-FORMAL-RICH-344" +claim_text = "The translated constructor boundary proves identifier_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.identifier_exact" +lean_statement_sha256 = "32f2fcbc369da6312f719ef25121e8d6ada83e1a15c1536699531a7b788ff7e2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::identifier::bounded_identifier_valid"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-345" +claim_text = "The translated constructor boundary proves identifier_decision_valid against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.identifier_decision_valid" +lean_statement_sha256 = "f4da8d57342a7204f3e7fc6b81a487e984bf173cef7cecfe788b15df2ed2b8be" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-346" +claim_text = "The translated constructor boundary proves media_type_parse_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.media_type_parse_exact" +lean_statement_sha256 = "0cc49f7d0029a4120443f567e800e233e37d34bf53a98675b658f63add04a098" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::MediaType}::parse"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-347" +claim_text = "The translated constructor boundary proves profile_id_parse_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.profile_id_parse_exact" +lean_statement_sha256 = "f577faadbe6935c5ea30346590c9791c10fabf86fd28a3c2936b1e2ea7211073" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::ProfileId}::parse"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-348" +claim_text = "The translated constructor boundary proves capability_id_parse_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.capability_id_parse_exact" +lean_statement_sha256 = "c387eb2ffb37b3ea2aa448e494c0f3f2b1ac3f6317ace5c6de136a4a2a0777c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::CapabilityId}::parse"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-349" +claim_text = "The translated constructor boundary proves resource_id_parse_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.resource_id_parse_exact" +lean_statement_sha256 = "4258f73acbbc1fe4479208366f4fe0e2ab23f6cb2df1227917db88928e34ecc7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::ResourceId}::parse"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-350" +claim_text = "The translated constructor boundary proves budget_algebra_id_parse_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.budget_algebra_id_parse_exact" +lean_statement_sha256 = "2c266c8cc11fa6e0aa35f9e8d11db780b778e20e7b288319c9e8f5b63eba54a2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::BudgetAlgebraId}::parse"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-351" +claim_text = "The translated constructor boundary proves canonical_action_new_exact against the independent byte-length and Unicode exclusion contract." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Constructors.canonical_action_new_exact" +lean_statement_sha256 = "2f0968f144fa92b89c5a8dff5725fab841530fe1633bd049f5237875caa64267" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::CanonicalAction}::new"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All Lean Strings represented as validated UTF-8 within the Aeneas U32 byte-carrier bound, and every relevant translated maximum; the action constructor additionally covers all of its translated field carriers and the exact nonempty/8 MiB body check. Incoming typed-field invariants remain premises rather than being asserted for arbitrary raw Lean records." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Constructors.lean" +sha256 = "e42aac4a0ed6ba11d4ec9e44e7a7d1c73622559e6b0a56abf3c2e7634700b393" + +[[claims]] +claim_id = "AP-FORMAL-RICH-352" +claim_text = "Successful shipping action decoding preserves the declared byte bound and optional nonempty requirement for the byte field." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Action.bounded_bytes_valid" +lean_statement_sha256 = "02eb91e31ce5ad2f2c9a9343b4d64dae002950acc11eb64c228ad4fd1c263265" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::bounded_bytes"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated input and limit carrier for which the named shipping call succeeds. These accepted-result implications prove body validity and bounds; they do not assert total decoding, aggregate allocation/work bounds, all other carrier invariants or the complete AP-SPEC-069 assurance claim." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/ByteFields.lean" +sha256 = "a929e0ea6ffef54937589767ed88a899367dddd6246e8b1141a81462196c7e96" + +[[claims]] +claim_id = "AP-FORMAL-RICH-353" +claim_text = "Successful shipping action decoding preserves a nonempty body within the protocol 8 MiB ceiling." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Action.decoded_body_valid" +lean_statement_sha256 = "dc493e06c2e1793d82e3bca4a532609fd73c98bdd95628338b96a8df3b41e39a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated input and limit carrier for which the named shipping call succeeds. These accepted-result implications prove body validity and bounds; they do not assert total decoding, aggregate allocation/work bounds, all other carrier invariants or the complete AP-SPEC-069 assurance claim." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/ActionValidity.lean" +sha256 = "b1b4e7dade19c14bbbc6a1abd8f5dbb403e4104f36587fa866ff974ce9144020" + +[[claims]] +claim_id = "AP-FORMAL-RICH-354" +claim_text = "Successful shipping action decoding preserves the declared deployment body-byte ceiling." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Action.decoded_body_within_deployment" +lean_statement_sha256 = "09d4163e800b1a910d1b59f44e8997fc240f99ec94a696016dc5b16f635e94ba" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated input and limit carrier for which the named shipping call succeeds. These accepted-result implications prove body validity and bounds; they do not assert total decoding, aggregate allocation/work bounds, all other carrier invariants or the complete AP-SPEC-069 assurance claim." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/ActionValidity.lean" +sha256 = "b1b4e7dade19c14bbbc6a1abd8f5dbb403e4104f36587fa866ff974ce9144020" + +[[claims]] +claim_id = "AP-FORMAL-RICH-355" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: minimal_limits_valid." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.minimal_limits_valid" +lean_statement_sha256 = "4062c41c7248276c3aa6577073a9b76972ba7fd904ead6c474397c5e4456bcb2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::{auths_model::VerifierLimits}::validate"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-356" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: minimal_encoding_exact." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.minimal_encoding_exact" +lean_statement_sha256 = "ee369a138ffd90a664c016b70df19dd581cba29e84d12ff162008123742a1986" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::encode::encode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-357" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: minimal_action_accepted." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.minimal_action_accepted" +lean_statement_sha256 = "07e015f675be491b1198d48b2006a8cc4a8c163673525fd804cb6ece38b495ec" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-358" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: duplicate_key_refused." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.duplicate_key_refused" +lean_statement_sha256 = "3ecb7970b7f5d30a83e0319a653ab3b5ac773d69eabb6051c6aeb67d31ca7661" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-359" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: nonminimal_integer_refused." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.nonminimal_integer_refused" +lean_statement_sha256 = "211e27c83a3543fd28f08107db72110bdad8f98278f8ea0b4a054b791bc117ca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-360" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: invalid_utf8_refused." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.invalid_utf8_refused" +lean_statement_sha256 = "6ea801e7569e4a610c5923ef55cb416190f3757835bca7cdb011dec7ef749b07" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-361" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: truncated_refused." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.truncated_refused" +lean_statement_sha256 = "f83e58b0a51b603201495f9bee4c94f4ad05c46587fc892e50c6bae34dd4cd2d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-362" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: trailing_byte_refused." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.trailing_byte_refused" +lean_statement_sha256 = "64584de46d43a655327602b4f47617fd8cdd0d72d9fc46e1f4af472727584b7f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-363" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: action_byte_limit_refused." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.action_byte_limit_refused" +lean_statement_sha256 = "fe31af1fe195c74c1367ee50d8f73f1429d61dbf9682fa05ba25e4df1fc25db5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-364" +claim_text = "The complete translated canonical-action codec proves the concrete acceptance, exact-byte or typed-refusal witness: action_byte_limit_exact." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Examples.action_byte_limit_exact" +lean_statement_sha256 = "7a5db49ff413e51654eaea7a2043b325149834e71478918c6331ad9214557673" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::decode_canonical_action"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The explicitly defined 26-byte minimal action, matching limits and named adversarial byte variations. The profile/body are opaque codec data. These examples establish non-vacuity and precise refusals, not application authorization, universal codec totality or completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the existing foundational axioms are trusted. Inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting behavior; their internals and physical allocator behavior are not proved here.", + "All Auths functions in the codec closure are mechanically translated. This scoped result does not complete E1–E5 or the composed authorization-to-execution theorem. The exact release revision still requires hosted evidence.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Examples.lean" +sha256 = "c8255204fbdf20679a4181234a27c1f8a333006dda45aa3e40b64c7a7703cc6d" + +[[claims]] +claim_id = "AP-FORMAL-RICH-338" +claim_text = "For every validated UTF-8 string within the Aeneas byte-carrier bound, the shipping identifier validator agrees with the declared byte limit and Unicode exclusion policy without a separate byte-representation premise." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Identifier.identifier_string_exact" +lean_statement_sha256 = "728cca6d2116aff14fb7ec44b031d636cfa554d7179c1053ce138c1e08a9298f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::identifier::bounded_identifier_valid"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every Lean String with UTF-8 byte length at most U32.max and every translated usize maximum." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. The inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting semantics; this is not a proof of standard-library internals.", + "All Auths functions in the expanded codec closure are mechanically translated. The sorting model is restricted to the actual stateless Unit digest-key callback and lawful lexicographic digest order. These component results do not complete AP-SPEC-069 E1, E2, E3, E4, E5 or the composed assurance claim.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Identifier.lean" +sha256 = "abd2aa2cb477b2acb2c288a61088b228820636a3e2fc3a728191d0526425b162" + +[[claims]] +claim_id = "AP-FORMAL-RICH-339" +claim_text = "Every successfully decoded canonical action re-encodes to exactly the accepted input bytes." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Action.decode_encode_exact" +lean_statement_sha256 = "973dab7010e05ac33b6e5de39a6ff64ed21ff2c47064f4cfe65eca6dc0836542" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::decode::decode_canonical_action", + "auths_codec::encode::encode_canonical_action", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated input slice, verifier-limit carrier, and canonical-action carrier for which the shipping canonical-action decoder returns success. This is the exact accepted-byte property, not complete object totality, inverse completeness, work bounds, or carrier validity." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. The inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting semantics; this is not a proof of standard-library internals.", + "All Auths functions in the expanded codec closure are mechanically translated. The sorting model is restricted to the actual stateless Unit digest-key callback and lawful lexicographic digest order. These component results do not complete AP-SPEC-069 E1, E2, E3, E4, E5 or the composed assurance claim.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Action.lean" +sha256 = "c70c5683709e211c3b334cb70048ab1dff4c881b825bafbcf804593d1bfd2e90" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims]] +claim_id = "AP-FORMAL-RICH-343" +claim_text = "Two accepted encodings of the same canonical action have identical bytes, without assuming hash injectivity." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Action.accepted_encoding_unique" +lean_statement_sha256 = "3ce38329f0a681bb195d235cfb90ccd00c30d902f4a399a8ac0dd33a197fa254" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::decode::decode_canonical_action", + "auths_codec::encode::encode_canonical_action", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of translated input slices, verifier-limit carrier, and canonical-action carrier accepted by the shipping canonical-action decoder." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. The inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting semantics; this is not a proof of standard-library internals.", + "All Auths functions in the expanded codec closure are mechanically translated. The sorting model is restricted to the actual stateless Unit digest-key callback and lawful lexicographic digest order. These component results do not complete AP-SPEC-069 E1, E2, E3, E4, E5 or the composed assurance claim.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Action.lean" +sha256 = "c70c5683709e211c3b334cb70048ab1dff4c881b825bafbcf804593d1bfd2e90" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims]] +claim_id = "AP-FORMAL-RICH-340" +claim_text = "The reviewed UTF-8 string-copy model preserves every represented validated string exactly." +claim_status = "qualified" +lean_declaration = "Auths.Codec.StringRefinement.string_copy_exact" +lean_statement_sha256 = "5908fe7247b8df57377869e96debb17e56a3ee11f9bf5fbcdb1bbac9878795dd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every validated Lean String within the Aeneas U32 byte-carrier bound; a theorem about the reviewed standard-library model, not a verification of Rust standard-library UTF-8 arithmetic." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. The inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting semantics; this is not a proof of standard-library internals.", + "All Auths functions in the expanded codec closure are mechanically translated. The sorting model is restricted to the actual stateless Unit digest-key callback and lawful lexicographic digest order. These component results do not complete AP-SPEC-069 E1, E2, E3, E4, E5 or the composed assurance claim.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/String.lean" +sha256 = "9b636e0a8b414ff044de406bcbdfc858a603dee3e3642eb1efdcc249956b990e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-341" +claim_text = "The reviewed string-borrow model returns exactly the represented UTF-8 bytes." +claim_status = "qualified" +lean_declaration = "Auths.Codec.StringRefinement.string_borrow_exact" +lean_statement_sha256 = "dd885c75e9628b3e9b836cf1809e57f37ba5e62822e0928b7b95b26e6ff77036" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every validated Lean String within the Aeneas U32 byte-carrier bound; no arbitrary raw byte carrier is assumed to be UTF-8." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. The inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting semantics; this is not a proof of standard-library internals.", + "All Auths functions in the expanded codec closure are mechanically translated. The sorting model is restricted to the actual stateless Unit digest-key callback and lawful lexicographic digest order. These component results do not complete AP-SPEC-069 E1, E2, E3, E4, E5 or the composed assurance claim.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/String.lean" +sha256 = "9b636e0a8b414ff044de406bcbdfc858a603dee3e3642eb1efdcc249956b990e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-342" +claim_text = "The reviewed UTF-8 validation model accepts the exact byte representation of every validated string." +claim_status = "qualified" +lean_declaration = "Auths.Codec.StringRefinement.utf8_accepts_string" +lean_statement_sha256 = "6c248c6b9f4e94b7bd8dfee2296c242342234fe87db19a32df4dbe5377ebd014" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every validated Lean String within the Aeneas U32 byte-carrier bound; this supplies model completeness on represented strings, not complete canonical-action decoding completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. The inventoried transparent standard-library models supply UTF-8, string, scalar, collection and pure-key sorting semantics; this is not a proof of standard-library internals.", + "All Auths functions in the expanded codec closure are mechanically translated. The sorting model is restricted to the actual stateless Unit digest-key callback and lawful lexicographic digest order. These component results do not complete AP-SPEC-069 E1, E2, E3, E4, E5 or the composed assurance claim.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/String.lean" +sha256 = "9b636e0a8b414ff044de406bcbdfc858a603dee3e3642eb1efdcc249956b990e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-333" +claim_text = "On every finite bounded scalar stream, the independent UTF-8 byte scan detects exactly the declared Unicode control and whitespace exclusions, without false matches across scalar boundaries." +claim_status = "qualified" +lean_declaration = "Auths.Model.Identifier.contains_encoded_scalars" +lean_statement_sha256 = "856c193807eb61f9a3544585e1c82fdf16a289ef2cf2b4f6b2685191c80b9a98" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every finite list of natural-number scalar values at most U+10FFFF; the theorem concerns the declared mathematical UTF-8 encoding and exclusion set." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. Borrowed str length, emptiness, and byte projection use reviewed transparent standard-library models.", + "The exclusion set is explicitly fixed in Auths.Model.Identifier. This component claim does not establish UTF-8 decoding of arbitrary bytes, complete constructor/object codec correctness, complete resource accounting, or full verifier correctness, and does not complete AP-SPEC-069 E1. The represented-stream theorem retains its explicit byte-representation premise.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Model/IdentifierSemantics.lean" +sha256 = "bddcd8b8ba531860612a3db88948953c5b3cb4d3413040288ea49985d698cfe2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-334" +claim_text = "The translated shipping identifier lookahead is total and returns exactly its exclusion-prefix grammar for every byte slice and cursor." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Identifier.forbidden_at_exact" +lean_statement_sha256 = "08d38de70fe6804ce7e3f09b0eb699db26db6ec96bab81c11efdac8429697119" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::identifier::forbidden_identifier_at", + "auths_model::identifier::forbidden_three_byte_prefix", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated byte slice and usize cursor, including outlying cursors and truncated prefixes." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. Borrowed str length, emptiness, and byte projection use reviewed transparent standard-library models.", + "The exclusion set is explicitly fixed in Auths.Model.Identifier. This component claim does not establish UTF-8 decoding of arbitrary bytes, complete constructor/object codec correctness, complete resource accounting, or full verifier correctness, and does not complete AP-SPEC-069 E1. The represented-stream theorem retains its explicit byte-representation premise.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Identifier.lean" +sha256 = "abd2aa2cb477b2acb2c288a61088b228820636a3e2fc3a728191d0526425b162" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-335" +claim_text = "The translated shipping identifier scan terminates and returns exactly the proof-facing exclusion scan for every byte slice and starting cursor." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Identifier.scan_exact" +lean_statement_sha256 = "3334dba0804ec98cc9b43993921c22aeee484970eac8b3a89ebfbf73e5a08d3d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::identifier::contains_forbidden_identifier"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated byte slice and usize starting cursor. The loop measure is the number of remaining bytes." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. Borrowed str length, emptiness, and byte projection use reviewed transparent standard-library models.", + "The exclusion set is explicitly fixed in Auths.Model.Identifier. This component claim does not establish UTF-8 decoding of arbitrary bytes, complete constructor/object codec correctness, complete resource accounting, or full verifier correctness, and does not complete AP-SPEC-069 E1. The represented-stream theorem retains its explicit byte-representation premise.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Identifier.lean" +sha256 = "abd2aa2cb477b2acb2c288a61088b228820636a3e2fc3a728191d0526425b162" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-336" +claim_text = "The translated shipping identifier validator accepts exactly nonempty byte carriers within the supplied maximum whose complete exclusion scan is false." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Identifier.identifier_exact" +lean_statement_sha256 = "985e2dddd886431d1a7a5b47219fd6a284477d09999fc8380f7ca54984f69428" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::identifier::bounded_identifier_valid", + "auths_model::identifier::contains_forbidden_identifier", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated Str byte carrier and usize maximum, including empty and oversized input." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. Borrowed str length, emptiness, and byte projection use reviewed transparent standard-library models.", + "The exclusion set is explicitly fixed in Auths.Model.Identifier. This component claim does not establish UTF-8 decoding of arbitrary bytes, complete constructor/object codec correctness, complete resource accounting, or full verifier correctness, and does not complete AP-SPEC-069 E1. The represented-stream theorem retains its explicit byte-representation premise.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Identifier.lean" +sha256 = "abd2aa2cb477b2acb2c288a61088b228820636a3e2fc3a728191d0526425b162" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-337" +claim_text = "For an explicitly represented bounded UTF-8 scalar stream, the translated shipping identifier validator accepts exactly the declared nonempty byte bound and Unicode exclusion policy." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Identifier.identifier_unicode_exact" +lean_statement_sha256 = "53fe320fcc51f4234335404a09b6b2f2e04eafd13b47daace04c256dbcef9e65" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::identifier::bounded_identifier_valid", + "auths_model::identifier::contains_forbidden_identifier", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated Str, usize maximum, and finite scalar list at most U+10FFFF whose mathematical UTF-8 encoding equals the carrier bytes." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the existing foundational axioms are trusted. Borrowed str length, emptiness, and byte projection use reviewed transparent standard-library models.", + "The exclusion set is explicitly fixed in Auths.Model.Identifier. This component claim does not establish UTF-8 decoding of arbitrary bytes, complete constructor/object codec correctness, complete resource accounting, or full verifier correctness, and does not complete AP-SPEC-069 E1. The represented-stream theorem retains its explicit byte-representation premise.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Identifier.lean" +sha256 = "abd2aa2cb477b2acb2c288a61088b228820636a3e2fc3a728191d0526425b162" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-329" +claim_text = "The mechanically translated shipping head-argument encoder appends exactly the independent big-endian digit sequence and terminates within its supplied capacity." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.Encoder.append_tail_exact" +lean_statement_sha256 = "886bd8ae148d405f5506ed3b5f34246e086b9fce1c43abf7d1e9bb5bede20953" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::append_tail"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated u64 value and initial byte vector, with width at most eight and initial length plus width within the platform vector bound." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Encoder.lean" +sha256 = "d05ab81351b2244604d833ea6341e5099fe729062030447074a464c5c5aff67b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-330" +claim_text = "The mechanically translated shipping head encoder is total and exactly follows the independent shortest definite-head grammar, refusing invalid major tags." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.Encoder.encode_head_refines" +lean_statement_sha256 = "ffe4de7b8d2713f931312e480d926e67fdac71ef85cc373978acfc560b867e59" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::cbor::encode_head", + "auths_codec::cbor::append_tail", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u8 major tag and u64 argument; successful bytes agree with the independent grammar and failure occurs only for tags above seven." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Encoder.lean" +sha256 = "d05ab81351b2244604d833ea6341e5099fe729062030447074a464c5c5aff67b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-331" +claim_text = "Every successful mechanically translated shipping head encoding contains one through nine bytes." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.Encoder.encode_head_byte_bound" +lean_statement_sha256 = "b556f1eea0fe18102fb8f87b07321b1328d5a74c6cca5b233e5db670a0bed296" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::cbor::encode_head", + "auths_codec::cbor::append_tail", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u8 major tag and u64 argument. This bounds head output bytes, not the complete object's allocation/work or the physical allocator." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Encoder.lean" +sha256 = "d05ab81351b2244604d833ea6341e5099fe729062030447074a464c5c5aff67b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-332" +claim_text = "Every valid mechanically translated shipping head encoding is accepted by the mechanically translated shipping reader, recovering its exact major/argument and preserving arbitrary following bytes." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.Encoder.encode_head_roundtrip" +lean_statement_sha256 = "d361cb9f515a10ff721e4641e2fd4e8203183eb36179728c8951954db0f3dc1a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::cbor::encode_head", + "auths_codec::cbor::append_tail", + "auths_codec::cbor::read_head", + "auths_codec::cbor::read_tail", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Major tags below eight, every u64 argument, and every bounded input slice/cursor containing the encoded bytes followed by the declared tail. This is head-codec completeness, not whole-object completeness." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Encoder.lean" +sha256 = "d05ab81351b2244604d833ea6341e5099fe729062030447074a464c5c5aff67b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-323" +claim_text = "The independent entry-deadline model proves permits_fold." +claim_status = "proved" +lean_declaration = "Auths.Product.EntryDeadline.permits_fold" +lean_statement_sha256 = "999af52140d9fea6df2367663666a322a5fa32af6b57fed4a5a84dab61f89ef6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Finite lists of independent natural-number upper endpoints, preserving inclusive and exclusive boundaries. This is endpoint algebra; it does not establish that an actual verification or installed gate supplied every required bound." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/EntryDeadline.lean" +sha256 = "814efeaa2d3e9cfbd7552c83fed6dc4820da05d9ba572131176e3892b9c8c936" + +[[claims]] +claim_id = "AP-FORMAL-RICH-324" +claim_text = "The independent entry-deadline model proves exclusive_endpoint_refuses." +claim_status = "proved" +lean_declaration = "Auths.Product.EntryDeadline.exclusive_endpoint_refuses" +lean_statement_sha256 = "e73d20a80ed1eed7dea6583f6a8b27e3636b25c7d2ff3eb26b158d75b069a060" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Finite lists of independent natural-number upper endpoints, preserving inclusive and exclusive boundaries. This is endpoint algebra; it does not establish that an actual verification or installed gate supplied every required bound." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/EntryDeadline.lean" +sha256 = "814efeaa2d3e9cfbd7552c83fed6dc4820da05d9ba572131176e3892b9c8c936" + +[[claims]] +claim_id = "AP-FORMAL-RICH-325" +claim_text = "The independent entry-deadline model proves inclusive_endpoint_admits." +claim_status = "proved" +lean_declaration = "Auths.Product.EntryDeadline.inclusive_endpoint_admits" +lean_statement_sha256 = "86218f7f1b1669b6e15866816f3d585c1811331fb1ab54529ad6d2521e91f013" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Finite lists of independent natural-number upper endpoints, preserving inclusive and exclusive boundaries. This is endpoint algebra; it does not establish that an actual verification or installed gate supplied every required bound." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/EntryDeadline.lean" +sha256 = "814efeaa2d3e9cfbd7552c83fed6dc4820da05d9ba572131176e3892b9c8c936" + +[[claims]] +claim_id = "AP-FORMAL-RICH-326" +claim_text = "The mechanically translated shipping entry-time predicate is total and exactly matches the independent lower-time and inclusive/exclusive endpoint semantics." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model" +lean_statement_sha256 = "67c9f67c9f95657d1d855d1eb6af14fe1e216f27bea22df817ba2bb95df4c3aa" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::deadline::entry_time_allows"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 evaluation time, current sample and upper endpoint, with either endpoint mode." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These theorems refine only the endpoint intersection and clock predicate for supplied typed bounds. The complete verifier's extraction of the temporal witness, installed gate projection, actual driver/I/O correspondence, monotonic clock and secret-lease enforcement remain outside these theorems. They do not complete AP-SPEC-069 E2, E3 or E4.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/EntryDeadline.lean" +sha256 = "591d4a45669cdd7d30c37158b6010d73207ea18f9d123d04de1e17878944b200" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-327" +claim_text = "The mechanically translated shipping endpoint intersection returns precisely the model's minimum endpoint and preserves exclusion when equal bounds meet." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model" +lean_statement_sha256 = "6fd010f4987e523c204af130fee1be0864336a343b85799566ed7ba963056179" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::deadline::intersect_entry_bounds"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of u64 upper endpoints and endpoint modes, without incrementing timestamps or overflowing." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These theorems refine only the endpoint intersection and clock predicate for supplied typed bounds. The complete verifier's extraction of the temporal witness, installed gate projection, actual driver/I/O correspondence, monotonic clock and secret-lease enforcement remain outside these theorems. They do not complete AP-SPEC-069 E2, E3 or E4.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/EntryDeadline.lean" +sha256 = "591d4a45669cdd7d30c37158b6010d73207ea18f9d123d04de1e17878944b200" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-328" +claim_text = "The mechanically translated shipping entry-time predicate refuses every current sample before its evaluation time." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses" +lean_statement_sha256 = "c4b69595d534943ae2a7d3d70c6b15f8e9193cf387346facd15c8773a71659f8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::deadline::entry_time_allows"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 evaluation time, earlier current sample and typed upper endpoint." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These theorems refine only the endpoint intersection and clock predicate for supplied typed bounds. The complete verifier's extraction of the temporal witness, installed gate projection, actual driver/I/O correspondence, monotonic clock and secret-lease enforcement remain outside these theorems. They do not complete AP-SPEC-069 E2, E3 or E4.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/EntryDeadline.lean" +sha256 = "591d4a45669cdd7d30c37158b6010d73207ea18f9d123d04de1e17878944b200" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-317" +claim_text = "The independent collection-fence history model proves collection_cannot_reopen_window." +claim_status = "proved" +lean_declaration = "Auths.Product.CollectionFence.collection_cannot_reopen_window" +lean_statement_sha256 = "7e9ffae66639bc285ecb5124989f7439a7f4530055292333b1206a598b24d090" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite model histories with any number of workers, collection, admission, crashes, recovery, and acknowledgement loss. This is the cutoff invariant, not a proof of the complete counter-admission algorithm or backend/driver correspondence." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CollectionFence.lean" +sha256 = "691871ae880fe9ab9944843e6c6b9c800192f806ff9aa1c8511fceb843d74fa9" + +[[claims]] +claim_id = "AP-FORMAL-RICH-318" +claim_text = "The independent collection-fence history model proves swept_window_cannot_readmit." +claim_status = "proved" +lean_declaration = "Auths.Product.CollectionFence.swept_window_cannot_readmit" +lean_statement_sha256 = "985f5cab0a7c0d4977dfa7da5e95e808b48fad58f75676a946a658686d9a8998" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite model histories with any number of workers, collection, admission, crashes, recovery, and acknowledgement loss. This is the cutoff invariant, not a proof of the complete counter-admission algorithm or backend/driver correspondence." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CollectionFence.lean" +sha256 = "691871ae880fe9ab9944843e6c6b9c800192f806ff9aa1c8511fceb843d74fa9" + +[[claims]] +claim_id = "AP-FORMAL-RICH-319" +claim_text = "The independent collection-fence history model proves later_window_admits." +claim_status = "proved" +lean_declaration = "Auths.Product.CollectionFence.later_window_admits" +lean_statement_sha256 = "8cda00f6e1cdb61ea75db826ebf42912319bef2f58008b321d3735562455f791" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Arbitrary finite model histories with any number of workers, collection, admission, crashes, recovery, and acknowledgement loss. This is the cutoff invariant, not a proof of the complete counter-admission algorithm or backend/driver correspondence." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CollectionFence.lean" +sha256 = "691871ae880fe9ab9944843e6c6b9c800192f806ff9aa1c8511fceb843d74fa9" + +[[claims]] +claim_id = "AP-FORMAL-RICH-320" +claim_text = "The mechanically translated shipping slot-eligibility leaf agrees exactly with the independent collection-cutoff predicate." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model" +lean_statement_sha256 = "5c7649d0cad1f4554d0273eaa3476492eb321ca5c181917739f0fcaa86f30574" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_stores::gateway_fence::gateway_window_open"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 expiry and optional u64 durable cutoff; no cutoff admits every expiry, and a present cutoff requires a strictly later expiry." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These are exact scalar-decision refinements and a conditional model-history consequence. Store locking/transaction wiring, filesystem/database durability, state parsing, the actual store-to-model history bridge, and the complete counter-admission algorithm remain outside these theorems. Backend conformance supports the retained store contract; AP-SPEC-069 E4 is not complete.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/CollectionFence.lean" +sha256 = "0e50d262b6f6aede5944b43c835da1644050508f7518d5e4b7e16a0a8339e0ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/stores/Funs.lean" +sha256 = "93659adb731e4ebd0bfd7dde510d582657fc8e89427ebdee9ee2cdf8324bcf64" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-321" +claim_text = "The mechanically translated shipping cutoff-advance leaf returns exactly the independent model's monotone maximum." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.CollectionFence.translated_advance_refines_model" +lean_statement_sha256 = "65ae3cda538e8fbe21a6f5e51ff61413ebe4478dfc94fabc193a86304c668043" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_stores::gateway_fence::advance_gateway_collection"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every optional u64 previous cutoff and u64 requested cutoff, including older clock samples and the u64 boundary." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These are exact scalar-decision refinements and a conditional model-history consequence. Store locking/transaction wiring, filesystem/database durability, state parsing, the actual store-to-model history bridge, and the complete counter-admission algorithm remain outside these theorems. Backend conformance supports the retained store contract; AP-SPEC-069 E4 is not complete.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/CollectionFence.lean" +sha256 = "0e50d262b6f6aede5944b43c835da1644050508f7518d5e4b7e16a0a8339e0ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/stores/Funs.lean" +sha256 = "93659adb731e4ebd0bfd7dde510d582657fc8e89427ebdee9ee2cdf8324bcf64" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-322" +claim_text = "The mechanically translated slot-eligibility leaf refuses an already collected expiry after every declared model history from that cutoff." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses" +lean_statement_sha256 = "051638ddef04ac4505e829672a6d7bf85381b053430ef04c8402b313ea1c52c3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_stores::gateway_fence::gateway_window_open"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "An arbitrary finite collection/admission model history whose final cutoff is the translated input, and an expiry no later than the prior cutoff. The actual backend-history bridge is not asserted." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These are exact scalar-decision refinements and a conditional model-history consequence. Store locking/transaction wiring, filesystem/database durability, state parsing, the actual store-to-model history bridge, and the complete counter-admission algorithm remain outside these theorems. Backend conformance supports the retained store contract; AP-SPEC-069 E4 is not complete.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/CollectionFence.lean" +sha256 = "0e50d262b6f6aede5944b43c835da1644050508f7518d5e4b7e16a0a8339e0ae" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/stores/Funs.lean" +sha256 = "93659adb731e4ebd0bfd7dde510d582657fc8e89427ebdee9ee2cdf8324bcf64" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-313" +claim_text = "The independent CBOR head grammar reads every valid shortest head encoding and preserves arbitrary following bytes." +claim_status = "proved" +lean_declaration = "Auths.Codec.readHead_encodeHead" +lean_statement_sha256 = "585bee28f8dd9f2cc59c8db8818331de6ef20234fe581c54e9a63a665771730e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The pure natural-number byte model: major tags below eight and arguments below 2^64. This model theorem alone is not a refinement of the shipping encoder or a complete protocol-object codec claim." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Semantics.lean" +sha256 = "f9549bf9d739921bc1ebf93dbefd83cf8aba5604c13efbb991d154e2ff3c0003" + +[[claims]] +claim_id = "AP-FORMAL-RICH-314" +claim_text = "The mechanically translated shipping CBOR head reader is total and exactly agrees with the independent definite-head byte grammar on success and refusal; success advances one to nine bytes without exceeding the input." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.read_head_refines" +lean_statement_sha256 = "6f8903230cb4a33a6893ff749d2699e32d4c30e5fa388b4b35447b502a963e05" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::cbor::read_head", + "auths_codec::cbor::read_tail", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every translated byte slice and platform cursor, including missing input, reserved/indefinite heads, non-minimal heads, and truncated arguments." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Codec/Refinement.lean" +sha256 = "e6a9ef5ca7019d0350de35e47bd9378194f9883310c964f4c585f68dd26f6976" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-315" +claim_text = "The mechanically translated shipping CBOR argument reader returns precisely the big-endian unsigned value when the bytes fit, or a typed error exactly when the input is too short, and returns the exact final cursor." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.read_tail_bounded" +lean_statement_sha256 = "1eaa957deced4f8f9b7e97e0a87f75aa9f40f243172ad7985f5ea8cdc057756c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::read_tail"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every byte slice, cursor at or before its end, and argument width from zero through eight, with initial accumulator zero." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Codec/Refinement.lean" +sha256 = "e6a9ef5ca7019d0350de35e47bd9378194f9883310c964f4c585f68dd26f6976" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-316" +claim_text = "The mechanically translated shipping head reader accepts every independently encoded valid head, recovers that head exactly, and preserves an arbitrary following tail." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Refinement.read_head_accepts_encoding" +lean_statement_sha256 = "71b762200851a0a3030ec82b9788d0c2ea233258ea5911d8863fa89f6af1447b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_codec::cbor::read_head", + "auths_codec::cbor::read_tail", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every valid head (major below eight and argument below 2^64), tail, byte slice and cursor representing that independent encoding." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Codec/Refinement.lean" +sha256 = "e6a9ef5ca7019d0350de35e47bd9378194f9883310c964f4c585f68dd26f6976" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/codec/Funs.lean" +sha256 = "29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-001" +claim_text = "Lean proves the rich authority property: finiteSet subset refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.finiteSet_subset_refl" +lean_statement_sha256 = "cac9d4b80390ce990484b56aee1f0d20fcb8d1b2b2b8f07ef1fa819caca6982c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-002" +claim_text = "Lean proves the rich authority property: finiteSet subset trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.finiteSet_subset_trans" +lean_statement_sha256 = "620ac85f39efb4108727cc41c2b3b7663eea53ffde7ef5d782ee2e5897e161da" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-003" +claim_text = "Lean proves the rich authority property: finiteSet subset antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.finiteSet_subset_antisymm" +lean_statement_sha256 = "04c8f87dfb0552e7abf656cf19ca4e29a5a81369e1178eb7d9aa634966a115be" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-004" +claim_text = "Lean proves the rich authority property: finiteSet membership monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.finiteSet_membership_monotone" +lean_statement_sha256 = "526bdf55ccea3aa1a07aef06197ef303b18a5c083994c97056422713106028a2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-005" +claim_text = "Lean proves the rich authority property: window contained refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.window_contained_refl" +lean_statement_sha256 = "52b61c239b76a3ec75ebc375c19ba060e170f9c88ab845652188da7e1f32c715" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-006" +claim_text = "Lean proves the rich authority property: window contained trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.window_contained_trans" +lean_statement_sha256 = "ed63f2b8060617d8e042f212bea8d9df13b58494cd94ef01081d7c849e19de7b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-007" +claim_text = "Lean proves the rich authority property: window contained antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.window_contained_antisymm" +lean_statement_sha256 = "a263d89be575fd98940d6a3324ec862360cfe26b2024dd38a13b828b763aa74a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-008" +claim_text = "Lean proves the rich authority property: window coverage monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.window_coverage_monotone" +lean_statement_sha256 = "e8d8a9503bde767273a9b55883a18365323b88ae798ebd4de744ffd822ee9dd7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-009" +claim_text = "Lean proves the rich authority property: action constraint refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.action_constraint_refl" +lean_statement_sha256 = "6b41a97add7b56d69dde91e7008ca41e34f568ca4081d8b81ca5b728342e5c1d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-010" +claim_text = "Lean proves the rich authority property: action constraint trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.action_constraint_trans" +lean_statement_sha256 = "1510dabf7d9cf6d4c1bdb99de295ced7f32f3c44678519aef38aa3fb58dcdee0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-011" +claim_text = "Lean proves the rich authority property: action constraint antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.action_constraint_antisymm" +lean_statement_sha256 = "59a7fb2812568c3a9eabd67248452de770baf4d2e1daf9ebf2dbea0baa42c81d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-092" +claim_text = "Lean proves the rich authority property: action constraint canonical antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.action_constraint_canonical_antisymm" +lean_statement_sha256 = "47d8802981c338d34dedf567e68555c3cca9f298dd13c681ba4b3baa927a6813" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-012" +claim_text = "Lean proves the rich authority property: action constraint allows monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.action_constraint_allows_monotone" +lean_statement_sha256 = "49927a15dec0e627c64244b981bd81ca171589f5ada904616bcec9811746efe2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-013" +claim_text = "Lean proves the rich authority property: budget refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.budget_refl" +lean_statement_sha256 = "54ffb1f592e48a7292cb925afd2f0e1c4c2412a46b7b5d8aeec7113fe58fc09a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-014" +claim_text = "Lean proves the rich authority property: budget trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.budget_trans" +lean_statement_sha256 = "313fe44a88fa3efd9bc1800bf0e6169039c5bcec051b847ea86c71d27318e0ae" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-015" +claim_text = "Lean proves the rich authority property: budget antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.budget_antisymm" +lean_statement_sha256 = "569b03bd90e823b38193e8a9681faf27341786455644132e4861c779c8c3395b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-016" +claim_text = "Lean proves the rich authority property: budget coverage monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.budget_coverage_monotone" +lean_statement_sha256 = "594cf3b8740d3b68643756cf665f0be72b2b5b010227f5efc0407ce78fc91520" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-124" +claim_text = "Lean proves the rich authority property: budget action coverage monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.budget_action_coverage_monotone" +lean_statement_sha256 = "986470888869bfa94623fd5d5f4a7a72820170912004d0710b39127565ab0379" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-261" +claim_text = "An expressible profile with no budget request under a bounded ceiling does not cover the action." +claim_status = "proved" +lean_declaration = "Auths.Rich.budgetCoversAction_expressible_absent_bounded" +lean_statement_sha256 = "9b30941cc8a5c3b3aa4c70e4703fb0e902ed07d7d0f5d07536f087234423a0b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 budget coverage over opaque identity carriers." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-093" +claim_text = "Lean proves the rich authority property: extensions refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_refl" +lean_statement_sha256 = "3deb6e01a441a7e322859de8eadaec18124a1cb370b09a38322fb4e17dfcb4cf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-094" +claim_text = "Lean proves the rich authority property: extensions trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_trans" +lean_statement_sha256 = "90aa05bf5d3bdaa2f0a8df2b7738628d66fdc848f306b392a015a2e1e12ba9e4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-096" +claim_text = "Lean proves the rich authority property: extensions le pinned iff." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_pinned_iff" +lean_statement_sha256 = "98fe643cba56dcda0d75b3dc27de128995feff749567004d74f0bf6a8ecf7e37" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-097" +claim_text = "Lean proves the rich authority property: extensions le false of dropped." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_false_of_dropped" +lean_statement_sha256 = "46a605cf7dea5af58e69b6f0bbc4ffed2ed34084cda7ea99b680ca975ac47f3a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-153" +claim_text = "Lean proves a child that strips a pinned critical-extension identifier is refused, whatever the laws." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_false_of_stripped" +lean_statement_sha256 = "92f064c6de7f9415d2483d26e88473b421a0b266b431f939de9f4178952ef6cd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-154" +claim_text = "Lean proves a child whose payload for a pinned identifier its law refuses is refused." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_false_of_refused" +lean_statement_sha256 = "4639baf3f61027f8833b78149c26c0af128dc39852f0360464e854e34acb944d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-155" +claim_text = "Lean proves a child that adds an identifier whose law refuses addition is refused." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_false_of_refused_addition" +lean_statement_sha256 = "7c57bc9d5691c1cb44f74f95653c02818b7a982cc8ed01c05d43aaed876b38a6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-105" +claim_text = "Lean proves the rich authority property: extensions le refuses a dropped singleton." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_refuses_a_dropped_singleton" +lean_statement_sha256 = "b0e6555b3ea818523fe6e8df539811645a6a7ee61e8a03c464b8852fb184829a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-156" +claim_text = "Lean proves per-identifier extension attenuation admits no world the parent refuses, given that every handler law narrows." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_le_narrows" +lean_statement_sha256 = "b84fc2cf70c513867276c1398608b399a6e3ca9f2c01905b3c339810dd1496d8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-017" +claim_text = "Lean proves the rich authority property: status refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.status_refl" +lean_statement_sha256 = "7d5310e68d00575620e99f894080ddc254f48770537a07e1a7e4acdae0090d63" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-018" +claim_text = "Lean proves the rich authority property: status trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.status_trans" +lean_statement_sha256 = "7e9d6580025807c2b2c984e8b167029b84ac610f9dcd280179e4c176872a04a1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-019" +claim_text = "Lean proves the rich authority property: status antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.status_antisymm" +lean_statement_sha256 = "a3badc32c1fcd22da760494c3c6eb256e637312f34fa7691591e7283f504867e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-020" +claim_text = "Lean proves the rich authority property: status satisfaction monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.status_satisfaction_monotone" +lean_statement_sha256 = "7f5f3cfc2e90f4a2bdf90499b6b596a0711d27f3668d3d99bcf8c5a0a146e022" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-021" +claim_text = "Lean proves the rich authority property: profile refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.profile_refl" +lean_statement_sha256 = "c256b640094e0458a6cb336c78c358b8f35906d7838c86142f649c4d7c3cf9ea" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-022" +claim_text = "Lean proves the rich authority property: profile trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.profile_trans" +lean_statement_sha256 = "bc702fae63c302ea1b30323b66eaa633f2c489dd14a84bda0802852888da4e5d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-023" +claim_text = "Lean proves the rich authority property: profile antisymm." +claim_status = "proved" +lean_declaration = "Auths.Rich.profile_antisymm" +lean_statement_sha256 = "306251093aa948294a625b5fd0e2707c52d9d391f172185ca36949ee0bd022ba" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-024" +claim_text = "Lean proves the rich authority property: profile coverage monotone." +claim_status = "proved" +lean_declaration = "Auths.Rich.profile_coverage_monotone" +lean_statement_sha256 = "fa6e1ec9008031df18e845bb6457030c5169bff159a30e5a30e4be9d7b445c16" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-025" +claim_text = "Lean proves the rich authority property: structural scope le refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.structural_scope_le_refl" +lean_statement_sha256 = "d62dc8e9720475e1f9aef453def070f12382d75b5d1836e28810c50a123fe1b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-026" +claim_text = "Lean proves the rich authority property: structural scope le trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.structural_scope_le_trans" +lean_statement_sha256 = "6cbce72d938dea6cd1a9f4814ba78cb52e8c5f4c7cddd2469a6526bb1662bb94" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-027" +claim_text = "Lean proves the rich authority property: scope le canonical antisymmetry." +claim_status = "proved" +lean_declaration = "Auths.Rich.scope_le_canonical_antisymmetry" +lean_statement_sha256 = "197fe00cdc067ce9188485dd0e9b76f9561669b95ca225396561d8ce855f4542" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-028" +claim_text = "Lean proves the rich authority property: action coverage downward closed." +claim_status = "proved" +lean_declaration = "Auths.Rich.action_coverage_downward_closed" +lean_statement_sha256 = "f76fefd95f4dae279b6fcfbe014a5e8fdd7a9a7c1641f42c19045b7b16a9c486" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-029" +claim_text = "Lean proves the rich authority property: evidence requirements downward closed." +claim_status = "proved" +lean_declaration = "Auths.Rich.evidence_requirements_downward_closed" +lean_statement_sha256 = "3fca86b2826d0c6807da5e6d6c742bb51084ff7bd9914f1cc40003a0eaae08b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-030" +claim_text = "Lean proves the rich authority property: complete admission downward closed." +claim_status = "proved" +lean_declaration = "Auths.Rich.complete_admission_downward_closed" +lean_statement_sha256 = "4894f6f4a2eb7bef73ad797ae1601d7c07994e4d1bff74e873b8f1df4ba6657b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-031" +claim_text = "Lean proves the rich authority property: semantic attenuation preorder refl." +claim_status = "proved" +lean_declaration = "Auths.Rich.semantic_attenuation_preorder_refl" +lean_statement_sha256 = "7ae1373433d76ff6136509d9662dab1b8e34867c4b4b067f1242499fb06ba0fd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-032" +claim_text = "Lean proves the rich authority property: semantic attenuation preorder trans." +claim_status = "proved" +lean_declaration = "Auths.Rich.semantic_attenuation_preorder_trans" +lean_statement_sha256 = "9b916eba63a367eacf049d8c8cb710908e7ca06d6e624f1b3d474bf6cb3fced9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-033" +claim_text = "Lean proves the rich authority property: structural scope le implies semantic attenuation." +claim_status = "proved" +lean_declaration = "Auths.Rich.structural_scope_le_implies_semantic_attenuation" +lean_statement_sha256 = "5218e5c6169c0fc0af43cb425d0a837930029032da4962d4168fd025f932d431" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-034" +claim_text = "Lean proves the rich authority property: scope semantic equivalence." +claim_status = "proved" +lean_declaration = "Auths.Rich.scope_semantic_equivalence" +lean_statement_sha256 = "ab0d42af5b5cf85e211b3660953239b56f008cd416570dd57f51d3d0c60175d2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-035" +claim_text = "Lean proves the rich authority property: structural scope le decides declared v1 relation." +claim_status = "proved" +lean_declaration = "Auths.Rich.structural_scope_le_decides_declared_v1_relation" +lean_statement_sha256 = "d21c9865f8d29bd1fef0778402eddb386af93dcea402725cc09a63a41c590529" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-036" +claim_text = "Lean proves the rich authority property: delegate implies scope le." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_implies_scope_le" +lean_statement_sha256 = "492a39565c693001c3f03fbb40573d3d3c6f08ddacf36e7b5f996ab04df0109f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-037" +claim_text = "Lean proves the rich authority property: delegate preserves root." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_preserves_root" +lean_statement_sha256 = "6b5a9d3d8a41d6753cf6787bd5df8afeffa2c2679fa0217b2fdfa59d8a1f46b2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-038" +claim_text = "Lean proves the rich authority property: delegate updates subject and parent." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_updates_subject_and_parent" +lean_statement_sha256 = "73aea20a45df311686451843eb0a05632aee895859fd5b12a91d950b9f30b581" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-125" +claim_text = "Lean proves the rich authority property: anchored chain preserves provenance." +claim_status = "proved" +lean_declaration = "Auths.Rich.anchored_chain_preserves_provenance" +lean_statement_sha256 = "854d2853a17bef32a429e1da533bb6ea9dec3428bf7a6649fc0dc5711331b9ee" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-139" +claim_text = "Lean proves the rich authority property: singleton context selects fresh self rooted start." +claim_status = "proved" +lean_declaration = "Auths.Rich.singleton_context_selects_fresh_self_rooted_start" +lean_statement_sha256 = "f110660181e70518b73b5360585a5eab8dad1d5ec2af11ac92b85c15569aabc8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-126" +claim_text = "Lean proves the rich authority property: chain descends from one root." +claim_status = "proved" +lean_declaration = "Auths.Authority.chain_descends_from_one_root" +lean_statement_sha256 = "854d2853a17bef32a429e1da533bb6ea9dec3428bf7a6649fc0dc5711331b9ee" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Authority.lean" +sha256 = "ad4757a4a8c19fd1626d3f2ad04a7fa0188e4ea445ca2c849369127d31b5b062" + +[[claims]] +claim_id = "AP-FORMAL-RICH-039" +claim_text = "Lean proves the rich authority property: delegate strict depth." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_strict_depth" +lean_statement_sha256 = "996384a43e290522990e26bb761fc181d37e551f3b2c11190e7ef4a55cd5a930" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-040" +claim_text = "Lean proves the rich authority property: delegate never widens." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_never_widens" +lean_statement_sha256 = "492a39565c693001c3f03fbb40573d3d3c6f08ddacf36e7b5f996ab04df0109f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-041" +claim_text = "Lean proves the rich authority property: remaining depth well founded." +claim_status = "proved" +lean_declaration = "Auths.Rich.remaining_depth_well_founded" +lean_statement_sha256 = "dcf9ed58cbeb7f0b6d9c7fa332d1b3f696f0114cee5ab770d2ad31b27d8698eb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-042" +claim_text = "Lean proves the rich authority property: finite delegation chain." +claim_status = "proved" +lean_declaration = "Auths.Rich.finite_delegation_chain" +lean_statement_sha256 = "c54457dda6f3f87e19a7224a424211e04f7da7706c7a6b950084ba630f0741f5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-043" +claim_text = "Lean proves the rich authority property: chain transitive attenuation." +claim_status = "proved" +lean_declaration = "Auths.Rich.chain_transitive_attenuation" +lean_statement_sha256 = "941e203039eef42df31f5c80208d2de0ac1345ff01f73b04ce139c9d57995c83" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-044" +claim_text = "Lean proves the rich authority property: authorized action covered." +claim_status = "proved" +lean_declaration = "Auths.Rich.authorized_action_covered" +lean_statement_sha256 = "7a3a3213af6f0aed9678912e472e816a9bbfb0f9b0040452f3fcde79d32152b0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-099" +claim_text = "Lean proves the rich authority property: extensions dimension is exact." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_dimension_is_exact" +lean_statement_sha256 = "ade313b34026661e080eb2b6ae656b39acb694efc597028eb0352fcc3c119bb8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-157" +claim_text = "Lean proves the generated extension dimension is false for a grant that strips a pinned identifier." +claim_status = "proved" +lean_declaration = "Auths.Rich.extensions_dimension_false_of_stripped" +lean_statement_sha256 = "978bd5383ecf2efee06ce1391d5355821d353f4e454cbe15d8a0bec2d925aea2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-101" +claim_text = "Lean proves the rich authority property: altered extensions deny every projection." +claim_status = "proved" +lean_declaration = "Auths.Rich.altered_extensions_deny_every_projection" +lean_statement_sha256 = "02f306f478ccb5919a689482ba1e101e9723e5d365d3f7bd4c71d303a37c5383" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-158" +claim_text = "Lean proves every accepted edge carries the grant's extension set, which attenuates every pinned parent identifier under its law." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_attenuates_pinned_extensions" +lean_statement_sha256 = "24acb38fc7066db51bd66b9e07dd5b6376010f969e2466acd191d080bbf01040" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-159" +claim_text = "Lean proves every state reachable along a delegation chain carries every critical-extension identifier pinned at its start." +claim_status = "proved" +lean_declaration = "Auths.Rich.chain_retains_pinned_extension_identifiers" +lean_statement_sha256 = "cd2cd919349232f6b3b498154eae98ab6070edd0936d891646946968b3cc6ac4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-160" +claim_text = "Lean proves an accepted delegation never widens authority, including every critical-extension payload, given that every handler law is a narrowing preorder." +claim_status = "proved" +lean_declaration = "Auths.Rich.delegate_never_widens_authority" +lean_statement_sha256 = "459fd80f79b0474a17b23f31d1ea894170a59be8af9ca849fa17b930850855f5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-161" +claim_text = "Lean proves no state reachable along a delegation chain admits an authorization fact its start refuses, given that every handler law is a narrowing preorder." +claim_status = "proved" +lean_declaration = "Auths.Rich.chain_never_widens_authority" +lean_statement_sha256 = "badba34df0ad02950772de9a16a08ed704b00d13161ca3adb9690156fa9528d9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-045" +claim_text = "Lean proves the rich authority property: rich projection accepts iff root preservation and scope depth checks." +claim_status = "proved" +lean_declaration = "Auths.Rich.rich_projection_accepts_iff_root_and_scope_depth_checks" +lean_statement_sha256 = "8701007d8b4c42f2059cd7e02a841fe632ae4380470f3b2a396d0702e8371f46" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-046" +claim_text = "Lean proves the rich authority property: apply grant success iff linked and projection." +claim_status = "proved" +lean_declaration = "Auths.Rich.apply_grant_success_iff_linked_and_projection" +lean_statement_sha256 = "d1e837214c3e2d92a11750a81de8f7a132d3615cd87b3d826e3952408a44d1b5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-047" +claim_text = "Lean proves the rich authority property: apply grant success iff delegates." +claim_status = "proved" +lean_declaration = "Auths.Rich.apply_grant_success_iff_delegates" +lean_statement_sha256 = "60adbaa9a7b69216f9a63e2d01e0d46c696e2e5c06b47a6b4b4a0bdac13e6550" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-048" +claim_text = "Lean proves the rich authority property: apply grant success unique." +claim_status = "proved" +lean_declaration = "Auths.Rich.apply_grant_success_unique" +lean_statement_sha256 = "e5f71557dd61f8b0a5479564c6418fd399bf7ab28dc31f18d2fcb8acd3ee169d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-049" +claim_text = "Lean proves the rich authority property: authority delegate diagnostic sound complete." +claim_status = "proved" +lean_declaration = "Auths.Rich.authority_delegate_diagnostic_sound_complete" +lean_statement_sha256 = "1b03026088d20c617111ac18f843d1a98eff2a0d88aee42703c1f9bbfbfc6202" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-050" +claim_text = "Lean proves the rich authority property: authority delegate first failure." +claim_status = "proved" +lean_declaration = "Auths.Rich.authority_delegate_first_failure" +lean_statement_sha256 = "4520e0f85b7efe3d629a9e1beaf601ea16ba7d9728759bab9dfbd2f208ddffcf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-051" +claim_text = "Lean proves the rich authority property: author planning diagnostic sound complete." +claim_status = "proved" +lean_declaration = "Auths.Rich.author_planning_diagnostic_sound_complete" +lean_statement_sha256 = "b6e9eff61245c569032bf56f08d2e4024342839385feca01eec87393f6fb6e58" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-052" +claim_text = "Lean proves the rich authority property: coverage decision ok iff covers." +claim_status = "proved" +lean_declaration = "Auths.Rich.coverage_decision_ok_iff_covers" +lean_statement_sha256 = "bba6affe418888d125471704869356f8eda4861176df0aa5e75b72e873bb4a31" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-140" +claim_text = "Lean proves the rich authority property: rooted of origin." +claim_status = "proved" +lean_declaration = "Auths.Rich.rooted_of_origin" +lean_statement_sha256 = "273f922682334f0d8d4d60194e8517e3c842a615da43e0ec829e231893fbed43" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-141" +claim_text = "Lean proves the rich authority property: reachable accepted." +claim_status = "proved" +lean_declaration = "Auths.Rich.reachable_accepted" +lean_statement_sha256 = "9072a66c7332af7b2d27fea1b83fae0893fc14f9158106ce72fd5c7fb60cce48" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-142" +claim_text = "Lean proves the rich authority property: rooted of reachable." +claim_status = "proved" +lean_declaration = "Auths.Rich.rooted_of_reachable" +lean_statement_sha256 = "ff692ede01812e450cc8984ab3fef696b0e1d71fb93086a53dd1117c27eefdd9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-127" +claim_text = "Lean proves the rich authority property: registry coverage decision ok iff covers." +claim_status = "proved" +lean_declaration = "Auths.Rich.registry_coverage_decision_ok_iff_covers" +lean_statement_sha256 = "75c5f00e47dfec8a229951c0220026fd984afd3ffce7b03b32f61bcc8a50672c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-122" +claim_text = "Lean proves the rich authority property: extensions not forgeable." +claim_status = "proved" +lean_declaration = "Auths.Rich.CertifiedProjection.extensions_not_forgeable" +lean_statement_sha256 = "77fa3bfc160297a578bb99027f43b51d5f93820a10000030043dbcb37f577bcf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-123" +claim_text = "Lean proves the rich authority property: root not forgeable." +claim_status = "proved" +lean_declaration = "Auths.Rich.CertifiedProjection.root_not_forgeable" +lean_statement_sha256 = "5e5412a76d954a30bb8e5581001dc229b77ddde589cfc4209756972e667e02a6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-109" +claim_text = "Lean proves the rich authority property: validity start direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.validity_start_direction" +lean_statement_sha256 = "b131c8323adfe2d1fdfb276e8b57d8ecbeeadc7ba76c42e142e9e60a1c7c8bd0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-110" +claim_text = "Lean proves the rich authority property: validity end direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.validity_end_direction" +lean_statement_sha256 = "64a8422660d220c34ccf2286b3d2b656caee30d180efb50390b98109f012cb9b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-128" +claim_text = "Lean proves the rich authority property: permission subset direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.permission_subset_direction" +lean_statement_sha256 = "460b9c2c8b40e2c47974aa6f40439a0921401af0a741e636dca7e8ce1e1128cb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-129" +claim_text = "Lean proves the rich authority property: audience subset direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.audience_subset_direction" +lean_statement_sha256 = "1efdeced0d7cc63e210e3eed78bf72af7188d0b4b89988645067c065df38d4ca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-130" +claim_text = "Lean proves the rich authority property: permission membership decision." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.permission_membership_decision" +lean_statement_sha256 = "5562c113f4b1600e9fa2e351daefdf7ad676c95399913cfaf5366a4d02693859" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-131" +claim_text = "Lean proves the rich authority property: audience membership decision." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.audience_membership_decision" +lean_statement_sha256 = "5562c113f4b1600e9fa2e351daefdf7ad676c95399913cfaf5366a4d02693859" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-132" +claim_text = "Lean proves the rich authority property: body digest membership decision." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.body_digest_membership_decision" +lean_statement_sha256 = "40e8f579841509c93f52d9b1e8ceeb0068d9deee142398402b148d5dcab74f52" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-133" +claim_text = "Lean proves the rich authority property: body digest subset direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.body_digest_subset_direction" +lean_statement_sha256 = "6f6d71aafc31d6e2f5f5d6b41450fab50ccbcc47ea24ff1a4d10a06f547e7a3b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-134" +claim_text = "Lean proves the rich authority property: action exact equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.action_exact_equality" +lean_statement_sha256 = "12d3ee8161fd73a2b9a4c289c074a70dbe838e01889bae915eb1a28a5e0b5cbf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-135" +claim_text = "Lean proves the rich authority property: action constructor fallback." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.action_constructor_fallback" +lean_statement_sha256 = "52a8700eb9047be465715d24eb7cce83a544f68beb675fc0ca746b20adcef29d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-136" +claim_text = "Lean proves the rich authority property: action singleton exact rejection." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.action_singleton_exact_rejection" +lean_statement_sha256 = "f748a54bcd87a1105b376fd789d539dcba915c55b382c4d84d0764697544e403" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-111" +claim_text = "Lean proves the rich authority property: budget value direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.budget_value_direction" +lean_statement_sha256 = "e5c3c785f61156754ca58b613f917897b7204e66cf2904be240c6ae56dc234d5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-112" +claim_text = "Lean proves the rich authority property: budget algebra equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.budget_algebra_equality" +lean_statement_sha256 = "856f719d1d4fe6a2b19dab9c3bcfd40873e74a55abaf10f945308fbb05b95652" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-113" +claim_text = "Lean proves the rich authority property: optional budget bounded parent." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.optional_budget_bounded_parent" +lean_statement_sha256 = "35b7c28a001e2386a652f5e174baa301a265a3eadd74a8c68c3b43d6d0cde025" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-114" +claim_text = "Lean proves the rich authority property: optional budget no request." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.optional_budget_no_request" +lean_statement_sha256 = "b661893af19ee64775f156871b07d71fd53478d22876735146530e3d0d624299" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-115" +claim_text = "Lean proves the rich authority property: delegation depth strictness." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.delegation_depth_strictness" +lean_statement_sha256 = "7c203a21398399f9e247a106c21958e147051c105775efb5696c6103d3fcef53" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-116" +claim_text = "Lean proves the rich authority property: status age direction." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.status_age_direction" +lean_statement_sha256 = "bcd2dc8a61a687aa05525983f0a82d8eb2c30f82bd8714e98f4538219ffa4018" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-117" +claim_text = "Lean proves the rich authority property: status method equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.status_method_equality" +lean_statement_sha256 = "65eb51069ff53dc4a198806e1fd34df0d06c718b805fe98af2c9ce6b81818c8f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-118" +claim_text = "Lean proves the rich authority property: assurance equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.assurance_equality" +lean_statement_sha256 = "682a5d15cb1ed38aafddcb2a5e0e987609428320b263e5bbae4cbea456d9d8ca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-163" +claim_text = "Lean kills the mutation that accepts a child critical extension without applying its identifier's law." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.critical_extension_law" +lean_statement_sha256 = "23f565b7d27ba7241114c8362d3604ec74ed08a4e05b82d5a97dce2500c87970" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-138" +claim_text = "Lean proves the rich authority property: critical extensions reversed not sorted." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.critical_extensions_reversed_not_sorted" +lean_statement_sha256 = "1ac76c3db510279b30c76d84b5538b47ad6c5f46fd2e3ae71a45976fea3131dc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-119" +claim_text = "Lean proves the rich authority property: profile version equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.profile_version_equality" +lean_statement_sha256 = "d061c3229df6d475f2f0dfc7a492dc1dce9c34555a20bd03b530e579a1b34d72" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-120" +claim_text = "Lean proves the rich authority property: principal linkage equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.principal_linkage_equality" +lean_statement_sha256 = "399766c14541a0cf9533a13cbb97e40432b86f182ea9b99bfc835aa86556998d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-121" +claim_text = "Lean proves the rich authority property: grant linkage equality." +claim_status = "proved" +lean_declaration = "Auths.Rich.Mutations.grant_linkage_equality" +lean_statement_sha256 = "78a60f2b43f1db4ae1ea88249aa8edab996999d314cc0d09a55151ae5170fb0c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Mutations.lean" +sha256 = "9c9e101c9a8948d1718f9f0e1b16d909716eeb7baac0f8c56d73e8d58b18655e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-053" +claim_text = "Lean proves the rich authority property: coverage diagnostic sound complete." +claim_status = "proved" +lean_declaration = "Auths.Rich.coverage_diagnostic_sound_complete" +lean_statement_sha256 = "77658775391d0d2d6b38529f58c690b9aa08a5146284dbb022765523106519e5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Theorems.lean" +sha256 = "9530bd60f38411eb906260ecb6ae6ec26978c4c5661cffee858e8e53bfc7d91c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-054" +claim_text = "The mechanically translated production author-scope evaluator returns exactly the rich target-V1 decision and first failing authority dimension." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.translated_rust_refines_rich_spec" +lean_statement_sha256 = "195ddcaa796803794574579d593c5a78f7fbd9611d32492de2a095e044fe2ca8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_authority::evaluate_author_scope_view", + "auths_model::profile_ref_equal", + "auths_model::permission_set_is_subset", + "auths_model::validity_window_contains", + "auths_model::audience_set_is_subset", + "auths_model::action_constraint_attenuates", + "auths_model::optional_budget_attenuates", + "auths_model::status_policy_attenuates", + "auths_model::assurance_policy_id_equal", + "auths_authority::critical_extensions_attenuate", + "auths_authority::parent_extensions_retained", + "auths_authority::child_extensions_admitted", + "auths_authority::parent_extension_retained", + "auths_authority::child_extension_admitted", + "auths_model::critical_extension_entries", + "auths_model::critical_extension_find", + "auths_model::critical_extension_id", + "auths_model::critical_extension_payload", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact translated pre-signing scope evaluator over validated bounded views, including all ten scope/depth dimensions and ordered diagnostics, for every set of critical-extension laws." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises are trusted.", + "Canonical decoding and cryptographic authenticity precede this pure evaluator and are outside this theorem.", + "The critical-extension handler laws live in auths-registries, outside the translated kernel. The theorem holds for every law the translated handler-law instance computes without failing (premise LawsRefine); that each registered law is a narrowing preorder is proved separately over decoded payloads, and the byte-level handlers' agreement with those decoded laws rests on the canonical codec.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims.evidence]] +kind = "lean-generated-vectors" +artifact = "core/formal-vectors/v1/rich-authority.json" +sha256 = "8f560ad3afa1ae5f0ef7dc5a8b77779e5da79c59d94d39bf2d2a005edac25a92" + +[[claims.evidence]] +kind = "mutation-matrix" +artifact = "formal/refinement-mutations-v1.json" +sha256 = "fa6aaad59e5628e4017f1bb69195d8bb83785121c295276ea4ab37d8f8771be4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/authority/Funs.lean" +sha256 = "2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-055" +claim_text = "The mechanically translated terminal-coverage evaluator returns exactly the rich ordered decision for the supplied trusted budget-expression context." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.translated_coverage_refines_rich_spec" +lean_statement_sha256 = "e8deba0035a09886221c46411be908f1ac8c30e0e3755ca956a62884a416a0fa" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_authority::evaluate_action_coverage_view", + "auths_authority::root_linkage", + "auths_authority::selected_profile_attenuates", + "auths_algebra_kernel::root_preserved", + "auths_model::principal_id_equal", + "auths_model::optional_grant_id_equal", + "auths_model::profile_ref_equal", + "auths_model::profile_slice_contains", + "auths_model::permission_set_contains", + "auths_model::validity_window_contains", + "auths_model::audience_set_contains", + "auths_model::action_constraint_allows", + "auths_model::budget_ceiling_covers_action", + "auths_model::optional_budget_covers", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The crate-private raw translated evaluator over validated authority/action views. The public EffectiveAuthority::authorizes boundary resolves budget expressibility from AcceptedRegistries and the exact action profile before calling it." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises are trusted.", + "The AcceptedRegistries lookup-to-kernel composition is enforced by the Rust public API and adversarial tests; the registry collection's provenance and canonical decoding are outside this translated raw-view theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims.evidence]] +kind = "lean-generated-vectors" +artifact = "core/formal-vectors/v1/rich-authority.json" +sha256 = "8f560ad3afa1ae5f0ef7dc5a8b77779e5da79c59d94d39bf2d2a005edac25a92" + +[[claims.evidence]] +kind = "mutation-matrix" +artifact = "formal/refinement-mutations-v1.json" +sha256 = "fa6aaad59e5628e4017f1bb69195d8bb83785121c295276ea4ab37d8f8771be4" + +[[claims.evidence]] +kind = "translated-rust" +artifact = "formal/qualification/aeneas/generated/authority/Funs.lean" +sha256 = "2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-056" +claim_text = "The mechanically translated delegation evaluator returns exactly the rich linkage, eleven-dimension attenuation decision, diagnostic, and accepted transition." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.translated_delegation_refines_rich_spec" +lean_statement_sha256 = "45782f85b6ded4714d9ca4e4b6a8ee2dc0e70c99395691101d834087a89c2fe1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_authority::evaluate_grant_view", + "auths_authority::root_linkage", + "auths_authority::depth_decreases", + "auths_authority::selected_profile_attenuates", + "auths_authority::extensions_attenuate", + "auths_algebra_kernel::root_preserved", + "auths_algebra_kernel::generated::attenuation_checks_accept", + "auths_model::principal_id_equal", + "auths_model::optional_grant_id_equal", + "auths_model::profile_ref_equal", + "auths_model::profile_slice_contains", + "auths_model::permission_set_is_subset", + "auths_model::validity_window_contains", + "auths_model::audience_set_is_subset", + "auths_model::action_constraint_attenuates", + "auths_model::optional_budget_attenuates", + "auths_model::status_policy_attenuates", + "auths_model::assurance_policy_id_equal", + "auths_authority::critical_extensions_attenuate", + "auths_authority::parent_extensions_retained", + "auths_authority::child_extensions_admitted", + "auths_authority::parent_extension_retained", + "auths_authority::child_extension_admitted", + "auths_model::critical_extension_entries", + "auths_model::critical_extension_find", + "auths_model::critical_extension_id", + "auths_model::critical_extension_payload", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The crate-private raw evaluator over validated parent/grant views, including root linkage, strict depth, every attenuation dimension, and the unique accepted transition, for every set of critical-extension laws." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises are trusted.", + "The critical-extension handler laws live in auths-registries, outside the translated kernel. The theorem holds for every law the translated handler-law instance computes without failing (premise LawsRefine); that each registered law is a narrowing preorder is proved separately over decoded payloads, and the byte-level handlers' agreement with those decoded laws rests on the canonical codec.", + "A present last-grant marker is representation data, not ancestry proof. Shipping Rust seals raw views; historical provenance is stated separately by Lean's AnchoredChain theorem from a fresh anchor through accepted transitions.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims.evidence]] +kind = "lean-generated-vectors" +artifact = "core/formal-vectors/v1/rich-authority.json" +sha256 = "8f560ad3afa1ae5f0ef7dc5a8b77779e5da79c59d94d39bf2d2a005edac25a92" + +[[claims.evidence]] +kind = "mutation-matrix" +artifact = "formal/refinement-mutations-v1.json" +sha256 = "fa6aaad59e5628e4017f1bb69195d8bb83785121c295276ea4ab37d8f8771be4" + +[[claims.evidence]] +kind = "translated-rust" +artifact = "formal/qualification/aeneas/generated/authority/Funs.lean" +sha256 = "2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-104" +claim_text = "The regenerated Aeneas translation of optional_budget_covers answers false for a present ceiling with an absent request, matching the shipping Rust. Lean records this positively: an action declaring no bound on what it may spend is exactly the authority a ceiling exists to deny. This replaces the former staleness claim, which recorded the opposite as checked evidence while the pinned translation was stale." +claim_status = "proved" +lean_declaration = "Auths.Refinement.translated_bounded_ceiling_denies_absent_request" +lean_statement_sha256 = "9c4ea11fa46f39a993ab4038263180284eca394df782a70259346c8167d7e4fc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims]] +claim_id = "AP-FORMAL-RICH-106" +claim_text = "Lean proves the rich authority property: translated expressible absent request is denied." +claim_status = "proved" +lean_declaration = "Auths.Refinement.translated_expressible_absent_request_is_denied" +lean_statement_sha256 = "90aa025faf3b73862f51432d5b07d0ef69c1bd67826d739083b6e42d65f00e4a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims]] +claim_id = "AP-FORMAL-RICH-107" +claim_text = "Lean proves the rich authority property: translated inexpressible absent request is covered." +claim_status = "proved" +lean_declaration = "Auths.Refinement.translated_inexpressible_absent_request_is_covered" +lean_statement_sha256 = "294ac2be47b25a2f72d528f66b974cb3acc2dfd8a330a8c6696b8dad12fb8d97" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims]] +claim_id = "AP-FORMAL-RICH-108" +claim_text = "Lean proves the rich authority property: translated absent ceiling covers anything." +claim_status = "proved" +lean_declaration = "Auths.Refinement.translated_absent_ceiling_covers_anything" +lean_statement_sha256 = "90df3548fb3d56bed30812c94acb18b2d6b0028f77aff11cd44aade8e2889961" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Production.lean" +sha256 = "6c2764b1e7c5246608c35fbca1d5060aeb9baa2489167948b5c147a4e5580f22" + +[[claims]] +claim_id = "AP-FORMAL-RICH-057" +claim_text = "Lean proves the bounded product-policy property: configuration match refl." +claim_status = "proved" +lean_declaration = "Auths.Product.configuration_match_refl" +lean_statement_sha256 = "1d3b3a5ed6156f4e5616d877b35e9942f824f876e6db3aa3cd39729305a8ed4e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Commitment.lean" +sha256 = "b94e57002d8b8c31906dab9e0f84c3ee38b01450f607f4fbb15ffffcb6a18221" + +[[claims]] +claim_id = "AP-FORMAL-RICH-058" +claim_text = "Lean proves the bounded product-policy property: configuration match deterministic." +claim_status = "proved" +lean_declaration = "Auths.Product.configuration_match_deterministic" +lean_statement_sha256 = "0b97aea7619fab2ffebd442c8d6376a02779d0e4c9673837e48f45c99488c8e0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Commitment.lean" +sha256 = "b94e57002d8b8c31906dab9e0f84c3ee38b01450f607f4fbb15ffffcb6a18221" + +[[claims]] +claim_id = "AP-FORMAL-RICH-059" +claim_text = "Lean proves the bounded product-policy property: checked add never wraps." +claim_status = "proved" +lean_declaration = "Auths.Product.checked_add_never_wraps" +lean_statement_sha256 = "f2e86c112c2021bab2444682e85973ad5b3f3de473bf5e093a47c65ebd74cf06" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Arithmetic.lean" +sha256 = "6e08fc3a8b059f5e86807f25972a5f4f97cce4c6729344f75752b7e30d913c47" + +[[claims]] +claim_id = "AP-FORMAL-RICH-060" +claim_text = "Lean proves the bounded product-policy property: checked sub never underflows." +claim_status = "proved" +lean_declaration = "Auths.Product.checked_sub_never_underflows" +lean_statement_sha256 = "fc97e83a1f988edafe17d5d775cafb333138ff36e1ee3ac65609f48844129fa5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Arithmetic.lean" +sha256 = "6e08fc3a8b059f5e86807f25972a5f4f97cce4c6729344f75752b7e30d913c47" + +[[claims]] +claim_id = "AP-FORMAL-RICH-061" +claim_text = "Lean proves the bounded product-policy property: checked div rejects zero." +claim_status = "proved" +lean_declaration = "Auths.Product.checked_div_rejects_zero" +lean_statement_sha256 = "004c9c8a21f3a6416181d4d561ae3dd38aebca10d640f288eb8af0e4bba34ba4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Arithmetic.lean" +sha256 = "6e08fc3a8b059f5e86807f25972a5f4f97cce4c6729344f75752b7e30d913c47" + +[[claims]] +claim_id = "AP-FORMAL-RICH-062" +claim_text = "Lean proves the bounded product-policy property: three way partition." +claim_status = "proved" +lean_declaration = "Auths.Product.three_way_partition" +lean_statement_sha256 = "fa4bfacdd689bfe94265f7c2627598a8d758ae6ac3667bc6270f581219151e3e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Eligibility.lean" +sha256 = "7dd0c6d987bc8684430f0bc2a7244c4965990a5278cc0d0dce0d63795e86d4f1" + +[[claims]] +claim_id = "AP-FORMAL-RICH-063" +claim_text = "Lean proves the bounded product-policy property: product contract configuration safety." +claim_status = "proved" +lean_declaration = "Auths.Product.product_contract_configuration_safety" +lean_statement_sha256 = "18957d267951e86ccae5c49b3b704e2e45d87c427d023f4e0a3684b895e461d5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Theorems.lean" +sha256 = "7c05061876df3a8d71c86e7ea07cf9db89f9e1c1eb32ecf45899008c8fade154" + +[[claims]] +claim_id = "AP-FORMAL-RICH-064" +claim_text = "Lean proves the bounded product-policy property: product contract output completeness." +claim_status = "proved" +lean_declaration = "Auths.Product.product_contract_output_completeness" +lean_statement_sha256 = "b4fa5d97dd43b72133cc583f8834921ed1c968fde6ac3eb4f7c4b5ecc49f1c08" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Theorems.lean" +sha256 = "7c05061876df3a8d71c86e7ea07cf9db89f9e1c1eb32ecf45899008c8fade154" + +[[claims]] +claim_id = "AP-FORMAL-RICH-065" +claim_text = "Lean proves the bounded product-policy property: translated configuration refines projection." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_configuration_refines_projection" +lean_statement_sha256 = "a988d91b2f65fea6451fdbe5ebc0b75ea7324b27c0b4031b1b49144eb15ef297" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-066" +claim_text = "Lean proves the bounded product-policy property: translated checked add refines nat." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_checked_add_refines_nat" +lean_statement_sha256 = "eed21c6bdc5e0ba56c0c8dd9249ee1d51053fa42b8df3958a762399ba0bf7ab5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-067" +claim_text = "Lean proves the bounded product-policy property: translated checked sub refines nat." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_checked_sub_refines_nat" +lean_statement_sha256 = "fed19d1701dac7a6f928957a78799fcf63eaf80d24ea0cbed66d77e490ed879c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-068" +claim_text = "Lean proves the bounded product-policy property: translated checked mul refines nat." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_checked_mul_refines_nat" +lean_statement_sha256 = "f2e5d31dcc8e7f7651c0223bfdabccadc850be49cb8431aebf966aee9f7acc35" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-069" +claim_text = "Lean proves the bounded product-policy property: translated checked div rejects zero." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_checked_div_rejects_zero" +lean_statement_sha256 = "cb30a894abfc0b326ba704c9d0979adb434cb7fc94f0134e14442c313e8670fb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-262" +claim_text = "The mechanically translated window index returns exactly the natural-number quotient of the time by the window length, and none for a zero-length window." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.translated_window_index_refines_nat" +lean_statement_sha256 = "2d4076b355c9fd4faad8b9663b8a68e1c49f619da2cf11c74e9bdb30f7d480da" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::window_index"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of u64 time and window length." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Reading the gateway clock and choosing the window length from the policy are outside this theorem; the clock is unauthenticated and assumed.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-263" +claim_text = "The mechanically translated digest comparison returns exactly the equality of the digests' byte values." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model" +lean_statement_sha256 = "d8411964df44b9e93b4d097961e55e60bef00a8ef71c89d7b3bec08963599b85" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::bounded_policy::digest_equal"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of 32-byte digests." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, and the listed foundational axioms are trusted; the theorem has no premise.", + "Decoding the bounded-policy extension, computing the digest of the parent's extension bytes, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/BoundedPolicy.lean" +sha256 = "a6914db63c0b7ed3efc94b19e312ceb3718cb181968ebbedfafb9e060c207de5" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-264" +claim_text = "The mechanically translated parent-link check returns exactly the model's link rule: a kept extension links exactly its parent's extension digest, and an added one carries no link." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model" +lean_statement_sha256 = "7c7c5aec926901e72f22a2b9c4b1c6c4bb833c010440f657fcb79d7e827144d7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::bounded_policy::bounded_policy_link_accepts", + "auths_model::bounded_policy::digest_equal", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every optional child link and optional parent digest." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, and the listed foundational axioms are trusted; the theorem has no premise.", + "Decoding the bounded-policy extension, computing the digest of the parent's extension bytes, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/BoundedPolicy.lean" +sha256 = "a6914db63c0b7ed3efc94b19e312ceb3718cb181968ebbedfafb9e060c207de5" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-186" +claim_text = "Lean proves the translated argument-ceiling evaluation leaf computes exactly the model decision." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_ceiling_count_refines_model" +lean_statement_sha256 = "ada2be3af3def88e58de1ff9aef4485651996241a5c2a0f8ce0dd50d27728b1e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The Aeneas-translated argument-ceiling window-count leaves of auths-bounded-policy, under the pinned translation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-187" +claim_text = "Lean proves the translated argument-ceiling tightening leaf computes exactly the model decider." +claim_status = "proved" +lean_declaration = "Auths.Product.Refinement.translated_ceiling_count_tightens_refines_model" +lean_statement_sha256 = "9477f8ea177a765c5ac61d23ce7032ca8156309063f5963bad218c829d08981c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The Aeneas-translated argument-ceiling window-count leaves of auths-bounded-policy, under the pinned translation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-236" +claim_text = "The mechanically translated count leaf returns exactly the model's count part of chain admission: every distinct counter of the fixed window below its capacity." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.translated_chain_counts_admit_refines_model" +lean_statement_sha256 = "f71baa54d41b494f3c2a69f250c2183339389bbe1d5d94fd64d8b5ed9afb7d67" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::chain_counts_admit"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of u64 slices of counter values and capacities, including slices of different lengths." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-237" +claim_text = "The mechanically translated sum leaf returns exactly the model's sum part of chain admission: every distinct running sum of the fixed window plus the argument within its capacity, with an overflowing addition refused." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.translated_chain_sums_admit_refines_model" +lean_statement_sha256 = "c75fcec112558e4eca8125e5996cd4dea6d1e2a76cd45bf1b1accbf1c0dfc5ee" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::chain_sums_admit"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 argument and pair of u64 slices of running sums and capacities, including slices of different lengths." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-238" +claim_text = "The mechanically translated tightening decider of policy /2 returns exactly the model's decider: the same argument, the unchanged ceiling and count rule, and the sum, partition, and scope rules." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.translated_argument_policy_tightens_refines_model" +lean_statement_sha256 = "f20279e5c8f3b5e9d3f9e56408c91d6f0151b2106434969f9890a5ef5389c337" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_bounded_policy::kernel::argument_policy_tightens", + "auths_bounded_policy::kernel::ceiling_count_tightens", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of policy members: argument names, ceilings, windows, counts, optional sums with optional partitions, and optional scopes with value lists of any length." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Decoding the canonical policy bytes and projecting them onto the decider's members is outside this theorem; it is covered by the policy codec tests and the bounds fixtures.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement.lean" +sha256 = "dab1d764f9a57352e146ae1465a104a936f21e6be9323497c561a8e9d738502e" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-175" +claim_text = "Lean proves the argument-ceiling evaluation is eligible exactly when the value is within the ceiling and the fixed window's counter has room." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.code_eligible_iff" +lean_statement_sha256 = "ca2f3dfef380a22f6280465f8320e1aca773e3ca0290cc38f7babe12f6642e63" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-176" +claim_text = "Lean proves the argument-ceiling tightening decider of policy /2 decides exactly semantic tightening, including the sum, partition, and scope rules." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.decider_iff_tightens" +lean_statement_sha256 = "ae8a39a1e41e905d9464cc4dad8638cf1047017ff0ad58d77cceba6498a1a2a3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-177" +claim_text = "Lean proves a tighter argument-ceiling policy never admits a context its parent refuses." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.tightening_never_admits_more" +lean_statement_sha256 = "fbdda26118f2596fdad003444f236e79a1bf12754a1a6beb0d61e30dd66e6287" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-178" +claim_text = "Lean proves the argument-ceiling tightening decider is sound: a child it accepts admits only contexts its parent admits." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.decider_sound" +lean_statement_sha256 = "9be80ea95233697c96ff6a9b5dce9aca5f84988261dcb57119c5e7bf0b7af0e8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-179" +claim_text = "Lean proves a smaller argument ceiling never authorizes more." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.smaller_ceiling_never_authorizes_more" +lean_statement_sha256 = "9e56daaf4f09d2a01150daf784d6584c590f59545639139ae91bfa6be4025690" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-180" +claim_text = "Lean proves a smaller count per fixed window never authorizes more." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.smaller_count_never_authorizes_more" +lean_statement_sha256 = "ddcd9f8d9141338018e9fb5a68fca37b7e157619f0ca917c0550cef5c8a828a6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-181" +claim_text = "Lean proves argument-ceiling tightening is reflexive." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.tightens_refl" +lean_statement_sha256 = "3c2b30687d72f28f07c13e1069f9e8f49ad2ca604c8d0b9561ad86e64090dec6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-182" +claim_text = "Lean proves argument-ceiling tightening is transitive." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.tightens_trans" +lean_statement_sha256 = "27bddfea8d4eaa275419f7461e14c30f42db2e6aa67ed049e2baafe0c113b7fd" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-183" +claim_text = "Lean proves the bounded-policy extension law the gateway enforces is a preorder that narrows, discharging in the product layer the narrowing premise of per-extension attenuation for bounded-policy-commitment-v1." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.bounded_policy_law_lawful" +lean_statement_sha256 = "b5311babd266c58b0a167f530675436fd804cf4ba0af4a66d33f6b8ba37fa749" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Product-layer premise of the bounded-policy-commitment-v1 extension. The kernel checks only that a delegated commitment links the digest of its parent's extension bytes; narrowing is discharged here by the registered evaluator's tightening decider, which the gateway runs on every linked pair before eligibility. This is not a kernel theorem." +residual_assumptions = [ + "Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted.", + "The gateway runs the registered decider on every linked pair of the authorized chain before any claim, and a verifier without that product layer applies only the kernel link law; the policy bytes decode to this model's policy under the registered canonicalization.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-184" +claim_text = "Lean proves the bounded-policy extension law accepts adding a bound to an unbounded grant." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.bounded_policy_law_accepts_addition" +lean_statement_sha256 = "1025dc58f2d798f02e8a8a643c4c3a76c544e76302970c2d7ce99ed6274cf89b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Product-layer premise of the bounded-policy-commitment-v1 extension. The kernel checks only that a delegated commitment links the digest of its parent's extension bytes; narrowing is discharged here by the registered evaluator's tightening decider, which the gateway runs on every linked pair before eligibility. This is not a kernel theorem." +residual_assumptions = [ + "Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted.", + "The gateway runs the registered decider on every linked pair of the authorized chain before any claim, and a verifier without that product layer applies only the kernel link law; the policy bytes decode to this model's policy under the registered canonicalization.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-185" +claim_text = "Lean proves the argument-ceiling evaluator satisfies the shared fixed-context tightening law." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.ceiling_count_fixed_context_tightening" +lean_statement_sha256 = "30accc61db6512783cf3b568eefa9d09579eccc72e3ce2d0ca196d3e27efbd40" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-239" +claim_text = "Lean proves reserving a chain's counters is all or none: either no counter changes, or each distinct count counter of the fixed window rises by exactly one, each distinct sum counter by exactly the argument, and every other counter is unchanged." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.reserve_all_or_none" +lean_statement_sha256 = "6ab5bb8963257698a595bbad3d04e33cf7a4284948372b3c1217489fd81cb0ef" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-240" +claim_text = "Lean proves that, for every arrival order in one fixed window, a link's count bounds its subject and delegates: the admitted actions whose chain contains the link number at most its count." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.aggregate_count_bound" +lean_statement_sha256 = "0f5accd437257509195f6034a9d50f0713a21aeab2c655b0fecb95527124eb8d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-241" +claim_text = "Lean proves that, for every arrival order in one fixed window, the argument sum of the admitted actions whose chain contains a link is at most the link's ceiling times its count." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.aggregate_spend_bound" +lean_statement_sha256 = "8bc18ab4c3404924341910f3b156124dad2a029e37e2fdef41b52a5117a13340" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-242" +claim_text = "Lean proves that, for every arrival order in one fixed window, a link's sum limit bounds the sum of the bounded argument over its subject and delegates, per listed partition value." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.aggregate_sum_bound" +lean_statement_sha256 = "37700c8ea564cd8346ffd48a8f33774fae3436abd135c0584bc7704afe7ff07f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-243" +claim_text = "Lean proves delegation never multiplies a count: in one fixed window, when every admitted action's chain carries the root link, the whole tree's admitted actions number at most the root's count and their argument sum is at most its ceiling times its count." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.delegation_never_multiplies" +lean_statement_sha256 = "f09ba1275f7a50f260a64fc78ed3663ea70f459ba704b3acb4598f685fdd9184" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-244" +claim_text = "Lean proves delegation never multiplies a sum: in one fixed window, when every admitted action's chain carries the root link, the argument sum of the whole tree's admitted actions, per listed partition value, is at most the root's sum limit." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.sum_delegation_never_multiplies" +lean_statement_sha256 = "289fea63130a02da951fd05c805bb6df285781948437b27519116a3e1b2defaf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-245" +claim_text = "Lean proves an admitted chain's scope and partition values are in every list its links carry." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.scope_admits_only_listed" +lean_statement_sha256 = "cad1fcf6fbaf3064577c894a1a8ea868c3e4085020bb580625abbb168f84a49f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-246" +claim_text = "Lean proves the count leaf's model, over a chain's distinct count counters with each counter's smallest capacity, decides exactly the count part of chain admission." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.chain_counts_part" +lean_statement_sha256 = "e93ff36670cc1ff2df9e0af15ff3bef912520b07c55b67ade09e6b84ce314f2a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-247" +claim_text = "Lean proves the sum leaf's model, over a chain's distinct sum counters with each counter's smallest limit, decides exactly the sum part of chain admission." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.chain_sums_part" +lean_statement_sha256 = "f10a2dd1bc798c06920ade27ff1bfeba59a7fbfa6653d81664b258ad231ed7f2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-248" +claim_text = "Lean proves chain admission is exactly the per-link argument, ceiling, scope, and partition checks, the count part, and the sum part." +claim_status = "proved" +lean_declaration = "Auths.Product.CeilingCount.chain_admits_parts" +lean_statement_sha256 = "3b815dca82bdd32ac7a47c9a5b5c29a70942dffb774dbe00ed4940ff34eeb880" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CeilingCount.lean" +sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-202" +claim_text = "Lean proves the gateway recipe property: capability total deterministic." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.capability_total_deterministic" +lean_statement_sha256 = "6f4fc1fec3bdae5a436cbf7894e76aa835bec591fc37b7dbf002aca033c13667" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-203" +claim_text = "Lean proves the gateway recipe property: class matches declarations." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.class_matches_declarations" +lean_statement_sha256 = "117884bcb89669e3376db0b00e75a96265c1bfdb3392000fde1430b59ea3a078" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-204" +claim_text = "Lean proves the gateway recipe property: write never conditional." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.write_never_conditional" +lean_statement_sha256 = "a29b4d1636de3467039d88777f399f89ed9748f66ca901ced1ebe540275f3832" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-215" +claim_text = "Lean proves the gateway recipe property: unknown resolves only linked." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.unknown_resolves_only_linked" +lean_statement_sha256 = "375c42a9e70d6c1717fd9e451f43612cae8141cfff4f9cdd00c28f38970b6383" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-216" +claim_text = "Lean proves the gateway recipe property: provider claim requires evidence." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.provider_claim_requires_evidence" +lean_statement_sha256 = "def91039f3a07a5683a962f3ee33d303addaae9a5689dda0f604fcd20b6167d0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-217" +claim_text = "Lean proves the gateway recipe property: terminal stages final." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.terminal_stages_final" +lean_statement_sha256 = "9d46111d329a79a4788b23cc5a64f81e8853791104d67e3fd1992bf904f80684" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-218" +claim_text = "Lean proves the gateway recipe property: transitions preserve identity." +claim_status = "proved" +lean_declaration = "Auths.Product.Recovery.transitions_preserve_identity" +lean_statement_sha256 = "ecbc5c29d6d4e0eeeb25fe5f4b2267aa8fc7b10bf316d501eac0e2f32af18bd1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/Recovery.lean" +sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" + +[[claims]] +claim_id = "AP-FORMAL-RICH-219" +claim_text = "Lean proves the gateway recipe property: lease requires verified claim." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.lease_requires_verified_claim" +lean_statement_sha256 = "c909a8624ee83d30cce1508a08b66b2f2844cffe645297855e5b6eb63f537092" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-220" +claim_text = "Lean proves the gateway recipe property: send requires lease and deadline." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.send_requires_lease_and_deadline" +lean_statement_sha256 = "b7308523e47d7da1dd32e3799a7794b90d040b26648e64f8200af2bbbc3b93f3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-221" +claim_text = "Lean proves the gateway recipe property: send requires credential checks." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.send_requires_credential_checks" +lean_statement_sha256 = "dee08ab850d6d85d371a7e39dce3e204411a2e20d9619258d27bf67b313e5039" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-222" +claim_text = "Lean proves the gateway recipe property: send requires relative ceiling." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.send_requires_relative_ceiling" +lean_statement_sha256 = "bb8d3c138ad18d9b9963c22bf746dbf1de793b9a6f64a37658db9b8854d22986" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-223" +claim_text = "Lean proves the gateway recipe property: account scope requires binding." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.account_scope_requires_binding" +lean_statement_sha256 = "246b93cf15db6b83675a162d97172251edb9bef8f6d9131fd4cecc7884ce6914" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-224" +claim_text = "Lean proves the gateway recipe property: at most one send." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.at_most_one_send" +lean_statement_sha256 = "19162c884a8ed60f9a15dfbb26e95aa35015ede017313498984ffada67a3ff50" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-225" +claim_text = "Lean proves the gateway recipe property: pre claim refusal stores nothing." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.pre_claim_refusal_stores_nothing" +lean_statement_sha256 = "d8266ccd00249eba927b1fbbf7e505db7e3ca06f100684c3b07d2fdc8006ec30" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-226" +claim_text = "Lean proves the gateway recipe property: not entered refusal table." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.not_entered_refusal_table" +lean_statement_sha256 = "177dc8c4accfb1fced3209eccd723ab3b00afdf8b4c71396393a772a862ff947" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-227" +claim_text = "Lean proves the gateway recipe property: post claim refusal records not entered." +claim_status = "proved" +lean_declaration = "Auths.Product.SubmitOrder.post_claim_refusal_records_not_entered" +lean_statement_sha256 = "192a3f34693f8a77fa76cfd8218a26fb32cd4e000c260923dc49f212bcda9ebe" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/SubmitOrder.lean" +sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" + +[[claims]] +claim_id = "AP-FORMAL-RICH-228" +claim_text = "Lean proves the gateway recipe property: relative ceiling exact." +claim_status = "proved" +lean_declaration = "Auths.Product.RelativeCeiling.relative_ceiling_exact" +lean_statement_sha256 = "ccaec2583a29ff660d59afea3cbc28bc6c2d81811b173ca661a752950597cf61" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RelativeCeiling.lean" +sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" + +[[claims]] +claim_id = "AP-FORMAL-RICH-229" +claim_text = "Lean proves the gateway recipe property: relative ceiling never exceeds ratio." +claim_status = "proved" +lean_declaration = "Auths.Product.RelativeCeiling.relative_ceiling_never_exceeds_ratio" +lean_statement_sha256 = "ddc05e7aac856e77fe875dc9327bb2f3de7d3c89a1c998ba9d0579239d51e192" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RelativeCeiling.lean" +sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" + +[[claims]] +claim_id = "AP-FORMAL-RICH-230" +claim_text = "Lean proves the gateway recipe property: relative ceiling monotone." +claim_status = "proved" +lean_declaration = "Auths.Product.RelativeCeiling.relative_ceiling_monotone" +lean_statement_sha256 = "0d104c40d0dd9c30ee55e8a8708d8c13f59c95a81c2ef0fea5335ca5db706848" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RelativeCeiling.lean" +sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" + +[[claims]] +claim_id = "AP-FORMAL-RICH-231" +claim_text = "Lean proves the gateway recipe property: relative basis never negative." +claim_status = "proved" +lean_declaration = "Auths.Product.RelativeCeiling.relative_basis_never_negative" +lean_statement_sha256 = "4ed5440adb7ca11dfa8288e59aaad29468d967cb1c8654cfc5d3331fbbc57b4b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RelativeCeiling.lean" +sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" + +[[claims]] +claim_id = "AP-FORMAL-RICH-205" +claim_text = "Lean proves the gateway recipe property: method and origin fixed." +claim_status = "proved" +lean_declaration = "Auths.Product.RequestConstruction.method_and_origin_fixed" +lean_statement_sha256 = "7bcf7156c75568a5207b8689d2b3be7a890a5007f80deb6dfb4242603d1abd5e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RequestConstruction.lean" +sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-206" +claim_text = "Lean proves the gateway recipe property: path from declared segments." +claim_status = "proved" +lean_declaration = "Auths.Product.RequestConstruction.path_from_declared_segments" +lean_statement_sha256 = "80f90e7a0f1a764d352c074a03cb29c5a8f0190e431604b216eca137f5cdce0a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RequestConstruction.lean" +sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-207" +claim_text = "Lean proves the gateway recipe property: headers within declaration." +claim_status = "proved" +lean_declaration = "Auths.Product.RequestConstruction.headers_within_declaration" +lean_statement_sha256 = "1767a7004a5b634fa8269968caa485cf114ffcdf718ae1c2a1218f06c950ce98" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RequestConstruction.lean" +sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-208" +claim_text = "Lean proves the gateway recipe property: account scope header exact." +claim_status = "proved" +lean_declaration = "Auths.Product.RequestConstruction.account_scope_header_exact" +lean_statement_sha256 = "10c9fb25aece47a2f6c82a3c90711b6fe27ee7b0b0ab111e86168e1548ec93c5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RequestConstruction.lean" +sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-209" +claim_text = "Lean proves the gateway recipe property: credential reads fixed." +claim_status = "proved" +lean_declaration = "Auths.Product.RequestConstruction.credential_reads_fixed" +lean_statement_sha256 = "02766f5e9149ca84b35952a07902a0d150524636fc1f4d9c50789dd03a159abb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RequestConstruction.lean" +sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-210" +claim_text = "Lean proves the gateway recipe property: body bounded." +claim_status = "proved" +lean_declaration = "Auths.Product.RequestConstruction.body_bounded" +lean_statement_sha256 = "b9ff16f851122675e417ffb5cf618b0960a474aba638473d9fd6c139cb4fa182" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/RequestConstruction.lean" +sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" + +[[claims]] +claim_id = "AP-FORMAL-RICH-265" +claim_text = "The mechanically translated initial submit state returns exactly the model's start state of the abstracted plan." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_start_refines_model" +lean_statement_sha256 = "0352a3ca2e917c34188e99770f714387e9fda7d0420d45b399c294fae164fce5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::order::start"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every submit plan." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "That GatewayEngine::submit performs I/O only as next_step directs holds by construction and is tested by the scenario corpus but is not proved over the async runtime; store atomicity and linearizability, the unauthenticated gateway clock, and provider behavior, including what a basis value, an account identifier, a refusal status, or an account-scope header means, are assumed.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-211" +claim_text = "The mechanically translated recovery-capability leaf returns exactly the model's capability for every declaration set." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_recovery_capability_refines_model" +lean_statement_sha256 = "427ce8baf2a9bf87c27a0b185a87ef6d7cf57dfaaf3b89f6e43bfd50e7de8c92" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::recovery::recovery_capability"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every observation locator, echo flag, idempotency declaration, and pre-entry flag." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", + "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-212" +claim_text = "The mechanically translated write construction returns exactly the model's request or refusal." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_construct_write_refines_model" +lean_statement_sha256 = "4a1b4fdc57bc755532f723f0e489a52178d1e1e905b9665f6c5f92cb0afeb155" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::construct::construct_write"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every write plan and argument list: path validation and percent-encoding, the canonical JSON or form body with the echo, version, account-scope, and idempotency headers, and the path and body bounds." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", + "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-213" +claim_text = "The mechanically translated action-read construction returns exactly the model's request or refusal." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_construct_action_read_refines_model" +lean_statement_sha256 = "bb5c93a4929e5313fe181638a0bd81b0e4f2dffb612feed83dc75a3f4434fc22" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::construct::construct_action_read"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every action-read plan and argument list: the encoded path and the version and account-scope headers." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", + "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-214" +claim_text = "The mechanically translated credential-read construction returns exactly the model's request, a function of the plan alone." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_construct_credential_read_refines_model" +lean_statement_sha256 = "9e69f024fad8ed4a8f21ccaf9bab552a377296555f66063bed13270869dab59f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::construct::construct_credential_read"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every credential-read plan: the fixed path and the version headers." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", + "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-232" +claim_text = "The mechanically translated admission-order step machine returns exactly the model's next state and action for every state and event." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_next_step_refines_model" +lean_statement_sha256 = "4f6f78fb06ad5e6bdabeafe6530141df9d68a0fbedaa02213e7e830e6c491989" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_gateway_kernel::order::next_step", + "auths_gateway_kernel::ratio::relative_ceiling_admits", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every plan, phase, verified argument, and event, including the denied-read index arithmetic and the relative-ceiling comparison on the verified argument." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "That GatewayEngine::submit performs I/O only as next_step directs holds by construction and is tested by the scenario corpus but is not proved over the async runtime; store atomicity and linearizability, the unauthenticated gateway clock, and provider behavior, including what a basis value, an account identifier, a refusal status, or an account-scope header means, are assumed.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-233" +claim_text = "The mechanically translated attempt-record transition rule returns exactly the model's decision for every pair of records." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_valid_transition_refines_model" +lean_statement_sha256 = "a112e2fa7fad786aa452f674aeca7331f57dc51d5d01c9023571e09b6c4f1833" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::transition::valid_transition"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of transition views: the unchangeable bytes, the plan summary, the closed stage table, the checkpoint, the pre-entry and response fields, and stage consistency." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "The store's projection of each stored record onto the transition view and the compare-and-swap on the exact stored bytes are outside this theorem; they are covered by the store conformance suite and the Kani harness over bounded records.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-234" +claim_text = "The mechanically translated relative basis returns exactly the model's basis: the value, or the difference when the subtrahend is at most the value, and absent otherwise." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_relative_basis_refines_model" +lean_statement_sha256 = "01d60aceb109109bfa03e8afc89b12399bf3ff7435df7643a695c05f4a3eb0db" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::ratio::relative_basis"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 value and optional u64 subtrahend." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Reading the basis from the provider response (the JSON integer rules, the subtrahend pointer, and the bind pointers) is outside this theorem; it is covered by the recipe corpus and fuzzing. What the basis means is the recipe author's, approved by the operator.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-235" +claim_text = "The mechanically translated relative-ceiling check returns exactly the model's exact comparison of the argument times 10 000 with the basis times the basis points." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Gateway.translated_relative_ceiling_admits_refines_model" +lean_statement_sha256 = "b74b4a9484b06e370376182e5eb9d0160797fbd60246ee5d54bb4d02d935841b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::ratio::relative_ceiling_admits"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 argument and basis and u16 basis points; neither u128 product overflows." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Reading the basis from the provider response (the JSON integer rules, the subtrahend pointer, and the bind pointers) is outside this theorem; it is covered by the recipe corpus and fuzzing. What the basis means is the recipe author's, approved by the operator.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Gateway.lean" +sha256 = "ff395c6884fe21b5989320b8523175f7e25e35af664531f31818dac639f0eb51" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-249" +claim_text = "Lean proves the connection credential-generation property: retained generation exact." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.retained_generation_exact" +lean_statement_sha256 = "5a5fe438f56954d871f9657a5a3d382ded930c94ba4e4ff14d8786624db91d65" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-250" +claim_text = "Lean proves the connection credential-generation property: lease generation exact." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.lease_generation_exact" +lean_statement_sha256 = "00f5f2fe7894d82e1bd31d1008f7d6c616bb2fdc44df3d770efd72cb3328b8cc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-251" +claim_text = "Lean proves the connection credential-generation property: credential generation le generation." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.credential_generation_le_generation" +lean_statement_sha256 = "9238e8945c3c2eefb361bdb5948e24e74aff8c8d75bdc993f254fae718423f21" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-252" +claim_text = "Lean proves the connection credential-generation property: state change preserves credential generation." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.state_change_preserves_credential_generation" +lean_statement_sha256 = "21d808e879ca61e1b963ee47434d437f62a4fddfd931e9bddb526fd64fc60d2d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-253" +claim_text = "Lean proves the connection credential-generation property: lease selects credential generation." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.lease_selects_credential_generation" +lean_statement_sha256 = "fcd8e4b1f6cc2d26b557d112ddd23e106297ded39fd605786a19c571a77a566f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-254" +claim_text = "Lean proves the connection credential-generation property: join after state changes." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.join_after_state_changes" +lean_statement_sha256 = "cb7c333deb7e0a658e774caa74b3ea3f815fe51dcaf51a2df9577a0d1cb5a8a7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-255" +claim_text = "Lean proves the connection credential-generation property: revoked never leases." +claim_status = "proved" +lean_declaration = "Auths.Product.ConnectionGenerations.revoked_never_leases" +lean_statement_sha256 = "cd6bed579be40bdfdc14ebdefd4b7f46fbe2499409a8d791466649e46331f49d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/ConnectionGenerations.lean" +sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" + +[[claims]] +claim_id = "AP-FORMAL-RICH-256" +claim_text = "The mechanically translated next generation returns exactly the model's successor, absent at the u64 bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Connections.translated_next_generation_refines_model" +lean_statement_sha256 = "50f902a37ddd5aa8eb769d37c32b135d114611b85d83dffd4241faa4527575fc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::next_generation"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 generation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Connections.lean" +sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-257" +claim_text = "The mechanically translated state change returns exactly the model's generations: the generation advances and the credential generation is kept." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Connections.translated_state_change_refines_model" +lean_statement_sha256 = "ec42028ad8f3b27ddda3a7529c79097a496ad20d6bfa4b529ebbaa27c97b1b5c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_connections::kernel::state_change", + "auths_connections::kernel::next_generation", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of u64 generations." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Connections.lean" +sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-258" +claim_text = "The mechanically translated rotation returns exactly the model's generations: both advance to the next generation." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Connections.translated_rotation_refines_model" +lean_statement_sha256 = "ae9b8de24e57ae7e8116c3d3a5fe6e35be3cbe350807822b1a42bb0f2cb5c250" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_connections::kernel::rotation", + "auths_connections::kernel::next_generation", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every pair of u64 generations." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Connections.lean" +sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-259" +claim_text = "The mechanically translated retained-entry search returns exactly the model's newest stored generation not after the record's generation." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Connections.translated_retained_generation_refines_model" +lean_statement_sha256 = "0f34a598bce76fd894dbb859b226616c03433fa08660f8179f7a08b77d815fd3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::retained_generation"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 record generation and every slice of stored generations, in any order." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Connections.lean" +sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-260" +claim_text = "The mechanically translated lease leaf returns exactly the model's selection: the retained generation, only when it is the credential generation." +claim_status = "qualified" +lean_declaration = "Auths.Product.Refinement.Connections.translated_lease_generation_refines_model" +lean_statement_sha256 = "0b055274a8b03d3b97de987af664c1ea51b66bfc09e0edc61606483c4c826911" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_connections::kernel::lease_generation", + "auths_connections::kernel::retained_generation", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every u64 record and credential generation and every slice of stored generations." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Product/Refinement/Connections.lean" +sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-070" +claim_text = "Lean proves the reservation/execution lifecycle property: additive capacity success positive." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.additive_capacity_success_positive" +lean_statement_sha256 = "dcd8c19f436246f345583eb79fa8f56ca0d79801619ec832bb1965cfa4ef7505" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-071" +claim_text = "Lean proves the reservation/execution lifecycle property: additive capacity success conserves." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.additive_capacity_success_conserves" +lean_statement_sha256 = "4c9f497e6dde81872f4262a4d1ef41176e7fed5cbbfdf5ddef76cd6d2f8720a3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-072" +claim_text = "Lean proves the reservation/execution lifecycle property: additive capacity success never overflows u64." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.additive_capacity_success_never_overflows_u64" +lean_statement_sha256 = "1505323a6e0d5ea769a5f3ce908b2e63df64a61ee675bf46ad235e4934158e55" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-073" +claim_text = "Lean proves the reservation/execution lifecycle property: reserve preserves capacity." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.reserve_preserves_capacity" +lean_statement_sha256 = "0215021eae68f54b9d07f77d465d2d5d0f574d82c956050d6a42d65f76360f1e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-074" +claim_text = "Lean proves the reservation/execution lifecycle property: commit preserves capacity." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.commit_preserves_capacity" +lean_statement_sha256 = "6e340919635140c32e62bbb5eaae23126fd0f53586c46407c7e16b970f4fd4ca" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-075" +claim_text = "Lean proves the reservation/execution lifecycle property: release preserves capacity." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.release_preserves_capacity" +lean_statement_sha256 = "a554833f3a765873264be9c667d0293f8b5a7cf6f3a79d9b1fa03131b6414b94" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-076" +claim_text = "Lean proves the reservation/execution lifecycle property: exact replay is stable." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.exact_replay_is_stable" +lean_statement_sha256 = "ddbb29e971f6f0c416d4ae2bbac689cc221c305745d7a2d90b0b36224f63320c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-077" +claim_text = "Lean proves the reservation/execution lifecycle property: conflicting replay is not exact." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.conflicting_replay_is_not_exact" +lean_statement_sha256 = "16040fad2ac968a316520f6e522063d1e6aeeb5000305573e650296cec80290f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-078" +claim_text = "Lean proves the reservation/execution lifecycle property: absent replay never claims effect." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.absent_replay_never_claims_effect" +lean_statement_sha256 = "52a298bd35ffa236d8370ab74d78a674e9e9243a686c52e611f92be3c5cfcf64" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-079" +claim_text = "Lean proves the reservation/execution lifecycle property: start attempt requires credential." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.start_attempt_requires_credential" +lean_statement_sha256 = "4dcfb31b2e2662aef2c336d0c4f55f922b3c6ac226776bed4daacca4424d1904" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-080" +claim_text = "Lean proves the reservation/execution lifecycle property: provider call requires attempt." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.provider_call_requires_attempt" +lean_statement_sha256 = "215e750dce32f2f49fa22b96b5c44699bb15604760223b9f26ace3becbac3bdb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-081" +claim_text = "Lean proves the reservation/execution lifecycle property: commit requires provider entry and effect." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.commit_requires_provider_entry_and_effect" +lean_statement_sha256 = "de9baa696f2dbc23d1dfe965a72bc95f211cda0525f3a212af4197864aab36f2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-082" +claim_text = "Lean proves the reservation/execution lifecycle property: outcome unknown cannot release." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.outcome_unknown_cannot_release" +lean_statement_sha256 = "3d3102111fb51a188aeffe93d7dc6ad13b25a4db54b871f8d4a4b27f98e88c9b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-083" +claim_text = "Lean proves the reservation/execution lifecycle property: outcome unknown only reconciliation can terminate." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.outcome_unknown_only_reconciliation_can_terminate" +lean_statement_sha256 = "98af24c5f5fa0f00c4cbc0ef76b168f8fbc0811d3a3069e587d844a9406c5def" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-084" +claim_text = "Lean proves the reservation/execution lifecycle property: configuration mismatch stops reservation." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.configuration_mismatch_stops_reservation" +lean_statement_sha256 = "9eb20bb520a94f7bfd23c41793df96630035b109d3bd77ae5520e384d80f87a7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-085" +claim_text = "Lean proves the reservation/execution lifecycle property: configuration mismatch stops credential." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.configuration_mismatch_stops_credential" +lean_statement_sha256 = "6f4e8f2d72115f41f5d9881ece6c3d8bff1fcca74bf34415a14475b316085abb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-086" +claim_text = "Lean proves the reservation/execution lifecycle property: terminal states never transition." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.terminal_states_never_transition" +lean_statement_sha256 = "ac59e2c5beb8dcaf74cafc08c46f48d6d2345ab773dcf2dae55a337bd1c30acc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Lifecycle/Theorems.lean" +sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" + +[[claims]] +claim_id = "AP-FORMAL-RICH-087" +claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for terminal-state classification." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.Refinement.translated_terminal_refines_rich" +lean_statement_sha256 = "8963dd672ee5d30584b6a8a131ca2e28a824c51ce5126805eea83ebbe55d71c9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_lifecycle::model::LifecycleState::is_terminal"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::model::LifecycleState::is_terminal` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." +residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Lifecycle/Refinement.lean" +sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-088" +claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for state transitions and their authorization gates." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.Refinement.translated_transition_refines_rich" +lean_statement_sha256 = "ed38f14b22ae254a97a391b4a7ea4064665d323a26e4ec556769f1451731c6cf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_lifecycle::kernel::transition_code"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::transition_code` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." +residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Lifecycle/Refinement.lean" +sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-089" +claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for exclusive capacity." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich" +lean_statement_sha256 = "76c468b3a6a2c9a0231675e987fabf48df92073dc24aadce05f6552165c9e8cf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_lifecycle::kernel::exclusive_capacity_available"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::exclusive_capacity_available` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." +residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Lifecycle/Refinement.lean" +sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-090" +claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for checked additive capacity." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich" +lean_statement_sha256 = "530d89045350d0aa6be9ad09121e16e2a91d8ed3652b8e9508e5ef2a655e9ada" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_lifecycle::kernel::additive_capacity_available"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::additive_capacity_available` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." +residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Lifecycle/Refinement.lean" +sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-091" +claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for replay classification." +claim_status = "proved" +lean_declaration = "Auths.Lifecycle.Refinement.translated_replay_refines_rich" +lean_statement_sha256 = "ede2a75a3447bb934a2454580f45e9610dcf521b669bca3fbe697f567764d7f4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_lifecycle::kernel::replay_code"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::replay_code` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." +residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Lifecycle/Refinement.lean" +sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-012" +claim_text = "Binary all composition is commutative." +claim_status = "proved" +lean_declaration = "Auths.all_commutative" +lean_statement_sha256 = "fd3226a3df5fb4730eeaeb50b3190d9f0ae29aeb961d395825787945fdcdd445" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The closed three-valued binary all operator." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-013" +claim_text = "Binary all composition is associative." +claim_status = "proved" +lean_declaration = "Auths.all_associative" +lean_statement_sha256 = "5749607a3f2752bdd73ae4559af264763d8a36ec3d1258ed4f60b11467d7e12d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The closed three-valued binary all operator." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-014" +claim_text = "Binary all composition is idempotent." +claim_status = "proved" +lean_declaration = "Auths.all_idempotent" +lean_statement_sha256 = "99993635cb0eadeacab1d64ee7f674245481d4160a770deaed82022c0851a3f6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The closed three-valued binary all operator." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-015" +claim_text = "Binary any composition is commutative." +claim_status = "proved" +lean_declaration = "Auths.any_commutative" +lean_statement_sha256 = "a2680b963a19fb4f377fefaad4102a4469895954bbea2b7541894902e979115d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The closed three-valued binary any operator." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-016" +claim_text = "Binary any composition is associative." +claim_status = "proved" +lean_declaration = "Auths.any_associative" +lean_statement_sha256 = "3ceaf22f6776423ee96cbdf5fa9bc5c13fca94bdbb3355b016d6b8e4c275afa8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The closed three-valued binary any operator." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-017" +claim_text = "Binary any composition is idempotent." +claim_status = "proved" +lean_declaration = "Auths.any_idempotent" +lean_statement_sha256 = "8f1cb9d3d130a67d026a96f278678b9070badc44f40f7c538ee68a3f9af90d82" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The closed three-valued binary any operator." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-018" +claim_text = "A threshold of one over two truth values equals binary any." +claim_status = "proved" +lean_declaration = "Auths.threshold_one_eq_any" +lean_statement_sha256 = "639a98d2dcab0db13ec9b221b75605fa48ec169a263f76feb2034f912d7a69c7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The hand-written two-input threshold helper, linked to the generated threshold-count function by thresholdTwo_eq_thresholdCounts." +residual_assumptions = ["Lean's kernel, the pinned toolchain, generator correctness, and the Rust vector harness are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims.evidence]] +kind = "test-corpus" +artifact = "core/formal-vectors/v1/threshold-counts.json" +sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-019" +claim_text = "A threshold of two over two truth values equals binary all." +claim_status = "proved" +lean_declaration = "Auths.threshold_n_eq_all" +lean_statement_sha256 = "7bfb0c0d44d1f31949d7039be3c2052cab9112fcb12d2abef005e6c52979b815" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The hand-written two-input threshold helper, linked to the generated threshold-count function by thresholdTwo_eq_thresholdCounts." +residual_assumptions = ["Lean's kernel, the pinned toolchain, generator correctness, and the Rust vector harness are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims.evidence]] +kind = "test-corpus" +artifact = "core/formal-vectors/v1/threshold-counts.json" +sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-020" +claim_text = "Raising the two-input threshold from one to two cannot raise its authorization truth." +claim_status = "proved" +lean_declaration = "Auths.threshold_monotone_k" +lean_statement_sha256 = "34c77c69b14f1b08db8fba8da86a0a9eb65b95147b85d8d3f48811b47cabcb79" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Exactly the two-input threshold helper and the declared three-valued truth order." +residual_assumptions = ["Lean's kernel, the pinned toolchain, listed foundational axioms, generator correctness, and the Rust vector harness are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims.evidence]] +kind = "test-corpus" +artifact = "core/formal-vectors/v1/threshold-counts.json" +sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-266" +claim_text = "A threshold of zero over two truth values is authorized, the threshold formula's value; the product's wire format and plan validation reject k = 0." +claim_status = "proved" +lean_declaration = "Auths.threshold_zero_authorized" +lean_statement_sha256 = "bc42184fb1f441c5e5ee699d44e0a80c38161401ae018e678d5b7a7300463cbf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-RICH-267" +claim_text = "A threshold of three or more over two truth values is denied, the threshold formula's value; plan validation rejects k above the member count." +claim_status = "proved" +lean_declaration = "Auths.threshold_above_inputs_denied" +lean_statement_sha256 = "d080b789affedcde693adeadcd36a21e772e0c5d21f40002ccc521f48a1c3748" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-RICH-268" +claim_text = "For every k, raising the two-input threshold cannot raise its authorization truth." +claim_status = "proved" +lean_declaration = "Auths.threshold_antitone_k" +lean_statement_sha256 = "efa1ab70eaceb5322dd690f37fd6372ab1092f49da878f391158840b4afed292" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-RICH-269" +claim_text = "For every count of authorized and indeterminate members, raising the required count cannot raise the generated threshold-count function's truth." +claim_status = "proved" +lean_declaration = "Auths.thresholdCounts_antitone_required" +lean_statement_sha256 = "5f1fda6eb247d5ed916296eccfef581d05ed4ecbed69455445bc8ce5ff12fcd6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The generated threshold-count function, whose Rust twin the verifier runs, and the declared three-valued truth order." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-RICH-270" +claim_text = "For every k, the two-input threshold helper equals the generated threshold-count function applied to the two inputs' authorized and indeterminate counts." +claim_status = "proved" +lean_declaration = "Auths.thresholdTwo_eq_thresholdCounts" +lean_statement_sha256 = "e36ef8702dd4af7d133609adacf0b481ac3302e59f9b0d64563976531f8a017e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-021" +claim_text = "Swapping the two inputs preserves binary all and binary any results." +claim_status = "proved" +lean_declaration = "Auths.binary_composition_swap_invariant" +lean_statement_sha256 = "5a2f18a8b889fca7e2d4f239a97a12490193b19c6d3e8703164e04cc556986c7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "A two-value swap only; arbitrary authorization-plan permutations are not claimed." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-022" +claim_text = "The two-value minimum diagnostic code is invariant under swapping its inputs." +claim_status = "proved" +lean_declaration = "Auths.canonical_diagnostic_permutation_invariant" +lean_statement_sha256 = "c0eae1c5c0004d836da0c28c5d5395ecb7e534d05e9816a573d27b7c0f912806" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The two-value canonicalCode helper; arbitrary plan diagnostic permutations are not claimed." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-023" +claim_text = "The current plan visit helper is definitionally the plan leaf enumeration." +claim_status = "proved" +lean_declaration = "Auths.plan_visit_is_leaf_enumeration" +lean_statement_sha256 = "a9d2d3fd6140d7535c9cf3567cf92a5891e8e77fda5924a34a032bb1d9cab0cb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "A definitional model equality; it does not prove that the shipping evaluator visits leaves once." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-024" +claim_text = "The current plan cost helper is definitionally the recursive node count." +claim_status = "proved" +lean_declaration = "Auths.plan_cost_is_node_count" +lean_statement_sha256 = "d0e9f71500f5da6108662057f11150fa61188b6b5059562b6db0079bd4e5820e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "A definitional model equality; no asymptotic or shipping evaluator cost bound is claimed." +residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-025" +claim_text = "An authorized generated threshold result implies the authorized count meets the threshold." +claim_status = "proved" +lean_declaration = "Auths.authorized_implies_threshold_met" +lean_statement_sha256 = "367522026ebf77cc4e8ee694920ff72384ab58cb573bb7cefb8406117955d2d1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The generated count classifier and its exhaustive target-V1 bounded Rust vectors." +residual_assumptions = ["Lean's kernel, the pinned toolchain, generator correctness, and the Rust vector harness are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims.evidence]] +kind = "test-corpus" +artifact = "core/formal-vectors/v1/threshold-counts.json" +sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-026" +claim_text = "A denied generated threshold result implies authorized plus indeterminate branches cannot meet the threshold." +claim_status = "proved" +lean_declaration = "Auths.denied_implies_threshold_impossible" +lean_statement_sha256 = "50005cbb684ef7566e1b6f71fc766e9960de178f0a86f03e37f4eb63cf7e46d5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The generated count classifier and its exhaustive target-V1 bounded Rust vectors." +residual_assumptions = ["Lean's kernel, the pinned toolchain, listed foundational axioms, generator correctness, and the Rust vector harness are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims.evidence]] +kind = "test-corpus" +artifact = "core/formal-vectors/v1/threshold-counts.json" +sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" + +[[claims]] +claim_id = "AP-FORMAL-BASELINE-027" +claim_text = "An indeterminate generated threshold result means authorization is not yet met but remains reachable." +claim_status = "proved" +lean_declaration = "Auths.indeterminate_implies_threshold_reachable" +lean_statement_sha256 = "dd970bbab7dd61f7b1274f9e829358d9627b3c822d4119628191018722f31039" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_algebra_kernel::threshold_counts"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The generated count classifier and its exhaustive target-V1 bounded Rust vectors." +residual_assumptions = ["Lean's kernel, the pinned toolchain, listed foundational axioms, generator correctness, and the Rust vector harness are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Composition.lean" +sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" + +[[claims.evidence]] +kind = "test-corpus" +artifact = "core/formal-vectors/v1/threshold-counts.json" +sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" + +[[claims]] +claim_id = "AP-FORMAL-RICH-143" +claim_text = "Lean proves adding an observation requirement never enlarges the set of authorized evaluations." +claim_status = "proved" +lean_declaration = "Auths.Observation.requirements_monotone" +lean_statement_sha256 = "148ccf94301235d93a8436967797e60faca90b144df545bd381377b4a50a6a6a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-144" +claim_text = "Lean proves adding a condition to an observation requirement never enlarges the set of satisfying evaluations." +claim_status = "proved" +lean_declaration = "Auths.Observation.conditions_monotone" +lean_statement_sha256 = "580cb89f54be773f8f5b9477dcfa105314d26628e415c3d9e43bc0abbaf13f07" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-145" +claim_text = "Lean proves a child grant whose base authority attenuates and whose observation requirements contain the parent's authorizes a subset of what the parent authorizes." +claim_status = "proved" +lean_declaration = "Auths.Observation.child_requirements_superset_attenuates" +lean_statement_sha256 = "569899c6f3632631a784c25e616bcf272690422a491a5f6227f51270e442fbe5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-146" +claim_text = "Lean proves attaching more observations never turns a satisfied observation requirement into an unsatisfied one." +claim_status = "proved" +lean_declaration = "Auths.Observation.satisfied_monotone_observations" +lean_statement_sha256 = "ba0d15b96cedec283e46c0829abd94525ab9d378848e5f17d737b529e786aff5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-147" +claim_text = "Lean proves an empty observation set satisfies no observation requirement." +claim_status = "proved" +lean_declaration = "Auths.Observation.no_observation_satisfies_nothing" +lean_statement_sha256 = "2de8b8b35b722baed67f9208a44ed87aad1918842eac9d30b1a0af9248cf6b91" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-148" +claim_text = "Lean proves an observation dated after the evaluation time is never fresh." +claim_status = "proved" +lean_declaration = "Auths.Observation.future_observation_never_fresh" +lean_statement_sha256 = "25e1df429190fb5954c738d846264281c1f699bf5f3b2dd09e153458f8f7d3da" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-149" +claim_text = "Lean proves an observation older than the requirement's maximum age is never fresh." +claim_status = "proved" +lean_declaration = "Auths.Observation.stale_observation_never_fresh" +lean_statement_sha256 = "bc723fae1eda0ccab4ab50fe9439378198157d48db4c7cb20c50b99501d4a705" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-150" +claim_text = "Lean proves a satisfied observation requirement had every action fact it references available." +claim_status = "proved" +lean_declaration = "Auths.Observation.satisfied_requires_action_facts" +lean_statement_sha256 = "868823975fffe7737c3f778322256228fee15e6e7aaa6d4ec7f6141da0b11ea1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-151" +claim_text = "Lean proves the three-valued observation verdict is satisfied exactly when some eligible observation satisfies every condition." +claim_status = "proved" +lean_declaration = "Auths.Observation.decision_satisfied_iff" +lean_statement_sha256 = "e7e42f0b73ac6aaacf07a646de0481da0942a790607af2896777f242e450da61" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-152" +claim_text = "Lean proves a denied observation verdict has an eligible observation and every eligible observation falsifies a condition." +claim_status = "proved" +lean_declaration = "Auths.Observation.decision_denied_has_falsifying_observation" +lean_statement_sha256 = "220d9a14270b12a16d4c386a08706c81032a17990421d6712ca365f94bcacde6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-164" +claim_text = "Lean proves an observation fresh under a smaller maximum age is fresh under a larger one." +claim_status = "proved" +lean_declaration = "Auths.Observation.fresh_monotone_max_age" +lean_statement_sha256 = "54093bcffc875104caccb21819e59c367362132d9d2446952efd7a408f65f059" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-165" +claim_text = "Lean proves a strictly narrowed observation requirement is satisfied only when its parent requirement is." +claim_status = "proved" +lean_declaration = "Auths.Observation.narrows_monotone" +lean_statement_sha256 = "9fba78f0577d3888e9f544a917fe1a44fa53cfbaeb9b600a27cab1a56859cb05" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-166" +claim_text = "Lean proves a covering observation requirement is satisfied only when the covered requirement is." +claim_status = "proved" +lean_declaration = "Auths.Observation.covers_monotone" +lean_statement_sha256 = "aafa19c473cfc60aa626d058fcb1285f5b515a435dbbf9d2d250c9935fd65bbb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-167" +claim_text = "Lean proves observation-requirement covering is transitive." +claim_status = "proved" +lean_declaration = "Auths.Observation.covers_trans" +lean_statement_sha256 = "8be67281de157aa1ce9f37e536382462d33cebfc8b6ad06ebacc950b100cb241" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-168" +claim_text = "Lean proves observation-requirement list attenuation is reflexive." +claim_status = "proved" +lean_declaration = "Auths.Observation.requirements_attenuate_refl" +lean_statement_sha256 = "3ddf75aca2a28b5c1f927d5adc747a45ab309a933646b17f963484e5d5128c98" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-169" +claim_text = "Lean proves observation-requirement list attenuation is transitive." +claim_status = "proved" +lean_declaration = "Auths.Observation.requirements_attenuate_trans" +lean_statement_sha256 = "3d3f4d07e0abf3bb05962c8d2dd052613dcb5be878594ae858290c2d0fa620d3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-170" +claim_text = "Lean proves a child requirement list that attenuates its parent's authorizes a subset of the parent's evaluations." +claim_status = "proved" +lean_declaration = "Auths.Observation.requirements_attenuate_monotone" +lean_statement_sha256 = "ee97dc30d382ed4737017fb8325d2ed3777d80c69ad989231e81b02b64686073" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-171" +claim_text = "Lean proves the observation-requirement-v1 attenuation law is a preorder that narrows." +claim_status = "proved" +lean_declaration = "Auths.Observation.observation_requirement_law_lawful" +lean_statement_sha256 = "617d5169222466363d1b356846ca50e92b48c170f114cd7cfec4bebbbbb64f7d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-172" +claim_text = "Lean proves the observation-requirement-v1 law accepts adding the extension where the parent has none." +claim_status = "proved" +lean_declaration = "Auths.Observation.observation_requirement_law_accepts_addition" +lean_statement_sha256 = "e20a8c08c602235bc1aabfeff4bf5e9eebd473a410cd568b26c88c497b8f4ef0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Observation.lean" +sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" + +[[claims]] +claim_id = "AP-FORMAL-RICH-286" +claim_text = "Lean proves the K-of-N approval property: approval decide eq threshold counts." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_decide_eq_threshold_counts" +lean_statement_sha256 = "edf74a0cb0c581e211fb2e53b7042562c38c18635c33161d238967b8be2f247e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-287" +claim_text = "Lean proves the K-of-N approval property: approval authorized iff distinct quorum." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_authorized_iff_distinct_quorum" +lean_statement_sha256 = "ed8b9c7105938a6c41ee1321aaea4472efc6d75b6a9ee2a6791ed2fa139f316c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-288" +claim_text = "Lean proves the K-of-N approval property: approval duplicate irrelevant." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_duplicate_irrelevant" +lean_statement_sha256 = "091b7dc31c1282d496858bae18b2a24238427aa9e44822bf0b87e902f969f83e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-289" +claim_text = "Lean proves the K-of-N approval property: approval outsider irrelevant." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_outsider_irrelevant" +lean_statement_sha256 = "7919b2b9e3f9af2cc09100de0d401b6481c08132ddc5cce127a4e4bc64ae0e77" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-290" +claim_text = "Lean proves the K-of-N approval property: approval other action irrelevant." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_other_action_irrelevant" +lean_statement_sha256 = "ab11d19f7f7a07159511b63cf269779db785763da037cfdaac4a6504ac844df4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-291" +claim_text = "Lean proves the K-of-N approval property: approval other requirement irrelevant." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_other_requirement_irrelevant" +lean_statement_sha256 = "6ae502a88055c3daca41ca03e8146337bb020150395d6f05f185e209320c9e78" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-292" +claim_text = "Lean proves the K-of-N approval property: approval self approval irrelevant." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_self_approval_irrelevant" +lean_statement_sha256 = "83b91c2de34c32a06176d103c17b455d7e5c1977f18c3b7d9fb7e758f99a6da4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-293" +claim_text = "Lean proves the K-of-N approval property: approval permutation invariant." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_permutation_invariant" +lean_statement_sha256 = "e5167218ec0c197a06f1eae05406ec507b75f3b2272a409c3f431f236070be33" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-294" +claim_text = "Lean proves the K-of-N approval property: approval monotone in approvals." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_monotone_in_approvals" +lean_statement_sha256 = "eb3583553f5f013a3a8f76bc84808f167a852b199d4528faf1beaa6f9aa4b98e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-295" +claim_text = "Lean proves the K-of-N approval property: approval antitone in threshold." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_antitone_in_threshold" +lean_statement_sha256 = "b1e0b00684d659884ad65523e4f4b42ceec355686cebdc950ddd6f70c57b67a1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-296" +claim_text = "Lean proves the K-of-N approval property: approval antitone in approvers." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_antitone_in_approvers" +lean_statement_sha256 = "91f04d22b450064899e426f5a02c45536f8e0a550cfd2209f3032c8a9cd0bc9d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-297" +claim_text = "Lean proves the K-of-N approval property: approval authorized meets." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_authorized_meets" +lean_statement_sha256 = "7543f43fad4398cf6f5514a0f628581d569ddb1b0190d4d341ed4ad762cb0174" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-298" +claim_text = "Lean proves the K-of-N approval property: covers monotone." +claim_status = "proved" +lean_declaration = "Auths.Approval.covers_monotone" +lean_statement_sha256 = "af566b39841cd9fb7769ebeb7004d3b64edfbcb35a7d779a72d9c017459a7d35" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-299" +claim_text = "Lean proves the K-of-N approval property: covers trans." +claim_status = "proved" +lean_declaration = "Auths.Approval.covers_trans" +lean_statement_sha256 = "71bb145d77cd3db75a110f32d90269a90ada8f43a25e5569a379a87ec68a2d9f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-300" +claim_text = "Lean proves the K-of-N approval property: approval requirements attenuate refl." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_requirements_attenuate_refl" +lean_statement_sha256 = "5001fe3083c023f9cc8260ff9d89ca869fbdf3b85cdf4bfc267ce78e9bae9358" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-301" +claim_text = "Lean proves the K-of-N approval property: approval requirements attenuate trans." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_requirements_attenuate_trans" +lean_statement_sha256 = "e3cdeabbbb19bff2db617206edf53cbbc5758f6276b7144cb9174aa52dd430ad" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-302" +claim_text = "Lean proves the K-of-N approval property: approval requirements attenuate monotone." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_requirements_attenuate_monotone" +lean_statement_sha256 = "bbfc53b74d226bc67466f477529aa6cdbf67df24408ff3eeae10773d92e5728d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-303" +claim_text = "Lean proves the K-of-N approval property: approval requirement law lawful." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_requirement_law_lawful" +lean_statement_sha256 = "53044016738fba16175dea47ebacba4ada4e9286616ea79a8cac69f94cad5b03" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-304" +claim_text = "Lean proves the K-of-N approval property: approval requirement law accepts addition." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_requirement_law_accepts_addition" +lean_statement_sha256 = "f8224b7c2a7f5b10c9fe3d1b368b240888e88c62ace4db0ef100ce24faea3661" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-305" +claim_text = "Lean proves the K-of-N approval property: approval requirement law refuses drop." +claim_status = "proved" +lean_declaration = "Auths.Approval.approval_requirement_law_refuses_drop" +lean_statement_sha256 = "fe7f7ba5f0892d4b6f9077950bbc333541a83d79fafe5d8ceee3dbed044e242e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Approval.lean" +sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" + +[[claims]] +claim_id = "AP-FORMAL-RICH-173" +claim_text = "Lean proves the exact-marker-v1 attenuation law is a preorder that narrows." +claim_status = "proved" +lean_declaration = "Auths.exact_marker_law_lawful" +lean_statement_sha256 = "6f9ff0b2e1f580f8cfc27dcaeaefeee2a19b7cda02879335bf9763287a89eb05" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/ExtensionLaw.lean" +sha256 = "bdd40e0557e17786ae30c05f8a15b1e4f3200e83e258f69c391994271cb86249" + +[[claims]] +claim_id = "AP-FORMAL-RICH-174" +claim_text = "Lean proves the exact-marker-v1 law refuses adding the marker." +claim_status = "proved" +lean_declaration = "Auths.exact_marker_law_refuses_addition" +lean_statement_sha256 = "1019a69a34a92a24de8ebdb88a1a5b5ee4707f044a355fbb62a097b913a9c7f5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/ExtensionLaw.lean" +sha256 = "bdd40e0557e17786ae30c05f8a15b1e4f3200e83e258f69c391994271cb86249" + +[[claims]] +claim_id = "AP-FORMAL-RICH-162" +claim_text = "Lean proves the narrowing premise holds when each registered identifier's law is a lawful narrowing law." +claim_status = "proved" +lean_declaration = "Auths.Rich.ExtensionLawsNarrow.of_lawful" +lean_statement_sha256 = "131876b8431f7e185e96f5249b6329b058bd7a3ad1feac47caa1d72c5921c8a4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Rich/Semantics.lean" +sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" + +[[claims]] +claim_id = "AP-FORMAL-RICH-188" +claim_text = "The mechanically translated fact-name comparison returns exactly the model's String equality." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_fact_name_equal_refines_model" +lean_statement_sha256 = "6b15e1125bd960ce5bf8c3447e0587ceebd672e592a891b26bc2d5e68a9add5c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::fact_name_equal"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "UTF-8 byte comparison of two fact names, bridged to String equality by UTF-8 injectivity." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-189" +claim_text = "The mechanically translated freshness predicate returns exactly the model's freshness over the u64 values." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_fresh_refines_model" +lean_statement_sha256 = "3db4557c386de7ea8812abdf9a330bc6a96432ce30daf16df94c060958d2673a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::observation_fresh"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The guarded u64 age subtraction, maximum age, and anchor validity window, for every u64 input." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-190" +claim_text = "The mechanically translated exact-subject comparison returns exactly the model's String equality." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_subject_equal_refines_model" +lean_statement_sha256 = "9b0aec23b54259d75ed186dbc7ef48d9e63bd0552e0a669478e2c95434501da4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::observation_subject_equal"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "UTF-8 byte comparison of the expected and observed resource, bridged to String equality." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-191" +claim_text = "The mechanically translated fact-value comparison returns exactly the model's equality of abstracted fact values." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_fact_value_equal_refines_model" +lean_statement_sha256 = "c2e5d55a276fda45f44996688fa2ce37eba6a02c4af677e93f0438495cee4112" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::fact_value_equal"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Unsigned, byte-string, and text fact values, including every cross-type pair." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-192" +claim_text = "The mechanically translated inclusive range test returns exactly the model's uintRange condition atom." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_uint_range_contains_refines_model" +lean_statement_sha256 = "a62d865cc0aed16965c3f48786e28f4eb056e75a8af68ea1b68a97d40dfcd81a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::uint_range_contains"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The inclusive u64 range test on an observed unsigned value." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-193" +claim_text = "The mechanically translated membership loop returns exactly the model's member condition atom." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_member_values_contain_refines_model" +lean_statement_sha256 = "1a823612cdb0ab8b1dfa2561f4563a452c907691b7412a258ffee9c2538693e6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::member_values_contain", + "auths_model::observation::fact_value_equal", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating scan of a finite literal list for an observed fact value." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-194" +claim_text = "The mechanically translated fact lookup returns a value whose abstraction is exactly the model's lookupFact." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_fact_refines_model" +lean_statement_sha256 = "5f566de2f5bf7018c2f9a683d466d8bcc99d1bc88bd19f0467efb34fe40b1bfa" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_fact", + "auths_model::observation::fact_name_equal", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating first-match scan of an observation's facts by name." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-195" +claim_text = "The mechanically translated condition-atom evaluator returns exactly the model's valueHolds with the supplied action value." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_condition_value_holds_refines_model" +lean_statement_sha256 = "87c518e6cd6ddd3ab66a1acf9cb01dd6a8ed729895310f6dd6b0f36c871be3ed" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::condition_value_holds", + "auths_model::observation::fact_value_equal", + "auths_model::observation::uint_range_contains", + "auths_model::observation::member_values_contain", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All four condition atoms against a present or absent observed value and a present or absent action value." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-196" +claim_text = "The mechanically translated named-condition evaluator returns exactly the model's valueHolds on the looked-up fact." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_condition_holds_refines_model" +lean_statement_sha256 = "d5df152ab006c6eccea9e9e1d19a4b2bf4643f4a6629d2f0a89a5b9a3759ea72" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_condition_holds", + "auths_model::observation::observation_fact", + "auths_model::observation::fact_name_equal", + "auths_model::observation::condition_value_holds", + "auths_model::observation::fact_value_equal", + "auths_model::observation::uint_range_contains", + "auths_model::observation::member_values_contain", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "One named condition over an observation's facts with its supplied action value." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-197" +claim_text = "The mechanically translated condition conjunction returns exactly the model's conjunction over conditions paired with their action values, and false on a length mismatch." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_model" +lean_statement_sha256 = "1693b5b82975dde2606b046c58afddf01ef58c6c6c4f973a1b0528dc99132810" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_conditions_hold", + "auths_model::observation::observation_condition_holds", + "auths_model::observation::observation_fact", + "auths_model::observation::fact_name_equal", + "auths_model::observation::condition_value_holds", + "auths_model::observation::fact_value_equal", + "auths_model::observation::uint_range_contains", + "auths_model::observation::member_values_contain", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating conjunction loop over a condition slice and a parallel action-value slice." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-198" +claim_text = "The mechanically translated condition conjunction rejects a condition list and action-value list of different lengths." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_length_mismatch_fails_closed" +lean_statement_sha256 = "4ff3b4c45f16ea6a3db0d4e48e54202e20f11ce220a3fee37d426a5f55616eba" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::observation_conditions_hold"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The length guard that precedes every condition evaluation." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-199" +claim_text = "With action values drawn from the environment, the mechanically translated condition conjunction returns exactly the model's conditionsHold." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_conditions_hold" +lean_statement_sha256 = "4d030ad8523e9b4e7031109a2d67e482fbb681b9424036d53496178523be7493" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_conditions_hold", + "auths_model::observation::observation_condition_holds", + "auths_model::observation::observation_fact", + "auths_model::observation::fact_name_equal", + "auths_model::observation::condition_value_holds", + "auths_model::observation::fact_value_equal", + "auths_model::observation::uint_range_contains", + "auths_model::observation::member_values_contain", +] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The conjunction loop when each eqAction condition's supplied action value is the environment's action fact for its reference." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-200" +claim_text = "The mechanically translated verdict combinator returns exactly the model's three-valued decision order." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_requirement_verdict_refines_model" +lean_statement_sha256 = "3ca419beb07857d75b92c8fb57b48431a8db672f27ec1ac81c8a112a920b40d0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::requirement_verdict"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Satisfied before denied before indeterminate, for every pair of eligibility and satisfaction inputs." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-201" +claim_text = "When every referenced action fact is available, the mechanically translated verdict over the model's eligibility and satisfaction is exactly requirementDecision." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_requirement_verdict_refines_requirement_decision" +lean_statement_sha256 = "52a0068811cc19be5605093531410d061f617ca4f3b9a5b1f056d6949077f118" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::requirement_verdict"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11540,37 +230374,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11583,39 +230600,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The per-requirement verdict when the requirement's action facts are available; unavailable action facts are indeterminate in the model." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-181" -claim_text = "Lean proves argument-ceiling tightening is reflexive." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.tightens_refl" -lean_statement_sha256 = "3c2b30687d72f28f07c13e1069f9e8f49ad2ca604c8d0b9561ad86e64090dec6" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-271" +claim_text = "The mechanically translated observer-anchor comparison returns exactly the model's String equality." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observer_anchor_id_equal_refines_model" +lean_statement_sha256 = "564453fe589aab144b7c4696318d798cb9489197156d1ee8d88cc68ca4efca6d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::observer_anchor_id_equal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11623,37 +230695,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11666,38 +230921,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "UTF-8 byte comparison of two observer-anchor identifiers, bridged to String equality." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-182" -claim_text = "Lean proves argument-ceiling tightening is transitive." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.tightens_trans" -lean_statement_sha256 = "27bddfea8d4eaa275419f7461e14c30f42db2e6aa67ed049e2baafe0c113b7fd" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-272" +claim_text = "The mechanically translated schema comparison returns exactly the model's String equality." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_schema_equal_refines_model" +lean_statement_sha256 = "4b027d678991524961d7103204315cda5f7af4cd88a06f875db770fbfc94bd83" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::observation::observation_schema_equal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11705,37 +231017,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11748,35 +231243,98 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "UTF-8 byte comparison of two observation-schema identifiers, bridged to String equality." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-183" -claim_text = "Lean proves the bounded-policy extension law the gateway enforces is a preorder that narrows, discharging in the product layer the narrowing premise of per-extension attenuation for bounded-policy-commitment-v1." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.bounded_policy_law_lawful" -lean_statement_sha256 = "b5311babd266c58b0a167f530675436fd804cf4ba0af4a66d33f6b8ba37fa749" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-273" +claim_text = "The mechanically translated subject comparison returns exactly the model's equality of requirement subjects." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_requirement_subject_equal_refines_model" +lean_statement_sha256 = "efbd6e09d1ed52b992044847b3a47c6f7f7bcea46410b284e140355071a4fb2a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::requirement_subject_equal", + "auths_model::observation::fact_name_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11784,37 +231342,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11827,21 +231568,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Product-layer premise of the bounded-policy-commitment-v1 extension. The kernel checks only that a delegated commitment links the digest of its parent's extension bytes; narrowing is discharged here by the registered evaluator's tightening decider, which the gateway runs on every linked pair before eligibility. This is not a kernel theorem." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Literal-resource and action-fact subjects, including every cross-kind pair." residual_assumptions = [ - "Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted.", - "The gateway runs the registered decider on every linked pair of the authorized chain before any claim, and a verifier without that product layer applies only the kernel link law; the policy bytes decode to this model's policy under the registered canonicalization.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -11851,18 +231635,31 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-184" -claim_text = "Lean proves the bounded-policy extension law accepts adding a bound to an unbounded grant." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.bounded_policy_law_accepts_addition" -lean_statement_sha256 = "1025dc58f2d798f02e8a8a643c4c3a76c544e76302970c2d7ce99ed6274cf89b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-274" +claim_text = "The mechanically translated membership-list comparison returns exactly the model's positional equality of abstracted values." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_member_values_equal_refines_model" +lean_statement_sha256 = "5c5ad163115e51cbe1d70ccb962047e73e69ff7fa94111d0187ce2429a83d0bb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::member_values_equal", + "auths_model::observation::fact_value_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11870,37 +231667,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11913,41 +231893,100 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Product-layer premise of the bounded-policy-commitment-v1 extension. The kernel checks only that a delegated commitment links the digest of its parent's extension bytes; narrowing is discharged here by the registered evaluator's tightening decider, which the gateway runs on every linked pair before eligibility. This is not a kernel theorem." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The length guard and the terminating positional loop over two finite literal lists." residual_assumptions = [ - "Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted.", - "The gateway runs the registered decider on every linked pair of the authorized chain before any claim, and a verifier without that product layer applies only the kernel link law; the policy bytes decode to this model's policy under the registered canonicalization.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-185" -claim_text = "Lean proves the argument-ceiling evaluator satisfies the shared fixed-context tightening law." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.ceiling_count_fixed_context_tightening" -lean_statement_sha256 = "30accc61db6512783cf3b568eefa9d09579eccc72e3ce2d0ca196d3e27efbd40" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-275" +claim_text = "The mechanically translated condition-atom comparison returns exactly the model's equality of condition atoms over one fact name." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_condition_test_equal_refines_model" +lean_statement_sha256 = "e3c6bf03b6853dbedee9fb11e2a4c93c599b64f24f59ae7a13cf742af8c07df3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::condition_test_equal", + "auths_model::observation::fact_value_equal", + "auths_model::observation::fact_name_equal", + "auths_model::observation::member_values_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -11955,37 +231994,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -11998,19 +232220,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All four condition atoms, including every cross-atom pair." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's registered argument-ceiling window-count evaluator /2: fixed-context evaluation over verified unsigned and text arguments and the counters of one fixed, epoch-aligned window, semantic tightening with the sum, partition, and scope rules, and the registered tightening decider." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -12019,18 +232287,32 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-239" -claim_text = "Lean proves reserving a chain's counters is all or none: either no counter changes, or each distinct count counter of the fixed window rises by exactly one, each distinct sum counter by exactly the argument, and every other counter is unchanged." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.reserve_all_or_none" -lean_statement_sha256 = "6ab5bb8963257698a595bbad3d04e33cf7a4284948372b3c1217489fd81cb0ef" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-276" +claim_text = "The mechanically translated condition comparison returns exactly the model's equality of abstracted conditions." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_condition_equal_refines_model" +lean_statement_sha256 = "44b638fa8228688cc4f4d77ad87bd9fbaf9a9b2eb037cb846e62d8caa6611447" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_condition_equal", + "auths_model::observation::fact_name_equal", + "auths_model::observation::condition_test_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12038,37 +232320,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12081,38 +232546,98 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The fact name and the condition atom of two named conditions." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-240" -claim_text = "Lean proves that, for every arrival order in one fixed window, a link's count bounds its subject and delegates: the admitted actions whose chain contains the link number at most its count." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.aggregate_count_bound" -lean_statement_sha256 = "0f5accd437257509195f6034a9d50f0713a21aeab2c655b0fecb95527124eb8d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-277" +claim_text = "The mechanically translated containment loop returns exactly the model's membership of the abstracted condition." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_contain_refines_model" +lean_statement_sha256 = "688fb6edaf3b5e37be4d7823f1fc273e24a61e7299d2ef3eb0ef9b877159c9b2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_conditions_contain", + "auths_model::observation::observation_condition_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12120,37 +232645,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12163,38 +232871,99 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating scan of a condition slice for one condition." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-241" -claim_text = "Lean proves that, for every arrival order in one fixed window, the argument sum of the admitted actions whose chain contains a link is at most the link's ceiling times its count." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.aggregate_spend_bound" -lean_statement_sha256 = "8bc18ab4c3404924341910f3b156124dad2a029e37e2fdef41b52a5117a13340" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-278" +claim_text = "The mechanically translated inclusion loop returns exactly the model's inclusion of condition atoms." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_include_refines_model" +lean_statement_sha256 = "96280dce9a82d09c459e502cdd7dc12f413aedb86d6846eeee90627795910722" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_conditions_include", + "auths_model::observation::observation_conditions_contain", + "auths_model::observation::observation_condition_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12202,37 +232971,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12245,38 +233197,98 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every atom of the wider slice occurring in the narrower slice, compared as a set of canonical atoms." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-242" -claim_text = "Lean proves that, for every arrival order in one fixed window, a link's sum limit bounds the sum of the bounded argument over its subject and delegates, per listed partition value." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.aggregate_sum_bound" -lean_statement_sha256 = "37700c8ea564cd8346ffd48a8f33774fae3436abd135c0584bc7704afe7ff07f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-279" +claim_text = "The mechanically translated condition-list comparison returns exactly the model's positional equality of abstracted conditions." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_equal_refines_model" +lean_statement_sha256 = "a235b885de3a11bd2db81a9b91c30f0a03082254b03dbb20cc561af3fb304eff" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_conditions_equal", + "auths_model::observation::observation_condition_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12284,37 +233296,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12327,38 +233522,100 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The length guard and the terminating positional loop over two condition slices." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-243" -claim_text = "Lean proves delegation never multiplies a count: in one fixed window, when every admitted action's chain carries the root link, the whole tree's admitted actions number at most the root's count and their argument sum is at most its ceiling times its count." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.delegation_never_multiplies" -lean_statement_sha256 = "f09ba1275f7a50f260a64fc78ed3663ea70f459ba704b3acb4598f685fdd9184" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-280" +claim_text = "The mechanically translated same-target check returns exactly the model's sameTarget." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_same_target_refines_model" +lean_statement_sha256 = "b79e3eaa4bb4270a1d44d9c62d457e4b3e396250ac36588a79068cd2d513e84b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_requirement_same_target", + "auths_model::observation::observer_anchor_id_equal", + "auths_model::observation::observation_schema_equal", + "auths_model::observation::requirement_subject_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12366,37 +233623,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12409,38 +233849,99 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The observer anchor, schema, and subject of two requirements." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-244" -claim_text = "Lean proves delegation never multiplies a sum: in one fixed window, when every admitted action's chain carries the root link, the argument sum of the whole tree's admitted actions, per listed partition value, is at most the root's sum limit." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.sum_delegation_never_multiplies" -lean_statement_sha256 = "289fea63130a02da951fd05c805bb6df285781948437b27519116a3e1b2defaf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-281" +claim_text = "The mechanically translated requirement comparison returns exactly the model's equality of abstracted requirements." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_equal_refines_model" +lean_statement_sha256 = "f78c2bb3bae9cdc9b1fb76d183c691737066bcc4ee4781fac6b82b335bba184c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_requirement_equal", + "auths_model::observation::observation_requirement_same_target", + "auths_model::observation::observation_conditions_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12448,37 +233949,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12491,38 +234175,99 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The target, the u64 maximum age, and the positional condition list of two requirements." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-245" -claim_text = "Lean proves an admitted chain's scope and partition values are in every list its links carry." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.scope_admits_only_listed" -lean_statement_sha256 = "cad1fcf6fbaf3064577c894a1a8ea868c3e4085020bb580625abbb168f84a49f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-282" +claim_text = "The mechanically translated narrowing check returns exactly the model's narrows." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_narrows_refines_model" +lean_statement_sha256 = "46ad4c556c162406b17661c87f1e1d246d960a3be471a4441a81012ba12711c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_requirement_narrows", + "auths_model::observation::observation_requirement_same_target", + "auths_model::observation::observation_conditions_include", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12530,37 +234275,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12573,38 +234501,99 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The same target, a maximum age no larger, a superset of condition atoms, and a strictly narrower age or atom set." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-246" -claim_text = "Lean proves the count leaf's model, over a chain's distinct count counters with each counter's smallest capacity, decides exactly the count part of chain admission." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.chain_counts_part" -lean_statement_sha256 = "e93ff36670cc1ff2df9e0af15ff3bef912520b07c55b67ade09e6b84ce314f2a" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-283" +claim_text = "The mechanically translated cover check returns exactly the model's covers." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_covers_refines_model" +lean_statement_sha256 = "9cbb882a6b66b35880cbb5fbb594262a8d665894b107bc8681332665bc3efc21" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_requirement_covers", + "auths_model::observation::observation_requirement_equal", + "auths_model::observation::observation_requirement_narrows", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12612,37 +234601,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12655,19 +234827,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "An identical requirement or a strict narrowing." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -12676,18 +234894,31 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-247" -claim_text = "Lean proves the sum leaf's model, over a chain's distinct sum counters with each counter's smallest limit, decides exactly the sum part of chain admission." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.chain_sums_part" -lean_statement_sha256 = "f10a2dd1bc798c06920ade27ff1bfeba59a7fbfa6653d81664b258ad231ed7f2" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-284" +claim_text = "The mechanically translated retention loop returns exactly the model's existence of a covering child requirement." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_retained_refines_model" +lean_statement_sha256 = "db23559560127b12376f178ce5a707aead02785eb5451e8aea0616a02d40e4a2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_requirement_retained", + "auths_model::observation::observation_requirement_covers", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12695,37 +234926,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12738,19 +235152,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating scan of a child requirement list for one parent requirement." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -12759,18 +235219,34 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-248" -claim_text = "Lean proves chain admission is exactly the per-link argument, ceiling, scope, and partition checks, the count part, and the sum part." -claim_status = "proved" -lean_declaration = "Auths.Product.CeilingCount.chain_admits_parts" -lean_statement_sha256 = "3b815dca82bdd32ac7a47c9a5b5c29a70942dffb774dbe00ed4940ff34eeb880" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-285" +claim_text = "The mechanically translated observation-requirement attenuation law returns exactly the model's requirementsAttenuate." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Observation.translated_observation_requirements_attenuate_refines_model" +lean_statement_sha256 = "e1c90caefc8cea86b905fce1bdaaaf489a1f64bcb46e2d9645a41268a45dd683" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::observation::observation_requirements_attenuate", + "auths_model::observation::observation_requirement_retained", + "auths_model::observation::observation_requirement_covers", + "auths_model::observation::observation_requirement_narrows", + "auths_model::observation::observation_requirement_equal", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12778,37 +235254,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12821,38 +235480,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every parent requirement covered by some child requirement, over requirement lists of any length." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", + "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The gateway's chain admission and reservation over the counters of one fixed, epoch-aligned window: each bounded grant of the authorized branch is a link whose count and sum counters are keyed by its subject, so every admitted action of the subject and of each delegate charges them. Store atomicity and the unauthenticated gateway clock are residual assumptions." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/CeilingCount.lean" -sha256 = "26dfe9dd4dfefd6ddd779fd7bfaa01aad4c629555285b95d8dedbeec974d5c2e" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Observation.lean" +sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-202" -claim_text = "Lean proves the gateway recipe property: capability total deterministic." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.capability_total_deterministic" -lean_statement_sha256 = "6f4fc1fec3bdae5a436cbf7894e76aa835bec591fc37b7dbf002aca033c13667" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-306" +claim_text = "The mechanically translated approver verdict returns exactly the model's approverVerdict over the abstracted outcomes." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_approver_verdict_refines_model" +lean_statement_sha256 = "96a93cb521f7ceee6550abe06fd102d42204467d4c97e1c0b2d19a4175f035c9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::approval::approver_verdict"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12860,37 +235576,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12903,35 +235802,98 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating scan of per-approval outcomes for one approver: counted when some outcome is counted, pending when none is and some is pending, ignored otherwise." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-203" -claim_text = "Lean proves the gateway recipe property: class matches declarations." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.class_matches_declarations" -lean_statement_sha256 = "117884bcb89669e3376db0b00e75a96265c1bfdb3392000fde1430b59ea3a078" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-307" +claim_text = "The mechanically translated distinct counting returns exactly the model's counted and pending approver counts, whose threshold decision is the model's decideCounts." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_approval_counts_refines_model" +lean_statement_sha256 = "36686ea58c4b0815ecfc6c85715c734d24d3273b4956ce66d58aaffa2abc5f54" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::approval::approval_counts", + "auths_model::approval::approver_verdict", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -12939,37 +235901,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -12982,35 +236127,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating loop over a requirement's listed approvers, each counted once, for every outcome list and every u16 threshold." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-204" -claim_text = "Lean proves the gateway recipe property: write never conditional." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.write_never_conditional" -lean_statement_sha256 = "a29b4d1636de3467039d88777f399f89ed9748f66ca901ced1ebe540275f3832" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-308" +claim_text = "The mechanically translated principal-list membership returns exactly the model's list membership." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model" +lean_statement_sha256 = "9c377995783f05529ff05f6655022584e0f6669d7acdf3ef1e57014e25ee1ec0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_model::approval::principal_ids_contain"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13018,37 +236223,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13061,35 +236449,98 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating scan of a principal slice for one principal, compared by UTF-8 bytes bridged to String equality." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-215" -claim_text = "Lean proves the gateway recipe property: unknown resolves only linked." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.unknown_resolves_only_linked" -lean_statement_sha256 = "375c42a9e70d6c1717fd9e451f43612cae8141cfff4f9cdd00c28f38970b6383" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-309" +claim_text = "The mechanically translated principal-list inclusion returns exactly the model's list subset." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model" +lean_statement_sha256 = "77c6b790409d4c2e7277d80217281bba70f67e6f21a3a23841c3110dd625f36f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::approval::principal_ids_subset", + "auths_model::approval::principal_ids_contain", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13097,37 +236548,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13140,38 +236774,99 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every principal of the narrower slice occurring in the wider slice." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-216" -claim_text = "Lean proves the gateway recipe property: provider claim requires evidence." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.provider_claim_requires_evidence" -lean_statement_sha256 = "def91039f3a07a5683a962f3ee33d303addaae9a5689dda0f604fcd20b6167d0" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-310" +claim_text = "The mechanically translated cover check returns exactly the model's covers: approvers a subset and a threshold no lower." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model" +lean_statement_sha256 = "f36b9195ab1f24fad69a6deccc01d1f9895b7803fdf243dd948595f4744f73f7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::approval::approval_requirement_covers", + "auths_model::approval::principal_ids_subset", + "auths_model::approval::principal_ids_contain", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13179,37 +236874,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13222,19 +237100,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "One child and one parent approval requirement." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -13243,18 +237167,31 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-217" -claim_text = "Lean proves the gateway recipe property: terminal stages final." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.terminal_stages_final" -lean_statement_sha256 = "9d46111d329a79a4788b23cc5a64f81e8853791104d67e3fd1992bf904f80684" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-311" +claim_text = "The mechanically translated retention loop returns exactly the model's existence of a covering child requirement." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model" +lean_statement_sha256 = "3b4e9f2ae9beff66fef142c2ebefc11dd86bd65202950c55914458bff46d6c8a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::approval::approval_requirement_retained", + "auths_model::approval::approval_requirement_covers", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13262,37 +237199,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13305,38 +237425,100 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The terminating scan of a child requirement list for one parent requirement." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-218" -claim_text = "Lean proves the gateway recipe property: transitions preserve identity." -claim_status = "proved" -lean_declaration = "Auths.Product.Recovery.transitions_preserve_identity" -lean_statement_sha256 = "ecbc5c29d6d4e0eeeb25fe5f4b2267aa8fc7b10bf316d501eac0e2f32af18bd1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-312" +claim_text = "The mechanically translated approval-requirement-v1 attenuation law returns exactly the model's requirementsAttenuate." +claim_status = "qualified" +lean_declaration = "Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model" +lean_statement_sha256 = "4eab09e98c4ff9d49768010b51dad1f0e7f5807c9899733a5ead580f7dc797c1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_model::approval::approval_requirements_attenuate", + "auths_model::approval::approval_requirement_retained", + "auths_model::approval::approval_requirement_covers", + "auths_model::approval::principal_ids_subset", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13344,37 +237526,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13387,19 +237752,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every parent requirement covered by some child requirement, over requirement lists of any length." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", + "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -13408,18 +237819,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/Recovery.lean" -sha256 = "54b0c7fa26dfa03b5a9659875100a4b5bc845dfe010f73d0ac96bc981c208b70" +kind = "lean-refinement" +artifact = "formal/Auths/Refinement/Approval.lean" +sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/model/Funs.lean" +sha256 = "d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-219" -claim_text = "Lean proves the gateway recipe property: lease requires verified claim." -claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.lease_requires_verified_claim" -lean_statement_sha256 = "c909a8624ee83d30cce1508a08b66b2f2844cffe645297855e5b6eb63f537092" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-748" +claim_text = "The actual public counter-ID comparator returns exactly byte identity for every pair of typed 32-byte IDs." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.counter_equal_spec" +lean_statement_sha256 = "5f586ac1364e31aaedb78107fd25f9bb895fc276b604223066cad5bc8926ae7d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::counter_equal"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13427,37 +237848,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13470,38 +238074,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-220" -claim_text = "Lean proves the gateway recipe property: send requires lease and deadline." -claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.send_requires_lease_and_deadline" -lean_statement_sha256 = "b7308523e47d7da1dd32e3799a7794b90d040b26648e64f8200af2bbbc3b93f3" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-749" +claim_text = "The actual first-position lookup terminates and returns the exact first key position or absence on every represented counter slice." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.counter_position_spec" +lean_statement_sha256 = "7cb0ff8381e7898992ca8fef424589cee1921555c298ef3cc6ca3ef3df218630" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::counter_position"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13509,37 +238171,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13552,38 +238397,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-221" -claim_text = "Lean proves the gateway recipe property: send requires credential checks." -claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.send_requires_credential_checks" -lean_statement_sha256 = "dee08ab850d6d85d371a7e39dce3e204411a2e20d9619258d27bf67b313e5039" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-750" +claim_text = "The actual contribution update returns exactly the independent first-key minimum-capacity update under the displayed allocation bound, without a uniqueness or desired-result premise." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.contribute_spec" +lean_statement_sha256 = "d5db25066b8c7068d9d0c0261a56590391e09c126f00f24b56c10023beefa06b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::contribute"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13591,37 +238494,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13634,38 +238720,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-222" -claim_text = "Lean proves the gateway recipe property: send requires relative ceiling." -claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.send_requires_relative_ceiling" -lean_statement_sha256 = "bb8d3c138ad18d9b9963c22bf746dbf1de793b9a6f64a37658db9b8854d22986" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-751" +claim_text = "The complete actual aggregation loop returns the independent finite contribution fold on the admitted gateway chain size domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.aggregate_spec" +lean_statement_sha256 = "75e3fc747387ca77e999cc094a93d2792044c61d5b7bcc5f3565d228d4ab318b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::aggregate"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13673,37 +238817,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13716,38 +239043,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-223" -claim_text = "Lean proves the gateway recipe property: account scope requires binding." -claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.account_scope_requires_binding" -lean_statement_sha256 = "246b93cf15db6b83675a162d97172251edb9bef8f6d9131fd4cecc7884ce6914" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-752" +claim_text = "Every complete native aggregation earns unique counter IDs from its actual empty initial state; no caller-supplied uniqueness invariant is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.source_aggregate_unique" +lean_statement_sha256 = "373e49b79889455eb1f1eff976a30a97e39a135a09c81c60b618f27cfbe0e86d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::aggregate"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13755,37 +239140,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13798,38 +239366,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-224" -claim_text = "Lean proves the gateway recipe property: at most one send." -claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.at_most_one_send" -lean_statement_sha256 = "19162c884a8ed60f9a15dfbb26e95aa35015ede017313498984ffada67a3ff50" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-753" +claim_text = "Every complete native aggregation returns exactly the independent pointwise minimum-capacity update for every shared counter ID; later contributions cannot multiply an ancestor budget." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities" +lean_statement_sha256 = "40c761b15ebb88ab6986cfd86c25d1356a11953cfcc33a1abded2ceee3f92fce" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::aggregate"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -13837,37 +239463,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13880,37 +239689,400 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-225" -claim_text = "Lean proves the gateway recipe property: pre claim refusal stores nothing." +claim_id = "AP-FORMAL-RICH-754" +claim_text = "Lean proves the bounded product-policy property: lookup contribute." claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.pre_claim_refusal_stores_nothing" -lean_statement_sha256 = "d8266ccd00249eba927b1fbbf7e505db7e3ca06f100684c3b07d2fdc8006ec30" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.lookup_contribute" +lean_statement_sha256 = "7467371a51ee13e48f0243c77cae89abcf400c4f45a3e97b641b720d9ac23d1a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" + +[[claims]] +claim_id = "AP-FORMAL-RICH-755" +claim_text = "Lean proves the bounded product-policy property: contribute keys." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.contribute_keys" +lean_statement_sha256 = "b0e1943d84bc42ce31ee0608dfd0c44405e49298ae21052310b52ad22cb1f1b0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -13919,37 +240091,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -13962,18 +240317,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -13983,16 +240381,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-226" -claim_text = "Lean proves the gateway recipe property: not entered refusal table." +claim_id = "AP-FORMAL-RICH-756" +claim_text = "Lean proves the bounded product-policy property: contribute unique." claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.not_entered_refusal_table" -lean_statement_sha256 = "177dc8c4accfb1fced3209eccd723ab3b00afdf8b4c71396393a772a862ff947" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.contribute_unique" +lean_statement_sha256 = "4171d0a063537b24c665770339835aeecc36bdbc057356a0dd5019ec41ffbe5d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14001,37 +240399,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14044,18 +240625,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -14065,16 +240689,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-227" -claim_text = "Lean proves the gateway recipe property: post claim refusal records not entered." +claim_id = "AP-FORMAL-RICH-757" +claim_text = "Lean proves the bounded product-policy property: contribute at." claim_status = "proved" -lean_declaration = "Auths.Product.SubmitOrder.post_claim_refusal_records_not_entered" -lean_statement_sha256 = "192a3f34693f8a77fa76cfd8218a26fb32cd4e000c260923dc49f212bcda9ebe" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.contribute_at" +lean_statement_sha256 = "6209d873ed58327ebcc1626160e31b8c67f8134ed42263b06de0de10b3a38c03" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14083,37 +240707,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14126,37 +240933,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/SubmitOrder.lean" -sha256 = "6b2fc0797bc4b8ccc5c5e53072c8388fc3267fc4131786cfdb761be02b50f722" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-228" -claim_text = "Lean proves the gateway recipe property: relative ceiling exact." +claim_id = "AP-FORMAL-RICH-758" +claim_text = "Lean proves the bounded product-policy property: contribute absent." claim_status = "proved" -lean_declaration = "Auths.Product.RelativeCeiling.relative_ceiling_exact" -lean_statement_sha256 = "ccaec2583a29ff660d59afea3cbc28bc6c2d81811b173ca661a752950597cf61" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.contribute_absent" +lean_statement_sha256 = "1c6a2b61ba227a13ca229096bd71e97eea3e3865b89f67da7d8cadf14f099f67" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14165,37 +241016,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14208,34 +241242,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RelativeCeiling.lean" -sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-229" -claim_text = "Lean proves the gateway recipe property: relative ceiling never exceeds ratio." +claim_id = "AP-FORMAL-RICH-759" +claim_text = "Lean proves the bounded product-policy property: aggregate exact." claim_status = "proved" -lean_declaration = "Auths.Product.RelativeCeiling.relative_ceiling_never_exceeds_ratio" -lean_statement_sha256 = "ddc05e7aac856e77fe875dc9327bb2f3de7d3c89a1c998ba9d0579239d51e192" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.aggregate_exact" +lean_statement_sha256 = "94ccaa8389be8c3d7494c15347da538564287006dcefc3fafd0fa9e970dff3b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14244,37 +241321,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14287,34 +241547,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RelativeCeiling.lean" -sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-230" -claim_text = "Lean proves the gateway recipe property: relative ceiling monotone." +claim_id = "AP-FORMAL-RICH-760" +claim_text = "Lean proves the bounded product-policy property: aggregate unique." claim_status = "proved" -lean_declaration = "Auths.Product.RelativeCeiling.relative_ceiling_monotone" -lean_statement_sha256 = "0d104c40d0dd9c30ee55e8a8708d8c13f59c95a81c2ef0fea5335ca5db706848" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.aggregate_unique" +lean_statement_sha256 = "85f3447f9035064c4575cce866eec21a8f8eb9f5b5af457d1125d6dac9649b55" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14323,37 +241629,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14366,38 +241855,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RelativeCeiling.lean" -sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-231" -claim_text = "Lean proves the gateway recipe property: relative basis never negative." +claim_id = "AP-FORMAL-RICH-761" +claim_text = "Lean proves the bounded product-policy property: contribute length le." claim_status = "proved" -lean_declaration = "Auths.Product.RelativeCeiling.relative_basis_never_negative" -lean_statement_sha256 = "4ed5440adb7ca11dfa8288e59aaad29468d967cb1c8654cfc5d3331fbbc57b4b" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.contribute_length_le" +lean_statement_sha256 = "08602018ceab3bd0f6130ea1e607284455953ec502adb719105970a764e026e8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14406,37 +241937,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14449,38 +242163,80 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, closed request construction over every compiled plan and argument list, the attempt-record transition rule over every sequence of records, the admission order over every event trace, and the exact relative ceiling." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RelativeCeiling.lean" -sha256 = "62a0b5dce3bd0e8bb4a17a91d9e1d9d6ba97dbdcb4ba4a67ae5c21cebae27b08" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-205" -claim_text = "Lean proves the gateway recipe property: method and origin fixed." +claim_id = "AP-FORMAL-RICH-762" +claim_text = "Lean proves the bounded product-policy property: aggregate append." claim_status = "proved" -lean_declaration = "Auths.Product.RequestConstruction.method_and_origin_fixed" -lean_statement_sha256 = "7bcf7156c75568a5207b8689d2b3be7a890a5007f80deb6dfb4242603d1abd5e" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.aggregate_append" +lean_statement_sha256 = "9d12937781a5ab49a43973cc7865c14f50ac015314b1fb34aad8543112261015" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14489,37 +242245,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14532,34 +242471,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RequestConstruction.lean" -sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-206" -claim_text = "Lean proves the gateway recipe property: path from declared segments." +claim_id = "AP-FORMAL-RICH-763" +claim_text = "Lean proves the bounded product-policy property: aggregate snoc." claim_status = "proved" -lean_declaration = "Auths.Product.RequestConstruction.path_from_declared_segments" -lean_statement_sha256 = "80f90e7a0f1a764d352c074a03cb29c5a8f0190e431604b216eca137f5cdce0a" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.aggregate_snoc" +lean_statement_sha256 = "10b3deb3e5435b247f0fe51245ecf991154c87a79fd0355edfade0e616cd86a6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14568,37 +242550,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14611,37 +242776,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +axioms = [] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RequestConstruction.lean" -sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-207" -claim_text = "Lean proves the gateway recipe property: headers within declaration." +claim_id = "AP-FORMAL-RICH-764" +claim_text = "Lean proves the bounded product-policy property: aggregate length le." claim_status = "proved" -lean_declaration = "Auths.Product.RequestConstruction.headers_within_declaration" -lean_statement_sha256 = "1767a7004a5b634fa8269968caa485cf114ffcdf718ae1c2a1218f06c950ce98" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.aggregate_length_le" +lean_statement_sha256 = "e10871d8605d778f80b0e57a306015ddcbbad24338606c1e060d26491a35e06b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -14650,37 +242855,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14693,35 +243081,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RequestConstruction.lean" -sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-208" -claim_text = "Lean proves the gateway recipe property: account scope header exact." -claim_status = "proved" -lean_declaration = "Auths.Product.RequestConstruction.account_scope_header_exact" -lean_statement_sha256 = "10c9fb25aece47a2f6c82a3c90711b6fe27ee7b0b0ab111e86168e1548ec93c5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-765" +claim_text = "The actual sum-counter first-position lookup terminates and returns the exact first matching public ID or absence on every represented slice." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.sum_position_spec" +lean_statement_sha256 = "7b3c002299b726fea6d5233894ff7b2ee65659a161fb64e9e8c754e341e7dfee" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::sum_position"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -14729,37 +243163,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14772,114 +243389,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RequestConstruction.lean" -sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" -[[claims]] -claim_id = "AP-FORMAL-RICH-209" -claim_text = "Lean proves the gateway recipe property: credential reads fixed." -claim_status = "proved" -lean_declaration = "Auths.Product.RequestConstruction.credential_reads_fixed" -lean_statement_sha256 = "02766f5e9149ca84b35952a07902a0d150524636fc1f4d9c50789dd03a159abb" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Product/RequestConstruction.lean" -sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-210" -claim_text = "Lean proves the gateway recipe property: body bounded." -claim_status = "proved" -lean_declaration = "Auths.Product.RequestConstruction.body_bounded" -lean_statement_sha256 = "b9ff16f851122675e417ffb5cf618b0960a474aba638473d9fd6c139cb4fa182" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-766" +claim_text = "The actual sum contribution update returns exactly the independent minimum-capacity update while retaining the first slot bound; no successful result or uniqueness premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.contribute_sum_spec" +lean_statement_sha256 = "cb44016f4522a5d5abdc22e3a3c6ccad2135d888eb7e67ed46521b931044a68f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::contribute_sum"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -14887,37 +243486,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -14930,38 +243712,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure gateway recipe semantics: the recovery capability a recipe's declarations determine, and closed request construction over every compiled plan and argument list." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/RequestConstruction.lean" -sha256 = "67ddacba55f5ad3892427e2f41cf5f5aa6419b8e0ca036771e06ef195f019d8e" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-265" -claim_text = "The mechanically translated initial submit state returns exactly the model's start state of the abstracted plan." +claim_id = "AP-FORMAL-RICH-767" +claim_text = "The complete actual sum-aggregation loop returns exactly the independent finite contribution fold, including first slot bounds, on the admitted gateway chain size domain." claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_start_refines_model" -lean_statement_sha256 = "0352a3ca2e917c34188e99770f714387e9fda7d0420d45b399c294fae164fce5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::order::start"] +lean_declaration = "Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec" +lean_statement_sha256 = "c79e9c10ae125f72b5a310a864275c7b55a508a9efa3b40cc7857ce39d1dbf4c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::aggregate_sum"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -14969,37 +243809,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15012,21 +244035,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every submit plan." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "That GatewayEngine::submit performs I/O only as next_step directs holds by construction and is tested by the scenario corpus but is not proved over the async runtime; store atomicity and linearizability, the unauthenticated gateway clock, and provider behavior, including what a basis value, an account identifier, a refusal status, or an account-scope header means, are assumed.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -15036,28 +244103,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" [[claims.evidence]] kind = "mechanical-translation" artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-211" -claim_text = "The mechanically translated recovery-capability leaf returns exactly the model's capability for every declaration set." +claim_id = "AP-FORMAL-RICH-768" +claim_text = "Every actual complete sum aggregation earns unique shared counter IDs from its own empty initial state." claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_recovery_capability_refines_model" -lean_statement_sha256 = "427ce8baf2a9bf87c27a0b185a87ef6d7cf57dfaaf3b89f6e43bfd50e7de8c92" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::recovery::recovery_capability"] +lean_declaration = "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique" +lean_statement_sha256 = "190eddc109c30359bcd4e62620e63e0562ccd0b4bdcd041c8ed9e1d76e7bb186" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::aggregate_sum"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15065,37 +244132,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15108,51 +244358,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every observation locator, echo flag, idempotency declaration, and pre-entry flag." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", - "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" [[claims.evidence]] kind = "mechanical-translation" artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-212" -claim_text = "The mechanically translated write construction returns exactly the model's request or refusal." +claim_id = "AP-FORMAL-RICH-769" +claim_text = "Every actual complete sum aggregation returns the exact independent pointwise minimum capacity for every shared ID. Retention of the first slot bound is established separately by the complete result; authenticated caller coupling and atomic runtime admission remain open." claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_construct_write_refines_model" -lean_statement_sha256 = "4a1b4fdc57bc755532f723f0e489a52178d1e1e905b9665f6c5f92cb0afeb155" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::construct::construct_write"] +lean_declaration = "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities" +lean_statement_sha256 = "38491810ae6fa96d4119433a0e9f7a00ded37e8ebe72e3f58189c47acbe27523" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::aggregate_sum"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15160,37 +244455,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15203,21 +244681,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every write plan and argument list: path validation and percent-encoding, the canonical JSON or form body with the echo, version, account-scope, and idempotency headers, and the path and body bounds." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", - "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -15227,28 +244749,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" [[claims.evidence]] kind = "mechanical-translation" artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-213" -claim_text = "The mechanically translated action-read construction returns exactly the model's request or refusal." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_construct_action_read_refines_model" -lean_statement_sha256 = "bb5c93a4929e5313fe181638a0bd81b0e4f2dffb612feed83dc75a3f4434fc22" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::construct::construct_action_read"] +claim_id = "AP-FORMAL-RICH-770" +claim_text = "Lean proves the bounded product-policy property: sum contribution projection." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_contribution_projection" +lean_statement_sha256 = "9f49190caf8ff16560dfe9bf5e43d800e213bf0e377b7359fde59ada87a357f3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15256,37 +244778,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15299,52 +245004,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every action-read plan and argument list: the encoded path and the version and account-scope headers." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", - "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] - -[[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" +axioms = ["propext"] [[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-214" -claim_text = "The mechanically translated credential-read construction returns exactly the model's request, a function of the plan alone." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_construct_credential_read_refines_model" -lean_statement_sha256 = "9e69f024fad8ed4a8f21ccaf9bab552a377296555f66063bed13270869dab59f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::construct::construct_credential_read"] +claim_id = "AP-FORMAL-RICH-771" +claim_text = "Lean proves the bounded product-policy property: sum aggregate projection." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_aggregate_projection" +lean_statement_sha256 = "85ca984f4b9d995a98674121c6ca7e5821eb20ed424c450bd0ce7e7a0f52d8a6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15352,37 +245083,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15395,55 +245309,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every credential-read plan: the fixed path and the version headers." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundational axioms, and the theorem's explicit representation-validity premise (every buffer the leaf builds is shorter than u32::MAX bytes) are trusted.", - "Recipe compilation, plan lowering, argument conversion from the verified MCP command, the echo-token and idempotency-key hashes, and the HTTP transport are outside this theorem; the compiler and conversion are covered by the hostile recipe corpus, the serde oracle, and fuzzing.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] - -[[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" +axioms = ["propext"] [[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-232" -claim_text = "The mechanically translated admission-order step machine returns exactly the model's next state and action for every state and event." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_next_step_refines_model" -lean_statement_sha256 = "4f6f78fb06ad5e6bdabeafe6530141df9d68a0fbedaa02213e7e830e6c491989" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_gateway_kernel::order::next_step", - "auths_gateway_kernel::ratio::relative_ceiling_admits", -] +claim_id = "AP-FORMAL-RICH-772" +claim_text = "Lean proves the bounded product-policy property: sum aggregate unique." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_aggregate_unique" +lean_statement_sha256 = "832eb7190adba618c2ca1ef67c0a1bc0fe15702287c97e1f80921de0a19e5253" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15451,37 +245388,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15494,52 +245614,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every plan, phase, verified argument, and event, including the denied-read index arithmetic and the relative-ceiling comparison on the verified argument." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "That GatewayEngine::submit performs I/O only as next_step directs holds by construction and is tested by the scenario corpus but is not proved over the async runtime; store atomicity and linearizability, the unauthenticated gateway clock, and provider behavior, including what a basis value, an account identifier, a refusal status, or an account-scope header means, are assumed.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-233" -claim_text = "The mechanically translated attempt-record transition rule returns exactly the model's decision for every pair of records." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_valid_transition_refines_model" -lean_statement_sha256 = "a112e2fa7fad786aa452f674aeca7331f57dc51d5d01c9023571e09b6c4f1833" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::transition::valid_transition"] +claim_id = "AP-FORMAL-RICH-773" +claim_text = "Lean proves the bounded product-policy property: sum aggregate capacities." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_aggregate_capacities" +lean_statement_sha256 = "24c69823c8819840822984056d8801c14b49cbe773eba2c24f3c64e1b99363ee" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15547,37 +245696,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15590,52 +245922,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of transition views: the unchangeable bytes, the plan summary, the closed stage table, the checkpoint, the pre-entry and response fields, and stage consistency." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "The store's projection of each stored record onto the transition view and the compare-and-swap on the exact stored bytes are outside this theorem; they are covered by the store conformance suite and the Kani harness over bounded records.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-234" -claim_text = "The mechanically translated relative basis returns exactly the model's basis: the value, or the difference when the subtrahend is at most the value, and absent otherwise." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_relative_basis_refines_model" -lean_statement_sha256 = "01d60aceb109109bfa03e8afc89b12399bf3ff7435df7643a695c05f4a3eb0db" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::ratio::relative_basis"] +claim_id = "AP-FORMAL-RICH-774" +claim_text = "Lean proves the bounded product-policy property: sum contribute length le." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_contribute_length_le" +lean_statement_sha256 = "12ebed32a03b6c5574f96171a3a5772609a728fc77dfc921a83cc0b1de02be6b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15643,37 +246004,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15686,52 +246230,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every u64 value and optional u64 subtrahend." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "Reading the basis from the provider response (the JSON integer rules, the subtrahend pointer, and the bind pointers) is outside this theorem; it is covered by the recipe corpus and fuzzing. What the basis means is the recipe author's, approved by the operator.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-235" -claim_text = "The mechanically translated relative-ceiling check returns exactly the model's exact comparison of the argument times 10 000 with the basis times the basis points." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Gateway.translated_relative_ceiling_admits_refines_model" -lean_statement_sha256 = "b74b4a9484b06e370376182e5eb9d0160797fbd60246ee5d54bb4d02d935841b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_gateway_kernel::ratio::relative_ceiling_admits"] +claim_id = "AP-FORMAL-RICH-775" +claim_text = "Lean proves the bounded product-policy property: sum aggregate append." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_aggregate_append" +lean_statement_sha256 = "3e934befb5bf3562cb64c4c466d55250224b744c1b2802ad3dec285651c4d85f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -15739,37 +246312,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15782,51 +246538,382 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every u64 argument and basis and u16 basis points; neither u128 product overflows." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "Reading the basis from the provider response (the JSON integer rules, the subtrahend pointer, and the bind pointers) is outside this theorem; it is covered by the recipe corpus and fuzzing. What the basis means is the recipe author's, approved by the operator.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] +axioms = [] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Gateway.lean" -sha256 = "59a2ad78eca15d40e4ca249d653cdbb870131ee2f24446bbff2f5f6144c72e13" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" -sha256 = "c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636" +[[claims]] +claim_id = "AP-FORMAL-RICH-776" +claim_text = "Lean proves the bounded product-policy property: sum aggregate snoc." +claim_status = "proved" +lean_declaration = "Auths.Product.CounterAggregation.sum_aggregate_snoc" +lean_statement_sha256 = "d9f35c7728fc08a73f13c86dce79c716ca9989ba75c73d76eca659a78b567f51" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [] [[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-249" -claim_text = "Lean proves the connection credential-generation property: retained generation exact." +claim_id = "AP-FORMAL-RICH-777" +claim_text = "Lean proves the bounded product-policy property: first slots preserved." claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.retained_generation_exact" -lean_statement_sha256 = "5a5fe438f56954d871f9657a5a3d382ded930c94ba4e4ff14d8786624db91d65" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.first_slots_preserved" +lean_statement_sha256 = "86f8899f63a0b259481e326d5620e07f91135035a65492fffc1d7cbad4f3b7d1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -15835,37 +246922,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15878,37 +247148,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-250" -claim_text = "Lean proves the connection credential-generation property: lease generation exact." +claim_id = "AP-FORMAL-RICH-778" +claim_text = "Lean proves the bounded product-policy property: sum contribute at." claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.lease_generation_exact" -lean_statement_sha256 = "00f5f2fe7894d82e1bd31d1008f7d6c616bb2fdc44df3d770efd72cb3328b8cc" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.sum_contribute_at" +lean_statement_sha256 = "8b51de7d37e308d79a833916a2fcf6c40769702d1dc8bd0959e0dbe586b99825" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -15917,37 +247227,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -15960,37 +247453,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-251" -claim_text = "Lean proves the connection credential-generation property: credential generation le generation." +claim_id = "AP-FORMAL-RICH-779" +claim_text = "Lean proves the bounded product-policy property: sum contribute absent." claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.credential_generation_le_generation" -lean_statement_sha256 = "9238e8945c3c2eefb361bdb5948e24e74aff8c8d75bdc993f254fae718423f21" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.CounterAggregation.sum_contribute_absent" +lean_statement_sha256 = "52104f03c8a3688b4b380423f2f73bfd7f5cd6fefbdcd25190633fa917003069" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -15999,37 +247536,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16042,38 +247762,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/SumAggregation.lean" +sha256 = "fb9f6e6b6b43629095d988fba54d89b750711b12195ec708828300a4342b719c" [[claims]] -claim_id = "AP-FORMAL-RICH-252" -claim_text = "Lean proves the connection credential-generation property: state change preserves credential generation." -claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.state_change_preserves_credential_generation" -lean_statement_sha256 = "21d808e879ca61e1b963ee47434d437f62a4fddfd931e9bddb526fd64fc60d2d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-780" +claim_text = "The actual batch-conflict interpreter returns exactly the independent claim/count/sum retry plan on every represented input, including invalid indices, missing parallel arrays and counter overflow; no bounds or successful result are assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationRetry.Refinement.retry_target_exact" +lean_statement_sha256 = "9d749ae918ec953de5588ef1d3f30f3bace655e533434364987ecf15811c40b4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_retry::retry_target"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16081,37 +247841,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16124,38 +248067,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/ReservationRetryRefinement.lean" +sha256 = "c1a1b639592c16e66a52702e5d7f408b02ddb278a4ba635596ddc4412daeb34f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-253" -claim_text = "Lean proves the connection credential-generation property: lease selects credential generation." -claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.lease_selects_credential_generation" -lean_statement_sha256 = "fcd8e4b1f6cc2d26b557d112ddd23e106297ded39fd605786a19c571a77a566f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-781" +claim_text = "Every conflict on the actual logical claim entry returns Replay for all frontier and metadata inputs; it never becomes a count/sum retry." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay" +lean_statement_sha256 = "d7a96869aa743965dacfeab3f13ac0109fa4f28b6e7db863b3e8d658d6e74618" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_retry::retry_target"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16163,37 +248164,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16206,38 +248390,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/ReservationRetryRefinement.lean" +sha256 = "c1a1b639592c16e66a52702e5d7f408b02ddb278a4ba635596ddc4412daeb34f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-254" -claim_text = "Lean proves the connection credential-generation property: join after state changes." -claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.join_after_state_changes" -lean_statement_sha256 = "cb7c333deb7e0a658e774caa74b3ea3f815fe51dcaf51a2df9577a0d1cb5a8a7" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-782" +claim_text = "Every actual count retry points to the exact conflicting count entry, advances exactly one and remains within the u64 word domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationRetry.Refinement.source_count_progress_safe" +lean_statement_sha256 = "de4cef14b4bd9966e5d1f950042edd81cc39aa946aa7b39511eef3569a802a3e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_retry::retry_target"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16245,37 +248487,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16288,38 +248713,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/ReservationRetryRefinement.lean" +sha256 = "c1a1b639592c16e66a52702e5d7f408b02ddb278a4ba635596ddc4412daeb34f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-255" -claim_text = "Lean proves the connection credential-generation property: revoked never leases." -claim_status = "proved" -lean_declaration = "Auths.Product.ConnectionGenerations.revoked_never_leases" -lean_statement_sha256 = "cd6bed579be40bdfdc14ebdefd4b7f46fbe2499409a8d791466649e46331f49d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-783" +claim_text = "Every actual sum retry points to the exact conflicting sum entry and existing slot, checks all parallel array bounds, and advances exactly one within the u64 word domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe" +lean_statement_sha256 = "a5343e1a3d8463f69f55a1c4216a9449b25c28e86e80978b75747a01aaa75d37" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_retry::retry_target"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16327,37 +248810,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16370,35 +249036,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure connection-record generation semantics over every sequence of install, join, rotate, disable, enable, and revoke across any number of processes sharing one record: the credential generation, the retained-entry lease rule, and revocation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Product/ConnectionGenerations.lean" -sha256 = "6b7164e6c4ec0fd8eff9edaf04dd7280df2e8d7a570e25b8d1ee7450a19d6510" +artifact = "formal/Auths/Product/ReservationRetryRefinement.lean" +sha256 = "c1a1b639592c16e66a52702e5d7f408b02ddb278a4ba635596ddc4412daeb34f" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-256" -claim_text = "The mechanically translated next generation returns exactly the model's successor, absent at the u64 bound." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Connections.translated_next_generation_refines_model" -lean_statement_sha256 = "50f902a37ddd5aa8eb769d37c32b135d114611b85d83dffd4241faa4527575fc" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_connections::kernel::next_generation"] +claim_id = "AP-FORMAL-RICH-784" +claim_text = "Lean proves the bounded product-policy property: existing claim is replay." +claim_status = "proved" +lean_declaration = "Auths.Product.ReservationRetry.existing_claim_is_replay" +lean_statement_sha256 = "e4eaa6407f587d21144a47017c3dce3a7b4689c589514e441fcfdfd45ae0a136" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16406,37 +249133,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16449,55 +249359,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every u64 generation." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Classical.choice", - "Quot.sound", -] - -[[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Connections.lean" -sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" -sha256 = "dfa1998e3506f06dce142222dc383116d0952155517edc399f5d94e688e22912" +axioms = ["propext"] [[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/ReservationRetry.lean" +sha256 = "e9bb3425ae6d1b05002a8ab0390285d477919ace1ab6dbf4b2adc7716d61116d" [[claims]] -claim_id = "AP-FORMAL-RICH-257" -claim_text = "The mechanically translated state change returns exactly the model's generations: the generation advances and the credential generation is kept." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Connections.translated_state_change_refines_model" -lean_statement_sha256 = "ec42028ad8f3b27ddda3a7529c79097a496ad20d6bfa4b529ebbaa27c97b1b5c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_connections::kernel::state_change", - "auths_connections::kernel::next_generation", -] +claim_id = "AP-FORMAL-RICH-785" +claim_text = "Lean proves the bounded product-policy property: count progress exact." +claim_status = "proved" +lean_declaration = "Auths.Product.ReservationRetry.count_progress_exact" +lean_statement_sha256 = "dac47f45a33f737f72fda0ed4e0e13cd687d2774bd7b6664b83eecb009a12046" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16505,37 +249438,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16548,22 +249664,62 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of u64 generations." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -16572,31 +249728,18 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Connections.lean" -sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" -sha256 = "dfa1998e3506f06dce142222dc383116d0952155517edc399f5d94e688e22912" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/ReservationRetry.lean" +sha256 = "e9bb3425ae6d1b05002a8ab0390285d477919ace1ab6dbf4b2adc7716d61116d" [[claims]] -claim_id = "AP-FORMAL-RICH-258" -claim_text = "The mechanically translated rotation returns exactly the model's generations: both advance to the next generation." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Connections.translated_rotation_refines_model" -lean_statement_sha256 = "ae9b8de24e57ae7e8116c3d3a5fe6e35be3cbe350807822b1a42bb0f2cb5c250" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_connections::kernel::rotation", - "auths_connections::kernel::next_generation", -] +claim_id = "AP-FORMAL-RICH-786" +claim_text = "Lean proves the bounded product-policy property: sum progress exact." +claim_status = "proved" +lean_declaration = "Auths.Product.ReservationRetry.sum_progress_exact" +lean_statement_sha256 = "fb049a9baa50919d7b488772d4fb58a4e87cb06aae87e4b4a525d510d05bfebc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16604,37 +249747,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16647,22 +249973,62 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every pair of u64 generations." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -16671,28 +250037,18 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Connections.lean" -sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" -sha256 = "dfa1998e3506f06dce142222dc383116d0952155517edc399f5d94e688e22912" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/ReservationRetry.lean" +sha256 = "e9bb3425ae6d1b05002a8ab0390285d477919ace1ab6dbf4b2adc7716d61116d" [[claims]] -claim_id = "AP-FORMAL-RICH-259" -claim_text = "The mechanically translated retained-entry search returns exactly the model's newest stored generation not after the record's generation." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Connections.translated_retained_generation_refines_model" -lean_statement_sha256 = "0f34a598bce76fd894dbb859b226616c03433fa08660f8179f7a08b77d815fd3" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_connections::kernel::retained_generation"] +claim_id = "AP-FORMAL-RICH-787" +claim_text = "Lean proves the bounded product-policy property: count available." +claim_status = "proved" +lean_declaration = "Auths.Product.ReservationRetry.count_available" +lean_statement_sha256 = "c3e7ba89ddab09d6c1c72f04bc122b98e070750cb114ed2e71a913f496366b81" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16700,37 +250056,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16743,22 +250282,62 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every u64 record generation and every slice of stored generations, in any order." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -16767,31 +250346,18 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Connections.lean" -sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" -sha256 = "dfa1998e3506f06dce142222dc383116d0952155517edc399f5d94e688e22912" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/ReservationRetry.lean" +sha256 = "e9bb3425ae6d1b05002a8ab0390285d477919ace1ab6dbf4b2adc7716d61116d" [[claims]] -claim_id = "AP-FORMAL-RICH-260" -claim_text = "The mechanically translated lease leaf returns exactly the model's selection: the retained generation, only when it is the credential generation." -claim_status = "qualified" -lean_declaration = "Auths.Product.Refinement.Connections.translated_lease_generation_refines_model" -lean_statement_sha256 = "0b055274a8b03d3b97de987af664c1ea51b66bfc09e0edc61606483c4c826911" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_connections::kernel::lease_generation", - "auths_connections::kernel::retained_generation", -] +claim_id = "AP-FORMAL-RICH-788" +claim_text = "Lean proves the bounded product-policy property: sum available." +claim_status = "proved" +lean_declaration = "Auths.Product.ReservationRetry.sum_available" +lean_statement_sha256 = "bbe675611eacae1581697f464f881827c2774114bd36b2b437a3b515ed8143a1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16799,37 +250365,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16842,22 +250591,62 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every u64 record and credential generation and every slice of stored generations." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", - "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -16866,28 +250655,18 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Product/Refinement/Connections.lean" -sha256 = "43d00e34902e02cb738ffdb7c2a555ce78f918af354a4858daba2391c077d6bd" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" -sha256 = "dfa1998e3506f06dce142222dc383116d0952155517edc399f5d94e688e22912" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/ReservationRetry.lean" +sha256 = "e9bb3425ae6d1b05002a8ab0390285d477919ace1ab6dbf4b2adc7716d61116d" [[claims]] -claim_id = "AP-FORMAL-RICH-070" -claim_text = "Lean proves the reservation/execution lifecycle property: additive capacity success positive." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.additive_capacity_success_positive" -lean_statement_sha256 = "dcd8c19f436246f345583eb79fa8f56ca0d79801619ec832bb1965cfa4ef7505" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-789" +claim_text = "The actual count-slot construction loop appends exactly every counter/frontier pair in input order on its checked size/alignment domain. This scoped helper result does not alone claim complete construction." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotBatch.Refinement.count_loop_exact" +lean_statement_sha256 = "4cab5cc67efb34dad53beb15cb521a1d66777bdbb5b8dc91d65a06e96d0aaa6c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_batch::build_batch"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16895,37 +250674,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -16938,19 +250900,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -16960,17 +250969,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-071" -claim_text = "Lean proves the reservation/execution lifecycle property: additive capacity success conserves." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.additive_capacity_success_conserves" -lean_statement_sha256 = "4c9f497e6dde81872f4262a4d1ef41176e7fed5cbbfdf5ddef76cd6d2f8720a3" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-790" +claim_text = "The actual sum-slot construction loop appends exactly the independent sum descriptions, or returns no batch on overflow after any prefix, on its checked size/alignment domain." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotBatch.Refinement.sum_loop_exact" +lean_statement_sha256 = "c06044a2f3eb04f56a4d8266a6d7fbbe69b8dbb3bd9a7b9cef7ceb0bf2aca83e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_batch::build_batch"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -16978,37 +250997,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17021,38 +251223,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-072" -claim_text = "Lean proves the reservation/execution lifecycle property: additive capacity success never overflows u64." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.additive_capacity_success_never_overflows_u64" -lean_statement_sha256 = "1505323a6e0d5ea769a5f3ce908b2e63df64a61ee675bf46ad235e4934158e55" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-791" +claim_text = "The complete actual slot-batch constructor is total on every represented input and returns exactly the independent claim/count/sum descriptions, rejecting shape/cardinality mismatches and cumulative overflow without any desired-result or length precondition." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotBatch.Refinement.build_exact" +lean_statement_sha256 = "57802c144d7c2304a1dc1b2465d27a37c7c4af86db7070e430706f3be117e305" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_batch::build_batch"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17060,37 +251320,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17103,38 +251546,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-073" -claim_text = "Lean proves the reservation/execution lifecycle property: reserve preserves capacity." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.reserve_preserves_capacity" -lean_statement_sha256 = "0215021eae68f54b9d07f77d465d2d5d0f574d82c956050d6a42d65f76360f1e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-792" +claim_text = "Every successful actual batch begins with the exact logical-operation claim key; no claim-first result is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotBatch.Refinement.source_claim_first" +lean_statement_sha256 = "b5e6a229d20124a74d4e40aa39125a2985fa0ff67e26e93685b38aae8523da09" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_batch::build_batch"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17142,37 +251643,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17185,38 +251869,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-074" -claim_text = "Lean proves the reservation/execution lifecycle property: commit preserves capacity." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.commit_preserves_capacity" -lean_statement_sha256 = "6e340919635140c32e62bbb5eaae23126fd0f53586c46407c7e16b970f4fd4ca" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-793" +claim_text = "Every successful actual batch contains exactly one claim and all required count/sum entries, with at most 33 descriptions; malformed vector shapes cannot silently truncate the reservation." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotBatch.Refinement.source_complete_entry_count" +lean_statement_sha256 = "25f53de98121b2673f565ec363ae1f2c0c97d64271b4aa1134bdde9e9ed31de6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_batch::build_batch"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17224,37 +251966,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17267,19 +252192,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -17289,17 +252261,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-075" -claim_text = "Lean proves the reservation/execution lifecycle property: release preserves capacity." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.release_preserves_capacity" -lean_statement_sha256 = "a554833f3a765873264be9c667d0293f8b5a7cf6f3a79d9b1fa03131b6414b94" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-794" +claim_text = "Every actual batch construction with an invalid length/cardinality shape returns None. It creates no partial descriptor batch; execution authority and actual backend atomicity are separate." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused" +lean_statement_sha256 = "59f25099d187ba6e97d67b61b515ad8e496afddcad1d5de2f3408b5f52bd16a9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::reservation_batch::build_batch"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17307,37 +252289,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17350,19 +252515,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -17372,16 +252584,26 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-076" -claim_text = "Lean proves the reservation/execution lifecycle property: exact replay is stable." +claim_id = "AP-FORMAL-RICH-795" +claim_text = "Lean proves the bounded product-policy property: sum entries length." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.exact_replay_is_stable" -lean_statement_sha256 = "ddbb29e971f6f0c416d4ae2bbac689cc221c305745d7a2d90b0b36224f63320c" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotBatch.sum_entries_length" +lean_statement_sha256 = "a43ba2418586538ab4a6c5ef230101ef4736b78873f8ee2e71f83d80eb2d7de3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -17390,37 +252612,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17433,34 +252838,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatch.lean" +sha256 = "edb724bea82c7cddc44de003052afb8a31160969cbf3a7c623ab8cf020730f57" [[claims]] -claim_id = "AP-FORMAL-RICH-077" -claim_text = "Lean proves the reservation/execution lifecycle property: conflicting replay is not exact." +claim_id = "AP-FORMAL-RICH-796" +claim_text = "Lean proves the bounded product-policy property: first is claim." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.conflicting_replay_is_not_exact" -lean_statement_sha256 = "16040fad2ac968a316520f6e522063d1e6aeeb5000305573e650296cec80290f" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotBatch.first_is_claim" +lean_statement_sha256 = "489cba7d4e3fd07b181a272fc781d0c81e78ade61a26e0d5db644ae4f1625b2c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -17469,37 +252917,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17512,34 +253143,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatch.lean" +sha256 = "edb724bea82c7cddc44de003052afb8a31160969cbf3a7c623ab8cf020730f57" [[claims]] -claim_id = "AP-FORMAL-RICH-078" -claim_text = "Lean proves the reservation/execution lifecycle property: absent replay never claims effect." +claim_id = "AP-FORMAL-RICH-797" +claim_text = "Lean proves the bounded product-policy property: exact entry count." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.absent_replay_never_claims_effect" -lean_statement_sha256 = "52a298bd35ffa236d8370ab74d78a674e9e9243a686c52e611f92be3c5cfcf64" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotBatch.exact_entry_count" +lean_statement_sha256 = "9e0a98bd1943ae5cd459b9fcc99df5d9172bd19425fc0b773d4ac7a1dd70ed9a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -17548,37 +253222,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17591,34 +253448,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatch.lean" +sha256 = "edb724bea82c7cddc44de003052afb8a31160969cbf3a7c623ab8cf020730f57" [[claims]] -claim_id = "AP-FORMAL-RICH-079" -claim_text = "Lean proves the reservation/execution lifecycle property: start attempt requires credential." +claim_id = "AP-FORMAL-RICH-798" +claim_text = "Lean proves the bounded product-policy property: invalid shape refused." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.start_attempt_requires_credential" -lean_statement_sha256 = "4dcfb31b2e2662aef2c336d0c4f55f922b3c6ac226776bed4daacca4424d1904" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotBatch.invalid_shape_refused" +lean_statement_sha256 = "897a1194250be3a5914fca7c6927123bac6bc21ad08d661d611f04b815c21b23" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -17627,37 +253531,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17670,34 +253757,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatch.lean" +sha256 = "edb724bea82c7cddc44de003052afb8a31160969cbf3a7c623ab8cf020730f57" [[claims]] -claim_id = "AP-FORMAL-RICH-080" -claim_text = "Lean proves the reservation/execution lifecycle property: provider call requires attempt." +claim_id = "AP-FORMAL-RICH-799" +claim_text = "Lean proves the bounded product-policy property: native sums refines." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.provider_call_requires_attempt" -lean_statement_sha256 = "215e750dce32f2f49fa22b96b5c44699bb15604760223b9f26ace3becbac3bdb" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotBatch.Refinement.native_sums_refines" +lean_statement_sha256 = "f6b2a298f868f1031ee0986c914cf2491ea59d283fc9b0fcc52bc302ca214f0c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -17706,37 +253836,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17749,35 +254062,82 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotBatchRefinement.lean" +sha256 = "cc58ecfff0dad8914823cf966f873266404a9162dee7af3e2f2a00e06232a554" [[claims]] -claim_id = "AP-FORMAL-RICH-081" -claim_text = "Lean proves the reservation/execution lifecycle property: commit requires provider entry and effect." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.commit_requires_provider_entry_and_effect" -lean_statement_sha256 = "de9baa696f2dbc23d1dfe965a72bc95f211cda0525f3a212af4197864aab36f2" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-800" +claim_text = "The complete actual lowercase counter-hex comparison returns exactly the independent full-length digit-pair identity predicate on every represented input; no canonicality or successful comparison is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec" +lean_statement_sha256 = "9e388766bc6ba7a58bf2e411a69b7a6089c57bcc9b0662969f9e555639ffd69f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::slot_record::counter_hex_matches"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17785,37 +254145,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17828,35 +254371,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotRecordRefinement.lean" +sha256 = "6d6381d37616fdb84358e5574ed2e8de8dd3a27ccf1d25a75648ff58d4fcb5c0" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-082" -claim_text = "Lean proves the reservation/execution lifecycle property: outcome unknown cannot release." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.outcome_unknown_cannot_release" -lean_statement_sha256 = "3d3102111fb51a188aeffe93d7dc6ad13b25a4db54b871f8d4a4b27f98e88c9b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-801" +claim_text = "The complete actual decoded cumulative-slot validator is total and returns exactly the independent schema/counter/slot/delta relation on every represented input. JSON parsing and storage integrity remain separate." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotRecord.Refinement.validate_cumulative_exact" +lean_statement_sha256 = "8aa2f78296b75017cce23e8137be91204af2b40ff3a189956b9fcb242192a165" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::slot_record::validate_cumulative"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17864,37 +254468,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17907,35 +254694,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotRecordRefinement.lean" +sha256 = "6d6381d37616fdb84358e5574ed2e8de8dd3a27ccf1d25a75648ff58d4fcb5c0" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-083" -claim_text = "Lean proves the reservation/execution lifecycle property: outcome unknown only reconciliation can terminate." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.outcome_unknown_only_reconciliation_can_terminate" -lean_statement_sha256 = "98af24c5f5fa0f00c4cbc0ef76b168f8fbc0811d3a3069e587d844a9406c5def" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-802" +claim_text = "Every accepted actual decoded cumulative record binds the exact schema bytes, canonical lowercase counter ID, requested slot and delta bounded by the returned cumulative value; no accepted identity is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotRecord.Refinement.source_accepted_binds_record" +lean_statement_sha256 = "84995ebd57c630db5a6ea382a08486dca2b348fe5e706d52624d25cb73a6b97c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::slot_record::validate_cumulative"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -17943,37 +254791,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -17986,35 +255017,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotRecordRefinement.lean" +sha256 = "6d6381d37616fdb84358e5574ed2e8de8dd3a27ccf1d25a75648ff58d4fcb5c0" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-084" -claim_text = "Lean proves the reservation/execution lifecycle property: configuration mismatch stops reservation." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.configuration_mismatch_stops_reservation" -lean_statement_sha256 = "9eb20bb520a94f7bfd23c41793df96630035b109d3bd77ae5520e384d80f87a7" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-803" +claim_text = "Every actual decoded record outside the independent exact identity and numeric relation returns None. Malformed storage bytes and backend semantics remain separate boundaries." +claim_status = "qualified" +lean_declaration = "Auths.Product.SlotRecord.Refinement.source_invalid_record_refused" +lean_statement_sha256 = "8d9b880a13f4dde3fb555c1a11b94fcc9cae8966da74e8b624fc02f6c08b0c0b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::slot_record::validate_cumulative"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18022,37 +255114,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18065,34 +255340,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotRecordRefinement.lean" +sha256 = "6d6381d37616fdb84358e5574ed2e8de8dd3a27ccf1d25a75648ff58d4fcb5c0" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-085" -claim_text = "Lean proves the reservation/execution lifecycle property: configuration mismatch stops credential." +claim_id = "AP-FORMAL-RICH-804" +claim_text = "Lean proves the bounded product-policy property: accepted iff." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.configuration_mismatch_stops_credential" -lean_statement_sha256 = "6f4e8f2d72115f41f5d9881ece6c3d8bff1fcca74bf34415a14475b316085abb" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotRecord.accepted_iff" +lean_statement_sha256 = "e9ae88371fac0a98ea6ce52cf5a83d230ef190d3cf3acca3d998e91d3c62850c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -18101,37 +255437,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18144,34 +255663,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotRecord.lean" +sha256 = "9178c77e736918dae8ae86ceb9d4e275f82520e5a3a8b2e75f4d37b312755cf3" [[claims]] -claim_id = "AP-FORMAL-RICH-086" -claim_text = "Lean proves the reservation/execution lifecycle property: terminal states never transition." +claim_id = "AP-FORMAL-RICH-805" +claim_text = "Lean proves the bounded product-policy property: accepted binds slot." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.terminal_states_never_transition" -lean_statement_sha256 = "ac59e2c5beb8dcaf74cafc08c46f48d6d2345ab773dcf2dae55a337bd1c30acc" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SlotRecord.accepted_binds_slot" +lean_statement_sha256 = "1e8552831301bfbc29fd95eec15048a19bedd076cc7880e23037ba25bedbb200" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -18180,37 +255742,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18223,35 +255968,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Pure V1 lifecycle transitions, capacity conservation, replay, configuration gates, credential ordering, provider entry, and reconciliation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Lifecycle/Theorems.lean" -sha256 = "1d30fad27e732bb77a87d7c34cb8230fbb869edc64fc3d3f33e7ee3f8592c8ab" +artifact = "formal/Auths/Product/SlotRecord.lean" +sha256 = "9178c77e736918dae8ae86ceb9d4e275f82520e5a3a8b2e75f4d37b312755cf3" [[claims]] -claim_id = "AP-FORMAL-RICH-087" -claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for terminal-state classification." +claim_id = "AP-FORMAL-RICH-806" +claim_text = "Lean proves the bounded product-policy property: hex matches injective." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.Refinement.translated_terminal_refines_rich" -lean_statement_sha256 = "8963dd672ee5d30584b6a8a131ca2e28a824c51ce5126805eea83ebbe55d71c9" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_lifecycle::model::LifecycleState::is_terminal"] +lean_declaration = "Auths.Product.SlotRecord.hex_matches_injective" +lean_statement_sha256 = "1e45a6c6fdf918d90ce0e552f896502c579d61de4a2f8757092d7ae00746e5e7" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18259,37 +256047,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18302,35 +256273,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::model::LifecycleState::is_terminal` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." -residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Lifecycle/Refinement.lean" -sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" +kind = "lean-proof" +artifact = "formal/Auths/Product/SlotRecord.lean" +sha256 = "9178c77e736918dae8ae86ceb9d4e275f82520e5a3a8b2e75f4d37b312755cf3" [[claims]] -claim_id = "AP-FORMAL-RICH-088" -claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for state transitions and their authorization gates." +claim_id = "AP-FORMAL-RICH-807" +claim_text = "Lean proves the bounded product-policy property: lookup at." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.Refinement.translated_transition_refines_rich" -lean_statement_sha256 = "ed38f14b22ae254a97a391b4a7ea4064665d323a26e4ec556769f1451731c6cf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_lifecycle::kernel::transition_code"] +lean_declaration = "Auths.Product.CounterAggregation.lookup_at" +lean_statement_sha256 = "f7b14cbeefd9d31bb50cc9a7559f4b05a0f7e3fcab41d896bb563ad9da06849c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18338,37 +256355,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18381,38 +256581,82 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::transition_code` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." -residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Lifecycle/Refinement.lean" -sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" +kind = "lean-proof" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-089" -claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for exclusive capacity." +claim_id = "AP-FORMAL-RICH-808" +claim_text = "Lean proves the bounded product-policy property: lookup absent." claim_status = "proved" -lean_declaration = "Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich" -lean_statement_sha256 = "76c468b3a6a2c9a0231675e987fabf48df92073dc24aadce05f6552165c9e8cf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_lifecycle::kernel::exclusive_capacity_available"] +lean_declaration = "Auths.Product.CounterAggregation.lookup_absent" +lean_statement_sha256 = "861e70e2c841375b4c180f243f9c3b5bf6e6042688da5bb21be8e2e8691097e3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18420,37 +256664,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18463,35 +256890,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::exclusive_capacity_available` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." -residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = ["propext"] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Lifecycle/Refinement.lean" -sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" +kind = "lean-proof" +artifact = "formal/Auths/Product/CounterAggregation.lean" +sha256 = "ad969bc95deac3e9e15900a8d3d883328b3d643489b84ff88577d86395a57f73" [[claims]] -claim_id = "AP-FORMAL-RICH-090" -claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for checked additive capacity." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich" -lean_statement_sha256 = "530d89045350d0aa6be9ad09121e16e2a91d8ed3652b8e9508e5ef2a655e9ada" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_lifecycle::kernel::additive_capacity_available"] +claim_id = "AP-FORMAL-RICH-809" +claim_text = "The complete actual count-capacity lookup is total and returns exactly the independent first-key capacity, with zero for an absent key, on every represented input including duplicate keys." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.count_capacity_spec" +lean_statement_sha256 = "b488833c2fb1c019704b20ae72753daeae00c5048381e93337c48ab3bceda7d0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::count_capacity"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18499,37 +256969,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18542,19 +257195,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::additive_capacity_available` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." -residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -18563,176 +257263,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Lifecycle/Refinement.lean" -sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" - -[[claims]] -claim_id = "AP-FORMAL-RICH-091" -claim_text = "Lean proves the mechanically translated shipping Rust lifecycle kernel refines the rich semantics for replay classification." -claim_status = "proved" -lean_declaration = "Auths.Lifecycle.Refinement.translated_replay_refines_rich" -lean_statement_sha256 = "ede2a75a3447bb934a2454580f45e9610dcf521b669bca3fbe697f567764d7f4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_lifecycle::kernel::replay_code"] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The pinned Charon/Aeneas translation of `auths_lifecycle::kernel::replay_code` is extensionally equivalent to the corresponding rich Lean V1 lifecycle semantics." -residual_assumptions = ["Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the qualified translation boundary, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +kind = "lean-proof" +artifact = "formal/Auths/Product/CounterAggregationRefinement.lean" +sha256 = "2ee2c8327df5a5ed2db777f1bf76e428611bbecb28715b826d289fa0d5ac853c" [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Lifecycle/Refinement.lean" -sha256 = "dd5eeb17239035d0e385be2392d944f6c1094f854744f4960e823bf0b868c7e6" - -[[claims]] -claim_id = "AP-FORMAL-BASELINE-012" -claim_text = "Binary all composition is commutative." -claim_status = "proved" -lean_declaration = "Auths.all_commutative" -lean_statement_sha256 = "fd3226a3df5fb4730eeaeb50b3190d9f0ae29aeb961d395825787945fdcdd445" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The closed three-valued binary all operator." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-013" -claim_text = "Binary all composition is associative." -claim_status = "proved" -lean_declaration = "Auths.all_associative" -lean_statement_sha256 = "5749607a3f2752bdd73ae4559af264763d8a36ec3d1258ed4f60b11467d7e12d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-810" +claim_text = "The actual sum contribution receives exactly the count-key lookup capacity as its slot bound while retaining its own sum ID and capacity. Both IDs are explicit inputs; their authenticated derivation is separate." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact" +lean_statement_sha256 = "762a52926457da8c0ffd01692f54189a34a58cd2e5f42bd8f3ad41589a7b0034" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::counter_aggregation::linked_sum_contribution"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18740,37 +257292,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18783,114 +257518,99 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The closed three-valued binary all operator." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" -[[claims]] -claim_id = "AP-FORMAL-BASELINE-014" -claim_text = "Binary all composition is idempotent." -claim_status = "proved" -lean_declaration = "Auths.all_idempotent" -lean_statement_sha256 = "99993635cb0eadeacab1d64ee7f674245481d4160a770deaed82022c0851a3f6" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The closed three-valued binary all operator." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-015" -claim_text = "Binary any composition is commutative." -claim_status = "proved" -lean_declaration = "Auths.any_commutative" -lean_statement_sha256 = "a2680b963a19fb4f377fefaad4102a4469895954bbea2b7541894902e979115d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-811" +claim_text = "Composing the actual count aggregation and linked sum constructor earns the exact independent per-key minimum as the sum slot bound on the admitted sixteen-link domain. Input uniqueness and a precomputed minimum are not assumed; caller ID derivation remains separate." +claim_status = "qualified" +lean_declaration = "Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum" +lean_statement_sha256 = "483bbc6ae90362dcda3dd1cfdbf9cd3ac7ab1a1a6509635557da192481a95152" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [ + "auths_gateway_kernel::counter_aggregation::aggregate", + "auths_gateway_kernel::counter_aggregation::linked_sum_contribution", +] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18898,37 +257618,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -18941,35 +257844,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The closed three-valued binary any operator." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/SumAggregationRefinement.lean" +sha256 = "258b1b5328707d0852a0ed97121c8310e25ae1f5c0ad65b41c466c877f2b4346" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-016" -claim_text = "Binary any composition is associative." -claim_status = "proved" -lean_declaration = "Auths.any_associative" -lean_statement_sha256 = "3ceaf22f6776423ee96cbdf5fa9bc5c13fca94bdbb3355b016d6b8e4c275afa8" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-812" +claim_text = "The complete actual reservation guard returns exactly the independent ordered decision over all count frontiers, sum-slot frontiers and cumulative sums, including malformed vector shapes and checked-word overflow." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact" +lean_statement_sha256 = "2788a29bcb7302387b6a7970138444174d24f1e8ce26ac20114242f0e1d2df5f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::reservation_admission"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -18977,37 +257941,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19020,35 +258167,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The closed three-valued binary any operator." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmissionRefinement.lean" +sha256 = "96fac0e450610a4181e3ea647eb45f4541a1a83331c7310f097875b08024b01d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-017" -claim_text = "Binary any composition is idempotent." -claim_status = "proved" -lean_declaration = "Auths.any_idempotent" -lean_statement_sha256 = "8f1cb9d3d130a67d026a96f278678b9070badc44f40f7c538ee68a3f9af90d82" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-813" +claim_text = "Every actual Admit result earns all count and sum-slot strict bounds and every cumulative sum bound through complete pairwise relations; those bounds are not premises of the source theorem." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds" +lean_statement_sha256 = "9d6c588e5dd4d848290b98bbdd0c4585cccf9bef71397ad7d57f68fd9e4ada58" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::reservation_admission"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19056,37 +258263,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19099,35 +258489,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The closed three-valued binary any operator." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmissionRefinement.lean" +sha256 = "96fac0e450610a4181e3ea647eb45f4541a1a83331c7310f097875b08024b01d" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-018" -claim_text = "A threshold of one over two truth values equals binary any." -claim_status = "proved" -lean_declaration = "Auths.threshold_one_eq_any" -lean_statement_sha256 = "639a98d2dcab0db13ec9b221b75605fa48ec169a263f76feb2034f912d7a69c7" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +claim_id = "AP-FORMAL-RICH-814" +claim_text = "The actual reservation guard preserves window-exhaustion precedence whenever any count or sum-slot pair lacks room, regardless of every sum input." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum" +lean_statement_sha256 = "329aa6df05d980d37c3d96b54dfc594cc047b236aea332f94d0a4aa55ff38514" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::reservation_admission"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19135,37 +258585,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19178,40 +258811,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The hand-written two-input threshold helper, linked to the generated threshold-count function by thresholdTwo_eq_thresholdCounts." -residual_assumptions = ["Lean's kernel, the pinned toolchain, generator correctness, and the Rust vector harness are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmissionRefinement.lean" +sha256 = "96fac0e450610a4181e3ea647eb45f4541a1a83331c7310f097875b08024b01d" [[claims.evidence]] -kind = "test-corpus" -artifact = "core/formal-vectors/v1/threshold-counts.json" -sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-019" -claim_text = "A threshold of two over two truth values equals binary all." -claim_status = "proved" -lean_declaration = "Auths.threshold_n_eq_all" -lean_statement_sha256 = "7bfb0c0d44d1f31949d7039be3c2052cab9112fcb12d2abef005e6c52979b815" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +claim_id = "AP-FORMAL-RICH-815" +claim_text = "Every actual Admit result earns all three frontier/capacity and total/capacity length equalities, so partial vector zips cannot create admission." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors" +lean_statement_sha256 = "8d7609eb79904942482001701a350d6ccc904f6719e326b14bbc72ac74996018" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::reservation_admission"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19219,37 +258907,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19262,40 +259133,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The hand-written two-input threshold helper, linked to the generated threshold-count function by thresholdTwo_eq_thresholdCounts." -residual_assumptions = ["Lean's kernel, the pinned toolchain, generator correctness, and the Rust vector harness are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmissionRefinement.lean" +sha256 = "96fac0e450610a4181e3ea647eb45f4541a1a83331c7310f097875b08024b01d" [[claims.evidence]] -kind = "test-corpus" -artifact = "core/formal-vectors/v1/threshold-counts.json" -sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-020" -claim_text = "Raising the two-input threshold from one to two cannot raise its authorization truth." -claim_status = "proved" -lean_declaration = "Auths.threshold_monotone_k" -lean_statement_sha256 = "34c77c69b14f1b08db8fba8da86a0a9eb65b95147b85d8d3f48811b47cabcb79" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +claim_id = "AP-FORMAL-RICH-816" +claim_text = "Every actual Admit result earns that every cumulative total plus the requested amount fits u64. This follows from complete sum-capacity checks and the represented capacity words, not an assumed no-overflow condition." +claim_status = "qualified" +lean_declaration = "Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow" +lean_statement_sha256 = "c30a291155529e016d9d75f1cc7693c5178556f0e95f5643a9f88fb5ddd58b0a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_bounded_policy::kernel::reservation_admission"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19303,37 +259229,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19346,43 +259455,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "Deriving the chain's distinct counters, their smallest capacities, and their current values from the grant chain and the store is outside this theorem; chain_counts_part and chain_sums_part show that the leaves decide exactly the count and sum parts of chainAdmits over those inputs. The atomicity and linearizability of the store's insert_all, and the unauthenticated gateway clock that selects the fixed window, are assumed and covered by the store conformance suite.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Exactly the two-input threshold helper and the declared three-valued truth order." -residual_assumptions = ["Lean's kernel, the pinned toolchain, listed foundational axioms, generator correctness, and the Rust vector harness are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmissionRefinement.lean" +sha256 = "96fac0e450610a4181e3ea647eb45f4541a1a83331c7310f097875b08024b01d" [[claims.evidence]] -kind = "test-corpus" -artifact = "core/formal-vectors/v1/threshold-counts.json" -sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean" +sha256 = "373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-266" -claim_text = "A threshold of zero over two truth values is authorized, the threshold formula's value; the product's wire format and plan validation reject k = 0." +claim_id = "AP-FORMAL-RICH-817" +claim_text = "Lean proves the bounded product-policy property: counts admit iff." claim_status = "proved" -lean_declaration = "Auths.threshold_zero_authorized" -lean_statement_sha256 = "bc42184fb1f441c5e5ee699d44e0a80c38161401ae018e678d5b7a7300463cbf" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +lean_declaration = "Auths.Product.ReservationAdmission.counts_admit_iff" +lean_statement_sha256 = "d14b865e33cf88201ec97206ce501d92e99b46028c4c75749cfe7e66ffed34c4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19390,37 +259551,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19433,35 +259777,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmission.lean" +sha256 = "643231219c956ce85044ac4989a95d8ecf3f5dbe1889ac462170a52273022261" [[claims]] -claim_id = "AP-FORMAL-RICH-267" -claim_text = "A threshold of three or more over two truth values is denied, the threshold formula's value; plan validation rejects k above the member count." +claim_id = "AP-FORMAL-RICH-818" +claim_text = "Lean proves the bounded product-policy property: sums admit iff." claim_status = "proved" -lean_declaration = "Auths.threshold_above_inputs_denied" -lean_statement_sha256 = "d080b789affedcde693adeadcd36a21e772e0c5d21f40002ccc521f48a1c3748" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +lean_declaration = "Auths.Product.ReservationAdmission.sums_admit_iff" +lean_statement_sha256 = "8fe5706fba842e90d92f6425a327495a74cfeeb1b334b5a32e6bc551a780aa74" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19469,37 +259859,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19512,35 +260085,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmission.lean" +sha256 = "643231219c956ce85044ac4989a95d8ecf3f5dbe1889ac462170a52273022261" [[claims]] -claim_id = "AP-FORMAL-RICH-268" -claim_text = "For every k, raising the two-input threshold cannot raise its authorization truth." +claim_id = "AP-FORMAL-RICH-819" +claim_text = "Lean proves the bounded product-policy property: admitted iff." claim_status = "proved" -lean_declaration = "Auths.threshold_antitone_k" -lean_statement_sha256 = "efa1ab70eaceb5322dd690f37fd6372ab1092f49da878f391158840b4afed292" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +lean_declaration = "Auths.Product.ReservationAdmission.admitted_iff" +lean_statement_sha256 = "c734c62bac34ca99c24aa21dc2e285692de049c118888dc314ed4e618860e846" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19548,37 +260167,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19591,39 +260393,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmission.lean" +sha256 = "643231219c956ce85044ac4989a95d8ecf3f5dbe1889ac462170a52273022261" [[claims]] -claim_id = "AP-FORMAL-RICH-269" -claim_text = "For every count of authorized and indeterminate members, raising the required count cannot raise the generated threshold-count function's truth." +claim_id = "AP-FORMAL-RICH-820" +claim_text = "Lean proves the bounded product-policy property: admitted shapes." claim_status = "proved" -lean_declaration = "Auths.thresholdCounts_antitone_required" -lean_statement_sha256 = "5f1fda6eb247d5ed916296eccfef581d05ed4ecbed69455445bc8ce5ff12fcd6" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +lean_declaration = "Auths.Product.ReservationAdmission.admitted_shapes" +lean_statement_sha256 = "2423bfcf4f49b3be0a5aa3cbfbee1c1876daad3bbd36ad564d3fd717aa667328" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19631,37 +260475,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19674,18 +260701,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The generated threshold-count function, whose Rust twin the verifier runs, and the declared three-valued truth order." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -19695,17 +260765,17 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmission.lean" +sha256 = "643231219c956ce85044ac4989a95d8ecf3f5dbe1889ac462170a52273022261" [[claims]] -claim_id = "AP-FORMAL-RICH-270" -claim_text = "For every k, the two-input threshold helper equals the generated threshold-count function applied to the two inputs' authorized and indeterminate counts." +claim_id = "AP-FORMAL-RICH-821" +claim_text = "Lean proves the bounded product-policy property: window refusal precedes sum." claim_status = "proved" -lean_declaration = "Auths.thresholdTwo_eq_thresholdCounts" -lean_statement_sha256 = "e36ef8702dd4af7d133609adacf0b481ac3302e59f9b0d64563976531f8a017e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +lean_declaration = "Auths.Product.ReservationAdmission.window_refusal_precedes_sum" +lean_statement_sha256 = "6095b377d9937a8713dbfd5175e0df80362a294ff0fe3cd096024aef37cf2e13" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19713,37 +260783,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19756,18 +261009,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The hand-written two-input threshold helper, the generated threshold-count function, and the declared three-valued truth order." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -19777,16 +261073,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmission.lean" +sha256 = "643231219c956ce85044ac4989a95d8ecf3f5dbe1889ac462170a52273022261" [[claims]] -claim_id = "AP-FORMAL-BASELINE-021" -claim_text = "Swapping the two inputs preserves binary all and binary any results." +claim_id = "AP-FORMAL-RICH-822" +claim_text = "Lean proves the bounded product-policy property: admitted sum at." claim_status = "proved" -lean_declaration = "Auths.binary_composition_swap_invariant" -lean_statement_sha256 = "5a2f18a8b889fca7e2d4f239a97a12490193b19c6d3e8703164e04cc556986c7" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.ReservationAdmission.admitted_sum_at" +lean_statement_sha256 = "e1a27b6c23e3806f873af085d1be1904ca5270cbaa8261ca97a49568d615fc6e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -19795,37 +261091,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19838,35 +261317,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "A two-value swap only; arbitrary authorization-plan permutations are not claimed." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ReservationAdmission.lean" +sha256 = "643231219c956ce85044ac4989a95d8ecf3f5dbe1889ac462170a52273022261" [[claims]] -claim_id = "AP-FORMAL-BASELINE-022" -claim_text = "The two-value minimum diagnostic code is invariant under swapping its inputs." -claim_status = "proved" -lean_declaration = "Auths.canonical_diagnostic_permutation_invariant" -lean_statement_sha256 = "c0eae1c5c0004d836da0c28c5d5395ecb7e534d05e9816a573d27b7c0f912806" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-823" +claim_text = "The complete actual profile-membership loop returns exactly membership of the full identifier-byte/version pair for every represented list and requested profile. Neither membership nor valid record construction is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact" +lean_statement_sha256 = "798922a36c5f964b652a5b012f5835e850f06ebba082f6a81f7c43cb47c224d2" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::entry_authorization::profile_allowed"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19874,37 +261399,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19917,35 +261625,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The two-value canonicalCode helper; arbitrary plan diagnostic permutations are not claimed." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ConnectionEntryRefinement.lean" +sha256 = "aea502c03f6c4400b350e7cc57cce058848941be95a5971f1d9b3896d294dc6b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-023" -claim_text = "The current plan visit helper is definitionally the plan leaf enumeration." -claim_status = "proved" -lean_declaration = "Auths.plan_visit_is_leaf_enumeration" -lean_statement_sha256 = "a9d2d3fd6140d7535c9cf3567cf92a5891e8e77fda5924a34a032bb1d9cab0cb" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-824" +claim_text = "The complete actual connection-entry predicate returns exactly the independent conjunction of active state, exact workload membership and exact profile identifier/version membership, with no desired-result Boolean premise." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionEntry.Refinement.entry_allows_exact" +lean_statement_sha256 = "e44ad30930f2b8ee6a9a1b2153c6b39611a57a3fe3ebabef8cd4eff52e03877e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::entry_authorization::entry_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -19953,37 +261722,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -19996,38 +261948,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "A definitional model equality; it does not prove that the shipping evaluator visits leaves once." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ConnectionEntryRefinement.lean" +sha256 = "aea502c03f6c4400b350e7cc57cce058848941be95a5971f1d9b3896d294dc6b" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-024" -claim_text = "The current plan cost helper is definitionally the recursive node count." -claim_status = "proved" -lean_declaration = "Auths.plan_cost_is_node_count" -lean_statement_sha256 = "d0e9f71500f5da6108662057f11150fa61188b6b5059562b6db0079bd4e5820e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-825" +claim_text = "Every actual positive connection-entry result earns active state and exact workload and profile/version membership. Credential leases, shared-record reloads, byte-to-record decoding and execution entry remain separate." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile" +lean_statement_sha256 = "7e6c797b1473cf60aa6c22fedc86ddfa6b6f50b5a8291adaba7171fb7e73b528" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::entry_authorization::entry_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20035,37 +262045,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20078,122 +262271,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "A definitional model equality; no asymptotic or shipping evaluator cost bound is claimed." -residual_assumptions = ["Lean's kernel, the pinned toolchain, and the listed foundational axioms are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" - -[[claims]] -claim_id = "AP-FORMAL-BASELINE-025" -claim_text = "An authorized generated threshold result implies the authorized count meets the threshold." -claim_status = "proved" -lean_declaration = "Auths.authorized_implies_threshold_met" -lean_statement_sha256 = "367522026ebf77cc4e8ee694920ff72384ab58cb573bb7cefb8406117955d2d1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The generated count classifier and its exhaustive target-V1 bounded Rust vectors." -residual_assumptions = ["Lean's kernel, the pinned toolchain, generator correctness, and the Rust vector harness are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +artifact = "formal/Auths/Product/ConnectionEntryRefinement.lean" +sha256 = "aea502c03f6c4400b350e7cc57cce058848941be95a5971f1d9b3896d294dc6b" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" [[claims.evidence]] -kind = "test-corpus" -artifact = "core/formal-vectors/v1/threshold-counts.json" -sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-026" -claim_text = "A denied generated threshold result implies authorized plus indeterminate branches cannot meet the threshold." -claim_status = "proved" -lean_declaration = "Auths.denied_implies_threshold_impossible" -lean_statement_sha256 = "50005cbb684ef7566e1b6f71fc766e9960de178f0a86f03e37f4eb63cf7e46d5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +claim_id = "AP-FORMAL-RICH-826" +claim_text = "The actual connection-entry predicate refuses every disabled state for all workload/profile lists and requests, even if both memberships hold." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionEntry.Refinement.source_disabled_refused" +lean_statement_sha256 = "7efced135e5736d676f326744c8d91c1df056c0bb739e62dec00acd8a84d973e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::entry_authorization::entry_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20201,37 +262368,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20244,43 +262594,96 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The generated count classifier and its exhaustive target-V1 bounded Rust vectors." -residual_assumptions = ["Lean's kernel, the pinned toolchain, listed foundational axioms, generator correctness, and the Rust vector harness are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ConnectionEntryRefinement.lean" +sha256 = "aea502c03f6c4400b350e7cc57cce058848941be95a5971f1d9b3896d294dc6b" [[claims.evidence]] -kind = "test-corpus" -artifact = "core/formal-vectors/v1/threshold-counts.json" -sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-BASELINE-027" -claim_text = "An indeterminate generated threshold result means authorization is not yet met but remains reachable." -claim_status = "proved" -lean_declaration = "Auths.indeterminate_implies_threshold_reachable" -lean_statement_sha256 = "dd970bbab7dd61f7b1274f9e829358d9627b3c822d4119628191018722f31039" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_algebra_kernel::threshold_counts"] +claim_id = "AP-FORMAL-RICH-827" +claim_text = "The actual connection-entry predicate refuses every revoked state for all workload/profile lists and requests, even if both memberships hold." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionEntry.Refinement.source_revoked_refused" +lean_statement_sha256 = "b13f4f99592ffb63d681733dfedc278f078ce2a16438b1d1480cb4b2b272eed8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::entry_authorization::entry_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20288,37 +262691,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20331,19 +262917,66 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate." +residual_assumptions = [ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The generated count classifier and its exhaustive target-V1 bounded Rust vectors." -residual_assumptions = ["Lean's kernel, the pinned toolchain, listed foundational axioms, generator correctness, and the Rust vector harness are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -20353,21 +262986,26 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Composition.lean" -sha256 = "c90da4ac068c442b129208678ff147dc35f93533ce5250d4f8593b927cc0f892" +artifact = "formal/Auths/Product/ConnectionEntryRefinement.lean" +sha256 = "aea502c03f6c4400b350e7cc57cce058848941be95a5971f1d9b3896d294dc6b" [[claims.evidence]] -kind = "test-corpus" -artifact = "core/formal-vectors/v1/threshold-counts.json" -sha256 = "e2d3878d0da4344f9d5b1abc35545cfd5df513b94474ce229b728139e63dd1f6" +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-143" -claim_text = "Lean proves adding an observation requirement never enlarges the set of authorized evaluations." +claim_id = "AP-FORMAL-RICH-828" +claim_text = "Lean proves the bounded product-policy property: admitted binds all." claim_status = "proved" -lean_declaration = "Auths.Observation.requirements_monotone" -lean_statement_sha256 = "148ccf94301235d93a8436967797e60faca90b144df545bd381377b4a50a6a6a" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.ConnectionEntry.admitted_binds_all" +lean_statement_sha256 = "f608944aabf38b7ddd0cee0fc4b0766f4e7d4abdb865f8671d6c780474bd4944" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -20376,37 +263014,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20419,18 +263240,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -20440,17 +263304,17 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionEntry.lean" +sha256 = "4228a97b55df8c5be6027b4fca024303efef958b3fd98d71218f45aa75300cc2" [[claims]] -claim_id = "AP-FORMAL-RICH-144" -claim_text = "Lean proves adding a condition to an observation requirement never enlarges the set of satisfying evaluations." -claim_status = "proved" -lean_declaration = "Auths.Observation.conditions_monotone" -lean_statement_sha256 = "580cb89f54be773f8f5b9477dcfa105314d26628e415c3d9e43bc0abbaf13f07" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-829" +claim_text = "The actual scalar token-tail classifier returns exactly the independent lowercase/digit/hyphen predicate for every u8." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.lower_tail_exact" +lean_statement_sha256 = "5898b164fdf8d6f1927af9978adc92701cc6797b4b4ad060bc081529654bfe38" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::lower_tail_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20458,37 +263322,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20501,38 +263548,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-145" -claim_text = "Lean proves a child grant whose base authority attenuates and whose observation requirements contain the parent's authorizes a subset of what the parent authorizes." -claim_status = "proved" -lean_declaration = "Auths.Observation.child_requirements_superset_attenuates" -lean_statement_sha256 = "569899c6f3632631a784c25e616bcf272690422a491a5f6227f51270e442fbe5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-830" +claim_text = "The complete actual printable-ASCII validator returns exactly the independent nonempty length-bounded full-buffer predicate for every slice and maximum, without an expected validity premise." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact" +lean_statement_sha256 = "3ce5d006c769c68aba18bc6d1c7431e239f6cffecf8016f3a8d8de7b153ab15f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::ascii_graphic_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20540,37 +263644,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20583,38 +263870,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-146" -claim_text = "Lean proves attaching more observations never turns a satisfied observation requirement into an unsatisfied one." -claim_status = "proved" -lean_declaration = "Auths.Observation.satisfied_monotone_observations" -lean_statement_sha256 = "ba0d15b96cedec283e46c0829abd94525ab9d378848e5f17d737b529e786aff5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-831" +claim_text = "The complete actual lowercase token validator returns exactly the independent bounded first-letter and complete-tail language for every slice and maximum, without an expected validity premise." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.lower_valid_exact" +lean_statement_sha256 = "6a87a49a50776a73801b672d1b51f7bfdf4738f8a59c050cf3b32d96fabac7c4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::lower_token_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20622,37 +263966,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20665,38 +264192,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-147" -claim_text = "Lean proves an empty observation set satisfies no observation requirement." -claim_status = "proved" -lean_declaration = "Auths.Observation.no_observation_satisfies_nothing" -lean_statement_sha256 = "2de8b8b35b722baed67f9208a44ed87aad1918842eac9d30b1a0af9248cf6b91" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-832" +claim_text = "Every successful actual lowercase token validation earns that the entire buffer contains no NUL byte; NUL absence is not assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul" +lean_statement_sha256 = "c8e855c7e07df2a4a4d45c3f2f789d767348fcf9e7cfdc7a331381fbfc7f7949" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::lower_token_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20704,37 +264288,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20747,35 +264514,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-148" -claim_text = "Lean proves an observation dated after the evaluation time is never fresh." -claim_status = "proved" -lean_declaration = "Auths.Observation.future_observation_never_fresh" -lean_statement_sha256 = "25e1df429190fb5954c738d846264281c1f699bf5f3b2dd09e153458f8f7d3da" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-833" +claim_text = "Every successful actual printable-ASCII validation earns that the entire buffer contains no NUL byte; NUL absence is not assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul" +lean_statement_sha256 = "c99f4aeff4cb684ec26ee2e3a57cb896aaf7f9dec146576d23b3d96504f0c70a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::ascii_graphic_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20783,37 +264610,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20826,19 +264836,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -20848,17 +264904,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-149" -claim_text = "Lean proves an observation older than the requirement's maximum age is never fresh." -claim_status = "proved" -lean_declaration = "Auths.Observation.stale_observation_never_fresh" -lean_statement_sha256 = "bc723fae1eda0ccab4ab50fe9439378198157d48db4c7cb20c50b99501d4a705" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-834" +claim_text = "Every successful actual lowercase token validation earns a nonempty buffer within its supplied size bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound" +lean_statement_sha256 = "32aacd96642cd7a57b2e97b84535ba8a40bba085beff61a0a5a58e1c8190d14e" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::lower_token_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20866,37 +264932,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20909,19 +265158,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -20931,17 +265226,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-150" -claim_text = "Lean proves a satisfied observation requirement had every action fact it references available." -claim_status = "proved" -lean_declaration = "Auths.Observation.satisfied_requires_action_facts" -lean_statement_sha256 = "868823975fffe7737c3f778322256228fee15e6e7aaa6d4ec7f6141da0b11ea1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-835" +claim_text = "Every successful actual printable-ASCII validation earns a nonempty buffer within its supplied size bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound" +lean_statement_sha256 = "66da89f4fd5974c8705b9bbfacf1dee7d0746b7436ddd896accdc40b4a04607c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::ascii_graphic_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -20949,37 +265254,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -20992,37 +265480,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise.", + "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytesRefinement.lean" +sha256 = "b90b393f96cb3d614fe42c27d4c903a1c20da8179a3e610cf791ee011fa78a4c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-151" -claim_text = "Lean proves the three-valued observation verdict is satisfied exactly when some eligible observation satisfies every condition." +claim_id = "AP-FORMAL-RICH-836" +claim_text = "Lean proves the bounded product-policy property: lower has no nul." claim_status = "proved" -lean_declaration = "Auths.Observation.decision_satisfied_iff" -lean_statement_sha256 = "e7e42f0b73ac6aaacf07a646de0481da0942a790607af2896777f242e450da61" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.ConnectionBytes.lower_has_no_nul" +lean_statement_sha256 = "ee0e01e3fa0e77979b392704736ebd341de5fcbe380fd946e1d7729212946802" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -21031,37 +265576,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21074,37 +265802,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytes.lean" +sha256 = "484d28647b0f4835dccb0b4b2d8c7d169422e22ea1c90255f706b572a5ed8dc6" [[claims]] -claim_id = "AP-FORMAL-RICH-152" -claim_text = "Lean proves a denied observation verdict has an eligible observation and every eligible observation falsifies a condition." +claim_id = "AP-FORMAL-RICH-837" +claim_text = "Lean proves the bounded product-policy property: graphic has no nul." claim_status = "proved" -lean_declaration = "Auths.Observation.decision_denied_has_falsifying_observation" -lean_statement_sha256 = "220d9a14270b12a16d4c386a08706c81032a17990421d6712ca365f94bcacde6" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.ConnectionBytes.graphic_has_no_nul" +lean_statement_sha256 = "c4be87188e214ab9576517d2966817e8bd3e594f4a3ca90543efa8d6971286a9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -21113,37 +265881,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21156,38 +266107,78 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [ - "propext", - "Quot.sound", -] +axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ConnectionBytes.lean" +sha256 = "484d28647b0f4835dccb0b4b2d8c7d169422e22ea1c90255f706b572a5ed8dc6" [[claims]] -claim_id = "AP-FORMAL-RICH-164" -claim_text = "Lean proves an observation fresh under a smaller maximum age is fresh under a larger one." -claim_status = "proved" -lean_declaration = "Auths.Observation.fresh_monotone_max_age" -lean_statement_sha256 = "54093bcffc875104caccb21819e59c367362132d9d2446952efd7a408f65f059" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-838" +claim_text = "The unchanged actual inherent profile constructor returns exactly InvalidProfile at version zero and otherwise constructs exactly the supplied semantic identifier and version. No result or nonzero-version premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.ProfileConstructor.Refinement.constructor_exact" +lean_statement_sha256 = "d97a4b9ef5cb26dbfe821f75a35139eab7c1566c76690330539578c092e07d71" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ConnectionProfile}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21195,37 +266186,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21238,19 +266412,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented typed SemanticId and u16 version. The actual shipping method body is translated transparently through a non-shipping selector; no constructor algorithm is duplicated or replaced." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. The offline selector uses only checksum-identical shipping lock identities and locked compilation.", + "The string-to-SemanticId parser, full record codec, projection and runtime caller composition remain separate. This proves constructor field/version behavior, not validity of an arbitrary represented SemanticId string.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -21260,17 +266480,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ProfileConstructorRefinement.lean" +sha256 = "0d2af49b655870e9cd5c3e05b26eeb88768d787b09d101c0091adc46667b1954" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-165" -claim_text = "Lean proves a strictly narrowed observation requirement is satisfied only when its parent requirement is." -claim_status = "proved" -lean_declaration = "Auths.Observation.narrows_monotone" -lean_statement_sha256 = "9fba78f0577d3888e9f544a917fe1a44fa53cfbaeb9b600a27cab1a56859cb05" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-839" +claim_text = "Every successful actual profile construction earns a positive version and preserves both exact supplied fields; successful construction is an output condition, not an input premise." +claim_status = "qualified" +lean_declaration = "Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields" +lean_statement_sha256 = "e17c5e349583aedb70a29a4ed9d96ca320c3a1eecd0301596e8e22d6d6363649" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ConnectionProfile}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21278,37 +266508,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21321,19 +266734,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented typed SemanticId and u16 version. The actual shipping method body is translated transparently through a non-shipping selector; no constructor algorithm is duplicated or replaced." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. The offline selector uses only checksum-identical shipping lock identities and locked compilation.", + "The string-to-SemanticId parser, full record codec, projection and runtime caller composition remain separate. This proves constructor field/version behavior, not validity of an arbitrary represented SemanticId string.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -21343,17 +266802,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ProfileConstructorRefinement.lean" +sha256 = "0d2af49b655870e9cd5c3e05b26eeb88768d787b09d101c0091adc46667b1954" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-166" -claim_text = "Lean proves a covering observation requirement is satisfied only when the covered requirement is." -claim_status = "proved" -lean_declaration = "Auths.Observation.covers_monotone" -lean_statement_sha256 = "aafa19c473cfc60aa626d058fcb1285f5b515a435dbbf9d2d250c9935fd65bbb" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-840" +claim_text = "The actual profile constructor refuses version zero for every represented semantic identifier." +claim_status = "qualified" +lean_declaration = "Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused" +lean_statement_sha256 = "154c4d583d50546e17f9e890436ac292c7072a1123d8d29b598007cda44a43ab" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ConnectionProfile}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21361,37 +266830,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21404,19 +267056,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented typed SemanticId and u16 version. The actual shipping method body is translated transparently through a non-shipping selector; no constructor algorithm is duplicated or replaced." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. The offline selector uses only checksum-identical shipping lock identities and locked compilation.", + "The string-to-SemanticId parser, full record codec, projection and runtime caller composition remain separate. This proves constructor field/version behavior, not validity of an arbitrary represented SemanticId string.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -21426,17 +267124,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/ProfileConstructorRefinement.lean" +sha256 = "0d2af49b655870e9cd5c3e05b26eeb88768d787b09d101c0091adc46667b1954" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-167" -claim_text = "Lean proves observation-requirement covering is transitive." -claim_status = "proved" -lean_declaration = "Auths.Observation.covers_trans" -lean_statement_sha256 = "8be67281de157aa1ce9f37e536382462d33cebfc8b6ad06ebacc950b100cb241" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-841" +claim_text = "The actual semantic-identifier head classifier exactly accepts ASCII letters and digits for every byte." +claim_status = "qualified" +lean_declaration = "Auths.Product.SemanticId.Refinement.semantic_head_exact" +lean_statement_sha256 = "8fc489fc1921eb1fade8969d06c04fbf255a6bf3485993954c87bb594c8ba5a0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::semantic_head_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21444,37 +267152,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21487,38 +267378,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/SemanticIdRefinement.lean" +sha256 = "36763ebbe27929c91ed47248dbcd1eb9be9530295ef098a926258a1592ea11e4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-168" -claim_text = "Lean proves observation-requirement list attenuation is reflexive." -claim_status = "proved" -lean_declaration = "Auths.Observation.requirements_attenuate_refl" -lean_statement_sha256 = "3ddf75aca2a28b5c1f927d5adc747a45ab309a933646b17f963484e5d5128c98" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-842" +claim_text = "The actual semantic-identifier tail classifier exactly accepts ASCII letters/digits and the five registered punctuation bytes." +claim_status = "qualified" +lean_declaration = "Auths.Product.SemanticId.Refinement.semantic_tail_exact" +lean_statement_sha256 = "95162f17de37fb6dcfeec4034014455e4d57795b667e08800b52ce0076763718" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::semantic_tail_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21526,37 +267474,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21569,35 +267700,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/SemanticIdRefinement.lean" +sha256 = "36763ebbe27929c91ed47248dbcd1eb9be9530295ef098a926258a1592ea11e4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-169" -claim_text = "Lean proves observation-requirement list attenuation is transitive." -claim_status = "proved" -lean_declaration = "Auths.Observation.requirements_attenuate_trans" -lean_statement_sha256 = "3d3f4d07e0abf3bb05962c8d2dd052613dcb5be878594ae858290c2d0fa620d3" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-843" +claim_text = "The complete actual identifier validator returns exactly the independent nonempty bounded initial-alphanumeric/full-tail language on every slice and maximum, without a validity premise." +claim_status = "qualified" +lean_declaration = "Auths.Product.SemanticId.Refinement.semantic_valid_exact" +lean_statement_sha256 = "4600e718cde7a6b061e121af3387331c97ac6bf9aaa6f8807a1dd7e894abba32" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::semantic_id_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21605,37 +267796,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21648,38 +268022,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/SemanticIdRefinement.lean" +sha256 = "36763ebbe27929c91ed47248dbcd1eb9be9530295ef098a926258a1592ea11e4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-170" -claim_text = "Lean proves a child requirement list that attenuates its parent's authorizes a subset of the parent's evaluations." -claim_status = "proved" -lean_declaration = "Auths.Observation.requirements_attenuate_monotone" -lean_statement_sha256 = "ee97dc30d382ed4737017fb8325d2ed3777d80c69ad989231e81b02b64686073" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-844" +claim_text = "Successful actual semantic-identifier validation earns NUL absence throughout the complete byte buffer." +claim_status = "qualified" +lean_declaration = "Auths.Product.SemanticId.Refinement.source_earns_no_nul" +lean_statement_sha256 = "5fe0e763a8d2548c9cdfd122852c78530ee46cdda7a022ba98a2ab9683fff73d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::semantic_id_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21687,37 +268118,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21730,19 +268344,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract evidence-conditioned authority: closed conjunctive observation conditions, freshness, observer and subject binding, over already verified observations and an abstract subject namespace matcher." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -21752,17 +268412,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/SemanticIdRefinement.lean" +sha256 = "36763ebbe27929c91ed47248dbcd1eb9be9530295ef098a926258a1592ea11e4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-171" -claim_text = "Lean proves the observation-requirement-v1 attenuation law is a preorder that narrows." -claim_status = "proved" -lean_declaration = "Auths.Observation.observation_requirement_law_lawful" -lean_statement_sha256 = "617d5169222466363d1b356846ca50e92b48c170f114cd7cfec4bebbbbb64f7d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-845" +claim_text = "Successful actual semantic-identifier validation earns that every byte is ASCII." +claim_status = "qualified" +lean_declaration = "Auths.Product.SemanticId.Refinement.source_earns_ascii" +lean_statement_sha256 = "0aeb216729b87c2c32aeae33e4c70bb7d832d5db03a05e1423fbe60fb5fa8469" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::semantic_id_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21770,37 +268440,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21813,19 +268666,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -21835,17 +268734,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/SemanticIdRefinement.lean" +sha256 = "36763ebbe27929c91ed47248dbcd1eb9be9530295ef098a926258a1592ea11e4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-172" -claim_text = "Lean proves the observation-requirement-v1 law accepts adding the extension where the parent has none." -claim_status = "proved" -lean_declaration = "Auths.Observation.observation_requirement_law_accepts_addition" -lean_statement_sha256 = "e20a8c08c602235bc1aabfeff4bf5e9eebd473a410cd568b26c88c497b8f4ef0" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-846" +claim_text = "Successful actual semantic-identifier validation earns a nonempty buffer within the supplied size bound." +claim_status = "qualified" +lean_declaration = "Auths.Product.SemanticId.Refinement.source_earns_bounds" +lean_statement_sha256 = "622f1c1da9395ef598f983908d8f25444d5e355790cfd63e3e97deab608e3fbf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::semantic_id_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -21853,37 +268762,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21896,34 +268988,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Observation.lean" -sha256 = "9be227ba41f690e73199b852fa16492e9a559dac094f97ee447b3e29bae381d2" +artifact = "formal/Auths/Product/SemanticIdRefinement.lean" +sha256 = "36763ebbe27929c91ed47248dbcd1eb9be9530295ef098a926258a1592ea11e4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-286" -claim_text = "Lean proves the K-of-N approval property: approval decide eq threshold counts." +claim_id = "AP-FORMAL-RICH-847" +claim_text = "Lean proves the bounded product-policy property: valid has no nul." claim_status = "proved" -lean_declaration = "Auths.Approval.approval_decide_eq_threshold_counts" -lean_statement_sha256 = "edf74a0cb0c581e211fb2e53b7042562c38c18635c33161d238967b8be2f247e" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SemanticId.valid_has_no_nul" +lean_statement_sha256 = "1ec684fe0967ead63400549abf3679f9884a6fb0623b4782b93f97edf90fe55b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -21932,37 +269084,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -21975,34 +269310,77 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = ["propext"] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/SemanticId.lean" +sha256 = "87968d7a618c0a5c8270484e6bde92676b46da089148e17e2d425f86476a170e" [[claims]] -claim_id = "AP-FORMAL-RICH-287" -claim_text = "Lean proves the K-of-N approval property: approval authorized iff distinct quorum." +claim_id = "AP-FORMAL-RICH-848" +claim_text = "Lean proves the bounded product-policy property: valid is ascii." claim_status = "proved" -lean_declaration = "Auths.Approval.approval_authorized_iff_distinct_quorum" -lean_statement_sha256 = "ed8b9c7105938a6c41ee1321aaea4472efc6d75b6a9ee2a6791ed2fa139f316c" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.SemanticId.valid_is_ascii" +lean_statement_sha256 = "e3ad8f881f44b7a2a40514ed3fca9501fb1723b597a32f2e6dbca3918f9ae97f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -22011,37 +269389,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22054,18 +269615,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -22075,16 +269679,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/SemanticId.lean" +sha256 = "87968d7a618c0a5c8270484e6bde92676b46da089148e17e2d425f86476a170e" [[claims]] -claim_id = "AP-FORMAL-RICH-288" -claim_text = "Lean proves the K-of-N approval property: approval duplicate irrelevant." +claim_id = "AP-FORMAL-RICH-849" +claim_text = "Lean proves the bounded product-policy property: preimage injective." claim_status = "proved" -lean_declaration = "Auths.Approval.approval_duplicate_irrelevant" -lean_statement_sha256 = "091b7dc31c1282d496858bae18b2a24238427aa9e44822bf0b87e902f969f83e" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.ConnectionFrame.preimage_injective" +lean_statement_sha256 = "d62d760f0428b40183af8254f977cbc4a4d72ad33d6e4220f3722a95ffa11d2f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -22093,37 +269697,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22136,18 +269923,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -22157,16 +269987,16 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/ConnectionFrame.lean" +sha256 = "84a4a88dc116f943b291f88645bf2861a17cb47ec9ed1d6474690ba9e1867025" [[claims]] -claim_id = "AP-FORMAL-RICH-289" -claim_text = "Lean proves the K-of-N approval property: approval outsider irrelevant." +claim_id = "AP-FORMAL-RICH-850" +claim_text = "Lean proves the bounded product-policy property: validated names bind both fields." claim_status = "proved" -lean_declaration = "Auths.Approval.approval_outsider_irrelevant" -lean_statement_sha256 = "7919b2b9e3f9af2cc09100de0d401b6481c08132ddc5cce127a4e4bc64ae0e77" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.ConnectionFrame.validated_names_bind_both_fields" +lean_statement_sha256 = "a67457a509285db1701598c92f9565fcd1d792e242287bf86c4a744de4a6e4bc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", @@ -22175,37 +270005,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22218,18 +270231,61 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Pure V1 bounded product-policy commitments, checked arithmetic, configuration gating, and eligibility." residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -22239,17 +270295,17 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/ConnectionFrame.lean" +sha256 = "84a4a88dc116f943b291f88645bf2861a17cb47ec9ed1d6474690ba9e1867025" [[claims]] -claim_id = "AP-FORMAL-RICH-290" -claim_text = "Lean proves the K-of-N approval property: approval other action irrelevant." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_other_action_irrelevant" -lean_statement_sha256 = "ab11d19f7f7a07159511b63cf269779db785763da037cfdaac4a6504ac844df4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-851" +claim_text = "The actual connection-key builder returns precisely the registered domain, exact provider bytes, NUL separator and exact alias bytes within the shipping constructor bounds; no field or separator is omitted." +claim_status = "qualified" +lean_declaration = "Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact" +lean_statement_sha256 = "e7161b6318fe610650b3086d3bde1cd5302e0044454bf1016c20775554142893" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_gateway_kernel::identity::connection_record_preimage"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22257,37 +270313,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22300,38 +270539,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "All represented provider/alias byte buffers of at most 64 bytes each, including empty and binary inputs. The separate independent framing theorem earns field injectivity from NUL-free provider validation." +residual_assumptions = [ + "Lean's kernel, the pinned toolchain and foundational axioms are trusted. The actual SHA-256 primitive, String-to-byte mapping and complete runtime association remain separate; no global hash injectivity is assumed.", + "Native gateway parity checks compare the shipping hash caller against the frozen streaming preimage. Allocation failure remains outside the translated machine model; the proved builder bounds are below the portable usize limit.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/ConnectionFrameRefinement.lean" +sha256 = "3e7f4d71e364a266045a7b514f63f6e1ba10cb621b335647f1fddeb92692b2c3" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/gateway/Funs.lean" +sha256 = "f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-291" -claim_text = "Lean proves the K-of-N approval property: approval other requirement irrelevant." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_other_requirement_irrelevant" -lean_statement_sha256 = "6ae502a88055c3daca41ca03e8146337bb020150395d6f05f185e209320c9e78" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-852" +claim_text = "The complete actual recovery-lease guard returns exactly the specified ordered typed failures or success for every state and generation pair, including raw zeros." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.recovery_exact" +lean_statement_sha256 = "5cb5446b73866d9aeaf18eb57623735feb4578ac459b057bb2138e26ea135af1" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::recovery_lease"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22339,37 +270635,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22382,38 +270861,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-292" -claim_text = "Lean proves the K-of-N approval property: approval self approval irrelevant." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_self_approval_irrelevant" -lean_statement_sha256 = "83b91c2de34c32a06176d103c17b455d7e5c1977f18c3b7d9fb7e758f99a6da4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-853" +claim_text = "A revoked connection refuses every actual recovery-lease request before generation checks." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation" +lean_statement_sha256 = "a8f836eb434775b4c395979c610464855560337da3f6fc7b54e7bb638e8c6260" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::recovery_lease"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22421,37 +270957,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22464,38 +271183,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-293" -claim_text = "Lean proves the K-of-N approval property: approval permutation invariant." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_permutation_invariant" -lean_statement_sha256 = "e5167218ec0c197a06f1eae05406ec507b75f3b2272a409c3f431f236070be33" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-854" +claim_text = "Successful actual recovery authorization earns a non-revoked state and a positive requested generation no newer than the record." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state" +lean_statement_sha256 = "f8d00ed5213b66873c203d6a8daca8ba5fd68481e387b21a44c104b1d3d1ebdc" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::recovery_lease"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22503,37 +271279,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22546,38 +271505,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-294" -claim_text = "Lean proves the K-of-N approval property: approval monotone in approvals." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_monotone_in_approvals" -lean_statement_sha256 = "eb3583553f5f013a3a8f76bc84808f167a852b199d4528faf1beaa6f9aa4b98e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-855" +claim_text = "The complete actual recovery-binding classifier returns exactly the independently stated current/recorded/refused generation policy on every tuple." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.binding_requirement_exact" +lean_statement_sha256 = "a9e1eb0de38751cc96b6a69aae4c3e6ef1d936a6ad565d80f2c9c9d6555ed151" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::recovery_binding_requirement"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22585,37 +271601,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22628,19 +271827,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -22650,17 +271895,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-295" -claim_text = "Lean proves the K-of-N approval property: approval antitone in threshold." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_antitone_in_threshold" -lean_statement_sha256 = "b1e0b00684d659884ad65523e4f4b42ceec355686cebdc950ddd6f70c57b67a1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-856" +claim_text = "Requiring the current commitment earns the exact current credential generation, its positivity and coverage by the operation generation." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation" +lean_statement_sha256 = "6a762880d7a9f4270ab1d153e4c21211ec0c4486d75c628f51b0f4acf802dd59" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::recovery_binding_requirement"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22668,37 +271923,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22711,38 +272149,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-296" -claim_text = "Lean proves the K-of-N approval property: approval antitone in approvers." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_antitone_in_approvers" -lean_statement_sha256 = "91f04d22b450064899e426f5a02c45536f8e0a550cfd2209f3032c8a9cd0bc9d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-857" +claim_text = "Selecting the authenticated recorded commitment earns a positive credential generation no newer than the operation, which strictly predates the current credential." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation" +lean_statement_sha256 = "050f89a9a51e85f7cb28baa9c92651bc3618073ffb0ba6bdca7c6b5ff7d1de24" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::recovery_binding_requirement"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22750,37 +272245,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22793,19 +272471,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -22815,17 +272539,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-297" -claim_text = "Lean proves the K-of-N approval property: approval authorized meets." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_authorized_meets" -lean_statement_sha256 = "7543f43fad4398cf6f5514a0f628581d569ddb1b0190d4d341ed4ad762cb0174" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-858" +claim_text = "The actual administrative state guard exactly permits changed state from a non-revoked record at a nondecreasing timestamp." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.state_transition_exact" +lean_statement_sha256 = "c4bdffff982b12a127f1534339c510aa1110bc06c7227ffebf4d2e654a9d48ff" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::state_transition_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22833,37 +272567,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22876,39 +272793,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract K-of-N approval model: per-approval verdicts over the approver, bound action, bound requirement identifier, validity window, and verification truth; distinct counting per listed approver; and the generated thresholdCounts decision." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-298" -claim_text = "Lean proves the K-of-N approval property: covers monotone." -claim_status = "proved" -lean_declaration = "Auths.Approval.covers_monotone" -lean_statement_sha256 = "af566b39841cd9fb7769ebeb7004d3b64edfbcb35a7d779a72d9c017459a7d35" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-859" +claim_text = "Successful actual state-transition validation earns terminal revocation, changed state and monotone time constraints." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time" +lean_statement_sha256 = "fed9252d884bc0c1948f19c45452f144812b2385d5dcdac6a93567c87a0b0a32" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::state_transition_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22916,37 +272888,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -22959,19 +273114,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -22981,17 +273182,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-299" -claim_text = "Lean proves the K-of-N approval property: covers trans." -claim_status = "proved" -lean_declaration = "Auths.Approval.covers_trans" -lean_statement_sha256 = "71bb145d77cd3db75a110f32d90269a90ada8f43a25e5569a379a87ec68a2d9f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-860" +claim_text = "The actual rotation/authorization-replacement guard permits exactly a non-revoked record and a nondecreasing timestamp." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.record_change_exact" +lean_statement_sha256 = "53cd7c4526f4f59d1aa19e94c114e7f8c2bf9bd173f090fbe668916cada1613a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::record_change_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -22999,37 +273210,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23042,35 +273436,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-300" -claim_text = "Lean proves the K-of-N approval property: approval requirements attenuate refl." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_requirements_attenuate_refl" -lean_statement_sha256 = "5001fe3083c023f9cc8260ff9d89ca869fbdf3b85cdf4bfc267ce78e9bae9358" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-861" +claim_text = "An accepted actual administrative record change earns non-revocation and monotone time." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time" +lean_statement_sha256 = "7b2c252860a726f99f8e031eab0f89ccc6bbbc2a73a530dcf248b9ec10b575a5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::record_change_allows"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23078,37 +273531,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23121,35 +273757,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch." +residual_assumptions = [ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/RecoveryGateRefinement.lean" +sha256 = "2f8ca8d6372c9f974f842523c9fea61993492cd8a4472ed8810322cb945671e6" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-301" -claim_text = "Lean proves the K-of-N approval property: approval requirements attenuate trans." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_requirements_attenuate_trans" -lean_statement_sha256 = "e3cdeabbbb19bff2db617206edf53cbbc5758f6276b7144cb9174aa52dd430ad" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-862" +claim_text = "The actual ProviderKind String constructor returns exactly the independent complete lowercase provider language decision and typed error, preserving the supplied string on success." +claim_status = "qualified" +lean_declaration = "Auths.Product.StringConstructors.Refinement.actual_provider_exact" +lean_statement_sha256 = "7fd119d2469c23d0ad989a7b98bb97baf1b56f20dac6b2eff883b9d4200dc8cf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ProviderKind}::parse"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23157,37 +273853,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23200,35 +274079,417 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound." +residual_assumptions = [ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/StringConstructorsRefinement.lean" +sha256 = "2c5abf1c5df72e9b9c5249ba438a83b12d86a68f83b3a3389d0ed5c04af36134" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-302" -claim_text = "Lean proves the K-of-N approval property: approval requirements attenuate monotone." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_requirements_attenuate_monotone" -lean_statement_sha256 = "bbfc53b74d226bc67466f477529aa6cdbf67df24408ff3eeae10773d92e5728d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-863" +claim_text = "The actual ConnectionAlias String constructor returns exactly the independent complete lowercase alias language decision and typed error, preserving the supplied string on success." +claim_status = "qualified" +lean_declaration = "Auths.Product.StringConstructors.Refinement.actual_alias_exact" +lean_statement_sha256 = "c38d61d03590f1cdf56e4538d404db16fe2b9cdfeffeb40827fcc3a864004d26" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ConnectionAlias}::parse"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound." +residual_assumptions = [ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Product/StringConstructorsRefinement.lean" +sha256 = "2c5abf1c5df72e9b9c5249ba438a83b12d86a68f83b3a3389d0ed5c04af36134" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-864" +claim_text = "The actual SemanticId String constructor returns exactly the independent complete semantic identifier language decision and typed error, preserving the supplied string on success." +claim_status = "qualified" +lean_declaration = "Auths.Product.StringConstructors.Refinement.actual_semantic_exact" +lean_statement_sha256 = "d18805e4cb99508ad4680c4e4f9cc8790cfd2cc9508395568c63d61ba6a4c2f9" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::SemanticId}::parse"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23236,37 +274497,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23279,19 +274723,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound." +residual_assumptions = [ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -23301,17 +274791,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/StringConstructorsRefinement.lean" +sha256 = "2c5abf1c5df72e9b9c5249ba438a83b12d86a68f83b3a3389d0ed5c04af36134" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-303" -claim_text = "Lean proves the K-of-N approval property: approval requirement law lawful." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_requirement_law_lawful" -lean_statement_sha256 = "53044016738fba16175dea47ebacba4ada4e9286616ea79a8cac69f94cad5b03" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-865" +claim_text = "Successful actual ProviderKind construction earns its complete UTF-8 byte grammar and exact input-payload preservation; no valid-input premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload" +lean_statement_sha256 = "ef68a085ba38efdc25b1383b95528a31a42916ca10516ef98a25af71b90120e3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ProviderKind}::parse"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23319,37 +274819,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23362,19 +275045,65 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound." +residual_assumptions = [ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", @@ -23384,96 +275113,27 @@ axioms = [ [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/StringConstructorsRefinement.lean" +sha256 = "2c5abf1c5df72e9b9c5249ba438a83b12d86a68f83b3a3389d0ed5c04af36134" -[[claims]] -claim_id = "AP-FORMAL-RICH-304" -claim_text = "Lean proves the K-of-N approval property: approval requirement law accepts addition." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_requirement_law_accepts_addition" -lean_statement_sha256 = "f8224b7c2a7f5b10c9fe3d1b368b240888e88c62ace4db0ef100ce24faea3661" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] -semantic_source_closure = [ - "formal/Auths.lean", - "formal/Auths/Approval.lean", - "formal/Auths/AssuranceAudit.lean", - "formal/Auths/Attenuation.lean", - "formal/Auths/Authority.lean", - "formal/Auths/Base.lean", - "formal/Auths/Composition.lean", - "formal/Auths/Diversity.lean", - "formal/Auths/ExtensionLaw.lean", - "formal/Auths/Generated/Algebra.lean", - "formal/Auths/Lifecycle/Refinement.lean", - "formal/Auths/Lifecycle/Semantics.lean", - "formal/Auths/Lifecycle/Theorems.lean", - "formal/Auths/Observation.lean", - "formal/Auths/Product/Arithmetic.lean", - "formal/Auths/Product/CeilingCount.lean", - "formal/Auths/Product/Commitment.lean", - "formal/Auths/Product/ConnectionGenerations.lean", - "formal/Auths/Product/Eligibility.lean", - "formal/Auths/Product/Recovery.lean", - "formal/Auths/Product/Refinement.lean", - "formal/Auths/Product/Refinement/BoundedPolicy.lean", - "formal/Auths/Product/Refinement/Connections.lean", - "formal/Auths/Product/Refinement/Gateway.lean", - "formal/Auths/Product/RelativeCeiling.lean", - "formal/Auths/Product/RequestConstruction.lean", - "formal/Auths/Product/SubmitOrder.lean", - "formal/Auths/Product/Theorems.lean", - "formal/Auths/Product/Tightening.lean", - "formal/Auths/Refinement/Approval.lean", - "formal/Auths/Refinement/Observation.lean", - "formal/Auths/Refinement/Production.lean", - "formal/Auths/Rich/Mutations.lean", - "formal/Auths/Rich/Semantics.lean", - "formal/Auths/Rich/Theorems.lean", - "formal/Auths/Rich/Types.lean", - "formal/Auths/Theorems.lean", - "formal/algebra-contract-v1.toml", - "formal/lake-manifest.json", - "formal/lakefile.toml", - "formal/lean-toolchain", - "formal/qualification/aeneas/generated/algebra/Funs.lean", - "formal/qualification/aeneas/generated/algebra/Types.lean", - "formal/qualification/aeneas/generated/authority/Funs.lean", - "formal/qualification/aeneas/generated/authority/FunsExternal.lean", - "formal/qualification/aeneas/generated/authority/Types.lean", - "formal/qualification/aeneas/generated/authority/TypesExternal.lean", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", - "formal/qualification/aeneas/generated/bounded_policy/Types.lean", - "formal/qualification/aeneas/generated/connections/Funs.lean", - "formal/qualification/aeneas/generated/connections/Types.lean", - "formal/qualification/aeneas/generated/gateway/Funs.lean", - "formal/qualification/aeneas/generated/gateway/Types.lean", - "formal/qualification/aeneas/generated/lifecycle/Funs.lean", - "formal/qualification/aeneas/generated/lifecycle/Types.lean", - "formal/qualification/aeneas/generated/model/Funs.lean", - "formal/qualification/aeneas/generated/model/FunsExternal.lean", - "formal/qualification/aeneas/generated/model/Types.lean", -] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] -toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" [[claims.evidence]] -kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-305" -claim_text = "Lean proves the K-of-N approval property: approval requirement law refuses drop." -claim_status = "proved" -lean_declaration = "Auths.Approval.approval_requirement_law_refuses_drop" -lean_statement_sha256 = "fe7f7ba5f0892d4b6f9077950bbc333541a83d79fafe5d8ceee3dbed044e242e" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-866" +claim_text = "Successful actual ConnectionAlias construction earns its complete UTF-8 byte grammar and exact input-payload preservation; no valid-input premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload" +lean_statement_sha256 = "d97260e72af8d2a6ae2bdbed2303bb4ef8ed9ae8d87907bed6f0a1527033094a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::ConnectionAlias}::parse"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23481,37 +275141,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23524,35 +275367,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound." +residual_assumptions = [ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Abstract approval-requirement-v1 attenuation law over decoded requirement lists (approver sets and thresholds) and the sets of approving principals each admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Approval.lean" -sha256 = "1fa785d2618c0fcd073158ecf3f43c90189bab20596ebdb8b7cdedd744f10618" +artifact = "formal/Auths/Product/StringConstructorsRefinement.lean" +sha256 = "2c5abf1c5df72e9b9c5249ba438a83b12d86a68f83b3a3389d0ed5c04af36134" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-173" -claim_text = "Lean proves the exact-marker-v1 attenuation law is a preorder that narrows." -claim_status = "proved" -lean_declaration = "Auths.exact_marker_law_lawful" -lean_statement_sha256 = "6f9ff0b2e1f580f8cfc27dcaeaefeee2a19b7cda02879335bf9763287a89eb05" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-867" +claim_text = "Successful actual SemanticId construction earns its complete UTF-8 byte grammar and exact input-payload preservation; no valid-input premise is assumed." +claim_status = "qualified" +lean_declaration = "Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload" +lean_statement_sha256 = "9d15303fb8345a8ddcb542b5f480b754b0c4f2c53652a9020902732187ad4748" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::model::{auths_connections::model::SemanticId}::parse"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23560,37 +275463,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23603,35 +275689,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound." +residual_assumptions = [ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/ExtensionLaw.lean" -sha256 = "bdd40e0557e17786ae30c05f8a15b1e4f3200e83e258f69c391994271cb86249" +artifact = "formal/Auths/Product/StringConstructorsRefinement.lean" +sha256 = "2c5abf1c5df72e9b9c5249ba438a83b12d86a68f83b3a3389d0ed5c04af36134" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/profile_construction/Funs.lean" +sha256 = "ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-174" -claim_text = "Lean proves the exact-marker-v1 law refuses adding the marker." -claim_status = "proved" -lean_declaration = "Auths.exact_marker_law_refuses_addition" -lean_statement_sha256 = "1019a69a34a92a24de8ebdb88a1a5b5ee4707f044a355fbb62a097b913a9c7f5" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-868" +claim_text = "The complete actual durable-record time validator returns exactly the independent lifetime/revocation-shape predicate for every state, timestamp pair and optional revocation timestamp." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecordTimes.Refinement.record_times_exact" +lean_statement_sha256 = "8a81b592eac81205bbb83e1cc486fa673101f3e593aec40832855fbd95097181" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::record_times_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23639,37 +275785,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23682,35 +276011,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual represented ConnectionState, two u64 timestamps and optional u64 revocation timestamp. The actual constructor/decoder validation consumes this predicate after unchanged allowlist checks." +residual_assumptions = [ + "Lean's kernel, pinned toolchain and permitted foundational axioms are trusted. No new external model, native axiom or expected-validity premise is introduced.", + "The complete record codec, all allowlist/resource checks, timestamp/caller projection and full runtime histories remain separate. Frozen full-record and actual canonical-decoder parity tests support the temporal validation cutover. These are integer/time-shape laws, not a proof of a physical clock.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Critical-extension attenuation laws over decoded payloads: each registered handler law is a preorder that narrows the worlds its payload admits." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = ["propext"] +axioms = [ + "propext", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/ExtensionLaw.lean" -sha256 = "bdd40e0557e17786ae30c05f8a15b1e4f3200e83e258f69c391994271cb86249" +artifact = "formal/Auths/Product/RecordTimesRefinement.lean" +sha256 = "bccf5548a11a064314084a8fde7e98280912d03a6cf8f99f8d6683ab217b770c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-162" -claim_text = "Lean proves the narrowing premise holds when each registered identifier's law is a lawful narrowing law." -claim_status = "proved" -lean_declaration = "Auths.Rich.ExtensionLawsNarrow.of_lawful" -lean_statement_sha256 = "131876b8431f7e185e96f5249b6329b058bd7a3ad1feac47caa1d72c5921c8a4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [] +claim_id = "AP-FORMAL-RICH-869" +claim_text = "Successful actual record time validation earns creation no later than update." +claim_status = "qualified" +lean_declaration = "Auths.Product.RecordTimes.Refinement.success_earns_order" +lean_statement_sha256 = "39b520e741eae5a1bb38df6e67b0715f252ba295df1f7e09d47439ba8a3eeb64" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::record_times_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23718,37 +276106,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23761,35 +276332,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual represented ConnectionState, two u64 timestamps and optional u64 revocation timestamp. The actual constructor/decoder validation consumes this predicate after unchanged allowlist checks." +residual_assumptions = [ + "Lean's kernel, pinned toolchain and permitted foundational axioms are trusted. No new external model, native axiom or expected-validity premise is introduced.", + "The complete record codec, all allowlist/resource checks, timestamp/caller projection and full runtime histories remain separate. Frozen full-record and actual canonical-decoder parity tests support the temporal validation cutover. These are integer/time-shape laws, not a proof of a physical clock.", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Rich target-V1 authority semantics over opaque identity carriers and extensional finite sets." -residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" -axioms = [] +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", +] [[claims.evidence]] kind = "lean-proof" -artifact = "formal/Auths/Rich/Semantics.lean" -sha256 = "af32de58b22ca8920782cf199d9e9391c897e1a455b9365e8f85ab4a24786c39" +artifact = "formal/Auths/Product/RecordTimesRefinement.lean" +sha256 = "bccf5548a11a064314084a8fde7e98280912d03a6cf8f99f8d6683ab217b770c" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-188" -claim_text = "The mechanically translated fact-name comparison returns exactly the model's String equality." +claim_id = "AP-FORMAL-RICH-870" +claim_text = "Successful actual record validation earns revocation timestamp presence exactly for revoked state and every present timestamp within the inclusive lifetime." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_fact_name_equal_refines_model" -lean_statement_sha256 = "6b15e1125bd960ce5bf8c3447e0587ceebd672e592a891b26bc2d5e68a9add5c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::fact_name_equal"] +lean_declaration = "Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape" +lean_statement_sha256 = "4cb19735c842786807d16971396a4cb7e59b0dbcd62ba26b7d2aca6ba3b487f6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::record_times_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23797,37 +276428,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23840,21 +276654,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "UTF-8 byte comparison of two fact names, bridged to String equality by UTF-8 injectivity." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual represented ConnectionState, two u64 timestamps and optional u64 revocation timestamp. The actual constructor/decoder validation consumes this predicate after unchanged allowlist checks." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned toolchain and permitted foundational axioms are trusted. No new external model, native axiom or expected-validity premise is introduced.", + "The complete record codec, all allowlist/resource checks, timestamp/caller projection and full runtime histories remain separate. Frozen full-record and actual canonical-decoder parity tests support the temporal validation cutover. These are integer/time-shape laws, not a proof of a physical clock.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -23864,28 +276721,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordTimesRefinement.lean" +sha256 = "bccf5548a11a064314084a8fde7e98280912d03a6cf8f99f8d6683ab217b770c" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-189" -claim_text = "The mechanically translated freshness predicate returns exactly the model's freshness over the u64 values." -claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_fresh_refines_model" -lean_statement_sha256 = "3db4557c386de7ea8812abdf9a330bc6a96432ce30daf16df94c060958d2673a" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::observation_fresh"] +claim_id = "AP-FORMAL-RICH-871" +claim_text = "The independent record-time model proves that the stated administrative state/time conditions preserve complete lifetime and revocation-timestamp validity." +claim_status = "proved" +lean_declaration = "Auths.Product.RecordTimes.Refinement.state_change_preserves_valid_time" +lean_statement_sha256 = "ed128ad84cc8da5a3c17ba7318a3ba132d450141bee8959eca010c40915466b0" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23893,37 +276750,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -23936,52 +276976,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The guarded u64 age subtraction, maximum age, and anchor validity window, for every u64 input." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every natural-number lifetime, optional revocation timestamp and actual state carrier satisfying the displayed independent before-state and administrative conditions. Separate source refinements earn those conditions; this does not claim the whole native caller was translated." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordTimesRefinement.lean" +sha256 = "bccf5548a11a064314084a8fde7e98280912d03a6cf8f99f8d6683ab217b770c" [[claims]] -claim_id = "AP-FORMAL-RICH-190" -claim_text = "The mechanically translated exact-subject comparison returns exactly the model's String equality." -claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_subject_equal_refines_model" -lean_statement_sha256 = "9b0aec23b54259d75ed186dbc7ef48d9e63bd0552e0a669478e2c95434501da4" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::observation_subject_equal"] +claim_id = "AP-FORMAL-RICH-872" +claim_text = "The independent record-time model proves that the stated administrative state/time conditions preserve complete lifetime and revocation-timestamp validity." +claim_status = "proved" +lean_declaration = "Auths.Product.RecordTimes.Refinement.data_change_preserves_valid_time" +lean_statement_sha256 = "d17b1edd2a77c67745ec9c0d4ab3974367c284d15fac7042f42d2e9cc43f5981" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -23989,37 +277058,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24032,52 +277284,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "UTF-8 byte comparison of the expected and observed resource, bridged to String equality." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every natural-number lifetime, optional revocation timestamp and actual state carrier satisfying the displayed independent before-state and administrative conditions. Separate source refinements earn those conditions; this does not claim the whole native caller was translated." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordTimesRefinement.lean" +sha256 = "bccf5548a11a064314084a8fde7e98280912d03a6cf8f99f8d6683ab217b770c" [[claims]] -claim_id = "AP-FORMAL-RICH-191" -claim_text = "The mechanically translated fact-value comparison returns exactly the model's equality of abstracted fact values." +claim_id = "AP-FORMAL-RICH-873" +claim_text = "The complete actual generic strict-order checker returns exactly the independent adjacent-chain scan for every slice under the displayed primitive comparator contract; empty/singleton behavior and every index are covered." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_fact_value_equal_refines_model" -lean_statement_sha256 = "c2e5d55a276fda45f44996688fa2ce37eba6a02c4af677e93f0438495cee4112" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::fact_value_equal"] +lean_declaration = "Auths.Product.StrictOrder.Refinement.strict_order_exact" +lean_statement_sha256 = "300d572568d9d1cfbfbe4a8df0069197fbfd009738d8ab6a75d42a0c1f030e8b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::strictly_sorted_unique"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24085,37 +277366,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24128,21 +277592,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Unsigned, byte-string, and text fact values, including every cross-type pair." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented slice and native Ord dictionary satisfying the displayed lower-level comparison contract. The no-duplicate consequence also requires the stated strict-order laws; no expected checker result or already-sorted input is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned toolchain, foundational axioms and displayed primitive comparator contract/laws are trusted. The entire Auths scan and index arithmetic are translated; no opaque iterator algorithm or new std model is introduced.", + "Closed String/profile comparator-instance correspondence, complete record bounds/text validity, actual caller projection and complete codec/runtime composition remain separate. Frozen native checks compare the two real comparators and full record/decoder behavior to the previous windows predicate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -24152,28 +277659,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/StrictOrderRefinement.lean" +sha256 = "36043ebbb151da3cbaff4fd7b491a9561c6e07a49218afc8934bd5d620f055f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-192" -claim_text = "The mechanically translated inclusive range test returns exactly the model's uintRange condition atom." +claim_id = "AP-FORMAL-RICH-874" +claim_text = "An accepted actual strict-order check earns no duplicates under the displayed primitive comparator meaning, transitivity and irreflexivity laws." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_uint_range_contains_refines_model" -lean_statement_sha256 = "a62d865cc0aed16965c3f48786e28f4eb056e75a8af68ea1b68a97d40dfcd81a" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::uint_range_contains"] +lean_declaration = "Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates" +lean_statement_sha256 = "7aa3ba65b3885075493ef5438d0752f1abea04fbdcf94399484a270f08d410df" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::strictly_sorted_unique"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24181,37 +277688,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24224,54 +277914,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The inclusive u64 range test on an observed unsigned value." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented slice and native Ord dictionary satisfying the displayed lower-level comparison contract. The no-duplicate consequence also requires the stated strict-order laws; no expected checker result or already-sorted input is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned toolchain, foundational axioms and displayed primitive comparator contract/laws are trusted. The entire Auths scan and index arithmetic are translated; no opaque iterator algorithm or new std model is introduced.", + "Closed String/profile comparator-instance correspondence, complete record bounds/text validity, actual caller projection and complete codec/runtime composition remain separate. Frozen native checks compare the two real comparators and full record/decoder behavior to the previous windows predicate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/StrictOrderRefinement.lean" +sha256 = "36043ebbb151da3cbaff4fd7b491a9561c6e07a49218afc8934bd5d620f055f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-193" -claim_text = "The mechanically translated membership loop returns exactly the model's member condition atom." -claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_member_values_contain_refines_model" -lean_statement_sha256 = "1a823612cdb0ab8b1dfa2561f4563a452c907691b7412a258ffee9c2538693e6" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::member_values_contain", - "auths_model::observation::fact_value_equal", -] +claim_id = "AP-FORMAL-RICH-875" +claim_text = "The independent adjacent-chain model earns global pairwise ordering and duplicate absence under the displayed primitive relation laws." +claim_status = "proved" +lean_declaration = "Auths.Product.StrictOrder.Refinement.ordered_implies_pairwise" +lean_statement_sha256 = "a03de256e8a21ec8216fe7d86901a18840fc94e13297989d33c79ac259e68f51" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24279,37 +278010,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24322,55 +278236,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating scan of a finite literal list for an observed fact value." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every list and Boolean comparison relation with the displayed transitivity/irreflexivity properties. This is a model law; separate source refinement earns the model predicate." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/StrictOrderRefinement.lean" +sha256 = "36043ebbb151da3cbaff4fd7b491a9561c6e07a49218afc8934bd5d620f055f0" [[claims]] -claim_id = "AP-FORMAL-RICH-194" -claim_text = "The mechanically translated fact lookup returns a value whose abstraction is exactly the model's lookupFact." -claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_fact_refines_model" -lean_statement_sha256 = "5f566de2f5bf7018c2f9a683d466d8bcc99d1bc88bd19f0467efb34fe40b1bfa" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_fact", - "auths_model::observation::fact_name_equal", -] +claim_id = "AP-FORMAL-RICH-876" +claim_text = "The independent adjacent-chain model earns global pairwise ordering and duplicate absence under the displayed primitive relation laws." +claim_status = "proved" +lean_declaration = "Auths.Product.StrictOrder.Refinement.ordered_implies_no_duplicates" +lean_statement_sha256 = "8eae962d91624e87ec1d32135780f759a022f2ff0918660275a735f75c7962a6" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = [] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24378,37 +278318,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24421,57 +278544,81 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating first-match scan of an observation's facts by name." -residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", -] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every list and Boolean comparison relation with the displayed transitivity/irreflexivity properties. This is a model law; separate source refinement earns the model predicate." +residual_assumptions = ["Lean's kernel, the pinned toolchain, the listed foundational axioms, and the theorem premises are trusted."] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" - -[[claims.evidence]] -kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" - -[[claims.evidence]] -kind = "source-closure" -artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +kind = "lean-proof" +artifact = "formal/Auths/Product/StrictOrderRefinement.lean" +sha256 = "36043ebbb151da3cbaff4fd7b491a9561c6e07a49218afc8934bd5d620f055f0" [[claims]] -claim_id = "AP-FORMAL-RICH-195" -claim_text = "The mechanically translated condition-atom evaluator returns exactly the model's valueHolds with the supplied action value." +claim_id = "AP-FORMAL-RICH-877" +claim_text = "The actual String comparison dictionary and complete strict-order scan refine String lexicographic order without a caller-supplied comparison or order-law premise." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_condition_value_holds_refines_model" -lean_statement_sha256 = "87c518e6cd6ddd3ab66a1acf9cb01dd6a8ed729895310f6dd6b0f36c871be3ed" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::condition_value_holds", - "auths_model::observation::fact_value_equal", - "auths_model::observation::uint_range_contains", - "auths_model::observation::member_values_contain", -] +lean_declaration = "Auths.Product.RecordShape.Refinement.text_order_exact" +lean_statement_sha256 = "869ac53a45980405349524856b0af8bb6a96d8bc481617412b6695f87e40e0ce" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::strictly_sorted_unique"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24479,37 +278626,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24522,21 +278852,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "All four condition atoms against a present or absent observed value and a present or absent action value." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -24546,35 +278919,30 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordShapeRefinement.lean" +sha256 = "f37358e9f9836f12e115bb2aba5ae6f1494db7f26b8226f96a6ed9e36523d7f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-196" -claim_text = "The mechanically translated named-condition evaluator returns exactly the model's valueHolds on the looked-up fact." +claim_id = "AP-FORMAL-RICH-878" +claim_text = "The actual derived profile comparison dictionary and complete strict-order scan refine lexicographic identifier-then-version order without a comparison or order-law premise." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_condition_holds_refines_model" -lean_statement_sha256 = "d5df152ab006c6eccea9e9e1d19a4b2bf4643f4a6629d2f0a89a5b9a3759ea72" -formal_review = "native-k-of-n-approvals-2026-09-30" +lean_declaration = "Auths.Product.RecordShape.Refinement.profile_order_exact" +lean_statement_sha256 = "e682447e1274ffab8f85e339e3715d3274bb4c3d3f18317ed4fafde3944f6936" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" rust_symbols = [ - "auths_model::observation::observation_condition_holds", - "auths_model::observation::observation_fact", - "auths_model::observation::fact_name_equal", - "auths_model::observation::condition_value_holds", - "auths_model::observation::fact_value_equal", - "auths_model::observation::uint_range_contains", - "auths_model::observation::member_values_contain", + "auths_connections::kernel::strictly_sorted_unique", + "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}::cmp", ] semantic_source_closure = [ "formal/Auths.lean", @@ -24583,37 +278951,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24626,21 +279177,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "One named condition over an observation's facts with its supplied action value." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -24650,37 +279244,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordShapeRefinement.lean" +sha256 = "f37358e9f9836f12e115bb2aba5ae6f1494db7f26b8226f96a6ed9e36523d7f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-197" -claim_text = "The mechanically translated condition conjunction returns exactly the model's conjunction over conditions paired with their action values, and false on a length mismatch." +claim_id = "AP-FORMAL-RICH-879" +claim_text = "The actual complete workload allowlist validator returns exactly nonempty bounded strict String ordering and printable-ASCII text validity on the represented UTF-8 carrier." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_model" -lean_statement_sha256 = "1693b5b82975dde2606b046c58afddf01ef58c6c6c4f973a1b0528dc99132810" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_conditions_hold", - "auths_model::observation::observation_condition_holds", - "auths_model::observation::observation_fact", - "auths_model::observation::fact_name_equal", - "auths_model::observation::condition_value_holds", - "auths_model::observation::fact_value_equal", - "auths_model::observation::uint_range_contains", - "auths_model::observation::member_values_contain", -] +lean_declaration = "Auths.Product.RecordShape.Refinement.workloads_exact" +lean_statement_sha256 = "a1e856cb0aef45650128546bc9d2bbb10f54c687d7318df9709a56e014b15de3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::workloads_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24688,37 +279273,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24731,21 +279499,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating conjunction loop over a condition slice and a parallel action-value slice." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -24755,28 +279566,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordShapeRefinement.lean" +sha256 = "f37358e9f9836f12e115bb2aba5ae6f1494db7f26b8226f96a6ed9e36523d7f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-198" -claim_text = "The mechanically translated condition conjunction rejects a condition list and action-value list of different lengths." +claim_id = "AP-FORMAL-RICH-880" +claim_text = "The actual complete profile allowlist validator returns exactly nonempty bounded strict identifier/version ordering, with no comparator premise." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_length_mismatch_fails_closed" -lean_statement_sha256 = "4ff3b4c45f16ea6a3db0d4e48e54202e20f11ce220a3fee37d426a5f55616eba" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::observation_conditions_hold"] +lean_declaration = "Auths.Product.RecordShape.Refinement.profiles_exact" +lean_statement_sha256 = "3eb01c16cb7085d356a56479cadc8213a6bbf43ca71251cd91d76b369d0cdc8f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::profiles_valid"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24784,37 +279595,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24827,21 +279821,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The length guard that precedes every condition evaluation." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -24851,37 +279888,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordShapeRefinement.lean" +sha256 = "f37358e9f9836f12e115bb2aba5ae6f1494db7f26b8226f96a6ed9e36523d7f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-199" -claim_text = "With action values drawn from the environment, the mechanically translated condition conjunction returns exactly the model's conditionsHold." +claim_id = "AP-FORMAL-RICH-881" +claim_text = "The composed validator called by ConnectionRecord::validate returns the exact workload/profile/timestamp verdict with native error precedence; success earns all displayed collection, text, duplicate-absence and temporal invariants." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_conditions_hold" -lean_statement_sha256 = "4d030ad8523e9b4e7031109a2d67e482fbb681b9424036d53496178523be7493" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_conditions_hold", - "auths_model::observation::observation_condition_holds", - "auths_model::observation::observation_fact", - "auths_model::observation::fact_name_equal", - "auths_model::observation::condition_value_holds", - "auths_model::observation::fact_value_equal", - "auths_model::observation::uint_range_contains", - "auths_model::observation::member_values_contain", -] +lean_declaration = "Auths.Product.RecordShape.Refinement.record_shape_exact" +lean_statement_sha256 = "057852fc7652c6b2d7991ce1e89fa149b39e501a16d789bba3fbc62f5137d91f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::validate_record_shape"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24889,37 +279917,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -24932,21 +280143,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The conjunction loop when each eqAction condition's supplied action value is the environment's action fact for its reference." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -24956,28 +280210,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordShapeRefinement.lean" +sha256 = "f37358e9f9836f12e115bb2aba5ae6f1494db7f26b8226f96a6ed9e36523d7f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-200" -claim_text = "The mechanically translated verdict combinator returns exactly the model's three-valued decision order." +claim_id = "AP-FORMAL-RICH-882" +claim_text = "The composed validator called by ConnectionRecord::validate returns the exact workload/profile/timestamp verdict with native error precedence; success earns all displayed collection, text, duplicate-absence and temporal invariants." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_requirement_verdict_refines_model" -lean_statement_sha256 = "3ca419beb07857d75b92c8fb57b48431a8db672f27ec1ac81c8a112a920b40d0" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::requirement_verdict"] +lean_declaration = "Auths.Product.RecordShape.Refinement.success_earns_all_invariants" +lean_statement_sha256 = "5120af7bd782ba4eb8d478a0278007634eeec0b84ca8410af8bc0db09759c688" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_connections::kernel::validate_record_shape"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -24985,37 +280239,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25028,51 +280465,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Satisfied before denied before indeterminate, for every pair of eligibility and satisfaction inputs." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Product/RecordShapeRefinement.lean" +sha256 = "f37358e9f9836f12e115bb2aba5ae6f1494db7f26b8226f96a6ed9e36523d7f0" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-201" -claim_text = "When every referenced action fact is available, the mechanically translated verdict over the model's eligibility and satisfaction is exactly requirementDecision." +claim_id = "AP-FORMAL-RICH-883" +claim_text = "The actual decoder constructor preserves the exact borrowed input and initializes its cursor to zero." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_requirement_verdict_refines_requirement_decision" -lean_statement_sha256 = "52a0068811cc19be5605093531410d061f617ca4f3b9a5b1f056d6949077f118" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::requirement_verdict"] +lean_declaration = "Auths.Codec.Cursor.new_exact" +lean_statement_sha256 = "08371385e5eb4614a8ed32e66663fabec5a5512859530e536f5531ffbe9fa0f4" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::new"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25080,37 +280561,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25123,51 +280787,95 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The per-requirement verdict when the requirement's action facts are available; unavailable action facts are indeterminate in the model." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", + "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-271" -claim_text = "The mechanically translated observer-anchor comparison returns exactly the model's String equality." +claim_id = "AP-FORMAL-RICH-884" +claim_text = "The actual explicit-cursor constructor accepts exactly positions at most the input length and preserves both fields." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observer_anchor_id_equal_refines_model" -lean_statement_sha256 = "564453fe589aab144b7c4696318d798cb9489197156d1ee8d88cc68ca4efca6d" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::observer_anchor_id_equal"] +lean_declaration = "Auths.Codec.Cursor.at_exact" +lean_statement_sha256 = "4a22d7575bedc08501aec164b9779808308e6980ee64cfbc80c2d6b4865a9a31" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::at"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25175,37 +280883,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25218,52 +281109,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "UTF-8 byte comparison of two observer-anchor identifiers, bridged to String equality." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-272" -claim_text = "The mechanically translated schema comparison returns exactly the model's String equality." +claim_id = "AP-FORMAL-RICH-885" +claim_text = "The actual position accessor returns exactly the stored cursor." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_schema_equal_refines_model" -lean_statement_sha256 = "4b027d678991524961d7103204315cda5f7af4cd88a06f875db770fbfc94bd83" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::observation::observation_schema_equal"] +lean_declaration = "Auths.Codec.Cursor.position_exact" +lean_statement_sha256 = "b35c9fa4df659963f97f8e98de57181b23dd99eaf8fe8c84e81c05468703aaaf" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::position"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25271,37 +281204,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25314,21 +281430,382 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "UTF-8 byte comparison of two observation-schema identifiers, bridged to String equality." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = ["propext"] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-886" +claim_text = "The actual typed-head decoder is total over every represented cursor and refines the independent byte grammar, exact decoded value, refusal cursor and preserved input." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Cursor.head_exact" +lean_statement_sha256 = "52e155eda6dba5eb46a3f536671e1edda44ef8b3a420427b6cc110565d614ed3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -25338,31 +281815,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-273" -claim_text = "The mechanically translated subject comparison returns exactly the model's equality of requirement subjects." +claim_id = "AP-FORMAL-RICH-887" +claim_text = "The actual unsigned-word reader refines the independent major-zero grammar and exact cursor/input behavior, including malformed and wrong-major heads." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_requirement_subject_equal_refines_model" -lean_statement_sha256 = "efbd6e09d1ed52b992044847b3a47c6f7f7bcea46410b284e140355071a4fb2a" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::requirement_subject_equal", - "auths_model::observation::fact_name_equal", -] +lean_declaration = "Auths.Codec.Cursor.u64_exact" +lean_statement_sha256 = "31241328183ef53462b073dfc79b8d977ab49f07a6671bddde30c1ff4f084b1d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25370,37 +281844,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25413,21 +282070,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Literal-resource and action-fact subjects, including every cross-kind pair." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -25437,31 +282137,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-274" -claim_text = "The mechanically translated membership-list comparison returns exactly the model's positional equality of abstracted values." +claim_id = "AP-FORMAL-RICH-888" +claim_text = "The actual u8 reader accepts exactly grammar-decoded words within 255 and preserves the consumed head cursor even when narrowing refuses." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_member_values_equal_refines_model" -lean_statement_sha256 = "5c5ad163115e51cbe1d70ccb962047e73e69ff7fa94111d0187ce2429a83d0bb" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::member_values_equal", - "auths_model::observation::fact_value_equal", -] +lean_declaration = "Auths.Codec.Cursor.u8_exact" +lean_statement_sha256 = "b7225c6927fe89fc4b07cbabf31681508aa8c576e154a7529c97967f2b6080d8" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25469,37 +282166,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25512,21 +282392,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The length guard and the terminating positional loop over two finite literal lists." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -25536,33 +282459,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-275" -claim_text = "The mechanically translated condition-atom comparison returns exactly the model's equality of condition atoms over one fact name." +claim_id = "AP-FORMAL-RICH-889" +claim_text = "The actual u16 reader accepts exactly grammar-decoded words within 65535 and preserves the consumed head cursor even when narrowing refuses." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_condition_test_equal_refines_model" -lean_statement_sha256 = "e3c6bf03b6853dbedee9fb11e2a4c93c599b64f24f59ae7a13cf742af8c07df3" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::condition_test_equal", - "auths_model::observation::fact_value_equal", - "auths_model::observation::fact_name_equal", - "auths_model::observation::member_values_equal", -] +lean_declaration = "Auths.Codec.Cursor.u16_exact" +lean_statement_sha256 = "963df08424d9f28c2c2ad76c8c9f8cd64343c10f7039e990848160c0762d94f5" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u16"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25570,37 +282488,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25613,21 +282714,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "All four condition atoms, including every cross-atom pair." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -25637,32 +282781,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-276" -claim_text = "The mechanically translated condition comparison returns exactly the model's equality of abstracted conditions." +claim_id = "AP-FORMAL-RICH-890" +claim_text = "The actual null reader accepts exactly the CBOR null byte, advances by one only on success and preserves the input." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_condition_equal_refines_model" -lean_statement_sha256 = "44b638fa8228688cc4f4d77ad87bd9fbaf9a9b2eb037cb846e62d8caa6611447" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_condition_equal", - "auths_model::observation::fact_name_equal", - "auths_model::observation::condition_test_equal", -] +lean_declaration = "Auths.Codec.Cursor.null_exact" +lean_statement_sha256 = "57cc72430a78d1a41da40bb524d1c6e6db68d0f9db5fdd9156d0244a6be0fb18" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::null"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25670,37 +282810,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25713,21 +283036,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The fact name and the condition atom of two named conditions." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -25737,31 +283103,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-277" -claim_text = "The mechanically translated containment loop returns exactly the model's membership of the abstracted condition." +claim_id = "AP-FORMAL-RICH-891" +claim_text = "The actual first-byte query returns exactly the independent major/additional-tag classification for every byte; it does not establish availability or validity of a complete head or payload." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_contain_refines_model" -lean_statement_sha256 = "688fb6edaf3b5e37be4d7823f1fc273e24a61e7299d2ef3eb0ef9b877159c9b2" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_conditions_contain", - "auths_model::observation::observation_condition_equal", -] +lean_declaration = "Auths.Codec.Cursor.datatype_exact" +lean_statement_sha256 = "835a8190eba1b3d390bba40533b531bd1956724ce912df1b9c970521e077dbae" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::datatype"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25769,37 +283132,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25812,21 +283358,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating scan of a condition slice for one condition." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -25836,32 +283425,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-278" -claim_text = "The mechanically translated inclusion loop returns exactly the model's inclusion of condition atoms." +claim_id = "AP-FORMAL-RICH-892" +claim_text = "The actual completion guard accepts exactly cursor equality with the explicitly supplied input length and otherwise returns Malformed; input identity is a separate caller obligation." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_include_refines_model" -lean_statement_sha256 = "96280dce9a82d09c459e502cdd7dc12f413aedb86d6846eeee90627795910722" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_conditions_include", - "auths_model::observation::observation_conditions_contain", - "auths_model::observation::observation_condition_equal", -] +lean_declaration = "Auths.Codec.Cursor.ensure_complete_exact" +lean_statement_sha256 = "a12143f383783f4f358e9f4b4d2e16a19f7962f7797773fbcae83b999da1e53f" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::ensure_complete"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25869,37 +283454,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -25912,55 +283680,94 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every atom of the wider slice occurring in the narrower slice, compared as a set of canonical atoms." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ "propext", - "Classical.choice", "Quot.sound", ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Cursor.lean" +sha256 = "e5c938c4e24a51fed21d986fd8e0e4dfb7b4ffe1603868008f946cacb14cebd4" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-279" -claim_text = "The mechanically translated condition-list comparison returns exactly the model's positional equality of abstracted conditions." +claim_id = "AP-FORMAL-RICH-893" +claim_text = "The actual payload reader returns exactly the grammar-selected contiguous bytes and cursor, including failed length conversion, addition overflow and truncated payloads." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_conditions_equal_refines_model" -lean_statement_sha256 = "a235b885de3a11bd2db81a9b91c30f0a03082254b03dbb20cc561af3fb304eff" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_conditions_equal", - "auths_model::observation::observation_condition_equal", -] +lean_declaration = "Auths.Codec.Payload.payload_exact" +lean_statement_sha256 = "6d07d4480a54d65314a8e7e7a1831545755f7d03eb22257ac322a46a29d91752" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -25968,37 +283775,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26011,21 +284001,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The length guard and the terminating positional loop over two condition slices." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26035,33 +284068,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Payload.lean" +sha256 = "5423ce90050bf40dfee70ed74f989150f5d64066406095c4aff51a0c67f2c2ef" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-280" -claim_text = "The mechanically translated same-target check returns exactly the model's sameTarget." +claim_id = "AP-FORMAL-RICH-894" +claim_text = "The actual byte-string reader returns exactly the definite major-two payload and its source cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_same_target_refines_model" -lean_statement_sha256 = "b79e3eaa4bb4270a1d44d9c62d457e4b3e396250ac36588a79068cd2d513e84b" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_requirement_same_target", - "auths_model::observation::observer_anchor_id_equal", - "auths_model::observation::observation_schema_equal", - "auths_model::observation::requirement_subject_equal", -] +lean_declaration = "Auths.Codec.Payload.bytes_exact" +lean_statement_sha256 = "181a8b8c1aa8e7979978dac88412db9135b565c45f152d1e2dd2bf7877563bbb" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::bytes"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26069,37 +284097,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26112,21 +284323,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The observer anchor, schema, and subject of two requirements." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26136,32 +284390,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Payload.lean" +sha256 = "5423ce90050bf40dfee70ed74f989150f5d64066406095c4aff51a0c67f2c2ef" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-281" -claim_text = "The mechanically translated requirement comparison returns exactly the model's equality of abstracted requirements." +claim_id = "AP-FORMAL-RICH-895" +claim_text = "The actual text reader returns exactly the definite major-three payload accepted by the explicit UTF-8 primitive contract, preserving cursor behavior on UTF-8 refusal." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_equal_refines_model" -lean_statement_sha256 = "f78c2bb3bae9cdc9b1fb76d183c691737066bcc4ee4781fac6b82b335bba184c" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_requirement_equal", - "auths_model::observation::observation_requirement_same_target", - "auths_model::observation::observation_conditions_equal", -] +lean_declaration = "Auths.Codec.Payload.str_exact" +lean_statement_sha256 = "ac65e38efacdec97f9c75fd2a2e62025c9071b638ff1a25f43295ecae34fc285" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26169,37 +284419,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26212,21 +284645,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The target, the u64 maximum age, and the positional condition list of two requirements." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26236,32 +284712,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Payload.lean" +sha256 = "5423ce90050bf40dfee70ed74f989150f5d64066406095c4aff51a0c67f2c2ef" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-282" -claim_text = "The mechanically translated narrowing check returns exactly the model's narrows." +claim_id = "AP-FORMAL-RICH-896" +claim_text = "Actual payload acceptance earns the exact contiguous source span, requested length, final cursor and input bounds without a successful-parse premise." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_narrows_refines_model" -lean_statement_sha256 = "46ad4c556c162406b17661c87f1e1d246d960a3be471a4441a81012ba12711c1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_requirement_narrows", - "auths_model::observation::observation_requirement_same_target", - "auths_model::observation::observation_conditions_include", -] +lean_declaration = "Auths.Codec.Payload.success_earns_span" +lean_statement_sha256 = "c7a85878263086deb2b8cbb325a865aafeb33f1c7ed918c25e27a84a35e2821d" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26269,37 +284741,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26312,21 +284967,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The same target, a maximum age no larger, a superset of condition atoms, and a strictly narrower age or atom set." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26336,32 +285034,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Payload.lean" +sha256 = "5423ce90050bf40dfee70ed74f989150f5d64066406095c4aff51a0c67f2c2ef" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-283" -claim_text = "The mechanically translated cover check returns exactly the model's covers." +claim_id = "AP-FORMAL-RICH-897" +claim_text = "For every valid CBOR major tag, the actual collection reader exactly distinguishes malformed input, indefinite collection heads and definite lengths with exact cursor/input preservation." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_covers_refines_model" -lean_statement_sha256 = "9cbb882a6b66b35880cbb5fbb594262a8d665894b107bc8681332665bc3efc21" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_requirement_covers", - "auths_model::observation::observation_requirement_equal", - "auths_model::observation::observation_requirement_narrows", -] +lean_declaration = "Auths.Codec.Collection.collection_exact" +lean_statement_sha256 = "18c575e709ad19a568b328b4e48191c88c8527ffe3b00e28196b63a7c429af6b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26369,37 +285063,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26412,21 +285289,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "An identical requirement or a strict narrowing." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26436,31 +285356,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Collection.lean" +sha256 = "3201d744fe017f36140642bb24ee6ec2dd5601db14435501624a2d677270a911" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-284" -claim_text = "The mechanically translated retention loop returns exactly the model's existence of a covering child requirement." +claim_id = "AP-FORMAL-RICH-898" +claim_text = "The actual raw map-head reader refines the independent collection grammar, including its indefinite form and exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_requirement_retained_refines_model" -lean_statement_sha256 = "db23559560127b12376f178ce5a707aead02785eb5451e8aea0616a02d40e4a2" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_requirement_retained", - "auths_model::observation::observation_requirement_covers", -] +lean_declaration = "Auths.Codec.Collection.map_exact" +lean_statement_sha256 = "9f79f77010142df5a655e2f991b62e9f08240d51ef518b42ef727757644f483a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26468,37 +285385,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26511,21 +285611,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating scan of a child requirement list for one parent requirement." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26535,34 +285678,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Collection.lean" +sha256 = "3201d744fe017f36140642bb24ee6ec2dd5601db14435501624a2d677270a911" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-285" -claim_text = "The mechanically translated observation-requirement attenuation law returns exactly the model's requirementsAttenuate." +claim_id = "AP-FORMAL-RICH-899" +claim_text = "The actual raw array-head reader refines the independent collection grammar, including its indefinite form and exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Observation.translated_observation_requirements_attenuate_refines_model" -lean_statement_sha256 = "e1c90caefc8cea86b905fce1bdaaaf489a1f64bcb46e2d9645a41268a45dd683" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::observation::observation_requirements_attenuate", - "auths_model::observation::observation_requirement_retained", - "auths_model::observation::observation_requirement_covers", - "auths_model::observation::observation_requirement_narrows", - "auths_model::observation::observation_requirement_equal", -] +lean_declaration = "Auths.Codec.Collection.array_exact" +lean_statement_sha256 = "d1d16225cf49fcc360e864e086cb6926f915fc718e2edb41ce8c048beb71854a" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26570,37 +285707,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26613,21 +285933,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every parent requirement covered by some child requirement, over requirement lists of any length." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared text fits the u32 UTF-8 byte bound) are trusted.", - "Observation signature verification, CBOR decoding, the subject namespace matcher, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26637,28 +286000,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Observation.lean" -sha256 = "e4a2990b64ac6ca113fa89aee9671b1086fa9a7e706539f11eac739eef461b38" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Collection.lean" +sha256 = "3201d744fe017f36140642bb24ee6ec2dd5601db14435501624a2d677270a911" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-306" -claim_text = "The mechanically translated approver verdict returns exactly the model's approverVerdict over the abstracted outcomes." +claim_id = "AP-FORMAL-RICH-900" +claim_text = "The actual field-key reader returns exactly Malformed, NonCanonical or success according to the independently decoded bounded integer and expected key, with exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_approver_verdict_refines_model" -lean_statement_sha256 = "96a93cb521f7ceee6550abe06fd102d42204467d4c97e1c0b2d19a4175f035c9" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::approval::approver_verdict"] +lean_declaration = "Auths.Codec.Fields.key_exact" +lean_statement_sha256 = "939122d4f0d2e51338528b56ec90bf47fe534f276d79655cc06967da59d158a3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::key"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26666,37 +286029,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26709,21 +286255,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating scan of per-approval outcomes for one approver: counted when some outcome is counted, pending when none is and some is pending, ignored otherwise." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26733,31 +286322,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-307" -claim_text = "The mechanically translated distinct counting returns exactly the model's counted and pending approver counts, whose threshold decision is the model's decideCounts." +claim_id = "AP-FORMAL-RICH-901" +claim_text = "The actual protocol map guard accepts exactly a definite head with the required field count and otherwise returns Malformed with exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_approval_counts_refines_model" -lean_statement_sha256 = "36686ea58c4b0815ecfc6c85715c734d24d3273b4956ce66d58aaffa2abc5f54" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::approval::approval_counts", - "auths_model::approval::approver_verdict", -] +lean_declaration = "Auths.Codec.Fields.map_exact" +lean_statement_sha256 = "9a5a3f314c93434dd43f5935c7815bf82d916ddc4db33fe96caaf3c6d872f03c" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::map"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26765,37 +286351,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26808,21 +286577,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating loop over a requirement's listed approvers, each counted once, for every outcome list and every u16 threshold." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26832,28 +286644,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-308" -claim_text = "The mechanically translated principal-list membership returns exactly the model's list membership." +claim_id = "AP-FORMAL-RICH-902" +claim_text = "The actual protocol text helper returns exactly the decoded UTF-8 bytes or Malformed with exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model" -lean_statement_sha256 = "9c377995783f05529ff05f6655022584e0f6669d7acdf3ef1e57014e25ee1ec0" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = ["auths_model::approval::principal_ids_contain"] +lean_declaration = "Auths.Codec.Fields.text_exact" +lean_statement_sha256 = "01ceb16026fa2d9a9ff570bfa5328d8dadad4e0198e87f895a9849d6f792e45b" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::text"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26861,37 +286673,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -26904,21 +286899,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating scan of a principal slice for one principal, compared by UTF-8 bytes bridged to String equality." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -26928,31 +286966,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-309" -claim_text = "The mechanically translated principal-list inclusion returns exactly the model's list subset." +claim_id = "AP-FORMAL-RICH-903" +claim_text = "The actual protocol null helper accepts exactly the CBOR null byte and maps primitive refusal to Malformed with exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model" -lean_statement_sha256 = "77c6b790409d4c2e7277d80217281bba70f67e6f21a3a23841c3110dd625f36f" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::approval::principal_ids_subset", - "auths_model::approval::principal_ids_contain", -] +lean_declaration = "Auths.Codec.Fields.null_exact" +lean_statement_sha256 = "a1af1cd72e624100fdabdaabce47d127c32bb1d27845f307528c793cd424f0fe" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::null"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -26960,37 +286995,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -27003,21 +287221,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every principal of the narrower slice occurring in the wider slice." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -27027,32 +287288,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-310" -claim_text = "The mechanically translated cover check returns exactly the model's covers: approvers a subset and a threshold no lower." +claim_id = "AP-FORMAL-RICH-904" +claim_text = "The actual optional-field null query exactly refines the independent first-byte type query and maps missing input to Malformed." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model" -lean_statement_sha256 = "f36b9195ab1f24fad69a6deccc01d1f9895b7803fdf243dd948595f4744f73f7" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::approval::approval_requirement_covers", - "auths_model::approval::principal_ids_subset", - "auths_model::approval::principal_ids_contain", -] +lean_declaration = "Auths.Codec.Fields.is_null_exact" +lean_statement_sha256 = "932a7768501edb01ceb10e552936569eec31cd9fc77573af603e11c601b1e260" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::is_null"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -27060,37 +287317,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -27103,21 +287543,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "One child and one parent approval requirement." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -27127,31 +287610,28 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-311" -claim_text = "The mechanically translated retention loop returns exactly the model's existence of a covering child requirement." +claim_id = "AP-FORMAL-RICH-905" +claim_text = "The actual protocol array guard accepts exactly definite lengths within its supplied bound, rejects indefinite or malformed heads as Malformed, and rejects excessive lengths as LimitExceeded." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model" -lean_statement_sha256 = "3b4e9f2ae9beff66fef142c2ebefc11dd86bd65202950c55914458bff46d6c8a" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::approval::approval_requirement_retained", - "auths_model::approval::approval_requirement_covers", -] +lean_declaration = "Auths.Codec.Fields.array_exact" +lean_statement_sha256 = "23416c9cec2193bd80f67d58446b8d2e4cdb64e64233d91c5c04420b41c7ccb3" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::array"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -27159,37 +287639,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -27202,21 +287865,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "The terminating scan of a child requirement list for one parent requirement." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -27226,33 +287932,350 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" [[claims]] -claim_id = "AP-FORMAL-RICH-312" -claim_text = "The mechanically translated approval-requirement-v1 attenuation law returns exactly the model's requirementsAttenuate." +claim_id = "AP-FORMAL-RICH-906" +claim_text = "The actual bounded-byte helper returns an exact owned copy only within the supplied size and nonempty requirements, preserving Malformed versus LimitExceeded and exact cursor/input behavior." claim_status = "qualified" -lean_declaration = "Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model" -lean_statement_sha256 = "4eab09e98c4ff9d49768010b51dad1f0e7f5807c9899733a5ead580f7dc797c1" -formal_review = "native-k-of-n-approvals-2026-09-30" -rust_symbols = [ - "auths_model::approval::approval_requirements_attenuate", - "auths_model::approval::approval_requirement_retained", - "auths_model::approval::approval_requirement_covers", - "auths_model::approval::principal_ids_subset", +lean_declaration = "Auths.Codec.Fields.bounded_bytes_exact" +lean_statement_sha256 = "4040c3743bda352f96d9e241cc8f5b5044ce5b151f5b0ae846fbe7a0d0814ace" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::bounded_bytes"] +semantic_source_closure = [ + "formal/Auths.lean", + "formal/Auths/Approval.lean", + "formal/Auths/AssuranceAudit.lean", + "formal/Auths/Attenuation.lean", + "formal/Auths/Authority.lean", + "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", + "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", + "formal/Auths/Diversity.lean", + "formal/Auths/ExtensionLaw.lean", + "formal/Auths/Generated/Algebra.lean", + "formal/Auths/Lifecycle/Refinement.lean", + "formal/Auths/Lifecycle/Semantics.lean", + "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", + "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", + "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", + "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", + "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", + "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", + "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", + "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", + "formal/Auths/Product/Refinement.lean", + "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", + "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", + "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", + "formal/Auths/Product/RelativeCeiling.lean", + "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", + "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", + "formal/Auths/Product/Theorems.lean", + "formal/Auths/Product/Tightening.lean", + "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", + "formal/Auths/Refinement/Observation.lean", + "formal/Auths/Refinement/Production.lean", + "formal/Auths/Rich/Mutations.lean", + "formal/Auths/Rich/Semantics.lean", + "formal/Auths/Rich/Theorems.lean", + "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", + "formal/algebra-contract-v1.toml", + "formal/lake-manifest.json", + "formal/lakefile.toml", + "formal/lean-toolchain", + "formal/qualification/aeneas/generated/algebra/Funs.lean", + "formal/qualification/aeneas/generated/algebra/Types.lean", + "formal/qualification/aeneas/generated/authority/Funs.lean", + "formal/qualification/aeneas/generated/authority/FunsExternal.lean", + "formal/qualification/aeneas/generated/authority/Types.lean", + "formal/qualification/aeneas/generated/authority/TypesExternal.lean", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", + "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/Types.lean", + "formal/qualification/aeneas/generated/lifecycle/Funs.lean", + "formal/qualification/aeneas/generated/lifecycle/Types.lean", + "formal/qualification/aeneas/generated/model/Funs.lean", + "formal/qualification/aeneas/generated/model/FunsExternal.lean", + "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", +] +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." +residual_assumptions = [ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", +] +toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" +axioms = [ + "propext", + "Classical.choice", + "Quot.sound", ] + +[[claims.evidence]] +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" + +[[claims.evidence]] +kind = "mechanical-translation" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" + +[[claims.evidence]] +kind = "source-closure" +artifact = "formal/qualification/aeneas/source-closure.json" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" + +[[claims]] +claim_id = "AP-FORMAL-RICH-907" +claim_text = "The actual digest-byte helper accepts exactly a definite 32-byte payload and preserves its exact bytes, cursor and Malformed refusals." +claim_status = "qualified" +lean_declaration = "Auths.Codec.Fields.digest_bytes_exact" +lean_statement_sha256 = "1012b2685e853f33acccb7166c35eccf56247ec01e6b61edcc71e7cc9e97a055" +formal_review = "ap-spec-069-payload-and-fields-2026-10-17" +rust_symbols = ["auths_codec::decode::digest_bytes"] semantic_source_closure = [ "formal/Auths.lean", "formal/Auths/Approval.lean", @@ -27260,37 +288283,220 @@ semantic_source_closure = [ "formal/Auths/Attenuation.lean", "formal/Auths/Authority.lean", "formal/Auths/Base.lean", + "formal/Auths/Codec/Action.lean", + "formal/Auths/Codec/ActionValidity.lean", + "formal/Auths/Codec/ByteFields.lean", + "formal/Auths/Codec/Collection.lean", + "formal/Auths/Codec/Constructors.lean", + "formal/Auths/Codec/Cursor.lean", + "formal/Auths/Codec/Encoder.lean", + "formal/Auths/Codec/Evaluation.lean", + "formal/Auths/Codec/Examples.lean", + "formal/Auths/Codec/Fields.lean", + "formal/Auths/Codec/Payload.lean", + "formal/Auths/Codec/PrincipalConstructor.lean", + "formal/Auths/Codec/PrincipalScheme.lean", + "formal/Auths/Codec/PrincipalSchemeModel.lean", + "formal/Auths/Codec/Refinement.lean", + "formal/Auths/Codec/ScopeConsequences.lean", + "formal/Auths/Codec/ScopeConstructor.lean", + "formal/Auths/Codec/ScopeDecodeExamples.lean", + "formal/Auths/Codec/ScopeDecodeSafety.lean", + "formal/Auths/Codec/ScopeDecodedUse.lean", + "formal/Auths/Codec/ScopeDuplicate.lean", + "formal/Auths/Codec/ScopeExamples.lean", + "formal/Auths/Codec/ScopeLoop.lean", + "formal/Auths/Codec/ScopeModel.lean", + "formal/Auths/Codec/ScopeSelectors.lean", + "formal/Auths/Codec/ScopeSort.lean", + "formal/Auths/Codec/ScopeTrustCollection.lean", + "formal/Auths/Codec/ScopeTrustSafety.lean", + "formal/Auths/Codec/ScopeTrustSelectors.lean", + "formal/Auths/Codec/Semantics.lean", + "formal/Auths/Codec/String.lean", "formal/Auths/Composition.lean", + "formal/Auths/Composition/Bounds.lean", + "formal/Auths/Composition/Collect.lean", + "formal/Auths/Composition/Diagnostics.lean", + "formal/Auths/Composition/Examples.lean", + "formal/Auths/Composition/Facade.lean", + "formal/Auths/Composition/FacadeExamples.lean", + "formal/Auths/Composition/IteratorFacts.lean", + "formal/Auths/Composition/Model.lean", + "formal/Auths/Composition/Order.lean", + "formal/Auths/Composition/Plan.lean", + "formal/Auths/Composition/PlanExamples.lean", + "formal/Auths/Composition/Refinement.lean", + "formal/Auths/Composition/SetModel.lean", + "formal/Auths/Composition/Traversal.lean", + "formal/Auths/Composition/ValidationCapacity.lean", + "formal/Auths/Composition/ValidationComplete.lean", + "formal/Auths/Composition/ValidationContract.lean", + "formal/Auths/Composition/ValidationExamples.lean", + "formal/Auths/Composition/ValidationLeaves.lean", + "formal/Auths/Composition/ValidationModel.lean", + "formal/Auths/Composition/ValidationProgress.lean", + "formal/Auths/Composition/ValidationPublic.lean", + "formal/Auths/Composition/ValidationRefinement.lean", + "formal/Auths/Composition/ValidationShape.lean", + "formal/Auths/Composition/ValidationSoundness.lean", + "formal/Auths/Composition/Work.lean", + "formal/Auths/Composition/Wrapper.lean", + "formal/Auths/Crypto/BufferAllocation.lean", + "formal/Auths/Crypto/CommitmentExamples.lean", + "formal/Auths/Crypto/CommitmentFrames.lean", + "formal/Auths/Crypto/CommitmentRefinement.lean", + "formal/Auths/Crypto/CommitmentValidity.lean", + "formal/Auths/Crypto/Encoding/Byte.lean", + "formal/Auths/Crypto/Encoding/Coordinate.lean", + "formal/Auths/Crypto/Encoding/Digits.lean", + "formal/Auths/Crypto/Encoding/Ed25519.lean", + "formal/Auths/Crypto/Encoding/Encoded.lean", + "formal/Auths/Crypto/Encoding/Examples.lean", + "formal/Auths/Crypto/Encoding/Flags.lean", + "formal/Auths/Crypto/Encoding/P256.lean", + "formal/Auths/Crypto/Encoding/RootFlags.lean", + "formal/Auths/Crypto/Encoding/Scan.lean", + "formal/Auths/Crypto/Endian.lean", + "formal/Auths/Crypto/Examples.lean", + "formal/Auths/Crypto/Framing.lean", + "formal/Auths/Crypto/FramingTotality.lean", + "formal/Auths/Crypto/NativeContract.lean", + "formal/Auths/Crypto/NativeExamples.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "formal/Auths/Crypto/P256Encoding.lean", + "formal/Auths/Crypto/P256Examples.lean", + "formal/Auths/Crypto/P256LowContract.lean", + "formal/Auths/Crypto/P256LowScan.lean", + "formal/Auths/Crypto/P256Native.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/Auths/Crypto/Refinement.lean", + "formal/Auths/Crypto/Sha256Examples.lean", + "formal/Auths/Crypto/Sha256Native.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/Auths/Crypto/Strict/Acceptance.lean", + "formal/Auths/Crypto/Strict/ByteLex.lean", + "formal/Auths/Crypto/Strict/CoordinateContract.lean", + "formal/Auths/Crypto/Strict/CoordinateModel.lean", + "formal/Auths/Crypto/Strict/CoordinateScan.lean", + "formal/Auths/Crypto/Strict/Examples.lean", + "formal/Auths/Crypto/Strict/LowContract.lean", + "formal/Auths/Crypto/Strict/LowScan.lean", + "formal/Auths/Crypto/Strict/RContract.lean", + "formal/Auths/Crypto/Strict/SourceAcceptance.lean", + "formal/Auths/Crypto/Strict/SuiteModel.lean", + "formal/Auths/Crypto/Strict/SuiteRefinement.lean", + "formal/Auths/Crypto/Strict/WeakContract.lean", + "formal/Auths/Crypto/SuiteAdapterExamples.lean", + "formal/Auths/Crypto/SuiteAdapters.lean", "formal/Auths/Diversity.lean", "formal/Auths/ExtensionLaw.lean", "formal/Auths/Generated/Algebra.lean", "formal/Auths/Lifecycle/Refinement.lean", "formal/Auths/Lifecycle/Semantics.lean", "formal/Auths/Lifecycle/Theorems.lean", + "formal/Auths/Model/IdentifierSemantics.lean", + "formal/Auths/Model/IdentifierString.lean", "formal/Auths/Observation.lean", + "formal/Auths/Product/AdmissionExamples.lean", + "formal/Auths/Product/AdmissionHistory.lean", + "formal/Auths/Product/AdmissionOwnership.lean", "formal/Auths/Product/Arithmetic.lean", + "formal/Auths/Product/BoundedClaimHistory.lean", "formal/Auths/Product/CeilingCount.lean", + "formal/Auths/Product/CollectionFence.lean", "formal/Auths/Product/Commitment.lean", + "formal/Auths/Product/ConnectionBytes.lean", + "formal/Auths/Product/ConnectionBytesRefinement.lean", + "formal/Auths/Product/ConnectionEntry.lean", + "formal/Auths/Product/ConnectionEntryRefinement.lean", + "formal/Auths/Product/ConnectionFrame.lean", + "formal/Auths/Product/ConnectionFrameRefinement.lean", "formal/Auths/Product/ConnectionGenerations.lean", + "formal/Auths/Product/CounterAggregation.lean", + "formal/Auths/Product/CounterAggregationRefinement.lean", + "formal/Auths/Product/CounterFrames.lean", + "formal/Auths/Product/CounterRefinement.lean", "formal/Auths/Product/Eligibility.lean", + "formal/Auths/Product/EntryDeadline.lean", + "formal/Auths/Product/Frontier/Model.lean", + "formal/Auths/Product/Frontier/Refinement.lean", + "formal/Auths/Product/OperationIdentity.lean", + "formal/Auths/Product/ProfileConstructorRefinement.lean", + "formal/Auths/Product/RecordShapeRefinement.lean", + "formal/Auths/Product/RecordTimesRefinement.lean", "formal/Auths/Product/Recovery.lean", + "formal/Auths/Product/RecoveryGateRefinement.lean", "formal/Auths/Product/Refinement.lean", "formal/Auths/Product/Refinement/BoundedPolicy.lean", + "formal/Auths/Product/Refinement/ByteIdentity.lean", + "formal/Auths/Product/Refinement/CollectionFence.lean", "formal/Auths/Product/Refinement/Connections.lean", + "formal/Auths/Product/Refinement/EntryDeadline.lean", "formal/Auths/Product/Refinement/Gateway.lean", + "formal/Auths/Product/Refinement/OperationIdentity.lean", + "formal/Auths/Product/Refinement/SchemaIndex.lean", "formal/Auths/Product/RelativeCeiling.lean", "formal/Auths/Product/RequestConstruction.lean", + "formal/Auths/Product/ReservationAdmission.lean", + "formal/Auths/Product/ReservationAdmissionRefinement.lean", + "formal/Auths/Product/ReservationRetry.lean", + "formal/Auths/Product/ReservationRetryRefinement.lean", + "formal/Auths/Product/SchemaIndex.lean", + "formal/Auths/Product/SemanticId.lean", + "formal/Auths/Product/SemanticIdRefinement.lean", + "formal/Auths/Product/SlotBatch.lean", + "formal/Auths/Product/SlotBatchRefinement.lean", + "formal/Auths/Product/SlotRecord.lean", + "formal/Auths/Product/SlotRecordRefinement.lean", + "formal/Auths/Product/StrictOrderRefinement.lean", + "formal/Auths/Product/StringConstructorsRefinement.lean", "formal/Auths/Product/SubmitOrder.lean", + "formal/Auths/Product/SumAggregation.lean", + "formal/Auths/Product/SumAggregationRefinement.lean", "formal/Auths/Product/Theorems.lean", "formal/Auths/Product/Tightening.lean", "formal/Auths/Refinement/Approval.lean", + "formal/Auths/Refinement/Identifier.lean", "formal/Auths/Refinement/Observation.lean", "formal/Auths/Refinement/Production.lean", "formal/Auths/Rich/Mutations.lean", "formal/Auths/Rich/Semantics.lean", "formal/Auths/Rich/Theorems.lean", "formal/Auths/Rich/Types.lean", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", "formal/Auths/Theorems.lean", + "formal/Auths/Verifier/StatusAdequacy.lean", + "formal/Auths/Verifier/StatusAlgebra.lean", + "formal/Auths/Verifier/StatusAllViews.lean", + "formal/Auths/Verifier/StatusAnchorExamples.lean", + "formal/Auths/Verifier/StatusAnchorVisibility.lean", + "formal/Auths/Verifier/StatusExamples.lean", + "formal/Auths/Verifier/StatusFloor.lean", + "formal/Auths/Verifier/StatusFold.lean", + "formal/Auths/Verifier/StatusGrant.lean", + "formal/Auths/Verifier/StatusGrantLeaves.lean", + "formal/Auths/Verifier/StatusIndependent.lean", + "formal/Auths/Verifier/StatusLatest.lean", + "formal/Auths/Verifier/StatusLeaves.lean", + "formal/Auths/Verifier/StatusModel.lean", + "formal/Auths/Verifier/StatusPublic.lean", + "formal/Auths/Verifier/StatusSearchContains.lean", + "formal/Auths/Verifier/StatusSearchFound.lean", + "formal/Auths/Verifier/StatusSearchLoop.lean", + "formal/Auths/Verifier/StatusSelection.lean", + "formal/Auths/Verifier/StatusSemantics.lean", + "formal/Auths/Verifier/StatusSummary.lean", + "formal/Auths/Verifier/StatusVisibility.lean", + "formal/Auths/Verifier/TemporalAssurance.lean", + "formal/Auths/Verifier/TemporalConsequences.lean", + "formal/Auths/Verifier/TemporalExamples.lean", + "formal/Auths/Verifier/TemporalModel.lean", + "formal/Auths/Verifier/TemporalNative.lean", + "formal/Auths/Verifier/TemporalProperties.lean", + "formal/Auths/Verifier/TemporalStatus.lean", "formal/algebra-contract-v1.toml", "formal/lake-manifest.json", "formal/lakefile.toml", @@ -27303,21 +288509,64 @@ semantic_source_closure = [ "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/bounded_policy/Funs.lean", "formal/qualification/aeneas/generated/bounded_policy/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/lifecycle/Funs.lean", "formal/qualification/aeneas/generated/lifecycle/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/model/Types.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/tools/SourceClosure.lean", ] -semantic_source_closure_sha256 = "a3c4451de61c9b0e5a5e01b2db5e9e428150a5da66adcf2ee7a3e22abdefe986" -scope = "Every parent requirement covered by some child requirement, over requirement lists of any length." +semantic_source_closure_sha256 = "6806e7e449993897404478583aaac7a7e4e172f4157220b19fb36502f75da32a" +scope = "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem." residual_assumptions = [ - "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted.", - "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem.", + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", ] toolchain_lock_sha256 = "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" axioms = [ @@ -27327,16 +288576,16 @@ axioms = [ ] [[claims.evidence]] -kind = "lean-refinement" -artifact = "formal/Auths/Refinement/Approval.lean" -sha256 = "94e3fcbd95c7e885b99c4796a830d4f7bbcd04f0d2f60066713ef3cd18604e9c" +kind = "lean-proof" +artifact = "formal/Auths/Codec/Fields.lean" +sha256 = "535e93010473d44f2a3caff919b34d003a0199ca0286256d45f54cbdfd6e19ed" [[claims.evidence]] kind = "mechanical-translation" -artifact = "formal/qualification/aeneas/generated/model/Funs.lean" -sha256 = "d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc" +artifact = "formal/qualification/aeneas/generated/connections/Funs.lean" +sha256 = "9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e" [[claims.evidence]] kind = "source-closure" artifact = "formal/qualification/aeneas/source-closure.json" -sha256 = "b9545f8e955554f32a852d87029fab3d96a6faa5ebe07667b83c0b1b209b4439" +sha256 = "bb498e348eb28a69b6e73af31149d677cadb4adaf46ba12bfa4adaa2e166580c" diff --git a/formal/check-site-functions-v1.toml b/formal/check-site-functions-v1.toml index 926185e58..0caa546d0 100644 --- a/formal/check-site-functions-v1.toml +++ b/formal/check-site-functions-v1.toml @@ -251,7 +251,7 @@ note = "Principal status statement carries an accepted critical extension, which [[sites]] site = "branch.anchor-principal-status" refusal = { file = "core/crates/auths-verifier/src/lib.rs", function = "status_decision" } -guard = { file = "core/crates/auths-registries/src/lib.rs", function = "select_principal" } +guard = { file = "core/crates/auths-registries/src/lib.rs", function = "select_principal_from_snapshot" } also = [{ file = "core/crates/auths-verifier/src/lib.rs", function = "check_principal_status" }, { file = "core/crates/auths-registries/src/lib.rs", function = "ExactStatusMethod::principal" }] stage = "stages 2 and 3" note = "Trust anchor principal is revoked in the status snapshot." @@ -274,7 +274,7 @@ note = "Grant status statement carries an accepted critical extension, which has [[sites]] site = "branch.grant-status" refusal = { file = "core/crates/auths-verifier/src/lib.rs", function = "status_decision" } -guard = { file = "core/crates/auths-registries/src/lib.rs", function = "select_grant" } +guard = { file = "core/crates/auths-registries/src/lib.rs", function = "select_grant_from_snapshot" } also = [{ file = "core/crates/auths-verifier/src/lib.rs", function = "check_grant_status" }, { file = "core/crates/auths-registries/src/lib.rs", function = "ExactStatusMethod::grant" }] stage = "stages 2 and 3" note = "Grant is revoked in the grant status snapshot." @@ -282,7 +282,7 @@ note = "Grant is revoked in the grant status snapshot." [[sites]] site = "branch.subject-principal-status" refusal = { file = "core/crates/auths-verifier/src/lib.rs", function = "status_decision" } -guard = { file = "core/crates/auths-registries/src/lib.rs", function = "select_principal" } +guard = { file = "core/crates/auths-registries/src/lib.rs", function = "select_principal_from_snapshot" } also = [{ file = "core/crates/auths-verifier/src/lib.rs", function = "check_principal_status" }, { file = "core/crates/auths-registries/src/lib.rs", function = "ExactStatusMethod::principal" }] stage = "stages 2 and 3" note = "Grant subject principal is revoked in the status snapshot." diff --git a/formal/coverage-scope-v1.toml b/formal/coverage-scope-v1.toml index b3272ca94..2bbbcf02d 100644 --- a/formal/coverage-scope-v1.toml +++ b/formal/coverage-scope-v1.toml @@ -13,6 +13,13 @@ schema = "auths-proof-coverage-scope/v1" verifier_crate = "core/crates/auths-verifier" decision_kernel_crates = ["product/runtime/auths-lifecycle", "product/policy/auths-bounded-policy"] translated_crates = [ + "core/crates/auths-registries", + "core/crates/auths-verifier", + "core/crates/auths-signature", + "core/crates/auths-signature-core", + "core/crates/auths-composition", + "product/stores/auths-stores", + "core/crates/auths-codec", "core/crates/auths-model", "core/crates/auths-algebra-kernel", "core/crates/auths-authority", @@ -46,15 +53,40 @@ crates = ["core/crates/auths-codec"] [[components]] name = "the signature suites" -crates = [] +crates = ["core/crates/auths-signature", "core/crates/auths-signature-core"] + +[[components]] +name = "the stateful gateway store backends" +crates = ["product/stores/auths-stores"] [files] +"product/runtime/auths-connections/src/strict_order_tests.rs" = "test-support" +"product/runtime/auths-connections/src/record_time_tests.rs" = "test-support" +"product/runtime/auths-connections/src/string_constructor_tests.rs" = "test-support" +"product/runtime/auths-connections/src/recovery_guard_tests.rs" = "test-support" +"formal/qualification/aeneas/entrypoints/profile_construction.rs" = "interface" +"product/runtime/auths-gateway-kernel/src/reservation_batch.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/slot_record.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/entry_authorization.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/reservation_retry.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/counter_aggregation.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/counter_preimages.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/identity.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/frontier.rs" = "decision" +"core/crates/auths-model/src/principal_scheme_tests.rs" = "test-support" +"core/crates/auths-model/src/scope_constructor_tests.rs" = "test-support" +"core/crates/auths-codec/src/scope_decode_tests.rs" = "test-support" +"core/crates/auths-registries/src/status_selection_tests.rs" = "test-support" +"core/crates/auths-verifier/src/temporal_tests.rs" = "test-support" +"core/crates/auths-signature/src/lib.rs" = "crypto" +"core/crates/auths-signature-core/src/lib.rs" = "crypto" "core/crates/auths-algebra-kernel/src/generated.rs" = "decision" "core/crates/auths-algebra-kernel/src/lib.rs" = "decision" "core/crates/auths-assurance/src/lib.rs" = "decision" "core/crates/auths-authority/src/lib.rs" = "decision" "core/crates/auths-codec/src/approval.rs" = "decoding" "core/crates/auths-codec/src/bounded_policy.rs" = "decoding" +"core/crates/auths-codec/src/cbor.rs" = "decoding" "core/crates/auths-codec/src/decode.rs" = "decoding" "core/crates/auths-codec/src/encode.rs" = "decoding" "core/crates/auths-codec/src/error.rs" = "decoding" @@ -62,9 +94,12 @@ crates = [] "core/crates/auths-codec/src/lib.rs" = "decoding" "core/crates/auths-codec/src/observation.rs" = "decoding" "core/crates/auths-composition/src/lib.rs" = "decision" +"core/crates/auths-composition/src/summary.rs" = "decision" +"core/crates/auths-composition/src/oracle.rs" = "test-support" "core/crates/auths-model/src/approval.rs" = "decision" "core/crates/auths-model/src/bounded.rs" = "decision" "core/crates/auths-model/src/bounded_policy.rs" = "decision" +"core/crates/auths-model/src/identifier.rs" = "decision" "core/crates/auths-model/src/lib.rs" = "decision" "core/crates/auths-model/src/observation.rs" = "decision" "core/crates/auths-ports/src/binding.rs" = "interface" @@ -92,6 +127,7 @@ crates = [] "product/runtime/auths-connections/src/model.rs" = "decision" "product/runtime/auths-connections/src/registry.rs" = "decision" "product/runtime/auths-gateway-kernel/src/construct.rs" = "decision" +"product/runtime/auths-gateway-kernel/src/deadline.rs" = "decision" "product/runtime/auths-gateway-kernel/src/lib.rs" = "decision" "product/runtime/auths-gateway-kernel/src/order.rs" = "decision" "product/runtime/auths-gateway-kernel/src/outcome.rs" = "decision" @@ -109,3 +145,12 @@ crates = [] "product/runtime/auths-lifecycle/src/sealed.rs" = "storage" "product/runtime/auths-lifecycle/src/test_support.rs" = "test-support" "product/runtime/auths-lifecycle/src/transition.rs" = "decision" + +"product/stores/auths-stores/src/gateway_fence.rs" = "decision" +"product/stores/auths-stores/src/gateway_attempt.rs" = "storage" +"product/stores/auths-stores/src/lifecycle.rs" = "storage" +"product/stores/auths-stores/src/lib.rs" = "interface" + + +[extraction_selectors] +"formal/qualification/aeneas/entrypoints/profile_construction.rs" = "auths_profile_construction" diff --git a/formal/lean-assurance-audit-v1.json b/formal/lean-assurance-audit-v1.json index 0c14778c6..abd54f8d7 100644 --- a/formal/lean-assurance-audit-v1.json +++ b/formal/lean-assurance-audit-v1.json @@ -3,51 +3,199 @@ { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.finiteSet_subset_refl", - "statement": "∀ {α : Type u} (set : Auths.Rich.FiniteSet α), set ⊆ set" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.word_exact", + "statement": "∀ (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8) (value : Aeneas.Std.U64),\n (↑output).length + 8 < 4294967295 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_preimages.append_word output value) fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.Refinement.Gateway.vecBytes output ++ Auths.Codec.bigEndian 8 ↑value", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHAppendOfAppend", + "instLENat", + "instLTNat", + "instOfNatNat", + "HAdd.hAdd", + "HAppend.hAppend", + "LE.le", + "LT.lt", + "List.instAppend", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Auths.Codec.bigEndian", + "auths_gateway_kernel.counter_preimages.append_word", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.finiteSet_subset_trans", - "statement": "∀ {α : Type u} {a b c : Auths.Rich.FiniteSet α}, a ⊆ b → b ⊆ c → a ⊆ c" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.component_exact", + "statement": "∀ (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8) (value : Aeneas.Std.Slice Aeneas.Std.U8),\n (↑output).length + 8 + (↑value).length < 4294967295 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_preimages.append_component output value) fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.Refinement.Gateway.vecBytes output ++ Auths.Codec.bigEndian 8 (↑value).length ++\n Auths.Product.Refinement.Gateway.sliceBytes value", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHAppendOfAppend", + "instLENat", + "instLTNat", + "instOfNatNat", + "HAdd.hAdd", + "HAppend.hAppend", + "LE.le", + "LT.lt", + "List.instAppend", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Codec.bigEndian", + "auths_gateway_kernel.counter_preimages.append_component", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.finiteSet_subset_antisymm", - "statement": "∀ {α : Type u} {a b : Auths.Rich.FiniteSet α}, a ⊆ b → b ⊆ a → a = b" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.coordinates_exact", + "statement": "∀ (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8) (window index : Aeneas.Std.U64),\n (↑output).length + 16 < 4294967295 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_preimages.append_coordinates output window index) fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.Refinement.Gateway.vecBytes output ++ Auths.Codec.bigEndian 8 ↑window ++\n Auths.Codec.bigEndian 8 ↑index", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHAppendOfAppend", + "instLENat", + "instLTNat", + "instOfNatNat", + "HAdd.hAdd", + "HAppend.hAppend", + "LE.le", + "LT.lt", + "List.instAppend", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Auths.Codec.bigEndian", + "auths_gateway_kernel.counter_preimages.append_coordinates", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.finiteSet_membership_monotone", - "statement": "∀ {α : Type u} {child parent : Auths.Rich.FiniteSet α} {item : α}, child ⊆ parent → item ∈ child → item ∈ parent" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.count_exact", + "statement": "∀ (namespaceBytes subject evaluator : Aeneas.Std.Slice Aeneas.Std.U8) (window index : Aeneas.Std.U64),\n (↑namespaceBytes).length ≤ 64 →\n (↑subject).length ≤ 512 →\n (↑evaluator).length ≤ 128 →\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.counter_preimages.count_counter_preimage namespaceBytes subject evaluator window index)\n fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.CounterFrames.encode\n { kind := Auths.Product.CounterFrames.Kind.count,\n components :=\n [Auths.Product.Refinement.Gateway.sliceBytes namespaceBytes,\n Auths.Product.Refinement.Gateway.sliceBytes subject,\n Auths.Product.Refinement.Gateway.sliceBytes evaluator],\n window := ↑window, index := ↑index }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_preimages.count_counter_preimage", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.encode", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterFrames.Counter.mk", + "Auths.Product.CounterFrames.Kind.count", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.window_contained_refl", - "statement": "∀ (window : Auths.Rich.InclusiveWindow), Auths.Rich.windowContained window window" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.sum_exact", + "statement": "∀ (namespaceBytes subject evaluator partitionBytes : Aeneas.Std.Slice Aeneas.Std.U8) (window index : Aeneas.Std.U64),\n (↑namespaceBytes).length ≤ 64 →\n (↑subject).length ≤ 512 →\n (↑evaluator).length ≤ 128 →\n (↑partitionBytes).length ≤ 64 →\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.counter_preimages.sum_counter_preimage namespaceBytes subject evaluator partitionBytes\n window index)\n fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.CounterFrames.encode\n { kind := Auths.Product.CounterFrames.Kind.sum,\n components :=\n [Auths.Product.Refinement.Gateway.sliceBytes namespaceBytes,\n Auths.Product.Refinement.Gateway.sliceBytes subject,\n Auths.Product.Refinement.Gateway.sliceBytes evaluator,\n Auths.Product.Refinement.Gateway.sliceBytes partitionBytes],\n window := ↑window, index := ↑index }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_preimages.sum_counter_preimage", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.encode", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterFrames.Counter.mk", + "Auths.Product.CounterFrames.Kind.sum", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ @@ -56,9 +204,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.window_contained_trans", - "statement": "∀ {a b c : Auths.Rich.InclusiveWindow},\n Auths.Rich.windowContained a b → Auths.Rich.windowContained b c → Auths.Rich.windowContained a c" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.count_slot_exact", + "statement": "∀ (counter : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (slot : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_preimages.count_slot_preimage counter slot) fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.CounterFrames.slotEncode\n { kind := Auths.Product.CounterFrames.Kind.count, counter := Auths.Product.Refinement.Gateway.byteList ↑counter,\n index := ↑slot }", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_preimages.count_slot_preimage", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterFrames.slotEncode", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterFrames.Kind.count", + "Auths.Product.CounterFrames.Slot.mk", + "Auths.Product.Refinement.Gateway.byteList", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ @@ -67,9 +249,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.window_contained_antisymm", - "statement": "∀ {a b : Auths.Rich.InclusiveWindow}, Auths.Rich.windowContained a b → Auths.Rich.windowContained b a → a = b" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.sum_slot_exact", + "statement": "∀ (counter : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (slot : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_preimages.sum_slot_preimage counter slot) fun actual =>\n Auths.Product.Refinement.Gateway.vecBytes actual =\n Auths.Product.CounterFrames.slotEncode\n { kind := Auths.Product.CounterFrames.Kind.sum, counter := Auths.Product.Refinement.Gateway.byteList ↑counter,\n index := ↑slot }", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_preimages.sum_slot_preimage", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterFrames.slotEncode", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterFrames.Kind.sum", + "Auths.Product.CounterFrames.Slot.mk", + "Auths.Product.Refinement.Gateway.byteList", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ @@ -78,176 +294,438 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.window_coverage_monotone", - "statement": "∀ {action child parent : Auths.Rich.InclusiveWindow},\n Auths.Rich.windowContained child parent →\n Auths.Rich.windowContained action child → Auths.Rich.windowContained action parent" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.count_source_binds_inputs", + "statement": "∀ (leftNamespaceBytes leftSubject leftEvaluator : Aeneas.Std.Slice Aeneas.Std.U8)\n (leftWindow leftIndex : Aeneas.Std.U64),\n (↑leftNamespaceBytes).length ≤ 64 →\n (↑leftSubject).length ≤ 512 →\n (↑leftEvaluator).length ≤ 128 →\n ∀ (rightNamespaceBytes rightSubject rightEvaluator : Aeneas.Std.Slice Aeneas.Std.U8)\n (rightWindow rightIndex : Aeneas.Std.U64),\n (↑rightNamespaceBytes).length ≤ 64 →\n (↑rightSubject).length ≤ 512 →\n (↑rightEvaluator).length ≤ 128 →\n ∀ (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_gateway_kernel.counter_preimages.count_counter_preimage leftNamespaceBytes leftSubject\n leftEvaluator leftWindow leftIndex =\n Aeneas.Std.Result.ok leftOutput →\n auths_gateway_kernel.counter_preimages.count_counter_preimage rightNamespaceBytes rightSubject\n rightEvaluator rightWindow rightIndex =\n Aeneas.Std.Result.ok rightOutput →\n Auths.Product.Refinement.Gateway.vecBytes leftOutput =\n Auths.Product.Refinement.Gateway.vecBytes rightOutput →\n { kind := Auths.Product.CounterFrames.Kind.count,\n components :=\n [Auths.Product.Refinement.Gateway.sliceBytes leftNamespaceBytes,\n Auths.Product.Refinement.Gateway.sliceBytes leftSubject,\n Auths.Product.Refinement.Gateway.sliceBytes leftEvaluator],\n window := ↑leftWindow, index := ↑leftIndex } =\n { kind := Auths.Product.CounterFrames.Kind.count,\n components :=\n [Auths.Product.Refinement.Gateway.sliceBytes rightNamespaceBytes,\n Auths.Product.Refinement.Gateway.sliceBytes rightSubject,\n Auths.Product.Refinement.Gateway.sliceBytes rightEvaluator],\n window := ↑rightWindow, index := ↑rightIndex }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_preimages.count_counter_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.Counter", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterFrames.Counter.mk", + "Auths.Product.CounterFrames.Kind.count", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.action_constraint_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} (constraint : Auths.Rich.ActionConstraint v),\n Auths.Rich.actionConstraintLe constraint constraint" + "module": "Auths.Product.CounterRefinement", + "name": "Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs", + "statement": "∀ (leftNamespaceBytes leftSubject leftEvaluator leftPartitionBytes : Aeneas.Std.Slice Aeneas.Std.U8)\n (leftWindow leftIndex : Aeneas.Std.U64),\n (↑leftNamespaceBytes).length ≤ 64 →\n (↑leftSubject).length ≤ 512 →\n (↑leftEvaluator).length ≤ 128 →\n (↑leftPartitionBytes).length ≤ 64 →\n ∀ (rightNamespaceBytes rightSubject rightEvaluator rightPartitionBytes : Aeneas.Std.Slice Aeneas.Std.U8)\n (rightWindow rightIndex : Aeneas.Std.U64),\n (↑rightNamespaceBytes).length ≤ 64 →\n (↑rightSubject).length ≤ 512 →\n (↑rightEvaluator).length ≤ 128 →\n (↑rightPartitionBytes).length ≤ 64 →\n ∀ (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_gateway_kernel.counter_preimages.sum_counter_preimage leftNamespaceBytes leftSubject\n leftEvaluator leftPartitionBytes leftWindow leftIndex =\n Aeneas.Std.Result.ok leftOutput →\n auths_gateway_kernel.counter_preimages.sum_counter_preimage rightNamespaceBytes rightSubject\n rightEvaluator rightPartitionBytes rightWindow rightIndex =\n Aeneas.Std.Result.ok rightOutput →\n Auths.Product.Refinement.Gateway.vecBytes leftOutput =\n Auths.Product.Refinement.Gateway.vecBytes rightOutput →\n { kind := Auths.Product.CounterFrames.Kind.sum,\n components :=\n [Auths.Product.Refinement.Gateway.sliceBytes leftNamespaceBytes,\n Auths.Product.Refinement.Gateway.sliceBytes leftSubject,\n Auths.Product.Refinement.Gateway.sliceBytes leftEvaluator,\n Auths.Product.Refinement.Gateway.sliceBytes leftPartitionBytes],\n window := ↑leftWindow, index := ↑leftIndex } =\n { kind := Auths.Product.CounterFrames.Kind.sum,\n components :=\n [Auths.Product.Refinement.Gateway.sliceBytes rightNamespaceBytes,\n Auths.Product.Refinement.Gateway.sliceBytes rightSubject,\n Auths.Product.Refinement.Gateway.sliceBytes rightEvaluator,\n Auths.Product.Refinement.Gateway.sliceBytes rightPartitionBytes],\n window := ↑rightWindow, index := ↑rightIndex }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_preimages.sum_counter_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.Counter", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterFrames.Counter.mk", + "Auths.Product.CounterFrames.Kind.sum", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.action_constraint_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Auths.Rich.ActionConstraint v},\n Auths.Rich.actionConstraintLe a b → Auths.Rich.actionConstraintLe b c → Auths.Rich.actionConstraintLe a c" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.fields_cancel", + "statement": "∀ (left right : List Auths.Product.CounterFrames.Bytes) (leftTail rightTail : Auths.Product.CounterFrames.Bytes),\n left.length = right.length →\n Auths.Product.CounterFrames.Bounded left →\n Auths.Product.CounterFrames.Bounded right →\n Auths.Product.CounterFrames.fields left ++ leftTail = Auths.Product.CounterFrames.fields right ++ rightTail →\n left = right ∧ leftTail = rightTail", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "List.length", + "Auths.Product.CounterFrames.Bounded", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.fields" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.action_constraint_antisymm", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.ActionConstraint v},\n Auths.Rich.actionConstraintLe a b →\n Auths.Rich.actionConstraintLe b a →\n ∀ (digest : Auths.Rich.Digest v),\n Auths.Rich.actionConstraintAllows a digest ↔ Auths.Rich.actionConstraintAllows b digest" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.encode_injective", + "statement": "∀ (left right : Auths.Product.CounterFrames.Counter),\n left.Valid →\n right.Valid → Auths.Product.CounterFrames.encode left = Auths.Product.CounterFrames.encode right → left = right", + "statement_constants": [ + "Eq", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.Counter", + "Auths.Product.CounterFrames.encode", + "Auths.Product.CounterFrames.Counter.Valid" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.action_constraint_canonical_antisymm", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.ActionConstraint v},\n Auths.Rich.actionConstraintCanonical a →\n Auths.Rich.actionConstraintCanonical b →\n Auths.Rich.actionConstraintLe a b → Auths.Rich.actionConstraintLe b a → a = b" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.slot_injective", + "statement": "∀ (left right : Auths.Product.CounterFrames.Slot),\n left.Valid →\n right.Valid →\n Auths.Product.CounterFrames.slotEncode left = Auths.Product.CounterFrames.slotEncode right → left = right", + "statement_constants": [ + "Eq", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.Slot", + "Auths.Product.CounterFrames.slotEncode", + "Auths.Product.CounterFrames.Slot.Valid" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.action_constraint_allows_monotone", - "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent : Auths.Rich.ActionConstraint v} {digest : Auths.Rich.Digest v},\n Auths.Rich.actionConstraintLe child parent →\n Auths.Rich.actionConstraintAllows child digest → Auths.Rich.actionConstraintAllows parent digest" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.fields_length", + "statement": "∀ (values : List Auths.Product.CounterFrames.Bytes),\n List.length (Auths.Product.CounterFrames.fields values) = 8 * values.length + (List.map List.length values).sum", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHMul", + "instMulNat", + "instOfNatNat", + "HAdd.hAdd", + "HMul.hMul", + "List.length", + "List.map", + "List.sum", + "MulZeroClass.toZero", + "Nat.instMulZeroClass", + "OfNat.ofNat", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.fields" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.budget_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} (budget : Option (Auths.Rich.BudgetCeiling v)), Auths.Rich.budgetLe budget budget" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.budget_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Option (Auths.Rich.BudgetCeiling v)},\n Auths.Rich.budgetLe a b → Auths.Rich.budgetLe b c → Auths.Rich.budgetLe a c" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.count_frame_length", + "statement": "∀ (namespaceBytes subject evaluator : Auths.Product.CounterFrames.Bytes) (window index : ℕ),\n List.length namespaceBytes ≤ 64 →\n List.length subject ≤ 512 →\n List.length evaluator ≤ 128 →\n List.length\n (Auths.Product.CounterFrames.encode\n { kind := Auths.Product.CounterFrames.Kind.count, components := [namespaceBytes, subject, evaluator],\n window := window, index := index }) ≤\n 774", + "statement_constants": [ + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "OfNat.ofNat", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.encode", + "Auths.Product.CounterFrames.Counter.mk", + "Auths.Product.CounterFrames.Kind.count" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.budget_antisymm", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Option (Auths.Rich.BudgetCeiling v)},\n Auths.Rich.budgetLe a b → Auths.Rich.budgetLe b a → a = b" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.budget_coverage_monotone", - "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent requested : Option (Auths.Rich.BudgetCeiling v)},\n Auths.Rich.budgetLe child parent → Auths.Rich.budgetCovers child requested → Auths.Rich.budgetCovers parent requested" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.sum_frame_length", + "statement": "∀ (namespaceBytes subject evaluator partitionBytes : Auths.Product.CounterFrames.Bytes) (window index : ℕ),\n List.length namespaceBytes ≤ 64 →\n List.length subject ≤ 512 →\n List.length evaluator ≤ 128 →\n List.length partitionBytes ≤ 64 →\n List.length\n (Auths.Product.CounterFrames.encode\n { kind := Auths.Product.CounterFrames.Kind.sum,\n components := [namespaceBytes, subject, evaluator, partitionBytes], window := window,\n index := index }) ≤\n 844", + "statement_constants": [ + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "OfNat.ofNat", + "Auths.Product.CounterFrames.Bytes", + "Auths.Product.CounterFrames.encode", + "Auths.Product.CounterFrames.Counter.mk", + "Auths.Product.CounterFrames.Kind.sum" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.budget_action_coverage_monotone", - "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent requested : Option (Auths.Rich.BudgetCeiling v)}\n {expression : Auths.Rich.BudgetExpression},\n Auths.Rich.budgetLe child parent →\n Auths.Rich.budgetCoversAction child requested expression → Auths.Rich.budgetCoversAction parent requested expression" + "module": "Auths.Product.CounterFrames", + "name": "Auths.Product.CounterFrames.slot_frame_length", + "statement": "∀ (value : Auths.Product.CounterFrames.Slot),\n value.Valid →\n List.length (Auths.Product.CounterFrames.slotEncode value) =\n if value.kind = Auths.Product.CounterFrames.Kind.count then 75 else 73", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "ite", + "List.length", + "OfNat.ofNat", + "Auths.Product.CounterFrames.Kind", + "Auths.Product.CounterFrames.Slot", + "Auths.Product.CounterFrames.instDecidableEqKind", + "Auths.Product.CounterFrames.slotEncode", + "Auths.Product.CounterFrames.Kind.count", + "Auths.Product.CounterFrames.Slot.Valid", + "Auths.Product.CounterFrames.Slot.kind" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.budgetCoversAction_expressible_absent_bounded", - "statement": "∀ {v : Auths.Rich.Vocabulary} (ceiling : Auths.Rich.BudgetCeiling v),\n ¬Auths.Rich.budgetCoversAction (some ceiling) none Auths.Rich.BudgetExpression.expressible" + "module": "Auths.Product.Frontier.Refinement", + "name": "Auths.Product.Frontier.Refinement.start_exact", + "statement": "∀ (bound : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_gateway_kernel.frontier.FrontierSearch.new bound) fun actual =>\n Auths.Product.Frontier.Refinement.view actual = Auths.Product.Frontier.Model.start ↑bound", + "statement_constants": [ + "Eq", + "Aeneas.Std.U64", + "auths_gateway_kernel.frontier.FrontierSearch", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.frontier.FrontierSearch.new", + "Auths.Product.Frontier.Model.Search", + "Auths.Product.Frontier.Model.start", + "Auths.Product.Frontier.Refinement.view" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ (extensions : Option (Auths.Rich.CriticalExtensions v)), Auths.Rich.extensionsLe extensions extensions" + "module": "Auths.Product.Frontier.Refinement", + "name": "Auths.Product.Frontier.Refinement.probe_exact", + "statement": "∀ (state : auths_gateway_kernel.frontier.FrontierSearch),\n Aeneas.Std.WP.spec state.probe fun actual =>\n Option.map Aeneas.Std.UScalar.val actual =\n Auths.Product.Frontier.Model.probe (Auths.Product.Frontier.Refinement.view state)", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Option.map", + "Aeneas.Std.U64", + "Aeneas.Std.UScalar", + "auths_gateway_kernel.frontier.FrontierSearch", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.frontier.FrontierSearch.probe", + "Auths.Product.Frontier.Model.probe", + "Auths.Product.Frontier.Refinement.view" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {a b c : Option (Auths.Rich.CriticalExtensions v)},\n Auths.Rich.extensionsLe a b → Auths.Rich.extensionsLe b c → Auths.Rich.extensionsLe a c" + "module": "Auths.Product.Frontier.Refinement", + "name": "Auths.Product.Frontier.Refinement.observe_exact", + "statement": "∀ (state : auths_gateway_kernel.frontier.FrontierSearch) (occupied : Bool),\n Aeneas.Std.WP.spec (state.observe occupied) fun actual =>\n Auths.Product.Frontier.Refinement.view actual =\n Auths.Product.Frontier.Model.observe (Auths.Product.Frontier.Refinement.view state) occupied", + "statement_constants": [ + "Bool", + "Eq", + "auths_gateway_kernel.frontier.FrontierSearch", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.frontier.FrontierSearch.observe", + "Auths.Product.Frontier.Model.Search", + "Auths.Product.Frontier.Model.observe", + "Auths.Product.Frontier.Refinement.view" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_pinned_iff", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (child parent : Auths.Rich.CriticalExtensions v),\n Auths.Rich.extensionsLe (some child) (some parent) ↔ Auths.Rich.extensionsAttenuate child parent" + "module": "Auths.Product.Frontier.Refinement", + "name": "Auths.Product.Frontier.Refinement.candidate_exact", + "statement": "∀ (state : auths_gateway_kernel.frontier.FrontierSearch),\n Aeneas.Std.WP.spec state.candidate fun actual => ↑actual = (Auths.Product.Frontier.Refinement.view state).lower", + "statement_constants": [ + "Eq", + "Nat", + "Aeneas.Std.U64", + "auths_gateway_kernel.frontier.FrontierSearch", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.frontier.FrontierSearch.candidate", + "Auths.Product.Frontier.Refinement.view", + "Auths.Product.Frontier.Model.Search.lower" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_false_of_dropped", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.CriticalExtensions v),\n ¬Auths.Rich.extensionsLe none (some parent)" + "module": "Auths.Product.Frontier.Model", + "name": "Auths.Product.Frontier.Model.sixty_four_reads_suffice", + "statement": "∀ bound < 2 ^ 64,\n ∀ (answers : List Bool),\n answers.length = 64 →\n Auths.Product.Frontier.Model.probe\n (Auths.Product.Frontier.Model.run (Auths.Product.Frontier.Model.start bound) answers) =\n none", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instHPow", + "instLTNat", + "instOfNatNat", + "HPow.hPow", + "LT.lt", + "List.length", + "Monoid.toPow", + "Nat.instMonoid", + "OfNat.ofNat", + "Option.none", + "Auths.Product.Frontier.Model.probe", + "Auths.Product.Frontier.Model.run", + "Auths.Product.Frontier.Model.start" + ] }, { "axioms": [ - "propext" + "propext", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_false_of_stripped", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.CriticalExtensions v}\n {entry : Auths.Rich.CriticalExtension v},\n entry ∈ parent.entries →\n (∀ candidate ∈ child.entries, candidate.id ≠ entry.id) → ¬Auths.Rich.extensionsLe (some child) (some parent)" + "module": "Auths.Product.Frontier.Model", + "name": "Auths.Product.Frontier.Model.candidate_conservative", + "statement": "∀ (state : Auths.Product.Frontier.Model.Search) (frontiers : List ℕ) (latest : ℕ),\n state.lower ≤ latest →\n (∀ frontier ∈ frontiers, frontier ≤ latest) →\n (Auths.Product.Frontier.Model.runPrefixes state frontiers).lower ≤ latest", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "LE.le", + "List.instMembership", + "Membership.mem", + "Auths.Product.Frontier.Model.Search", + "Auths.Product.Frontier.Model.runPrefixes", + "Auths.Product.Frontier.Model.Search.lower" + ] }, { "axioms": [ - "propext" + "propext", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_false_of_refused", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.CriticalExtensions v}\n {childEntry parentEntry : Auths.Rich.CriticalExtension v},\n parentEntry ∈ parent.entries →\n childEntry ∈ child.entries →\n childEntry.id = parentEntry.id →\n ¬Auths.Rich.extensionLawAccepts parentEntry.id (some childEntry.body) (some parentEntry.body) →\n ¬Auths.Rich.extensionsLe (some child) (some parent)" + "module": "Auths.Product.Frontier.Model", + "name": "Auths.Product.Frontier.Model.successful_insertion_is_at_frontier", + "statement": "∀ (state : Auths.Product.Frontier.Model.Search) (frontiers : List ℕ) (latest : ℕ),\n state.lower ≤ latest →\n (∀ frontier ∈ frontiers, frontier ≤ latest) →\n ¬(Auths.Product.Frontier.Model.runPrefixes state frontiers).lower < latest →\n (Auths.Product.Frontier.Model.runPrefixes state frontiers).lower = latest", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Not", + "instLENat", + "instLTNat", + "LE.le", + "LT.lt", + "List.instMembership", + "Membership.mem", + "Auths.Product.Frontier.Model.Search", + "Auths.Product.Frontier.Model.runPrefixes", + "Auths.Product.Frontier.Model.Search.lower" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_false_of_refused_addition", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.CriticalExtensions v}\n {entry : Auths.Rich.CriticalExtension v},\n entry ∈ child.entries →\n (∀ candidate ∈ parent.entries, candidate.id ≠ entry.id) →\n ¬Auths.Rich.extensionLawAccepts entry.id (some entry.body) none →\n ¬Auths.Rich.extensionsLe (some child) (some parent)" + "module": "Auths.Product.Frontier.Refinement", + "name": "Auths.Product.Frontier.Refinement.source_work_bound", + "statement": "∀ (bound : Aeneas.Std.U64) (answers : List Bool),\n answers.length = 64 →\n Aeneas.Std.WP.spec\n (do\n let start ← auths_gateway_kernel.frontier.FrontierSearch.new bound\n let final ← Auths.Product.Frontier.Refinement.composeReads start answers\n final.probe)\n fun actual => actual = none", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instOfNatNat", + "Bind.bind", + "List.length", + "OfNat.ofNat", + "Option.none", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "Aeneas.Std.instBindResult", + "auths_gateway_kernel.frontier.FrontierSearch", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.frontier.FrontierSearch.new", + "auths_gateway_kernel.frontier.FrontierSearch.probe", + "Auths.Product.Frontier.Refinement.composeReads" + ] }, { "axioms": [ @@ -255,34 +733,84 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_refuses_a_dropped_singleton", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (extension : Auths.Rich.CriticalExtension v)\n (bodyBounded : v.extensionBodySize extension.body.value ≤ Auths.Rich.hardMaxExtensionBytes),\n ¬Auths.Rich.extensionsLe (some (Auths.Rich.CriticalExtensions.empty v))\n (some (Auths.Rich.CriticalExtensions.singleton extension bodyBounded))" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.every_history_preserves", + "statement": "∀ (events : List Auths.Product.BoundedClaimHistory.Event),\n Auths.Product.BoundedClaimHistory.Invariant\n (Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial events)", + "statement_constants": [ + "List", + "Auths.Product.BoundedClaimHistory.Event", + "Auths.Product.BoundedClaimHistory.Invariant", + "Auths.Product.BoundedClaimHistory.initial", + "Auths.Product.BoundedClaimHistory.run" + ] }, { "axioms": [ - "propext" + "propext", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_le_narrows", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {child parent : Option (Auths.Rich.CriticalExtensions v)},\n Auths.Rich.extensionsLe child parent →\n ∀ {world : Auths.Rich.ExtensionLaws.World v},\n Auths.Rich.extensionsAdmit child world → Auths.Rich.extensionsAdmit parent world" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.every_history_count_bound", + "statement": "∀ (events : List Auths.Product.BoundedClaimHistory.Event) (link : Auths.Product.CeilingCount.Link),\n (Auths.Product.CeilingCount.containing link\n (Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial events).bounds.2).length ≤\n link.2.maxCount", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Prod.snd", + "Auths.Product.BoundedClaimHistory.Event", + "Auths.Product.BoundedClaimHistory.initial", + "Auths.Product.BoundedClaimHistory.run", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.containing", + "Auths.Product.BoundedClaimHistory.State.bounds", + "Auths.Product.CeilingCount.Policy.maxCount" + ] }, { "axioms": [ - "propext" + "propext", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.status_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} (status : Auths.Rich.StatusPolicy v), Auths.Rich.statusLe status status" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.status_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Auths.Rich.StatusPolicy v},\n Auths.Rich.statusLe a b → Auths.Rich.statusLe b c → Auths.Rich.statusLe a c" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.every_history_sum_bound", + "statement": "∀ (events : List Auths.Product.BoundedClaimHistory.Event) (link : Auths.Product.CeilingCount.Link)\n (bound : Auths.Product.CeilingCount.SumBound),\n link.2.sum = some bound →\n ∀ (partition : Auths.Product.CeilingCount.Name),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (Auths.Product.CeilingCount.containingIn link bound partition\n (Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial events).bounds.2)).sum ≤\n bound.limit", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instAddNat", + "instLENat", + "LE.le", + "List.map", + "List.sum", + "MulZeroClass.toZero", + "Nat.instMulZeroClass", + "Option.some", + "Prod.snd", + "Auths.Product.BoundedClaimHistory.Event", + "Auths.Product.BoundedClaimHistory.initial", + "Auths.Product.BoundedClaimHistory.run", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.SumBound", + "Auths.Product.CeilingCount.containingIn", + "Auths.Product.BoundedClaimHistory.State.bounds", + "Auths.Product.CeilingCount.Arrival.value", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.SumBound.limit" + ] }, { "axioms": [ @@ -290,16 +818,17 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.status_antisymm", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.StatusPolicy v},\n Auths.Rich.statusLe a b → Auths.Rich.statusLe b a → a = b" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.status_satisfaction_monotone", - "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent : Auths.Rich.StatusPolicy v} {facts : Auths.Rich.EvidenceFacts v},\n Auths.Rich.statusLe child parent → Auths.Rich.statusSatisfied child facts → Auths.Rich.statusSatisfied parent facts" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.every_history_one_owner", + "statement": "∀ (events : List Auths.Product.BoundedClaimHistory.Event),\n Auths.Product.AdmissionHistory.SingleOwner\n (Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial events).ownership", + "statement_constants": [ + "List", + "Auths.Product.AdmissionHistory.SingleOwner", + "Auths.Product.BoundedClaimHistory.Event", + "Auths.Product.BoundedClaimHistory.initial", + "Auths.Product.BoundedClaimHistory.run", + "Auths.Product.BoundedClaimHistory.State.ownership" + ] }, { "axioms": [ @@ -307,9 +836,28 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.profile_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} (profile : Auths.Rich.ProfileScope v), Auths.Rich.profileLe profile profile" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.replay_preserves_counters", + "statement": "∀ (state : Auths.Product.BoundedClaimHistory.State) (operation : Auths.Product.AdmissionHistory.Operation)\n (worker : Auths.Product.AdmissionHistory.Worker) (arrival : Auths.Product.CeilingCount.Arrival) (acknowledged : Bool),\n state.ownership.claims operation ≠ none →\n (Auths.Product.BoundedClaimHistory.attempt state operation worker arrival acknowledged).bounds = state.bounds", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Ne", + "Option", + "Prod", + "Option.none", + "Auths.Product.AdmissionHistory.Operation", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.BoundedClaimHistory.State", + "Auths.Product.BoundedClaimHistory.attempt", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.AdmissionHistory.State.claims", + "Auths.Product.BoundedClaimHistory.State.bounds", + "Auths.Product.BoundedClaimHistory.State.ownership" + ] }, { "axioms": [ @@ -317,9 +865,25 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.profile_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Auths.Rich.ProfileScope v},\n Auths.Rich.profileLe a b → Auths.Rich.profileLe b c → Auths.Rich.profileLe a c" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.closed_window_cannot_charge", + "statement": "∀ (state : Auths.Product.BoundedClaimHistory.State) (operation : Auths.Product.AdmissionHistory.Operation)\n (worker : Auths.Product.AdmissionHistory.Worker) (arrival : Auths.Product.CeilingCount.Arrival) (acknowledged : Bool),\n state.closed = true →\n (Auths.Product.BoundedClaimHistory.attempt state operation worker arrival acknowledged).bounds = state.bounds", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "Bool.true", + "Auths.Product.AdmissionHistory.Operation", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.BoundedClaimHistory.State", + "Auths.Product.BoundedClaimHistory.attempt", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.BoundedClaimHistory.State.bounds", + "Auths.Product.BoundedClaimHistory.State.closed" + ] }, { "axioms": [ @@ -327,9 +891,33 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.profile_antisymm", - "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.ProfileScope v},\n Auths.Rich.profileLe a b → Auths.Rich.profileLe b a → a = b" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.Examples.useful_delegation_shares_capacity", + "statement": "(Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial\n Auths.Product.BoundedClaimHistory.Examples.trace✝).bounds.2.length =\n 2 ∧\n (Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial\n Auths.Product.BoundedClaimHistory.Examples.trace✝).ownership.handles\n (\"operator\", \"second\") =\n some 2 ∧\n (Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial\n Auths.Product.BoundedClaimHistory.Examples.trace✝).ownership.handles\n (\"operator\", \"third\") =\n none", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "String", + "instOfNatNat", + "List.length", + "OfNat.ofNat", + "Option.none", + "Option.some", + "Prod.mk", + "Prod.snd", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.BoundedClaimHistory.initial", + "Auths.Product.BoundedClaimHistory.run", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.AdmissionHistory.State.handles", + "Auths.Product.BoundedClaimHistory.State.bounds", + "Auths.Product.BoundedClaimHistory.State.ownership", + "_private.Auths.Product.BoundedClaimHistory.0.Auths.Product.BoundedClaimHistory.Examples.trace" + ] }, { "axioms": [ @@ -337,19 +925,69 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.profile_coverage_monotone", - "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent : Auths.Rich.ProfileScope v} {profile : Auths.Rich.Profile v},\n Auths.Rich.profileLe child parent → Auths.Rich.profileAllows child profile → Auths.Rich.profileAllows parent profile" + "module": "Auths.Product.BoundedClaimHistory", + "name": "Auths.Product.BoundedClaimHistory.Examples.recovery_cannot_reissue_lost_handle", + "statement": "(Auths.Product.BoundedClaimHistory.run Auths.Product.BoundedClaimHistory.initial\n (Auths.Product.BoundedClaimHistory.Examples.trace✝ ++\n [Auths.Product.BoundedClaimHistory.Event.readOnlyRecovery,\n Auths.Product.BoundedClaimHistory.Event.writeEntry (\"operator\", \"first\") 1,\n Auths.Product.BoundedClaimHistory.Event.writeEntry (\"operator\", \"second\") 2,\n Auths.Product.BoundedClaimHistory.Event.writeEntry (\"operator\", \"second\") 2])).ownership.entries =\n [((\"operator\", \"second\"), 2)]", + "statement_constants": [ + "Eq", + "List", + "Prod", + "String", + "instHAppendOfAppend", + "instOfNatNat", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.nil", + "OfNat.ofNat", + "Prod.mk", + "Auths.Product.AdmissionHistory.Operation", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.BoundedClaimHistory.Event", + "Auths.Product.BoundedClaimHistory.initial", + "Auths.Product.BoundedClaimHistory.run", + "Auths.Product.AdmissionHistory.State.entries", + "Auths.Product.BoundedClaimHistory.Event.readOnlyRecovery", + "Auths.Product.BoundedClaimHistory.Event.writeEntry", + "Auths.Product.BoundedClaimHistory.State.ownership", + "_private.Auths.Product.BoundedClaimHistory.0.Auths.Product.BoundedClaimHistory.Examples.trace" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.structural_scope_le_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v → ∀ (scope : Auths.Rich.AuthorityScope v), Auths.Rich.structuralScopeLe scope scope" + "module": "Auths.Codec.PrincipalConstructor", + "name": "Auths.PrincipalConstructor.parse_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n AuthsScopeCodec.auths_model.PrincipalId.parse (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok\n (if Auths.PrincipalConstructor.valid value = true then Aeneas.Std.core.result.Result.Ok value\n else Aeneas.Std.core.result.Result.Err AuthsScopeCodec.auths_model.ModelError.InvalidPrincipal)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instDecidableEqBool", + "instLENat", + "ite", + "Bool.true", + "ByteArray.size", + "LE.le", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "Auths.PrincipalConstructor.valid", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.PrincipalId", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "AuthsScopeCodec.auths_model.ModelError.InvalidPrincipal", + "AuthsScopeCodec.auths_model.PrincipalId.parse", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -358,9 +996,39 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.structural_scope_le_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {a b c : Auths.Rich.AuthorityScope v},\n Auths.Rich.structuralScopeLe a b → Auths.Rich.structuralScopeLe b c → Auths.Rich.structuralScopeLe a c" + "module": "Auths.Product.Refinement.OperationIdentity", + "name": "Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity", + "statement": "∀ (leftNamespace leftOperation rightNamespace rightOperation : Aeneas.Std.Slice Aeneas.Std.U8),\n (↑leftNamespace).length ≤ 64 →\n (↑rightNamespace).length ≤ 64 →\n (↑leftOperation).length ≤ 128 →\n (↑rightOperation).length ≤ 128 →\n auths_gateway_kernel.identity.valid_token leftNamespace 64#usize = Aeneas.Std.Result.ok true →\n auths_gateway_kernel.identity.valid_token rightNamespace 64#usize = Aeneas.Std.Result.ok true →\n ∀ (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_gateway_kernel.identity.logical_operation_preimage leftNamespace leftOperation =\n Aeneas.Std.Result.ok leftOutput →\n auths_gateway_kernel.identity.logical_operation_preimage rightNamespace rightOperation =\n Aeneas.Std.Result.ok rightOutput →\n ↑leftOutput = ↑rightOutput → ↑leftNamespace = ↑rightNamespace ∧ ↑leftOperation = ↑rightOperation", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.identity.logical_operation_preimage", + "auths_gateway_kernel.identity.valid_token", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.alloc.vec.Vec" + ] }, { "axioms": [ @@ -369,9 +1037,29 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.scope_le_canonical_antisymmetry", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {a b : Auths.Rich.AuthorityScope v},\n Auths.Rich.actionConstraintCanonical a.actionConstraint →\n Auths.Rich.actionConstraintCanonical b.actionConstraint →\n Auths.Rich.structuralScopeLe a b → Auths.Rich.structuralScopeLe b a → a.extensions = b.extensions → a = b" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.failure_before_commit_can_retry", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.failedBeforeCommit,\n Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true]).handles\n Auths.Product.AdmissionHistory.Examples.first.operation =\n some 1", + "statement_constants": [ + "Eq", + "Option", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Event.failedBeforeCommit", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.handles" + ] }, { "axioms": [ @@ -380,19 +1068,61 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.action_coverage_downward_closed", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.AuthorityScope v}\n {action : Auths.Rich.Action v} {expression : Auths.Rich.BudgetExpression},\n Auths.Rich.structuralScopeLe child parent →\n Auths.Rich.actionCovers child action expression → Auths.Rich.actionCovers parent action expression" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.terminal_refusal_retains_claim_without_capacity", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.terminalRefusal Auths.Product.AdmissionHistory.Examples.first.operation\n 1]).claims\n Auths.Product.AdmissionHistory.Examples.first.operation =\n some 1 ∧\n (Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy\n Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.terminalRefusal Auths.Product.AdmissionHistory.Examples.first.operation\n 1]).historical\n 0 =\n 0", + "statement_constants": [ + "And", + "Eq", + "Nat", + "Option", + "instOfNatNat", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.Product.AdmissionHistory.Counter", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.terminalRefusal", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.claims", + "Auths.Product.AdmissionHistory.State.historical" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.evidence_requirements_downward_closed", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.AuthorityScope v}\n {facts : Auths.Rich.EvidenceFacts v},\n Auths.Rich.structuralScopeLe child parent →\n Auths.Rich.evidenceRequirementsSatisfied child facts → Auths.Rich.evidenceRequirementsSatisfied parent facts" + "module": "Auths.Codec.PrincipalScheme", + "name": "Auths.PrincipalScheme.scheme_refines", + "statement": "∀ (value : Aeneas.Std.Str),\n Aeneas.Std.WP.spec (AuthsScopeCodec.auths_model.identifier.principal_scheme_valid value) fun actual =>\n actual = Auths.PrincipalScheme.Model.evaluate (List.map (fun x => ↑x) ↑value)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.PrincipalScheme.Model.evaluate", + "AuthsScopeCodec.auths_model.identifier.principal_scheme_valid" + ] }, { "axioms": [ @@ -401,29 +1131,129 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.complete_admission_downward_closed", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {child parent : Auths.Rich.AuthorityScope v} {facts : Auths.Rich.AuthorizationFacts v},\n Auths.Rich.structuralScopeLe child parent → Auths.Rich.admits child facts → Auths.Rich.admits parent facts" + "module": "Auths.Codec.ScopeTrustSafety", + "name": "Auths.ScopeConstructor.accepted_rule_valid", + "statement": "∀ (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits)\n (rule : AuthsScopeCodec.auths_model.StatusTrustRule) (next : AuthsScopeCodec.cbor.Decoder),\n AuthsScopeCodec.decode.status_trust_rule decoder limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rule, next) →\n Auths.ScopeConstructor.scopeValid rule.scope", + "statement_constants": [ + "Eq", + "Prod", + "Prod.mk", + "Aeneas.Std.Result", + "Auths.ScopeConstructor.scopeValid", + "AuthsScopeCodec.auths_model.StatusTrustRule", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_trust_rule", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "AuthsScopeCodec.auths_model.StatusTrustRule.scope", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.semantic_attenuation_preorder_refl", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (scope : Auths.Rich.AuthorityScope v),\n Auths.Rich.semanticAttenuates scope scope" + "module": "Auths.Codec.ScopeTrustCollection", + "name": "Auths.ScopeConstructor.accepted_trust_valid", + "statement": "∀ (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits)\n (rules : Aeneas.Std.alloc.vec.Vec AuthsScopeCodec.auths_model.StatusTrustRule) (next : AuthsScopeCodec.cbor.Decoder),\n AuthsScopeCodec.decode.status_trust decoder limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rules, next) →\n Auths.ScopeConstructor.trustValid ↑rules", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.mk", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.ScopeConstructor.trustValid", + "AuthsScopeCodec.auths_model.StatusTrustRule", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_trust", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.semantic_attenuation_preorder_trans", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {a b c : Auths.Rich.AuthorityScope v},\n Auths.Rich.semanticAttenuates a b → Auths.Rich.semanticAttenuates b c → Auths.Rich.semanticAttenuates a c" + "module": "Auths.Codec.ScopeTrustSelectors", + "name": "Auths.ScopeConstructor.decoded_trust_principal", + "statement": "∀ (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits)\n (rules : Aeneas.Std.alloc.vec.Vec AuthsScopeCodec.auths_model.StatusTrustRule) (next : AuthsScopeCodec.cbor.Decoder)\n (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String)\n (view : AuthsStatusSelection.auths_model.StatusView) (now : Aeneas.Std.U64),\n AuthsScopeCodec.decode.status_trust decoder limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rules, next) →\n have constructed :=\n { id := snapshot.id, observed_at := snapshot.observed_at, valid_until := snapshot.valid_until,\n statements := snapshot.statements, checkpoints := snapshot.checkpoints,\n trust := Auths.ScopeConstructor.nativeRules rules };\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy constructed\n subject view now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑constructed.observed_at) (↑constructed.valid_until)\n (List.map Auths.StatusSelection.ruleView ↑constructed.trust)\n (List.map Auths.StatusSelection.principalView ↑constructed.statements) subject\n (Auths.StatusSelection.viewView view) ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Prod", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "Prod.mk", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "Auths.ScopeConstructor.nativeRules", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.viewView", + "AuthsScopeCodec.auths_model.StatusTrustRule", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_trust", + "AuthsScopeCodec.error.CodecError", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.checkpoints", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.mk", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -432,19 +1262,104 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.structural_scope_le_implies_semantic_attenuation", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {child parent : Auths.Rich.AuthorityScope v},\n Auths.Rich.structuralScopeLe child parent → Auths.Rich.semanticAttenuates child parent" + "module": "Auths.Codec.ScopeTrustSelectors", + "name": "Auths.ScopeConstructor.decoded_trust_grant", + "statement": "∀ (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits)\n (rules : Aeneas.Std.alloc.vec.Vec AuthsScopeCodec.auths_model.StatusTrustRule) (next : AuthsScopeCodec.cbor.Decoder)\n (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId)\n (view : AuthsStatusSelection.auths_model.StatusView) (now : Aeneas.Std.U64),\n AuthsScopeCodec.decode.status_trust decoder limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rules, next) →\n have constructed :=\n { id := snapshot.id, observed_at := snapshot.observed_at, valid_until := snapshot.valid_until,\n statements := snapshot.statements, checkpoints := snapshot.checkpoints,\n trust := Auths.ScopeConstructor.nativeRules rules };\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy constructed\n subject view now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑constructed.observed_at) (↑constructed.valid_until)\n (List.map Auths.StatusSelection.ruleView ↑constructed.trust)\n (List.map Auths.StatusSelection.grantView ↑constructed.statements) subject\n (Auths.StatusSelection.viewView view) ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Prod", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Prod.mk", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.ScopeConstructor.nativeRules", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.viewView", + "AuthsScopeCodec.auths_model.StatusTrustRule", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_trust", + "AuthsScopeCodec.error.CodecError", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.checkpoints", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.id", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.mk", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.scope_semantic_equivalence", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (scope : Auths.Rich.AuthorityScope v),\n Auths.Rich.scopeSemanticEquivalent scope scope" + "module": "Auths.Product.Refinement.SchemaIndex", + "name": "Auths.Product.SchemaIndex.Refinement.field_name_equal_spec", + "statement": "∀ (left right : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.field_name_equal left right) fun result =>\n result = decide (↑left = ↑right)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instDecidableEqList", + "instLENat", + "Decidable.decide", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.instDecidableEqUScalar_1", + "auths_gateway_kernel.construct.field_name_equal", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec" + ] }, { "axioms": [ @@ -453,29 +1368,90 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.structural_scope_le_decides_declared_v1_relation", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (child parent : Auths.Rich.AuthorityScope v),\n Auths.Rich.structuralScopeLeDecide child parent = true ↔ Auths.Rich.structuralScopeLe child parent" + "module": "Auths.Product.Refinement.SchemaIndex", + "name": "Auths.Product.SchemaIndex.Refinement.field_index_spec", + "statement": "∀ (names : Aeneas.Std.Slice (Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8)) (wanted : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.field_index names wanted) fun result =>\n Option.map Aeneas.Std.UScalar.val result =\n Auths.Product.SchemaIndex.position (Auths.Product.SchemaIndex.Refinement.namesView names)\n (List.map (fun x => ↑x) ↑wanted)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Option.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Usize", + "auths_gateway_kernel.construct.field_index", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.SchemaIndex.position", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SchemaIndex.Refinement.namesView" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_implies_scope_le", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → Auths.Rich.structuralScopeLe child.scope parent.scope" + "module": "Auths.Product.Refinement.OperationIdentity", + "name": "Auths.Product.OperationIdentity.Refinement.logical_preimage_exact", + "statement": "∀ (namespaceBytes operation : Aeneas.Std.Slice Aeneas.Std.U8),\n (↑namespaceBytes).length ≤ 64 →\n (↑operation).length ≤ 128 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.identity.logical_operation_preimage namespaceBytes operation)\n fun output =>\n Auths.Product.Refinement.Gateway.vecBytes output =\n Auths.Product.OperationIdentity.preimage\n { namespaceBytes := Auths.Product.Refinement.Gateway.sliceBytes namespaceBytes,\n operation := Auths.Product.Refinement.Gateway.sliceBytes operation }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.identity.logical_operation_preimage", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.OperationIdentity.preimage", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.OperationIdentity.Identity.mk", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_preserves_root", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → child.root = parent.root" + "module": "Auths.Product.Refinement.OperationIdentity", + "name": "Auths.Product.OperationIdentity.Refinement.token_exact", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.identity.valid_token value maximum) fun actual =>\n actual = Auths.Product.OperationIdentity.validToken (Auths.Product.Refinement.Gateway.sliceBytes value) ↑maximum", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_gateway_kernel.identity.valid_token", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.WP.spec", + "Auths.Product.OperationIdentity.validToken", + "Auths.Product.Refinement.Gateway.sliceBytes" + ] }, { "axioms": [ @@ -483,9 +1459,17 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_updates_subject_and_parent", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → child.subject = grant.subject ∧ child.lastGrant = some grantId" + "module": "Auths.Product.AdmissionHistory", + "name": "Auths.Product.AdmissionHistory.every_history_preserves_capacity", + "statement": "∀ (policy : Auths.Product.AdmissionHistory.Policy) (events : List Auths.Product.AdmissionHistory.Event),\n Auths.Product.AdmissionHistory.BudgetInvariant policy\n (Auths.Product.AdmissionHistory.run policy Auths.Product.AdmissionHistory.empty events)", + "statement_constants": [ + "List", + "Auths.Product.AdmissionHistory.BudgetInvariant", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Policy", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run" + ] }, { "axioms": [ @@ -493,69 +1477,186 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.anchored_chain_preserves_provenance", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v]\n {trusted : Auths.Rich.FiniteSet (Auths.Rich.Principal v)} {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.AnchoredChain trusted start rest →\n ∀ (state : Auths.Rich.ChainState v),\n state = start ∨ state ∈ rest → state.root = start.root ∧ Auths.Rich.rooted state ∧ state.root ∈ trusted" + "module": "Auths.Product.AdmissionOwnership", + "name": "Auths.Product.AdmissionHistory.claim_has_one_owner", + "statement": "∀ (policy : Auths.Product.AdmissionHistory.Policy) (events : List Auths.Product.AdmissionHistory.Event),\n Auths.Product.AdmissionHistory.SingleOwner\n (Auths.Product.AdmissionHistory.run policy Auths.Product.AdmissionHistory.empty events)", + "statement_constants": [ + "List", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Policy", + "Auths.Product.AdmissionHistory.SingleOwner", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.singleton_context_selects_fresh_self_rooted_start", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (start : Auths.Rich.ChainState v),\n start.root = start.subject → start.lastGrant = none → Auths.Rich.AnchoredChain {start.root} start []" + "module": "Auths.Product.AdmissionOwnership", + "name": "Auths.Product.AdmissionHistory.unacknowledged_has_no_new_handle", + "statement": "∀ (policy : Auths.Product.AdmissionHistory.Policy) (state : Auths.Product.AdmissionHistory.State)\n (request : Auths.Product.AdmissionHistory.Request),\n Auths.Product.AdmissionHistory.SingleOwner state →\n state.claims request.operation = none →\n (Auths.Product.AdmissionHistory.admit policy state request false).handles request.operation = none", + "statement_constants": [ + "Eq", + "Option", + "Bool.false", + "Option.none", + "Auths.Product.AdmissionHistory.Policy", + "Auths.Product.AdmissionHistory.Request", + "Auths.Product.AdmissionHistory.SingleOwner", + "Auths.Product.AdmissionHistory.State", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.admit", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.claims", + "Auths.Product.AdmissionHistory.State.handles" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Authority", - "name": "Auths.Authority.chain_descends_from_one_root", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v]\n {trusted : Auths.Rich.FiniteSet (Auths.Rich.Principal v)} {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.AnchoredChain trusted start rest →\n ∀ (state : Auths.Rich.ChainState v),\n state = start ∨ state ∈ rest → state.root = start.root ∧ Auths.Rich.rooted state ∧ state.root ∈ trusted" + "module": "Auths.Product.AdmissionOwnership", + "name": "Auths.Product.AdmissionHistory.recovery_mints_no_handle", + "statement": "∀ (policy : Auths.Product.AdmissionHistory.Policy) (state : Auths.Product.AdmissionHistory.State),\n (Auths.Product.AdmissionHistory.step policy state Auths.Product.AdmissionHistory.Event.readOnlyRecovery).handles =\n state.handles", + "statement_constants": [ + "Eq", + "Option", + "Auths.Product.AdmissionHistory.Operation", + "Auths.Product.AdmissionHistory.Policy", + "Auths.Product.AdmissionHistory.State", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.step", + "Auths.Product.AdmissionHistory.Event.readOnlyRecovery", + "Auths.Product.AdmissionHistory.State.handles" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_strict_depth", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → child.remainingDepth < parent.remainingDepth" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.available_capacity_admits", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true]).handles\n Auths.Product.AdmissionHistory.Examples.first.operation =\n some 1", + "statement_constants": [ + "Eq", + "Option", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.handles" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_never_widens", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → Auths.Rich.structuralScopeLe child.scope parent.scope" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.lost_acknowledgement_preserves_claim", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first false]).claims\n Auths.Product.AdmissionHistory.Examples.first.operation =\n some 1", + "statement_constants": [ + "Eq", + "Option", + "instOfNatNat", + "Bool.false", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.claims" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.remaining_depth_well_founded", - "statement": "∀ {v : Auths.Rich.Vocabulary}, WellFounded fun child parent => child.remainingDepth < parent.remainingDepth" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.lost_acknowledgement_cannot_enter", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first false,\n Auths.Product.AdmissionHistory.Event.writeEntry Auths.Product.AdmissionHistory.Examples.first.operation\n 1]).entries =\n []", + "statement_constants": [ + "Eq", + "List", + "Prod", + "instOfNatNat", + "Bool.false", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Operation", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Event.writeEntry", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.entries" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.finite_delegation_chain", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)}, Auths.Rich.DelegationChain start rest → rest.length ≤ start.remainingDepth" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.replay_cannot_change_owner", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true,\n Auths.Product.AdmissionHistory.Event.admission\n (have __src := Auths.Product.AdmissionHistory.Examples.first;\n { operation := __src.operation, worker := 2, debits := [] })\n true]).claims\n Auths.Product.AdmissionHistory.Examples.first.operation =\n some 1", + "statement_constants": [ + "Eq", + "Option", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.Product.AdmissionHistory.Debit", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Request", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.mk", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.claims" + ] }, { "axioms": [ @@ -564,9 +1665,31 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.chain_transitive_attenuation", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {root middle terminal : Auths.Rich.ChainState v} {firstId secondId : Auths.Rich.GrantId v}\n {firstGrant secondGrant : Auths.Rich.Grant v},\n Auths.Rich.delegates root firstId firstGrant middle →\n Auths.Rich.delegates middle secondId secondGrant terminal →\n Auths.Rich.structuralScopeLe terminal.scope root.scope" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.two_entries_consume_shared_capacity", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true,\n Auths.Product.AdmissionHistory.Event.writeEntry Auths.Product.AdmissionHistory.Examples.first.operation 1,\n Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.second true,\n Auths.Product.AdmissionHistory.Event.writeEntry Auths.Product.AdmissionHistory.Examples.second.operation 2,\n Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.third true]).historical\n 0 =\n 2", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Auths.Product.AdmissionHistory.Counter", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Event.writeEntry", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Examples.second", + "Auths.Product.AdmissionHistory.Examples.third", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.historical" + ] }, { "axioms": [ @@ -575,9 +1698,28 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.authorized_action_covered", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v} {action : Auths.Rich.Action v}\n {expression : Auths.Rich.BudgetExpression},\n Auths.Rich.delegates parent grantId grant child →\n Auths.Rich.actionCovers child.scope action expression → Auths.Rich.actionCovers parent.scope action expression" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.crash_cannot_refund_capacity", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true,\n Auths.Product.AdmissionHistory.Event.processCrash 1]).historical\n 0 =\n 1", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Auths.Product.AdmissionHistory.Counter", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Event.processCrash", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.State.historical" + ] }, { "axioms": [ @@ -586,9 +1728,31 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_dimension_is_exact", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v),\n (Auths.Rich.delegationProjection parent grant).value.extensionsAttenuate = true ↔\n Auths.Rich.extensionsLe (some grant.extensions) parent.scope.extensions" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.collected_window_cannot_reopen", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true,\n Auths.Product.AdmissionHistory.Event.collection 100, Auths.Product.AdmissionHistory.Event.collection 0,\n Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.second true]).claims\n Auths.Product.AdmissionHistory.Examples.second.operation =\n none", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.none", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Event.collection", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Examples.second", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.claims" + ] }, { "axioms": [ @@ -597,9 +1761,31 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.extensions_dimension_false_of_stripped", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v) (pinned : Auths.Rich.CriticalExtensions v),\n parent.scope.extensions = some pinned →\n ∀ {entry : Auths.Rich.CriticalExtension v},\n entry ∈ pinned.entries →\n (∀ candidate ∈ grant.extensions.entries, candidate.id ≠ entry.id) →\n (Auths.Rich.delegationProjection parent grant).value.extensionsAttenuate = false" + "module": "Auths.Product.AdmissionExamples", + "name": "Auths.Product.AdmissionHistory.Examples.write_handle_is_one_use", + "statement": "(Auths.Product.AdmissionHistory.run Auths.Product.AdmissionHistory.Examples.policy Auths.Product.AdmissionHistory.empty\n [Auths.Product.AdmissionHistory.Event.admission Auths.Product.AdmissionHistory.Examples.first true,\n Auths.Product.AdmissionHistory.Event.writeEntry Auths.Product.AdmissionHistory.Examples.first.operation 1,\n Auths.Product.AdmissionHistory.Event.writeEntry Auths.Product.AdmissionHistory.Examples.first.operation\n 1]).entries =\n [(Auths.Product.AdmissionHistory.Examples.first.operation, 1)]", + "statement_constants": [ + "Eq", + "List", + "Prod", + "instOfNatNat", + "Bool.true", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Prod.mk", + "Auths.Product.AdmissionHistory.Event", + "Auths.Product.AdmissionHistory.Operation", + "Auths.Product.AdmissionHistory.Worker", + "Auths.Product.AdmissionHistory.empty", + "Auths.Product.AdmissionHistory.run", + "Auths.Product.AdmissionHistory.Event.admission", + "Auths.Product.AdmissionHistory.Event.writeEntry", + "Auths.Product.AdmissionHistory.Examples.first", + "Auths.Product.AdmissionHistory.Examples.policy", + "Auths.Product.AdmissionHistory.Request.operation", + "Auths.Product.AdmissionHistory.State.entries" + ] }, { "axioms": [ @@ -608,29 +1794,77 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.altered_extensions_deny_every_projection", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v),\n ¬Auths.Rich.extensionsLe (some grant.extensions) parent.scope.extensions →\n Auths.Rich.certifiedAccepts (Auths.Rich.delegationProjection parent grant) = false" + "module": "Auths.Product.SchemaIndex", + "name": "Auths.Product.SchemaIndex.indexed_argument_is_named", + "statement": "∀ (fields : List Auths.Product.SchemaIndex.Name) (arguments : List Auths.Product.RequestConstruction.Arg)\n (named : Auths.Product.SchemaIndex.Name → Option Auths.Product.RequestConstruction.Arg),\n Auths.Product.SchemaIndex.Aligned fields arguments named →\n ∀ («name» : Auths.Product.SchemaIndex.Name) (index : ℕ),\n Auths.Product.SchemaIndex.position fields «name» = some index → arguments[index]? = named «name»", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLTNat", + "GetElem?.getElem?", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "Option.some", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.SchemaIndex.Aligned", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_attenuates_pinned_extensions", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child →\n ∀ (pinned : Auths.Rich.CriticalExtensions v),\n parent.scope.extensions = some pinned →\n child.scope.extensions = some grant.extensions ∧ Auths.Rich.extensionsAttenuate grant.extensions pinned" + "module": "Auths.Product.SchemaIndex", + "name": "Auths.Product.SchemaIndex.lowered_field_uses_exact_name", + "statement": "∀ (fields : List Auths.Product.SchemaIndex.Name) (arguments : List Auths.Product.RequestConstruction.Arg)\n (named : Auths.Product.SchemaIndex.Name → Option Auths.Product.RequestConstruction.Arg),\n Auths.Product.SchemaIndex.Aligned fields arguments named →\n ∀ («name» : Auths.Product.SchemaIndex.Name) (index : ℕ),\n Auths.Product.SchemaIndex.lowerSegment fields (Auths.Product.SchemaIndex.NamedSegment.field «name») =\n some (Auths.Product.RequestConstruction.Segment.field index) →\n arguments[index]? = named «name»", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLTNat", + "GetElem?.getElem?", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "Option.some", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.Segment", + "Auths.Product.SchemaIndex.Aligned", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.lowerSegment", + "Auths.Product.RequestConstruction.Segment.field", + "Auths.Product.SchemaIndex.NamedSegment.field" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.chain_retains_pinned_extension_identifiers", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.DelegationChain start rest →\n ∀ (pinned : Auths.Rich.CriticalExtensions v),\n start.scope.extensions = some pinned →\n ∀ state ∈ rest,\n ∃ carried, state.scope.extensions = some carried ∧ ∀ entry ∈ pinned.entries, carried.carries entry.id" + "module": "Auths.Product.SchemaIndex", + "name": "Auths.Product.SchemaIndex.undeclared_field_refused", + "statement": "∀ (fields : List Auths.Product.SchemaIndex.Name),\n ∀ «name» ∉ fields,\n Auths.Product.SchemaIndex.lowerSegment fields (Auths.Product.SchemaIndex.NamedSegment.field «name») = none", + "statement_constants": [ + "Eq", + "List", + "Not", + "Option", + "List.instMembership", + "Membership.mem", + "Option.none", + "Auths.Product.RequestConstruction.Segment", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.lowerSegment", + "Auths.Product.SchemaIndex.NamedSegment.field" + ] }, { "axioms": [ @@ -639,53 +1873,106 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.delegate_never_widens_authority", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {parent child : Auths.Rich.ChainState v} {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → Auths.Rich.semanticAttenuates child.scope parent.scope" + "module": "Auths.Product.SchemaIndex", + "name": "Auths.Product.SchemaIndex.field_rendering_preserved", + "statement": "∀ (fields : List Auths.Product.SchemaIndex.Name) (arguments : List Auths.Product.RequestConstruction.Arg)\n (named : Auths.Product.SchemaIndex.Name → Option Auths.Product.RequestConstruction.Arg),\n Auths.Product.SchemaIndex.Aligned fields arguments named →\n ∀ («name» : Auths.Product.SchemaIndex.Name) (index : ℕ) (value : Auths.Product.RequestConstruction.Bytes),\n Auths.Product.SchemaIndex.position fields «name» = some index →\n named «name» = some (Auths.Product.RequestConstruction.Arg.text value) →\n Auths.Product.RequestConstruction.segmentBytes arguments\n (Auths.Product.RequestConstruction.Segment.field index) =\n Auths.Product.RequestConstruction.pathEncode value", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "Option.some", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.pathEncode", + "Auths.Product.RequestConstruction.segmentBytes", + "Auths.Product.SchemaIndex.Aligned", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.RequestConstruction.Arg.text", + "Auths.Product.RequestConstruction.Segment.field" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.chain_never_widens_authority", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {start : Auths.Rich.ChainState v} {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.DelegationChain start rest → ∀ state ∈ rest, Auths.Rich.semanticAttenuates state.scope start.scope" + "module": "Auths.Product.OperationIdentity", + "name": "Auths.Product.OperationIdentity.preimage_injective", + "statement": "∀ (left right : Auths.Product.OperationIdentity.Identity),\n Auths.Product.OperationIdentity.NulFree left.namespaceBytes →\n Auths.Product.OperationIdentity.NulFree right.namespaceBytes →\n Auths.Product.OperationIdentity.preimage left = Auths.Product.OperationIdentity.preimage right → left = right", + "statement_constants": [ + "Eq", + "Auths.Product.OperationIdentity.Bytes", + "Auths.Product.OperationIdentity.Identity", + "Auths.Product.OperationIdentity.NulFree", + "Auths.Product.OperationIdentity.preimage", + "Auths.Product.OperationIdentity.Identity.namespaceBytes" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.rich_projection_accepts_iff_root_and_scope_depth_checks", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v),\n Auths.Rich.certifiedAccepts (Auths.Rich.delegationProjection parent grant) = true ↔\n Auths.Rich.rootPreserved parent grant ∧ Auths.Rich.scopeDepthChecks parent grant" + "module": "Auths.Product.OperationIdentity", + "name": "Auths.Product.OperationIdentity.valid_tokens_bind_identity", + "statement": "∀ (left right : Auths.Product.OperationIdentity.Identity),\n Auths.Product.OperationIdentity.validToken left.namespaceBytes 64 = true →\n Auths.Product.OperationIdentity.validToken right.namespaceBytes 64 = true →\n Auths.Product.OperationIdentity.preimage left = Auths.Product.OperationIdentity.preimage right → left = right", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instOfNatNat", + "Bool.true", + "OfNat.ofNat", + "Auths.Product.OperationIdentity.Bytes", + "Auths.Product.OperationIdentity.Identity", + "Auths.Product.OperationIdentity.preimage", + "Auths.Product.OperationIdentity.validToken", + "Auths.Product.OperationIdentity.Identity.namespaceBytes" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.apply_grant_success_iff_linked_and_projection", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v) (child : Auths.Rich.ChainState v),\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted child ↔\n Auths.Rich.linked parent grant ∧\n Auths.Rich.certifiedAccepts (Auths.Rich.delegationProjection parent grant) = true ∧\n ∃ (checks : Auths.Rich.scopeDepthChecks parent grant),\n child = Auths.Rich.acceptedNextState parent grantId grant checks" + "module": "Auths.Codec.PrincipalSchemeModel", + "name": "Auths.PrincipalScheme.Model.evaluate_iff_grammar", + "statement": "∀ (values : List ℕ), Auths.PrincipalScheme.Model.evaluate values = true ↔ Auths.PrincipalScheme.Model.grammar values", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Bool.true", + "Auths.PrincipalScheme.Model.evaluate", + "Auths.PrincipalScheme.Model.grammar" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.apply_grant_success_iff_delegates", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v) (child : Auths.Rich.ChainState v),\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted child ↔\n Auths.Rich.delegates parent grantId grant child" + "module": "Auths.Codec.PrincipalSchemeModel", + "name": "Auths.PrincipalScheme.Model.grammar_minimum", + "statement": "∀ (values : List ℕ), Auths.PrincipalScheme.Model.grammar values → 3 ≤ values.length", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Auths.PrincipalScheme.Model.grammar" + ] }, { "axioms": [ @@ -694,9 +1981,50 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.apply_grant_success_unique", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v} {left right : Auths.Rich.ChainState v},\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted left →\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted right → left = right" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list", + "statement": "AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.unsortedListed\n Auths.ScopeConstructor.DecodeExamples.limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok\n (AuthsScopeCodec.auths_model.StatusScope.Anchors\n ⟨[\"a\", \"c\"], Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list._proof_1⟩),\n have __src := Auths.ScopeConstructor.DecodeExamples.unsortedListed;\n { input := __src.input, position := 9#usize })", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Subtype.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.TrustAnchorId", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.limits", + "Auths.ScopeConstructor.DecodeExamples.unsortedListed", + "AuthsScopeCodec.auths_model.StatusScope.Anchors", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "Aeneas.Std.core.result.Result", + "Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list._proof_1", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -705,9 +2033,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.authority_delegate_diagnostic_sound_complete", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v),\n (∃ child, Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted child) ↔\n Auths.Rich.linked parent grant ∧ Auths.Rich.scopeDepthChecks parent grant" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list", + "statement": "AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.duplicateListed\n Auths.ScopeConstructor.DecodeExamples.limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsScopeCodec.error.CodecError.Model AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot),\n have __src := Auths.ScopeConstructor.DecodeExamples.duplicateListed;\n { input := __src.input, position := 9#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.duplicateListed", + "Auths.ScopeConstructor.DecodeExamples.limits", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "AuthsScopeCodec.error.CodecError.Model", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -716,9 +2078,33 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.authority_delegate_first_failure", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v),\n (Auths.Rich.evaluateGrant parent grantId grant =\n Auths.Rich.DelegationDecision.denied Auths.Rich.DelegationDiagnostic.brokenGrantChain ↔\n ¬Auths.Rich.linked parent grant) ∧\n (Auths.Rich.evaluateGrant parent grantId grant =\n Auths.Rich.DelegationDecision.denied Auths.Rich.DelegationDiagnostic.delegationExpanded ↔\n Auths.Rich.linked parent grant ∧ ¬Auths.Rich.scopeDepthChecks parent grant)" + "module": "Auths.Codec.ScopeDecodedUse", + "name": "Auths.ScopeConstructor.decoded_scope_covers", + "statement": "∀ (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits)\n (scope : AuthsScopeCodec.auths_model.StatusScope) (next : AuthsScopeCodec.cbor.Decoder) (issuer : String)\n (anchor : AuthsStatusSelection.auths_model.TrustAnchor),\n AuthsScopeCodec.decode.status_scope decoder limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok scope, next) →\n (Auths.ScopeConstructor.nativeScope scope).covers issuer anchor =\n Aeneas.Std.Result.ok\n (Auths.StatusSelection.Model.scopeCovers\n (Auths.StatusSelection.scopeView (Auths.ScopeConstructor.nativeScope scope)) issuer\n (Auths.StatusSelection.Model.View.anchor anchor.id anchor.principal))", + "statement_constants": [ + "Bool", + "Eq", + "Prod", + "String", + "Prod.mk", + "Aeneas.Std.Result", + "Auths.ScopeConstructor.nativeScope", + "Auths.StatusSelection.scopeView", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "AuthsStatusSelection.auths_model.TrustAnchor", + "Aeneas.Std.Result.ok", + "Auths.StatusSelection.Model.scopeCovers", + "AuthsStatusSelection.auths_model.StatusScope.covers", + "AuthsStatusSelection.auths_model.TrustAnchor.id", + "AuthsStatusSelection.auths_model.TrustAnchor.principal", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.View.anchor", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -727,59 +2113,252 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.author_planning_diagnostic_sound_complete", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent child : Auths.Rich.AuthorityScope v)\n (parentDepth childDepth : ℕ),\n Auths.Rich.evaluateAuthorScope parent child parentDepth childDepth = Auths.Rich.AuthorDecision.accepted ↔\n Auths.Rich.structuralScopeLe child parent ∧ 0 < parentDepth ∧ childDepth < parentDepth" + "module": "Auths.Codec.ScopeDecodeSafety", + "name": "Auths.ScopeConstructor.accepted_scope_valid", + "statement": "∀ (decoder : AuthsScopeCodec.cbor.Decoder) (limits : AuthsScopeCodec.auths_model.VerifierLimits)\n (scope : AuthsScopeCodec.auths_model.StatusScope) (next : AuthsScopeCodec.cbor.Decoder),\n AuthsScopeCodec.decode.status_scope decoder limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok scope, next) →\n Auths.ScopeConstructor.scopeValid scope", + "statement_constants": [ + "Eq", + "Prod", + "Prod.mk", + "Aeneas.Std.Result", + "Auths.ScopeConstructor.scopeValid", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.coverage_decision_ok_iff_covers", - "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (authority : Auths.Rich.ChainState v)\n (action : Auths.Rich.Action v) (expression : Auths.Rich.BudgetExpression),\n Auths.Rich.evaluateCoverage authority action expression = Auths.Rich.CoverageDecision.authorized ↔\n Auths.Rich.terminalCovers authority action expression" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.accepts_own", + "statement": "∀ (limits : AuthsScopeCodec.auths_model.VerifierLimits),\n AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.own limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok AuthsScopeCodec.auths_model.StatusScope.OwnAnchor,\n have __src := Auths.ScopeConstructor.DecodeExamples.own;\n { input := __src.input, position := 3#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.own", + "AuthsScopeCodec.auths_model.StatusScope.OwnAnchor", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.rooted_of_origin", - "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (state : Auths.Rich.ChainState v),\n state.root = state.subject → state.lastGrant = none → Auths.Rich.rooted state" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.accepts_any", + "statement": "∀ (limits : AuthsScopeCodec.auths_model.VerifierLimits),\n AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.anyAnchor limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok AuthsScopeCodec.auths_model.StatusScope.AnyAnchor,\n have __src := Auths.ScopeConstructor.DecodeExamples.anyAnchor;\n { input := __src.input, position := 3#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.anyAnchor", + "AuthsScopeCodec.auths_model.StatusScope.AnyAnchor", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.reachable_accepted", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v),\n Auths.Rich.ReachableFromRoot parent →\n grant.issuer = parent.subject →\n ∀ (checks : Auths.Rich.scopeDepthChecks parent grant),\n Auths.Rich.ReachableFromRoot (Auths.Rich.acceptedNextState parent grantId grant checks)" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag", + "statement": "∀ (limits : AuthsScopeCodec.auths_model.VerifierLimits),\n AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.unknown limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.error.CodecError.Malformed,\n have __src := Auths.ScopeConstructor.DecodeExamples.unknown;\n { input := __src.input, position := 3#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.unknown", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "AuthsScopeCodec.error.CodecError.Malformed", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.rooted_of_reachable", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {state : Auths.Rich.ChainState v},\n Auths.Rich.ReachableFromRoot state → Auths.Rich.rooted state" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.refuses_truncation", + "statement": "∀ (limits : AuthsScopeCodec.auths_model.VerifierLimits),\n AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.truncated limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.error.CodecError.Malformed,\n have __src := Auths.ScopeConstructor.DecodeExamples.truncated;\n { input := __src.input, position := 2#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.truncated", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "AuthsScopeCodec.error.CodecError.Malformed", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.registry_coverage_decision_ok_iff_covers", - "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (authority : Auths.Rich.ChainState v)\n (action : Auths.Rich.Action v) (registry : Auths.Rich.BudgetExpressionRegistry v),\n Auths.Rich.evaluateCoverageWithRegistry authority action registry = Auths.Rich.CoverageDecision.authorized ↔\n Auths.Rich.terminalCoversWithRegistry authority action registry" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.accepts_listed", + "statement": "AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.listed\n Auths.ScopeConstructor.DecodeExamples.limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok\n (AuthsScopeCodec.auths_model.StatusScope.Anchors\n ⟨[\"anchor:a\"], Auths.ScopeConstructor.DecodeExamples.accepts_listed._proof_1⟩),\n have __src := Auths.ScopeConstructor.DecodeExamples.listed;\n { input := __src.input, position := 14#usize })", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Subtype.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.TrustAnchorId", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.limits", + "Auths.ScopeConstructor.DecodeExamples.listed", + "AuthsScopeCodec.auths_model.StatusScope.Anchors", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "Aeneas.Std.core.result.Result", + "Auths.ScopeConstructor.DecodeExamples.accepts_listed._proof_1", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -788,9 +2367,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.CertifiedProjection.extensions_not_forgeable", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n {grant : Auths.Rich.Grant v} (certified : Auths.Rich.CertifiedProjection parent grant),\n ¬Auths.Rich.extensionsLe (some grant.extensions) parent.scope.extensions → certified.value.extensionsAttenuate = false" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.refuses_empty_list", + "statement": "AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.emptyListed\n Auths.ScopeConstructor.DecodeExamples.limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsScopeCodec.error.CodecError.Model AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot),\n have __src := Auths.ScopeConstructor.DecodeExamples.emptyListed;\n { input := __src.input, position := 5#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.emptyListed", + "Auths.ScopeConstructor.DecodeExamples.limits", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "AuthsScopeCodec.error.CodecError.Model", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -799,9 +2412,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.CertifiedProjection.root_not_forgeable", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n {grant : Auths.Rich.Grant v} (certified : Auths.Rich.CertifiedProjection parent grant),\n ¬Auths.Rich.rootPreserved parent grant → certified.value.rootPreserved = false" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id", + "statement": "AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.invalidId\n Auths.ScopeConstructor.DecodeExamples.limits =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsScopeCodec.error.CodecError.Model AuthsScopeCodec.auths_model.ModelError.InvalidRegistryId),\n have __src := Auths.ScopeConstructor.DecodeExamples.invalidId;\n { input := __src.input, position := 6#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.invalidId", + "Auths.ScopeConstructor.DecodeExamples.limits", + "AuthsScopeCodec.auths_model.ModelError.InvalidRegistryId", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "AuthsScopeCodec.error.CodecError.Model", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -810,9 +2457,73 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.validity_start_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 5 10 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 3 10 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.validity" + "module": "Auths.Codec.ScopeDecodeExamples", + "name": "Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit", + "statement": "AuthsScopeCodec.decode.status_scope Auths.ScopeConstructor.DecodeExamples.listed\n (have __src := Auths.ScopeConstructor.DecodeExamples.limits;\n { bundle_bytes := __src.bundle_bytes, action_bytes := __src.action_bytes, context_bytes := __src.context_bytes,\n grants := __src.grants, actions := __src.actions, plan_leaves := __src.plan_leaves,\n plan_depth := __src.plan_depth, plan_branching := __src.plan_branching, evidence := __src.evidence,\n evidence_bytes := __src.evidence_bytes, bindings := __src.bindings, principal_status := __src.principal_status,\n grant_status := __src.grant_status, attachments := __src.attachments, attachment_bytes := __src.attachment_bytes,\n signatures := __src.signatures, signature_bytes := __src.signature_bytes, permissions := __src.permissions,\n audiences := __src.audiences, extensions := __src.extensions, extension_bytes := __src.extension_bytes,\n body_digests := __src.body_digests, binding_evidence := __src.binding_evidence,\n canonical_body_bytes := __src.canonical_body_bytes, registry_entries := __src.registry_entries,\n trust_anchors := 0#usize, work_units := __src.work_units, approvals := __src.approvals,\n approver_anchors := __src.approver_anchors, approval_requirements := __src.approval_requirements }) =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.error.CodecError.LimitExceeded,\n have __src := Auths.ScopeConstructor.DecodeExamples.listed;\n { input := __src.input, position := 5#usize })", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.StatusScope", + "AuthsScopeCodec.auths_model.VerifierLimits", + "AuthsScopeCodec.cbor.Decoder", + "AuthsScopeCodec.decode.status_scope", + "AuthsScopeCodec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.ScopeConstructor.DecodeExamples.limits", + "Auths.ScopeConstructor.DecodeExamples.listed", + "AuthsScopeCodec.auths_model.VerifierLimits.action_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.actions", + "AuthsScopeCodec.auths_model.VerifierLimits.approval_requirements", + "AuthsScopeCodec.auths_model.VerifierLimits.approvals", + "AuthsScopeCodec.auths_model.VerifierLimits.approver_anchors", + "AuthsScopeCodec.auths_model.VerifierLimits.attachment_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.attachments", + "AuthsScopeCodec.auths_model.VerifierLimits.audiences", + "AuthsScopeCodec.auths_model.VerifierLimits.binding_evidence", + "AuthsScopeCodec.auths_model.VerifierLimits.bindings", + "AuthsScopeCodec.auths_model.VerifierLimits.body_digests", + "AuthsScopeCodec.auths_model.VerifierLimits.bundle_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.canonical_body_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.context_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.evidence", + "AuthsScopeCodec.auths_model.VerifierLimits.evidence_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.extension_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.extensions", + "AuthsScopeCodec.auths_model.VerifierLimits.grant_status", + "AuthsScopeCodec.auths_model.VerifierLimits.grants", + "AuthsScopeCodec.auths_model.VerifierLimits.mk", + "AuthsScopeCodec.auths_model.VerifierLimits.permissions", + "AuthsScopeCodec.auths_model.VerifierLimits.plan_branching", + "AuthsScopeCodec.auths_model.VerifierLimits.plan_depth", + "AuthsScopeCodec.auths_model.VerifierLimits.plan_leaves", + "AuthsScopeCodec.auths_model.VerifierLimits.principal_status", + "AuthsScopeCodec.auths_model.VerifierLimits.registry_entries", + "AuthsScopeCodec.auths_model.VerifierLimits.signature_bytes", + "AuthsScopeCodec.auths_model.VerifierLimits.signatures", + "AuthsScopeCodec.auths_model.VerifierLimits.work_units", + "AuthsScopeCodec.cbor.Decoder.input", + "AuthsScopeCodec.cbor.Decoder.mk", + "AuthsScopeCodec.error.CodecError.LimitExceeded", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -821,9 +2532,71 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.validity_end_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 5 10 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 5 12 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.validity" + "module": "Auths.Codec.ScopeSelectors", + "name": "Auths.ScopeConstructor.constructed_grant_selection", + "statement": "∀ (values : Aeneas.Std.alloc.vec.Vec String) (implementation : AuthsStatusSelection.ExactStatusMethod)\n (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId)\n (view : AuthsStatusSelection.auths_model.StatusView) (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (AuthsScopeCodec.auths_model.StatusScopeAnchors.new values) fun result =>\n match result with\n | Aeneas.Std.core.result.Result.Ok output =>\n have constructed :=\n { id := snapshot.id, observed_at := snapshot.observed_at, valid_until := snapshot.valid_until,\n statements := snapshot.statements, checkpoints := snapshot.checkpoints,\n trust := Auths.ScopeConstructor.listedRules output snapshot.trust };\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy constructed\n subject view now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑constructed.observed_at) (↑constructed.valid_until)\n (List.map Auths.StatusSelection.ruleView ↑constructed.trust)\n (List.map Auths.StatusSelection.grantView ↑constructed.statements) subject\n (Auths.StatusSelection.viewView view) ↑now\n | Aeneas.Std.core.result.Result.Err error => error = AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.ScopeConstructor.listedRules", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.viewView", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.ScopeConstructor.constructed_principal_selection.match_1", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.checkpoints", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.id", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.mk", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -832,9 +2605,64 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.permission_subset_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := {{ value := 0 }, { value := 1 }}, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := {{ value := 0 }}, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted" + "module": "Auths.Codec.ScopeSelectors", + "name": "Auths.ScopeConstructor.constructed_principal_selection", + "statement": "∀ (values : Aeneas.Std.alloc.vec.Vec String) (implementation : AuthsStatusSelection.ExactStatusMethod)\n (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String)\n (view : AuthsStatusSelection.auths_model.StatusView) (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (AuthsScopeCodec.auths_model.StatusScopeAnchors.new values) fun result =>\n match result with\n | Aeneas.Std.core.result.Result.Ok output =>\n have constructed :=\n { id := snapshot.id, observed_at := snapshot.observed_at, valid_until := snapshot.valid_until,\n statements := snapshot.statements, checkpoints := snapshot.checkpoints,\n trust := Auths.ScopeConstructor.listedRules output snapshot.trust };\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy\n constructed subject view now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑constructed.observed_at) (↑constructed.valid_until)\n (List.map Auths.StatusSelection.ruleView ↑constructed.trust)\n (List.map Auths.StatusSelection.principalView ↑constructed.statements) subject\n (Auths.StatusSelection.viewView view) ↑now\n | Aeneas.Std.core.result.Result.Err error => error = AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.U64", + "Auths.ScopeConstructor.listedRules", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.viewView", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.ScopeConstructor.constructed_principal_selection.match_1", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.checkpoints", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.mk", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -843,39 +2671,129 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.audience_subset_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := {{ value := 0 }, { value := 1 }}, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := {{ value := 0 }}, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted" + "module": "Auths.Codec.ScopeConstructor", + "name": "Auths.ScopeConstructor.constructor_refines", + "statement": "∀ (values : Aeneas.Std.alloc.vec.Vec String),\n AuthsScopeCodec.auths_model.StatusScopeAnchors.new values =\n Aeneas.Std.Result.ok (Auths.ScopeConstructor.expectedConstructor values)", + "statement_constants": [ + "Eq", + "String", + "Aeneas.Std.Result", + "Auths.ScopeConstructor.expectedConstructor", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "Aeneas.Std.Result.ok", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.permission_membership_decision", - "statement": "Auths.Rich.evaluateCoverage (Auths.Rich.Mutations.baseState✝ 0 0 2 none) Auths.Rich.Mutations.baseAction✝\n Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.authorized" + "module": "Auths.Codec.ScopeConsequences", + "name": "Auths.ScopeConstructor.constructor_validity", + "statement": "∀ (values : Aeneas.Std.alloc.vec.Vec String),\n Aeneas.Std.WP.spec (AuthsScopeCodec.auths_model.StatusScopeAnchors.new values) fun result =>\n match result with\n | Aeneas.Std.core.result.Result.Ok output =>\n Auths.ScopeConstructor.Model.admitted ↑values ∧\n Auths.StatusSelection.Search.Ordered ↑output ∧\n (↑output).Perm ↑values ∧ (↑output).length ≤ Auths.ScopeConstructor.Model.maximum\n | Aeneas.Std.core.result.Result.Err error =>\n error = AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot ∧\n ¬Auths.ScopeConstructor.Model.admitted ↑values", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Not", + "String", + "instLENat", + "LE.le", + "List.Perm", + "List.length", + "String.instOrd", + "Subtype.val", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "AuthsScopeCodec.auths_model.TrustAnchorId", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.ScopeConstructor.Model.admitted", + "Auths.ScopeConstructor.Model.maximum", + "Auths.ScopeConstructor.constructor_validity.match_1", + "Auths.StatusSelection.Search.Ordered", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.audience_membership_decision", - "statement": "Auths.Rich.evaluateCoverage (Auths.Rich.Mutations.baseState✝ 0 0 2 none) Auths.Rich.Mutations.baseAction✝\n Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.authorized" + "module": "Auths.Codec.ScopeConsequences", + "name": "Auths.ScopeConstructor.constructed_lookup", + "statement": "∀ (values : Aeneas.Std.alloc.vec.Vec String) (target : String),\n Aeneas.Std.WP.spec (AuthsScopeCodec.auths_model.StatusScopeAnchors.new values) fun result =>\n match result with\n | Aeneas.Std.core.result.Result.Ok output =>\n AuthsStatusSelection.auths_model.StatusScopeAnchors.contains output target =\n Aeneas.Std.Result.ok ((↑values).contains target)\n | Aeneas.Std.core.result.Result.Err error => error = AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "LE.le", + "List.contains", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.ScopeConstructor.constructor_validity.match_1", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "AuthsStatusSelection.auths_model.StatusScopeAnchors.contains", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.body_digest_membership_decision", - "statement": "Auths.Rich.evaluateCoverage\n (have __src := Auths.Rich.Mutations.baseState✝ 0 0 2 none;\n { root := __src.root, subject := __src.subject,\n scope :=\n have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences,\n actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }}, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions },\n remainingDepth := __src.remainingDepth, lastGrant := __src.lastGrant })\n Auths.Rich.Mutations.baseAction✝ Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.authorized" + "module": "Auths.Codec.ScopeExamples", + "name": "Auths.ScopeConstructor.Examples.accepts_unsorted", + "statement": "AuthsScopeCodec.auths_model.StatusScopeAnchors.new Auths.ScopeConstructor.Examples.pair =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok\n ⟨[\"anchor:a\", \"anchor:c\"], Auths.ScopeConstructor.Examples.accepts_unsorted._proof_1⟩)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Subtype.mk", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "AuthsScopeCodec.auths_model.TrustAnchorId", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.ScopeConstructor.Examples.pair", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "Aeneas.Std.core.result.Result", + "Auths.ScopeConstructor.Examples.accepts_unsorted._proof_1", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -884,19 +2802,44 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.body_digest_subset_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences,\n actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }, { value := 1 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted" + "module": "Auths.Codec.ScopeExamples", + "name": "Auths.ScopeConstructor.Examples.rejects_duplicate", + "statement": "AuthsScopeCodec.auths_model.StatusScopeAnchors.new Auths.ScopeConstructor.Examples.duplicate =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "Aeneas.Std.Result.ok", + "Auths.ScopeConstructor.Examples.duplicate", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.action_exact_equality", - "statement": "Auths.Rich.evaluateCoverage\n (have __src := Auths.Rich.Mutations.baseState✝ 0 0 2 none;\n { root := __src.root, subject := __src.subject,\n scope :=\n have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.exactBodyDigest { value := 0 },\n budget := __src.budget, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions },\n remainingDepth := __src.remainingDepth, lastGrant := __src.lastGrant })\n (Auths.Rich.Mutations.baseAction✝ 0 none 0 0 0 1) Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.denied Auths.Rich.CoverageDiagnostic.actionConstraintMismatch" + "module": "Auths.Codec.ScopeExamples", + "name": "Auths.ScopeConstructor.Examples.rejects_empty", + "statement": "AuthsScopeCodec.auths_model.StatusScopeAnchors.new Auths.ScopeConstructor.Examples.empty =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "Aeneas.Std.Result.ok", + "Auths.ScopeConstructor.Examples.empty", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -905,9 +2848,32 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.action_constructor_fallback", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.exactBodyDigest { value := 0 },\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences,\n actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }, { value := 1 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.actionConstraint" + "module": "Auths.Codec.ScopeExamples", + "name": "Auths.ScopeConstructor.Examples.rejects_oversized", + "statement": "∀ (values : Aeneas.Std.alloc.vec.Vec String),\n Auths.ScopeConstructor.Model.maximum < (↑values).length →\n AuthsScopeCodec.auths_model.StatusScopeAnchors.new values =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "String", + "instLENat", + "instLTNat", + "LE.le", + "LT.lt", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "AuthsScopeCodec.auths_model.ModelError", + "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.ScopeConstructor.Model.maximum", + "AuthsScopeCodec.auths_model.ModelError.InvalidStatusSnapshot", + "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -916,9 +2882,41 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.action_singleton_exact_rejection", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.exactBodyDigest { value := 0 },\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted" + "module": "Auths.Verifier.StatusSearchLoop", + "name": "Auths.StatusSelection.Search.search_loop", + "statement": "∀ (values : List String) (target : String) (fuel base size : ℕ),\n Auths.StatusSelection.Search.Ordered values →\n 0 < size →\n size < fuel →\n base + size ≤ values.length →\n ∃ result,\n AuthsStatusSelection.binarySearchLoop AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpOrd values\n target fuel base size =\n Aeneas.Std.Result.ok result ∧\n (Auths.StatusSelection.Search.hit result = true ↔\n Auths.StatusSelection.Search.Found values target base size) ∧\n Auths.StatusSelection.Search.index result ≤ base + size", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Iff", + "List", + "Nat", + "String", + "instAddNat", + "instHAdd", + "instLENat", + "instLTNat", + "instOfNatNat", + "AuthsStatusSelection.binarySearchLoop", + "Bool.true", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.length", + "OfNat.ofNat", + "String.instOrd", + "Aeneas.Std.Result", + "AuthsStatusSelection.auths_model.TrustAnchorId", + "Aeneas.Std.Result.ok", + "Auths.StatusSelection.Search.Found", + "Auths.StatusSelection.Search.Ordered", + "Auths.StatusSelection.Search.hit", + "Auths.StatusSelection.Search.index", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpOrd" + ] }, { "axioms": [ @@ -927,9 +2925,31 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.budget_value_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 3 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.budget" + "module": "Auths.Verifier.StatusSearchContains", + "name": "Auths.StatusSelection.Search.scope_contains", + "statement": "∀ (values : AuthsStatusSelection.auths_model.StatusScopeAnchors) (target : String),\n Auths.StatusSelection.Search.Ordered ↑values →\n values.contains target = Aeneas.Std.Result.ok ((↑values).contains target)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "LE.le", + "List.contains", + "List.length", + "String.instOrd", + "Subtype.val", + "Aeneas.Std.Result", + "AuthsStatusSelection.auths_model.StatusScopeAnchors", + "AuthsStatusSelection.auths_model.TrustAnchorId", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.StatusSelection.Search.Ordered", + "AuthsStatusSelection.auths_model.StatusScopeAnchors.contains" + ] }, { "axioms": [ @@ -938,9 +2958,32 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.budget_algebra_equality", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 1 }, value := 1 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.budget" + "module": "Auths.Verifier.StatusAnchorVisibility", + "name": "Auths.StatusSelection.visibility_refines", + "statement": "∀ (rules : Aeneas.Std.Slice AuthsStatusSelection.auths_model.StatusTrustRule) (issuer : String)\n (view : AuthsStatusSelection.auths_model.StatusView),\n Auths.StatusSelection.rulesOrdered ↑rules →\n Aeneas.Std.WP.spec (AuthsStatusSelection.auths_model.status_issuer_visible rules issuer view) fun actual =>\n actual =\n Auths.StatusSelection.Model.visible (List.map Auths.StatusSelection.ruleView ↑rules) issuer\n (Auths.StatusSelection.viewView view)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "String", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.rulesOrdered", + "Auths.StatusSelection.viewView", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_model.status_issuer_visible", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.visible" + ] }, { "axioms": [ @@ -949,19 +2992,118 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.optional_budget_bounded_parent", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := none, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.budget" + "module": "Auths.Verifier.StatusAllViews", + "name": "Auths.StatusSelection.principal_method_all_views", + "statement": "∀ (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String)\n (view : AuthsStatusSelection.auths_model.StatusView) (now : Aeneas.Std.U64),\n Auths.StatusSelection.rulesOrdered ↑snapshot.trust →\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy snapshot\n subject view now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑snapshot.observed_at) (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.principalView ↑snapshot.statements) subject\n (Auths.StatusSelection.viewView view) ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.U64", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.rulesOrdered", + "Auths.StatusSelection.viewView", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.optional_budget_no_request", - "statement": "Auths.Rich.evaluateCoverage\n (have __src := Auths.Rich.Mutations.baseState✝ 0 0 2 none;\n { root := __src.root, subject := __src.subject,\n scope :=\n have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions },\n remainingDepth := __src.remainingDepth, lastGrant := __src.lastGrant })\n Auths.Rich.Mutations.baseAction✝ Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.denied Auths.Rich.CoverageDiagnostic.budgetCeilingExceeded" + "module": "Auths.Verifier.StatusAllViews", + "name": "Auths.StatusSelection.grant_method_all_views", + "statement": "∀ (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId)\n (view : AuthsStatusSelection.auths_model.StatusView) (now : Aeneas.Std.U64),\n Auths.StatusSelection.rulesOrdered ↑snapshot.trust →\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy snapshot subject\n view now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑snapshot.observed_at) (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.grantView ↑snapshot.statements) subject\n (Auths.StatusSelection.viewView view) ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.rulesOrdered", + "Auths.StatusSelection.viewView", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.StatusView", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "Aeneas.Std.core.result.Result", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -970,9 +3112,18 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.delegation_depth_strictness", - "statement": "Auths.Rich.Mutations.delegationDeniedWith✝ Auths.Rich.DelegationDiagnostic.delegationExpanded\n (Auths.Rich.evaluateGrant (Auths.Rich.Mutations.baseState✝ 0 0 3 none) { value := 0 }\n (Auths.Rich.Mutations.baseGrant✝ 0 3)) =\n true" + "module": "Auths.Verifier.StatusAnchorExamples", + "name": "Auths.StatusSelection.AnchorExamples.first_listed_anchor", + "statement": "Auths.StatusSelection.AnchorExamples.anchors.contains \"anchor:a\" = Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.StatusSelection.AnchorExamples.anchors", + "AuthsStatusSelection.auths_model.StatusScopeAnchors.contains" + ] }, { "axioms": [ @@ -981,9 +3132,18 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.status_age_direction", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 0 } { seconds := 5, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 0 } { seconds := 10, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.status" + "module": "Auths.Verifier.StatusAnchorExamples", + "name": "Auths.StatusSelection.AnchorExamples.last_listed_anchor", + "statement": "Auths.StatusSelection.AnchorExamples.anchors.contains \"anchor:c\" = Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.StatusSelection.AnchorExamples.anchors", + "AuthsStatusSelection.auths_model.StatusScopeAnchors.contains" + ] }, { "axioms": [ @@ -992,9 +3152,18 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.status_method_equality", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 0 } { seconds := 5, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 1 } { seconds := 5, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.status" + "module": "Auths.Verifier.StatusAnchorExamples", + "name": "Auths.StatusSelection.AnchorExamples.unlisted_anchor_refused", + "statement": "Auths.StatusSelection.AnchorExamples.anchors.contains \"anchor:b\" = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.StatusSelection.AnchorExamples.anchors", + "AuthsStatusSelection.auths_model.StatusScopeAnchors.contains" + ] }, { "axioms": [ @@ -1003,9 +3172,45 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.assurance_equality", - "statement": "Auths.Rich.evaluateAuthorScope Auths.Rich.Mutations.baseScope✝ (Auths.Rich.Mutations.baseScope✝ 1) 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.assurance" + "module": "Auths.Verifier.StatusAnchorExamples", + "name": "Auths.StatusSelection.AnchorExamples.own_anchor_active", + "statement": "∀ (base : AuthsStatusSelection.auths_model.TrustAnchor),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n Auths.StatusSelection.AnchorExamples.ownSnapshot \"raw:actor\"\n (AuthsStatusSelection.auths_model.StatusView.Anchor\n (Auths.StatusSelection.AnchorExamples.anchor base \"raw:issuer\"))\n 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.active, through := 60 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.TrustAnchor", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.AnchorExamples.anchor", + "Auths.StatusSelection.AnchorExamples.ownSnapshot", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.StatusView.Anchor", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.Decision.active", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1014,18 +3219,70 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.critical_extension_law", - "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance,\n extensions := some (Auths.Rich.Mutations.singletonExtension✝ 0 0) })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance,\n extensions := some (Auths.Rich.Mutations.singletonExtension✝ 0 1) })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.extensions" + "module": "Auths.Verifier.StatusAnchorExamples", + "name": "Auths.StatusSelection.AnchorExamples.other_anchor_hidden", + "statement": "∀ (base : AuthsStatusSelection.auths_model.TrustAnchor),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n Auths.StatusSelection.AnchorExamples.ownSnapshot \"raw:actor\"\n (AuthsStatusSelection.auths_model.StatusView.Anchor\n (Auths.StatusSelection.AnchorExamples.anchor base \"raw:other\"))\n 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.missing, through := 100 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.TrustAnchor", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.AnchorExamples.anchor", + "Auths.StatusSelection.AnchorExamples.ownSnapshot", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.StatusView.Anchor", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.Decision.missing", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.critical_extensions_reversed_not_sorted", - "statement": "¬List.Pairwise Auths.Rich.criticalExtensionLt [Auths.Rich.Mutations.extension✝ 1 0, Auths.Rich.Mutations.extension✝ 0 0]" + "module": "Auths.Verifier.StatusIndependent", + "name": "Auths.StatusSelection.Algebra.evaluateScan_eq_evaluate", + "statement": "∀ {Subject : Type} [inst : BEq Subject] (id : String) (policy : Auths.StatusSelection.Model.Policy) (observed cap : ℕ)\n (rules : List Auths.StatusSelection.Model.Rule) (rows : List (Auths.StatusSelection.Model.Statement Subject))\n (subject : Subject) (view : Auths.StatusSelection.Model.View) (now : ℕ),\n Auths.StatusSelection.Model.evaluateScan id policy observed cap rules rows subject view now =\n Auths.StatusSelection.Model.evaluate id policy observed cap rules rows subject view now", + "statement_constants": [ + "BEq", + "Eq", + "List", + "Nat", + "String", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Policy", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.View", + "Auths.StatusSelection.Model.evaluate", + "Auths.StatusSelection.Model.evaluateScan" + ] }, { "axioms": [ @@ -1034,9 +3291,54 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.profile_version_equality", - "statement": "auths_model.profile_ref_equal { id := \"auths.opentofu.saved-plan-apply\", version := 2#u16 }\n { id := \"auths.opentofu.saved-plan-apply\", version := 1#u16 } =\n Aeneas.Std.Result.ok false" + "module": "Auths.Verifier.StatusSemantics", + "name": "Auths.StatusSelection.principal_method_approver_independent", + "statement": "∀ (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String) (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy snapshot\n subject AuthsStatusSelection.auths_model.StatusView.Approver now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑snapshot.observed_at) (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.principalView ↑snapshot.statements) subject\n Auths.StatusSelection.Model.View.approver ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.U64", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.View.approver", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1045,9 +3347,60 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.principal_linkage_equality", - "statement": "Auths.Rich.Mutations.delegationDeniedWith✝ Auths.Rich.DelegationDiagnostic.brokenGrantChain\n (Auths.Rich.evaluateGrant (Auths.Rich.Mutations.baseState✝ 0 0 1 none) { value := 0 }\n (Auths.Rich.Mutations.baseGrant✝ 1)) =\n true" + "module": "Auths.Verifier.StatusSemantics", + "name": "Auths.StatusSelection.grant_method_approver_independent", + "statement": "∀ (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId)\n (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy snapshot subject\n AuthsStatusSelection.auths_model.StatusView.Approver now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluate implementation.id (Auths.StatusSelection.policyView policy)\n (↑snapshot.observed_at) (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.grantView ↑snapshot.statements) subject\n Auths.StatusSelection.Model.View.approver ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluate", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.View.approver", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1056,30 +3409,96 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Mutations", - "name": "Auths.Rich.Mutations.grant_linkage_equality", - "statement": "Auths.Rich.Mutations.delegationDeniedWith✝ Auths.Rich.DelegationDiagnostic.brokenGrantChain\n (Auths.Rich.evaluateGrant (Auths.Rich.Mutations.baseState✝ 0 0 1 (some 0)) { value := 2 }\n (Auths.Rich.Mutations.baseGrant✝ 0 0 (some 1))) =\n true" + "module": "Auths.Verifier.StatusFloor", + "name": "Auths.StatusSelection.sequence_floor_refines", + "statement": "∀ (rules : Aeneas.Std.Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String),\n Aeneas.Std.WP.spec (AuthsStatusSelection.status_sequence_floor rules method issuer) fun actual =>\n Option.map (fun value => ↑value) actual =\n Auths.StatusSelection.Model.sequenceFloor (List.map Auths.StatusSelection.ruleView ↑rules) method issuer", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "String", + "instLENat", + "AuthsStatusSelection.status_sequence_floor", + "LE.le", + "List.length", + "List.map", + "Option.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.sequenceFloor" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Rich.Theorems", - "name": "Auths.Rich.coverage_diagnostic_sound_complete", - "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (authority : Auths.Rich.ChainState v)\n (action : Auths.Rich.Action v) (expression : Auths.Rich.BudgetExpression),\n (Auths.Rich.evaluateCoverage authority action expression = Auths.Rich.CoverageDecision.authorized ↔\n Auths.Rich.terminalCovers authority action expression) ∧\n ∀ (reason : Auths.Rich.CoverageDiagnostic),\n Auths.Rich.evaluateCoverage authority action expression = Auths.Rich.CoverageDecision.denied reason →\n ¬Auths.Rich.terminalCovers authority action expression" + "module": "Auths.Verifier.StatusVisibility", + "name": "Auths.StatusSelection.approver_visibility_refines", + "statement": "∀ (rules : Aeneas.Std.Slice AuthsStatusSelection.auths_model.StatusTrustRule) (issuer : String),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.auths_model.status_issuer_visible rules issuer\n AuthsStatusSelection.auths_model.StatusView.Approver)\n fun actual =>\n actual =\n Auths.StatusSelection.Model.visible (List.map Auths.StatusSelection.ruleView ↑rules) issuer\n Auths.StatusSelection.Model.View.approver", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "String", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.status_issuer_visible", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.visible", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Auths.StatusSelection.Model.View.approver" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_rust_refines_rich_spec", - "statement": "∀ {L : Type} (inst : auths_authority.auths_model.CriticalExtensionLaws L) (laws : L)\n [inst_1 : Auths.Rich.ExtensionLaws Auths.Refinement.ProductionVocabulary],\n Auths.Refinement.LawsRefine inst laws Auths.Refinement.productionLaw →\n ∀ (parent child : auths_authority.auths_model.ScopeAuthorityView)\n (parentValid : Auths.Refinement.ScopeAuthorityViewValid parent)\n (childValid : Auths.Refinement.ScopeAuthorityViewValid child),\n Aeneas.Std.WP.spec (auths_authority.evaluate_author_scope_view inst parent child laws) fun result =>\n result = Auths.Refinement.richAuthorScopeDecision parent child parentValid childValid" + "module": "Auths.Verifier.StatusLeaves", + "name": "Auths.StatusSelection.freshness_exact", + "statement": "∀ (method : AuthsStatusSelection.auths_model.StatusMethodId) (age : AuthsStatusSelection.auths_model.FreshnessLimit)\n (observed expiresAt now : AuthsStatusSelection.auths_model.Timestamp),\n AuthsStatusSelection.ExactStatusMethod.freshness\n (AuthsStatusSelection.auths_model.StatusPolicy.SnapshotRequired method age) observed expiresAt now =\n Aeneas.Std.Result.ok\n (if Auths.StatusSelection.Model.fresh ↑age ↑observed ↑expiresAt ↑now = true then\n AuthsStatusSelection.auths_ports.StatusDecision.Active\n else AuthsStatusSelection.auths_ports.StatusDecision.Stale)", + "statement_constants": [ + "Bool", + "Eq", + "instDecidableEqBool", + "ite", + "Bool.true", + "Aeneas.Std.Result", + "AuthsStatusSelection.ExactStatusMethod.freshness", + "AuthsStatusSelection.auths_model.FreshnessLimit", + "AuthsStatusSelection.auths_model.StatusMethodId", + "AuthsStatusSelection.auths_model.Timestamp", + "AuthsStatusSelection.auths_ports.StatusDecision", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.StatusSelection.Model.fresh", + "AuthsStatusSelection.auths_model.StatusPolicy.SnapshotRequired", + "AuthsStatusSelection.auths_ports.StatusDecision.Active", + "AuthsStatusSelection.auths_ports.StatusDecision.Stale" + ] }, { "axioms": [ @@ -1088,9 +3507,52 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_coverage_refines_rich_spec", - "statement": "∀ (authority : auths_authority.AuthorityStateView) (action : auths_authority.auths_model.ActionAuthorityView)\n (authorityValid : Auths.Refinement.AuthorityStateViewValid authority)\n (actionValid : Auths.Refinement.ActionAuthorityViewValid action) (expression : auths_model.ProfileBudgetExpression),\n Aeneas.Std.WP.spec (auths_authority.evaluate_action_coverage_view authority action expression) fun result =>\n result =\n Auths.Refinement.productionCoverageDecision\n (Auths.Rich.evaluateCoverage (Auths.Refinement.richAuthorityState authority authorityValid)\n (Auths.Refinement.richAction action actionValid) (Auths.Refinement.richBudgetExpression expression))" + "module": "Auths.Verifier.StatusSelection", + "name": "Auths.StatusSelection.principal_loop_refines", + "statement": "∀ (records : List AuthsStatusSelection.auths_model.SignedPrincipalStatus)\n (statements : Aeneas.Std.Slice AuthsStatusSelection.auths_model.SignedPrincipalStatus)\n (rules : Aeneas.Std.Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method subject : String)\n (age now : Aeneas.Std.U64) (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot)\n (state : Auths.StatusSelection.NativeScan) (position : Aeneas.Std.Usize),\n List.drop ↑position ↑statements = records →\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.select_principal_from_snapshot_loop method age snapshot subject\n AuthsStatusSelection.auths_model.StatusView.Approver now statements rules state.1 state.2.1 state.2.2.1\n state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position)\n fun actual =>\n Auths.StatusSelection.scanView actual =\n Auths.StatusSelection.Model.scan (↑snapshot.valid_until) (↑age) (↑now) method\n (List.map Auths.StatusSelection.ruleView ↑rules) subject Auths.StatusSelection.Model.View.approver\n (List.map Auths.StatusSelection.principalView records) (Auths.StatusSelection.scanView state)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.select_principal_from_snapshot_loop", + "LE.le", + "List.drop", + "List.length", + "List.map", + "Prod.fst", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.Usize", + "Auths.StatusSelection.NativeScan", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.scanView", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.Timestamp", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Scan", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.scan", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Auths.StatusSelection.Model.View.approver" + ] }, { "axioms": [ @@ -1099,9 +3561,47 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_delegation_refines_rich_spec", - "statement": "∀ {L : Type} (inst : auths_authority.auths_model.CriticalExtensionLaws L) (laws : L)\n [inst_1 : Auths.Rich.ExtensionLaws Auths.Refinement.ProductionVocabulary],\n Auths.Refinement.LawsRefine inst laws Auths.Refinement.productionLaw →\n ∀ (parent : auths_authority.AuthorityStateView) (grantId : auths_model.GrantId)\n (grant : auths_authority.auths_model.GrantAuthorityView)\n (parentValid : Auths.Refinement.AuthorityStateViewValid parent)\n (grantValid : Auths.Refinement.GrantAuthorityViewValid grant),\n Aeneas.Std.WP.spec (auths_authority.evaluate_grant_view inst parent grantId grant laws) fun result =>\n result.outcome =\n Auths.Refinement.productionDelegationOutcome\n (Auths.Rich.evaluateGrant (Auths.Refinement.richAuthorityState parent parentValid)\n (Auths.Refinement.richGrantId grantId) (Auths.Refinement.richGrant grant grantValid))\n grantId grant" + "module": "Auths.Verifier.StatusPublic", + "name": "Auths.StatusSelection.principal_selector_approver_refines", + "statement": "∀ (id : String) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String) (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.select_principal_from_snapshot id policy snapshot subject\n AuthsStatusSelection.auths_model.StatusView.Approver now)\n fun actual =>\n Auths.StatusSelection.evaluationView actual =\n Auths.StatusSelection.Model.evaluateScan id (Auths.StatusSelection.policyView policy) (↑snapshot.observed_at)\n (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.principalView ↑snapshot.statements) subject\n Auths.StatusSelection.Model.View.approver ↑now", + "statement_constants": [ + "Eq", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.select_principal_from_snapshot", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.U64", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluateScan", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Auths.StatusSelection.Model.View.approver" + ] }, { "axioms": [ @@ -1110,9 +3610,54 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_bounded_ceiling_denies_absent_request", - "statement": "∀ (ceiling : auths_model.BudgetCeiling),\n auths_model.optional_budget_covers (some ceiling) none = Aeneas.Std.Result.ok false" + "module": "Auths.Verifier.StatusPublic", + "name": "Auths.StatusSelection.principal_method_approver_refines", + "statement": "∀ (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.PrincipalStatusSnapshot) (subject : String) (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal implementation policy snapshot\n subject AuthsStatusSelection.auths_model.StatusView.Approver now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluateScan implementation.id (Auths.StatusSelection.policyView policy)\n (↑snapshot.observed_at) (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.principalView ↑snapshot.statements) subject\n Auths.StatusSelection.Model.View.approver ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.U64", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.principalView", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluateScan", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.View.approver", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1121,9 +3666,59 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_expressible_absent_request_is_denied", - "statement": "∀ (ceiling : auths_model.BudgetCeiling),\n auths_model.budget_ceiling_covers_action (some ceiling) none auths_model.ProfileBudgetExpression.Expressible =\n Aeneas.Std.Result.ok false" + "module": "Auths.Verifier.StatusGrant", + "name": "Auths.StatusSelection.grant_loop_refines", + "statement": "∀ (records : List AuthsStatusSelection.auths_model.SignedGrantStatus)\n (statements : Aeneas.Std.Slice AuthsStatusSelection.auths_model.SignedGrantStatus)\n (rules : Aeneas.Std.Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method : String)\n (subject : AuthsStatusSelection.auths_model.GrantId) (age now : Aeneas.Std.U64)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (state : Auths.StatusSelection.NativeScan)\n (position : Aeneas.Std.Usize),\n List.drop ↑position ↑statements = records →\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.select_grant_from_snapshot_loop method age snapshot subject\n AuthsStatusSelection.auths_model.StatusView.Approver now statements rules state.1 state.2.1 state.2.2.1\n state.2.2.2.1 state.2.2.2.2.1 state.2.2.2.2.2.1 state.2.2.2.2.2.2 position)\n fun actual =>\n Auths.StatusSelection.scanView actual =\n Auths.StatusSelection.Model.scan (↑snapshot.valid_until) (↑age) (↑now) method\n (List.map Auths.StatusSelection.ruleView ↑rules) subject Auths.StatusSelection.Model.View.approver\n (List.map Auths.StatusSelection.grantView records) (Auths.StatusSelection.scanView state)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "String", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.select_grant_from_snapshot_loop", + "LE.le", + "List.drop", + "List.length", + "List.map", + "OfNat.ofNat", + "Prod.fst", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.StatusSelection.NativeScan", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.ruleView", + "Auths.StatusSelection.scanView", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_model.Timestamp", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Scan", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.scan", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Auths.StatusSelection.Model.View.approver" + ] }, { "axioms": [ @@ -1132,9 +3727,54 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_inexpressible_absent_request_is_covered", - "statement": "∀ (ceiling : auths_model.BudgetCeiling),\n auths_model.budget_ceiling_covers_action (some ceiling) none auths_model.ProfileBudgetExpression.Inexpressible =\n Aeneas.Std.Result.ok true" + "module": "Auths.Verifier.StatusGrant", + "name": "Auths.StatusSelection.grant_selector_approver_refines", + "statement": "∀ (id : String) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId)\n (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.select_grant_from_snapshot id policy snapshot subject\n AuthsStatusSelection.auths_model.StatusView.Approver now)\n fun actual =>\n Auths.StatusSelection.evaluationView actual =\n Auths.StatusSelection.Model.evaluateScan id (Auths.StatusSelection.policyView policy) (↑snapshot.observed_at)\n (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.grantView ↑snapshot.statements) subject\n Auths.StatusSelection.Model.View.approver ↑now", + "statement_constants": [ + "Eq", + "List", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.select_grant_from_snapshot", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluateScan", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Auths.StatusSelection.Model.View.approver" + ] }, { "axioms": [ @@ -1143,81 +3783,292 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Production", - "name": "Auths.Refinement.translated_absent_ceiling_covers_anything", - "statement": "∀ (requested : Option auths_model.BudgetCeiling) (expression : auths_model.ProfileBudgetExpression),\n auths_model.budget_ceiling_covers_action none requested expression = Aeneas.Std.Result.ok true" + "module": "Auths.Verifier.StatusGrant", + "name": "Auths.StatusSelection.grant_method_approver_refines", + "statement": "∀ (implementation : AuthsStatusSelection.ExactStatusMethod) (policy : AuthsStatusSelection.auths_model.StatusPolicy)\n (snapshot : AuthsStatusSelection.auths_model.GrantStatusSnapshot) (subject : AuthsStatusSelection.auths_model.GrantId)\n (now : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant implementation policy snapshot subject\n AuthsStatusSelection.auths_model.StatusView.Approver now)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n Auths.StatusSelection.Model.evaluateScan implementation.id (Auths.StatusSelection.policyView policy)\n (↑snapshot.observed_at) (↑snapshot.valid_until) (List.map Auths.StatusSelection.ruleView ↑snapshot.trust)\n (List.map Auths.StatusSelection.grantView ↑snapshot.statements) subject\n Auths.StatusSelection.Model.View.approver ↑now", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "AuthsStatusSelection.ExactStatusMethod", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Auths.StatusSelection.evaluationView", + "Auths.StatusSelection.grantView", + "Auths.StatusSelection.policyView", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.ExactStatusMethod.id", + "AuthsStatusSelection.auths_model.GrantId", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "AuthsStatusSelection.auths_model.SignedGrantStatus", + "AuthsStatusSelection.auths_model.StatusPolicy", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Model.Evaluation", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.Statement", + "Auths.StatusSelection.Model.evaluateScan", + "AuthsStatusSelection.auths_model.Digest._proof_1", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.observed_at", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.statements", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.trust", + "AuthsStatusSelection.auths_model.GrantStatusSnapshot.valid_until", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Model.View.approver", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Commitment", - "name": "Auths.Product.configuration_match_refl", - "statement": "∀ (configuration : Auths.Product.ConfigurationCommitment),\n Auths.Product.configurationMatch configuration configuration = Auths.Product.ConfigurationMatch.matches" + "module": "Auths.Verifier.StatusGrantLeaves", + "name": "Auths.StatusSelection.byte_array_comparison", + "statement": "∀ {N : Aeneas.Std.Usize} (left right : Aeneas.Std.Array Aeneas.Std.U8 N),\n Aeneas.Std.core.array.equality.PartialEqArray.eq Aeneas.Std.core.cmp.PartialEqU8 left right =\n Aeneas.Std.Result.ok (left == right)", + "statement_constants": [ + "Bool", + "Eq", + "BEq.beq", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.instBEqArray", + "Aeneas.Std.instBEqUScalar_1", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.core.cmp.PartialEqU8", + "Aeneas.Std.core.array.equality.PartialEqArray.eq" + ] }, { - "axioms": [], + "axioms": [ + "propext" + ], "kind": "theorem", - "module": "Auths.Product.Commitment", - "name": "Auths.Product.configuration_match_deterministic", - "statement": "∀ (required executed : Auths.Product.ConfigurationCommitment),\n ∃ result, Auths.Product.configurationMatch required executed = result" + "module": "Auths.Verifier.StatusFloor", + "name": "Auths.StatusSelection.native_floor_view", + "statement": "∀ (rules : Aeneas.Std.Slice AuthsStatusSelection.auths_model.StatusTrustRule) (method issuer : String),\n Option.map (fun value => ↑value) (Auths.StatusSelection.nativeFloor rules method issuer) =\n Auths.StatusSelection.Model.sequenceFloor (List.map Auths.StatusSelection.ruleView ↑rules) method issuer", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "String", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Option.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Auths.StatusSelection.nativeFloor", + "Auths.StatusSelection.ruleView", + "AuthsStatusSelection.auths_model.StatusTrustRule", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.sequenceFloor" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Product.Arithmetic", - "name": "Auths.Product.checked_add_never_wraps", - "statement": "∀ {left right result : Auths.Product.UnitQuantity},\n Auths.Product.checkedAdd left right = Except.ok result →\n result.amount = left.amount + right.amount ∧ result.amount ≤ Auths.Product.u64Max" + "module": "Auths.Verifier.StatusVisibility", + "name": "Auths.StatusSelection.unknown_issuer_visible", + "statement": "∀ (rules : List Auths.StatusSelection.Model.Rule) (issuer : String) (view : Auths.StatusSelection.Model.View),\n (∀ rule ∈ rules, rule.issuer ≠ issuer) → Auths.StatusSelection.Model.visible rules issuer view = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Ne", + "String", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.StatusSelection.Model.Rule", + "Auths.StatusSelection.Model.View", + "Auths.StatusSelection.Model.visible", + "Auths.StatusSelection.Model.Rule.issuer" + ] }, { "axioms": [], "kind": "theorem", - "module": "Auths.Product.Arithmetic", - "name": "Auths.Product.checked_sub_never_underflows", - "statement": "∀ {left right result : Auths.Product.UnitQuantity},\n Auths.Product.checkedSub left right = Except.ok result → right.amount ≤ left.amount" + "module": "qualification.aeneas.generated.status_selection.FunsExternal", + "name": "AuthsStatusSelection.lt_default_delegates", + "statement": "∀ {Self Rhs : Type} (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs),\n AuthsStatusSelection.core.cmp.PartialOrd.lt.default implementation left right =\n Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.core.cmp.PartialOrd", + "Aeneas.Std.core.cmp.PartialOrd.partial_cmp", + "AuthsStatusSelection.core.cmp.PartialOrd.lt.default", + "Aeneas.Std.core.cmp.PartialOrd.lt.default" + ] }, { - "axioms": [ - "propext" - ], + "axioms": [], "kind": "theorem", - "module": "Auths.Product.Arithmetic", - "name": "Auths.Product.checked_div_rejects_zero", - "statement": "∀ {quantity result : Auths.Product.UnitQuantity}, Auths.Product.checkedDiv quantity 0 = Except.ok result → False" + "module": "qualification.aeneas.generated.status_selection.FunsExternal", + "name": "AuthsStatusSelection.gt_default_delegates", + "statement": "∀ {Self Rhs : Type} (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs),\n AuthsStatusSelection.core.cmp.PartialOrd.gt.default implementation left right =\n Aeneas.Std.core.cmp.PartialOrd.gt.default implementation.partial_cmp left right", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.core.cmp.PartialOrd", + "Aeneas.Std.core.cmp.PartialOrd.partial_cmp", + "AuthsStatusSelection.core.cmp.PartialOrd.gt.default", + "Aeneas.Std.core.cmp.PartialOrd.gt.default" + ] }, { "axioms": [], "kind": "theorem", - "module": "Auths.Product.Eligibility", - "name": "Auths.Product.three_way_partition", - "statement": "∀ (result : Auths.Product.Eligibility),\n (∃ outputs, result = Auths.Product.Eligibility.eligible outputs) ∨\n (∃ code stage, result = Auths.Product.Eligibility.denied code stage) ∨\n ∃ code stage, result = Auths.Product.Eligibility.indeterminate code stage" + "module": "qualification.aeneas.generated.status_selection.FunsExternal", + "name": "AuthsStatusSelection.max_default_delegates", + "statement": "∀ {Self : Type} (implementation : Aeneas.Std.core.cmp.Ord Self) (left right : Self),\n AuthsStatusSelection.core.cmp.Ord.max.default implementation left right =\n Aeneas.Std.core.cmp.Ord.max.default implementation.partialOrdInst.lt left right", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.core.cmp.Ord", + "Aeneas.Std.core.cmp.Ord.partialOrdInst", + "Aeneas.Std.core.cmp.PartialOrd.lt", + "AuthsStatusSelection.core.cmp.Ord.max.default", + "Aeneas.Std.core.cmp.Ord.max.default" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Theorems", - "name": "Auths.Product.product_contract_configuration_safety", - "statement": "∀ {required executed : Auths.Product.ConfigurationCommitment} {result : Auths.Product.Eligibility}\n {mismatchCode mismatchStage : Auths.Product.SemanticId},\n Auths.Product.configurationMatch required executed ≠ Auths.Product.ConfigurationMatch.matches →\n Auths.Product.isEligible (Auths.Product.gateConfiguration required executed result mismatchCode mismatchStage) =\n false" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.active_selected_horizon", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 2#u64\n 40#u64]\n Auths.StatusSelection.Examples.active_selected_horizon._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.active, through := 60 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Active", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.active_selected_horizon._proof_1", + "Auths.StatusSelection.Model.Decision.active", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Theorems", - "name": "Auths.Product.product_contract_output_completeness", - "statement": "∀ {result : Auths.Product.Eligibility},\n Auths.Product.isEligible result = true → ∃ outputs, result = Auths.Product.Eligibility.eligible outputs" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_configuration_refines_projection", - "statement": "∀ (semanticEqual canonicalizationEqual digestEqual implementationEqualOrUnpinned : Bool),\n auths_bounded_policy.kernel.configuration_match_code semanticEqual canonicalizationEqual digestEqual\n implementationEqualOrUnpinned =\n Aeneas.Std.Result.ok\n (Auths.Product.Refinement.generatedConfigurationMatch\n (Auths.Product.projectedConfigurationMatch semanticEqual canonicalizationEqual digestEqual\n implementationEqualOrUnpinned))" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.revoked_selected_horizon", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Revoked 2#u64\n 40#u64]\n Auths.StatusSelection.Examples.revoked_selected_horizon._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.revoked, through := 60 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Revoked", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.revoked_selected_horizon._proof_1", + "Auths.StatusSelection.Model.Decision.revoked", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1226,9 +4077,49 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_checked_add_refines_nat", - "statement": "∀ (left right : Aeneas.Std.U64),\n match auths_bounded_policy.kernel.checked_add_u64 left right with\n | Aeneas.Std.Result.ok (some result) => ↑left + ↑right ≤ Aeneas.Std.U64.max ∧ ↑result = ↑left + ↑right\n | Aeneas.Std.Result.ok none => Aeneas.Std.U64.max < ↑left + ↑right\n | Aeneas.Std.Result.fail e => False\n | Aeneas.Std.Result.div => False" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.stale_selected_refused", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 2#u64\n 0#u64]\n Auths.StatusSelection.Examples.stale_selected_refused._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.stale, through := 50 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Active", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.stale_selected_refused._proof_1", + "Auths.StatusSelection.Model.Decision.stale", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1237,9 +4128,49 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_checked_sub_refines_nat", - "statement": "∀ (left right : Aeneas.Std.U64),\n match auths_bounded_policy.kernel.checked_sub_u64 left right with\n | Aeneas.Std.Result.ok (some result) => ↑right ≤ ↑left ∧ ↑result = ↑left - ↑right\n | Aeneas.Std.Result.ok none => ↑left < ↑right\n | Aeneas.Std.Result.fail e => False\n | Aeneas.Std.Result.div => False" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.rollback_despite_newer", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 0#u64\n 40#u64,\n Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 3#u64\n 40#u64]\n Auths.StatusSelection.Examples.rollback_despite_newer._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.rollback, through := 50 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Active", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.rollback_despite_newer._proof_1", + "Auths.StatusSelection.Model.Decision.rollback", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1248,9 +4179,50 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_checked_mul_refines_nat", - "statement": "∀ (left right : Aeneas.Std.U64),\n match auths_bounded_policy.kernel.checked_mul_u64 left right with\n | Aeneas.Std.Result.ok (some result) => ↑left * ↑right ≤ Aeneas.Std.U64.max ∧ ↑result = ↑left * ↑right\n | Aeneas.Std.Result.ok none => Aeneas.Std.U64.max < ↑left * ↑right\n | Aeneas.Std.Result.fail e => False\n | Aeneas.Std.Result.div => False" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.newer_discards_old_stale_revocation", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Revoked 1#u64\n 0#u64,\n Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 2#u64\n 40#u64]\n Auths.StatusSelection.Examples.newer_discards_old_stale_revocation._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.active, through := 60 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Active", + "AuthsStatusSelection.auths_model.PrincipalState.Revoked", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.newer_discards_old_stale_revocation._proof_1", + "Auths.StatusSelection.Model.Decision.active", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1259,9 +4231,50 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_checked_div_rejects_zero", - "statement": "∀ (value : Aeneas.Std.U64), auths_bounded_policy.kernel.checked_div_u64 value 0#u64 = Aeneas.Std.Result.ok none" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.latest_ties_conservatively_revoke", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 2#u64\n 40#u64,\n Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Superseded\n 2#u64 40#u64]\n Auths.StatusSelection.Examples.latest_ties_conservatively_revoke._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.revoked, through := 60 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Active", + "AuthsStatusSelection.auths_model.PrincipalState.Superseded", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.latest_ties_conservatively_revoke._proof_1", + "Auths.StatusSelection.Model.Decision.revoked", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1270,9 +4283,49 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_window_index_refines_nat", - "statement": "∀ (now windowSeconds : Aeneas.Std.U64),\n ∃ result,\n auths_bounded_policy.kernel.window_index now windowSeconds = Aeneas.Std.Result.ok result ∧\n Option.map (fun x => ↑x) result = if ↑windowSeconds = 0 then none else some (↑now / ↑windowSeconds)" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.wrong_method_refused", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation\n (AuthsStatusSelection.auths_model.StatusPolicy.SnapshotRequired \"other-status-v1\" 20#u64)\n (Auths.StatusSelection.Examples.snapshot\n [Auths.StatusSelection.Examples.principalStatement AuthsStatusSelection.auths_model.PrincipalState.Active 2#u64\n 40#u64]\n Auths.StatusSelection.Examples.active_selected_horizon._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.wrongMethod, through := 50 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.principalStatement", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.PrincipalState.Active", + "AuthsStatusSelection.auths_model.StatusPolicy.SnapshotRequired", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.active_selected_horizon._proof_1", + "Auths.StatusSelection.Model.Decision.wrongMethod", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1281,9 +4334,46 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.BoundedPolicy", - "name": "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model", - "statement": "∀ (left right : auths_model.Digest),\n auths_model.bounded_policy.digest_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Product.Refinement.BoundedPolicy.digestBytes left =\n Auths.Product.Refinement.BoundedPolicy.digestBytes right))" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.missing_uses_snapshot_window", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot [] Auths.StatusSelection.Examples.missing_uses_snapshot_window._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.missing, through := 100 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.missing_uses_snapshot_window._proof_1", + "Auths.StatusSelection.Model.Decision.missing", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1292,9 +4382,48 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.BoundedPolicy", - "name": "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model", - "statement": "∀ (childLink parentDigest : Option auths_model.Digest),\n auths_model.bounded_policy.bounded_policy_link_accepts childLink parentDigest =\n Aeneas.Std.Result.ok\n (Auths.Product.Refinement.BoundedPolicy.boundedPolicyLinkAccepts\n (Option.map Auths.Product.Refinement.BoundedPolicy.digestBytes childLink)\n (Option.map Auths.Product.Refinement.BoundedPolicy.digestBytes parentDigest))" + "module": "Auths.Verifier.StatusExamples", + "name": "Auths.StatusSelection.Examples.unknown_issuer_refused", + "statement": "Aeneas.Std.WP.spec\n (AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal\n Auths.StatusSelection.Examples.implementation Auths.StatusSelection.Examples.required\n (Auths.StatusSelection.Examples.snapshot [Auths.StatusSelection.Examples.unknownIssuer]\n Auths.StatusSelection.Examples.unknown_issuer_refused._proof_1)\n \"raw:actor\" AuthsStatusSelection.auths_model.StatusView.Approver 50#u64)\n fun actual =>\n ∃ evaluation,\n actual = Aeneas.Std.core.result.Result.Ok evaluation ∧\n Auths.StatusSelection.evaluationView evaluation =\n { decision := Auths.StatusSelection.Model.Decision.untrusted, through := 50 }", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Auths.StatusSelection.evaluationView", + "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "AuthsStatusSelection.auths_ports.RegistryOperationError", + "AuthsStatusSelection.auths_ports.StatusEvaluation", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.StatusSelection.Examples.implementation", + "Auths.StatusSelection.Examples.required", + "Auths.StatusSelection.Examples.snapshot", + "Auths.StatusSelection.Examples.unknownIssuer", + "Auths.StatusSelection.Model.Evaluation", + "AuthsStatusSelection.auths_model.StatusView.Approver", + "Aeneas.Std.core.result.Result", + "Auths.StatusSelection.Examples.unknown_issuer_refused._proof_1", + "Auths.StatusSelection.Model.Decision.untrusted", + "Auths.StatusSelection.Model.Evaluation.mk", + "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1302,9 +4431,32 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_ceiling_count_refines_model", - "statement": "∀ (value ceiling count maxCount : Aeneas.Std.U64),\n auths_bounded_policy.kernel.ceiling_count_code value ceiling count maxCount =\n Aeneas.Std.Result.ok\n (Auths.Product.Refinement.generatedCeilingCountCode\n (Auths.Product.CeilingCount.codeOf ↑value ↑ceiling ↑count ↑maxCount))" + "module": "Auths.Verifier.TemporalNative", + "name": "Auths.TemporalWitness.status_horizon_exact", + "statement": "∀ (evaluation : AuthsTemporalWitness.auths_ports.StatusEvaluation) (evaluatedAt : auths_model.Timestamp),\n AuthsTemporalWitness.status_horizon evaluation evaluatedAt =\n Aeneas.Std.Result.ok\n (if ↑evaluatedAt ≤ ↑evaluation.valid_through then Aeneas.Std.core.result.Result.Ok evaluation.valid_through\n else\n Aeneas.Std.core.result.Result.Err\n (AuthsTemporalWitness.VerificationFailure.Indeterminate\n AuthsTemporalWitness.auths_model.Requirement.StaleStatus))", + "statement_constants": [ + "Eq", + "Nat", + "instLENat", + "ite", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_horizon", + "LE.le", + "Nat.decLe", + "auths_model.Timestamp", + "Aeneas.Std.Result", + "AuthsTemporalWitness.VerificationFailure.Indeterminate", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_ports.StatusEvaluation", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "AuthsTemporalWitness.auths_model.Requirement.StaleStatus", + "AuthsTemporalWitness.auths_ports.StatusEvaluation.valid_through", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1312,31 +4464,104 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_ceiling_count_tightens_refines_model", - "statement": "∀ (childCeiling childMax childWindow parentCeiling parentMax parentWindow : Aeneas.Std.U64),\n auths_bounded_policy.kernel.ceiling_count_tightens childCeiling childMax childWindow parentCeiling parentMax\n parentWindow =\n Aeneas.Std.Result.ok\n (Auths.Product.CeilingCount.numericTightens ↑childCeiling ↑childMax ↑childWindow ↑parentCeiling ↑parentMax\n ↑parentWindow)" + "module": "Auths.Verifier.TemporalNative", + "name": "Auths.TemporalWitness.status_horizon_accepts_iff", + "statement": "∀ (evaluation : AuthsTemporalWitness.auths_ports.StatusEvaluation) (evaluatedAt output : auths_model.Timestamp),\n AuthsTemporalWitness.status_horizon evaluation evaluatedAt =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) ↔\n output = evaluation.valid_through ∧ ↑evaluatedAt ≤ ↑output", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Nat", + "instLENat", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_horizon", + "LE.le", + "auths_model.Timestamp", + "Aeneas.Std.Result", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_ports.StatusEvaluation", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "AuthsTemporalWitness.auths_ports.StatusEvaluation.valid_through", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_chain_counts_admit_refines_model", - "statement": "∀ (counts capacities : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_bounded_policy.kernel.chain_counts_admit counts capacities) fun result =>\n result =\n Auths.Product.CeilingCount.countsAdmit (Auths.Product.Refinement.natList ↑counts)\n (Auths.Product.Refinement.natList ↑capacities)" + "module": "Auths.Verifier.TemporalNative", + "name": "Auths.TemporalWitness.status_horizon_stale_refused", + "statement": "∀ (evaluation : AuthsTemporalWitness.auths_ports.StatusEvaluation) (evaluatedAt : auths_model.Timestamp),\n ↑evaluation.valid_through < ↑evaluatedAt →\n AuthsTemporalWitness.status_horizon evaluation evaluatedAt =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsTemporalWitness.VerificationFailure.Indeterminate\n AuthsTemporalWitness.auths_model.Requirement.StaleStatus))", + "statement_constants": [ + "Eq", + "Nat", + "instLTNat", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_horizon", + "LT.lt", + "auths_model.Timestamp", + "Aeneas.Std.Result", + "AuthsTemporalWitness.VerificationFailure.Indeterminate", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_ports.StatusEvaluation", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "AuthsTemporalWitness.auths_model.Requirement.StaleStatus", + "AuthsTemporalWitness.auths_ports.StatusEvaluation.valid_through", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ - "propext", - "Classical.choice", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_chain_sums_admit_refines_model", - "statement": "∀ (sums : Aeneas.Std.Slice Aeneas.Std.U64) (argument : Aeneas.Std.U64) (capacities : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_bounded_policy.kernel.chain_sums_admit sums argument capacities) fun result =>\n result =\n Auths.Product.CeilingCount.sumsAdmit (Auths.Product.Refinement.natList ↑sums) (↑argument)\n (Auths.Product.Refinement.natList ↑capacities)" + "module": "Auths.Verifier.TemporalNative", + "name": "Auths.TemporalWitness.status_decision_accepts_iff", + "statement": "∀ (decision : AuthsTemporalWitness.auths_ports.StatusDecision) (principal : Bool),\n AuthsTemporalWitness.status_decision decision principal = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ()) ↔\n decision = AuthsTemporalWitness.auths_ports.StatusDecision.Active", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "Unit", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_decision", + "Unit.unit", + "Aeneas.Std.Result", + "AuthsTemporalWitness.auths_ports.StatusDecision", + "Aeneas.Std.Result.ok", + "AuthsTemporalWitness.auths_ports.StatusDecision.Active", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Verifier.TemporalStatus", + "name": "Auths.TemporalWitness.Status.decision_refines", + "statement": "∀ (decision : AuthsTemporalWitness.auths_ports.StatusDecision) (principal : Bool),\n AuthsTemporalWitness.status_decision decision principal =\n Aeneas.Std.Result.ok\n (Auths.TemporalWitness.Status.resultValue\n (Auths.TemporalWitness.Status.evaluate principal (Auths.TemporalWitness.Status.stateView decision)))", + "statement_constants": [ + "Bool", + "Eq", + "Unit", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_decision", + "Aeneas.Std.Result", + "AuthsTemporalWitness.auths_ports.StatusDecision", + "Aeneas.Std.Result.ok", + "Auths.TemporalWitness.Status.evaluate", + "Auths.TemporalWitness.Status.resultValue", + "Auths.TemporalWitness.Status.stateView", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -1345,28 +4570,117 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement", - "name": "Auths.Product.Refinement.translated_argument_policy_tightens_refines_model", - "statement": "∀ (child parent : auths_bounded_policy.kernel.PolicyMembers),\n Aeneas.Std.WP.spec (auths_bounded_policy.kernel.argument_policy_tightens child parent) fun result =>\n result =\n Auths.Product.CeilingCount.decider (Auths.Product.Refinement.policyOf child)\n (Auths.Product.Refinement.policyOf parent)" + "module": "Auths.Verifier.TemporalAssurance", + "name": "Auths.TemporalWitness.assurance_loop_refines", + "statement": "∀ (records : List AuthsTemporalWitness.auths_model.AssuranceSatisfaction)\n (iterator : Aeneas.Std.core.slice.iter.Iter AuthsTemporalWitness.auths_model.AssuranceSatisfaction)\n (context : AuthsTemporalWitness.auths_model.TrustedContext) (initial : auths_model.Timestamp),\n List.drop iterator.i ↑iterator.slice = records →\n Aeneas.Std.WP.spec (AuthsTemporalWitness.assurance_horizon_loop iterator context initial) fun actual =>\n Auths.TemporalWitness.AssuranceRefines\n (Auths.TemporalWitness.assuranceHorizon (Auths.TemporalWitness.policyView context)\n (List.map Auths.TemporalWitness.witnessView records) ↑initial)\n actual", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.assurance_horizon_loop", + "LE.le", + "List.drop", + "List.length", + "List.map", + "Subtype.val", + "auths_model.Timestamp", + "Auths.TemporalWitness.AssuranceRefines", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.policyView", + "Auths.TemporalWitness.witnessView", + "AuthsTemporalWitness.auths_model.AssuranceSatisfaction", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_model.TrustedContext", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.slice.iter.Iter", + "Aeneas.Std.core.slice.iter.Iter.i", + "Aeneas.Std.core.slice.iter.Iter.slice" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.code_eligible_iff", - "statement": "∀ (value ceiling count maxCount : ℕ),\n Auths.Product.CeilingCount.codeOf value ceiling count maxCount = Auths.Product.CeilingCount.Code.eligible ↔\n value ≤ ceiling ∧ count < maxCount" + "module": "Auths.Verifier.TemporalAssurance", + "name": "Auths.TemporalWitness.assurance_entry_refines", + "statement": "∀ (records : Aeneas.Std.Slice AuthsTemporalWitness.auths_model.AssuranceSatisfaction)\n (context : AuthsTemporalWitness.auths_model.TrustedContext),\n Aeneas.Std.WP.spec (AuthsTemporalWitness.assurance_horizon records context) fun actual =>\n Auths.TemporalWitness.AssuranceRefines\n (Auths.TemporalWitness.assuranceHorizon (Auths.TemporalWitness.policyView context)\n (List.map Auths.TemporalWitness.witnessView ↑records) Auths.TemporalWitness.wordMaximum)\n actual", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.assurance_horizon", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Auths.TemporalWitness.AssuranceRefines", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.policyView", + "Auths.TemporalWitness.witnessView", + "Auths.TemporalWitness.wordMaximum", + "AuthsTemporalWitness.auths_model.AssuranceSatisfaction", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_model.TrustedContext", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.decider_iff_tightens", - "statement": "∀ (child parent : Auths.Product.CeilingCount.Policy),\n Auths.Product.CeilingCount.decider child parent = true ↔ Auths.Product.CeilingCount.tightens child parent" + "module": "Auths.Verifier.TemporalConsequences", + "name": "Auths.TemporalWitness.successful_native_horizon_exact", + "statement": "∀ (records : Aeneas.Std.Slice AuthsTemporalWitness.auths_model.AssuranceSatisfaction)\n (context : AuthsTemporalWitness.auths_model.TrustedContext) (horizon : auths_model.Timestamp),\n AuthsTemporalWitness.assurance_horizon records context =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok horizon) →\n Auths.TemporalWitness.assuranceHorizon (Auths.TemporalWitness.policyView context)\n (List.map Auths.TemporalWitness.witnessView ↑records) Auths.TemporalWitness.wordMaximum =\n Except.ok ↑horizon", + "statement_constants": [ + "Eq", + "Except", + "List", + "Nat", + "Unit", + "instLENat", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.assurance_horizon", + "Except.ok", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "auths_model.Timestamp", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.policyView", + "Auths.TemporalWitness.witnessView", + "Auths.TemporalWitness.wordMaximum", + "AuthsTemporalWitness.auths_model.AssuranceSatisfaction", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_model.TrustedContext", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1375,31 +4689,112 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.tightening_never_admits_more", - "statement": "∀ {child parent : Auths.Product.CeilingCount.Policy} {context : Auths.Product.CeilingCount.Context},\n Auths.Product.CeilingCount.tightens child parent →\n Auths.Product.CeilingCount.admits child context → Auths.Product.CeilingCount.admits parent context" + "module": "Auths.Verifier.TemporalConsequences", + "name": "Auths.TemporalWitness.native_horizon_permits_iff", + "statement": "∀ (records : Aeneas.Std.Slice AuthsTemporalWitness.auths_model.AssuranceSatisfaction)\n (context : AuthsTemporalWitness.auths_model.TrustedContext) (horizon : auths_model.Timestamp),\n AuthsTemporalWitness.assurance_horizon records context =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok horizon) →\n ∀ (now : ℕ),\n now ≤ ↑horizon ↔\n now ≤ Auths.TemporalWitness.wordMaximum ∧\n ∀ record ∈ ↑records,\n Auths.TemporalWitness.selectedExpiryAllows (Auths.TemporalWitness.policyView context)\n (Auths.TemporalWitness.witnessView record) now", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Nat", + "instLENat", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.assurance_horizon", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "Subtype.val", + "auths_model.Timestamp", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.TemporalWitness.policyView", + "Auths.TemporalWitness.selectedExpiryAllows", + "Auths.TemporalWitness.witnessView", + "Auths.TemporalWitness.wordMaximum", + "AuthsTemporalWitness.auths_model.AssuranceSatisfaction", + "AuthsTemporalWitness.auths_model.Timestamp", + "AuthsTemporalWitness.auths_model.TrustedContext", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.decider_sound", - "statement": "∀ {child parent : Auths.Product.CeilingCount.Policy},\n Auths.Product.CeilingCount.decider child parent = true →\n ∀ (context : Auths.Product.CeilingCount.Context),\n Auths.Product.CeilingCount.admits child context → Auths.Product.CeilingCount.admits parent context" + "module": "Auths.Verifier.TemporalProperties", + "name": "Auths.TemporalWitness.assurance_permits_iff", + "statement": "∀ (ages : List (Option ℕ)) (records : List Auths.TemporalWitness.Witness) (initial now : ℕ),\n (∃ horizon, Auths.TemporalWitness.assuranceHorizon ages records initial = Except.ok horizon ∧ now ≤ horizon) ↔\n now ≤ initial ∧ ∀ record ∈ records, Auths.TemporalWitness.selectedExpiryAllows ages record now", + "statement_constants": [ + "And", + "Eq", + "Except", + "Exists", + "Iff", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "Except.ok", + "LE.le", + "List.instMembership", + "Membership.mem", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.selectedExpiryAllows" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.smaller_ceiling_never_authorizes_more", - "statement": "∀ (policy : Auths.Product.CeilingCount.Policy) {ceiling : ℕ},\n ceiling ≤ policy.ceiling →\n ∀ {context : Auths.Product.CeilingCount.Context},\n Auths.Product.CeilingCount.admits\n { argument := policy.argument, ceiling := ceiling, window := policy.window, maxCount := policy.maxCount,\n sum := policy.sum, scope := policy.scope }\n context →\n Auths.Product.CeilingCount.admits policy context" + "module": "Auths.Verifier.TemporalProperties", + "name": "Auths.TemporalWitness.successful_horizon_bounded", + "statement": "∀ (ages : List (Option ℕ)) (records : List Auths.TemporalWitness.Witness) (initial horizon : ℕ),\n Auths.TemporalWitness.assuranceHorizon ages records initial = Except.ok horizon →\n horizon ≤ initial ∧ ∀ record ∈ records, Auths.TemporalWitness.selectedExpiryAllows ages record horizon", + "statement_constants": [ + "And", + "Eq", + "Except", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "Except.ok", + "LE.le", + "List.instMembership", + "Membership.mem", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.selectedExpiryAllows" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "qualification.aeneas.generated.temporal_witness.FunsExternal", + "name": "AuthsTemporalWitness.lt_default_delegates", + "statement": "∀ {Self Rhs : Type} (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs),\n AuthsTemporalWitness.core.cmp.PartialOrd.lt.default implementation left right =\n Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.core.cmp.PartialOrd", + "Aeneas.Std.core.cmp.PartialOrd.partial_cmp", + "AuthsTemporalWitness.core.cmp.PartialOrd.lt.default", + "Aeneas.Std.core.cmp.PartialOrd.lt.default" + ] }, { "axioms": [ @@ -1408,130 +4803,469 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.smaller_count_never_authorizes_more", - "statement": "∀ (policy : Auths.Product.CeilingCount.Policy) {maxCount : ℕ},\n maxCount ≤ policy.maxCount →\n ∀ {context : Auths.Product.CeilingCount.Context},\n Auths.Product.CeilingCount.admits\n { argument := policy.argument, ceiling := policy.ceiling, window := policy.window, maxCount := maxCount,\n sum := policy.sum, scope := policy.scope }\n context →\n Auths.Product.CeilingCount.admits policy context" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.inclusive_status_endpoint", + "statement": "AuthsTemporalWitness.status_horizon\n { decision := AuthsTemporalWitness.auths_ports.StatusDecision.Active, valid_through := 100#u64 } 100#u64 =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok 100#u64)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_horizon", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.Result", + "AuthsTemporalWitness.auths_model.Timestamp", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "AuthsTemporalWitness.auths_ports.StatusDecision.Active", + "AuthsTemporalWitness.auths_ports.StatusEvaluation.mk", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.tightens_refl", - "statement": "∀ (policy : Auths.Product.CeilingCount.Policy), Auths.Product.CeilingCount.tightens policy policy" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.expired_status_refused", + "statement": "AuthsTemporalWitness.status_horizon\n { decision := AuthsTemporalWitness.auths_ports.StatusDecision.Active, valid_through := 100#u64 } 101#u64 =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsTemporalWitness.VerificationFailure.Indeterminate AuthsTemporalWitness.auths_model.Requirement.StaleStatus))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_horizon", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.Result", + "AuthsTemporalWitness.VerificationFailure.Indeterminate", + "AuthsTemporalWitness.auths_model.Timestamp", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64", + "AuthsTemporalWitness.auths_model.Requirement.StaleStatus", + "AuthsTemporalWitness.auths_ports.StatusDecision.Active", + "AuthsTemporalWitness.auths_ports.StatusEvaluation.mk", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.revoked_principal_refused", + "statement": "AuthsTemporalWitness.status_decision AuthsTemporalWitness.auths_ports.StatusDecision.Revoked true =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsTemporalWitness.VerificationFailure.Denied AuthsTemporalWitness.auths_model.DenialReason.PrincipalRevoked))", + "statement_constants": [ + "Eq", + "Unit", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_decision", + "Bool.true", + "Aeneas.Std.Result", + "AuthsTemporalWitness.VerificationFailure.Denied", + "Aeneas.Std.Result.ok", + "AuthsTemporalWitness.auths_model.DenialReason.PrincipalRevoked", + "AuthsTemporalWitness.auths_ports.StatusDecision.Revoked", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.revoked_grant_refused", + "statement": "AuthsTemporalWitness.status_decision AuthsTemporalWitness.auths_ports.StatusDecision.Revoked false =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err\n (AuthsTemporalWitness.VerificationFailure.Denied AuthsTemporalWitness.auths_model.DenialReason.GrantRevoked))", + "statement_constants": [ + "Eq", + "Unit", + "AuthsTemporalWitness.VerificationFailure", + "AuthsTemporalWitness.status_decision", + "Bool.false", + "Aeneas.Std.Result", + "AuthsTemporalWitness.VerificationFailure.Denied", + "Aeneas.Std.Result.ok", + "AuthsTemporalWitness.auths_model.DenialReason.GrantRevoked", + "AuthsTemporalWitness.auths_ports.StatusDecision.Revoked", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.tightens_trans", - "statement": "∀ {child middle parent : Auths.Product.CeilingCount.Policy},\n Auths.Product.CeilingCount.tightens child middle →\n Auths.Product.CeilingCount.tightens middle parent → Auths.Product.CeilingCount.tightens child parent" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.selected_expiry_admitted", + "statement": "Auths.TemporalWitness.assuranceHorizon [some 20] [{ requirementIndex := 0, observedAt := some 100 }]\n Auths.TemporalWitness.wordMaximum =\n Except.ok 120", + "statement_constants": [ + "Eq", + "Except", + "Nat", + "Option", + "Unit", + "instOfNatNat", + "Except.ok", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.wordMaximum", + "Auths.TemporalWitness.Witness.mk" + ] }, { "axioms": [ - "propext", - "Classical.choice", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.bounded_policy_law_lawful", - "statement": "Auths.Product.CeilingCount.boundedPolicyLaw.Lawful" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.missing_requirement_refused", + "statement": "Auths.TemporalWitness.assuranceHorizon [some 20] [{ requirementIndex := 1, observedAt := some 100 }]\n Auths.TemporalWitness.wordMaximum =\n Except.error ()", + "statement_constants": [ + "Eq", + "Except", + "Nat", + "Option", + "Unit", + "instOfNatNat", + "Except.error", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Unit.unit", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.wordMaximum", + "Auths.TemporalWitness.Witness.mk" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.bounded_policy_law_accepts_addition", - "statement": "∀ (policy : Auths.Product.CeilingCount.Policy),\n Auths.Product.CeilingCount.boundedPolicyLaw.attenuates (some policy) none" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.missing_observation_refused", + "statement": "Auths.TemporalWitness.assuranceHorizon [some 20] [{ requirementIndex := 0, observedAt := none }]\n Auths.TemporalWitness.wordMaximum =\n Except.error ()", + "statement_constants": [ + "Eq", + "Except", + "Nat", + "Option", + "Unit", + "instOfNatNat", + "Except.error", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.none", + "Option.some", + "Unit.unit", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.wordMaximum", + "Auths.TemporalWitness.Witness.mk" + ] }, { "axioms": [ - "propext", - "Classical.choice", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.ceiling_count_fixed_context_tightening", - "statement": "∀ {child parent : Auths.Product.CeilingCount.Policy} {context : Auths.Product.CeilingCount.Context}\n {childOutputs : Auths.Product.OutputCommitments},\n Auths.Product.CeilingCount.tightens child parent →\n Auths.Product.CeilingCount.evaluator.evaluate child context = Auths.Product.Eligibility.eligible childOutputs →\n ∃ parentOutputs,\n Auths.Product.CeilingCount.evaluator.evaluate parent context =\n Auths.Product.Eligibility.eligible parentOutputs ∧\n childOutputs = parentOutputs" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.unbounded_requirement_needs_no_observation", + "statement": "Auths.TemporalWitness.assuranceHorizon [none] [{ requirementIndex := 0, observedAt := none }]\n Auths.TemporalWitness.wordMaximum =\n Except.ok Auths.TemporalWitness.wordMaximum", + "statement_constants": [ + "Eq", + "Except", + "Nat", + "Option", + "Unit", + "instOfNatNat", + "Except.ok", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.none", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.wordMaximum", + "Auths.TemporalWitness.Witness.mk" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.reserve_all_or_none", - "statement": "∀ (facts : Auths.Product.CeilingCount.Facts) (links : List Auths.Product.CeilingCount.Link) (value : ℕ)\n (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.reserve facts links value counts = none ∨\n ∃ raised,\n Auths.Product.CeilingCount.reserve facts links value counts = some raised ∧\n (∀ key ∈ Auths.Product.CeilingCount.countKeys links, raised key = counts key + 1) ∧\n (∀ key ∈ Auths.Product.CeilingCount.sumKeys facts.text links, raised key = counts key + value) ∧\n ∀ key ∉ Auths.Product.CeilingCount.countKeys links,\n key ∉ Auths.Product.CeilingCount.sumKeys facts.text links → raised key = counts key" + "module": "Auths.Verifier.TemporalExamples", + "name": "Auths.TemporalWitness.Examples.overflowing_expiry_saturates", + "statement": "Auths.TemporalWitness.assuranceHorizon [some 20]\n [{ requirementIndex := 0, observedAt := some Auths.TemporalWitness.wordMaximum }]\n Auths.TemporalWitness.wordMaximum =\n Except.ok Auths.TemporalWitness.wordMaximum", + "statement_constants": [ + "Eq", + "Except", + "Nat", + "Option", + "Unit", + "instOfNatNat", + "Except.ok", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Option.some", + "Auths.TemporalWitness.Witness", + "Auths.TemporalWitness.assuranceHorizon", + "Auths.TemporalWitness.wordMaximum", + "Auths.TemporalWitness.Witness.mk" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.aggregate_count_bound", - "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (link : Auths.Product.CeilingCount.Link),\n (Auths.Product.CeilingCount.containing link (Auths.Product.CeilingCount.admitAll counts arrivals).2).length ≤\n link.2.maxCount" + "module": "Auths.Crypto.SuiteAdapters", + "name": "Auths.Crypto.SuiteAdapters.ed_public_refines", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (suite : AuthsSuiteAdapters.Ed25519Suite) (input : AuthsSuiteAdapters.auths_ports.SignatureInput),\n AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify suite input =\n Aeneas.Std.Result.ok\n (Auths.Crypto.SuiteAdapters.portResult\n (Auths.Crypto.Strict.SuiteModel.edVerify decode equation ↑input.verification_key ↑input.signing_preimage\n ↑input.signature))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "AuthsSuiteAdapters.Ed25519Suite", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "AuthsSuiteAdapters.auths_ports.SignatureInput", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract", + "Auths.Crypto.SuiteAdapters.portResult", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signature", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signing_preimage", + "AuthsSuiteAdapters.auths_ports.SignatureInput.verification_key", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.edVerify", + "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.aggregate_spend_bound", - "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (link : Auths.Product.CeilingCount.Link),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (Auths.Product.CeilingCount.containing link (Auths.Product.CeilingCount.admitAll counts arrivals).2)).sum ≤\n link.2.ceiling * link.2.maxCount" + "module": "Auths.Crypto.SuiteAdapters", + "name": "Auths.Crypto.SuiteAdapters.ed_accepts_iff", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (suite : AuthsSuiteAdapters.Ed25519Suite) (input : AuthsSuiteAdapters.auths_ports.SignatureInput),\n AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify suite input =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ()) ↔\n Auths.Crypto.Strict.Acceptance.EdAccepts decode equation ↑input.verification_key ↑input.signing_preimage\n ↑input.signature", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "AuthsSuiteAdapters.Ed25519Suite", + "LE.le", + "List.length", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "AuthsSuiteAdapters.auths_ports.SignatureInput", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signature", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signing_preimage", + "AuthsSuiteAdapters.auths_ports.SignatureInput.verification_key", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.Acceptance.EdAccepts", + "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.aggregate_sum_bound", - "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (link : Auths.Product.CeilingCount.Link) {bound : Auths.Product.CeilingCount.SumBound},\n link.2.sum = some bound →\n ∀ (partition : Auths.Product.CeilingCount.Name),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (Auths.Product.CeilingCount.containingIn link bound partition\n (Auths.Product.CeilingCount.admitAll counts arrivals).2)).sum ≤\n bound.limit" + "module": "Auths.Crypto.SuiteAdapterExamples", + "name": "Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted", + "statement": "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify Auths.Crypto.SuiteAdapterExamples.edSuite\n Auths.Crypto.SuiteAdapterExamples.edInput =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ())", + "statement_constants": [ + "Eq", + "Unit", + "Unit.unit", + "Aeneas.Std.Result", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "Aeneas.Std.Result.ok", + "Auths.Crypto.NativeExamples.forwardingPrimitive", + "Auths.Crypto.SuiteAdapterExamples.edInput", + "Auths.Crypto.SuiteAdapterExamples.edSuite", + "Aeneas.Std.core.result.Result", + "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.delegation_never_multiplies", - "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (root : Auths.Product.CeilingCount.Link),\n (∀ arrival ∈ arrivals, root ∈ arrival.links) →\n (Auths.Product.CeilingCount.admitAll counts arrivals).2.length ≤ root.2.maxCount ∧\n (List.map Auths.Product.CeilingCount.Arrival.value (Auths.Product.CeilingCount.admitAll counts arrivals).2).sum ≤\n root.2.ceiling * root.2.maxCount" + "module": "Auths.Crypto.SuiteAdapterExamples", + "name": "Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused", + "statement": "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify Auths.Crypto.SuiteAdapterExamples.edSuite\n Auths.Crypto.SuiteAdapterExamples.edChanged =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err AuthsSuiteAdapters.auths_ports.SignatureError.InvalidSignature)", + "statement_constants": [ + "Eq", + "Unit", + "Aeneas.Std.Result", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "Aeneas.Std.Result.ok", + "Auths.Crypto.NativeExamples.forwardingPrimitive", + "Auths.Crypto.SuiteAdapterExamples.edChanged", + "Auths.Crypto.SuiteAdapterExamples.edSuite", + "AuthsSuiteAdapters.auths_ports.SignatureError.InvalidSignature", + "Aeneas.Std.core.result.Result", + "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.sum_delegation_never_multiplies", - "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (root : Auths.Product.CeilingCount.Link),\n (∀ arrival ∈ arrivals, root ∈ arrival.links) →\n ∀ {bound : Auths.Product.CeilingCount.SumBound},\n root.2.sum = some bound →\n ∀ (partition : Auths.Product.CeilingCount.Name),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (List.filter\n (fun arrival =>\n decide (Auths.Product.CeilingCount.partitionValue arrival.facts.text bound.partition = partition))\n (Auths.Product.CeilingCount.admitAll counts arrivals).2)).sum ≤\n bound.limit" + "module": "Auths.Crypto.SuiteAdapters", + "name": "Auths.Crypto.SuiteAdapters.p256_public_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (suite : AuthsSuiteAdapters.P256Sha256Suite) (input : AuthsSuiteAdapters.auths_ports.SignatureInput),\n AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify suite input =\n Aeneas.Std.Result.ok\n (Auths.Crypto.SuiteAdapters.portResult\n (Auths.Crypto.Strict.SuiteModel.p256Verify decode parse equation ↑input.verification_key\n ↑input.signing_preimage ↑input.signature))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "AuthsSuiteAdapters.P256Sha256Suite", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "AuthsSuiteAdapters.auths_ports.SignatureInput", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature", + "Auths.Crypto.SuiteAdapters.portResult", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signature", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signing_preimage", + "AuthsSuiteAdapters.auths_ports.SignatureInput.verification_key", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.p256Verify", + "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.scope_admits_only_listed", - "statement": "∀ {facts : Auths.Product.CeilingCount.Facts} {value : ℕ} {links : List Auths.Product.CeilingCount.Link}\n {counts : Auths.Product.CeilingCount.CounterKey → ℕ},\n Auths.Product.CeilingCount.chainAdmits facts value links counts = true →\n ∀ {link : Auths.Product.CeilingCount.Link},\n link ∈ links →\n (∀ (scope : Auths.Product.CeilingCount.Values),\n link.2.scope = some scope →\n ∃ listedValue, facts.text scope.argument = some listedValue ∧ listedValue ∈ scope.values) ∧\n ∀ (bound : Auths.Product.CeilingCount.SumBound) (partition : Auths.Product.CeilingCount.Values),\n link.2.sum = some bound →\n bound.partition = some partition →\n ∃ listedValue, facts.text partition.argument = some listedValue ∧ listedValue ∈ partition.values" + "module": "Auths.Crypto.SuiteAdapters", + "name": "Auths.Crypto.SuiteAdapters.p256_accepts_iff", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (suite : AuthsSuiteAdapters.P256Sha256Suite) (input : AuthsSuiteAdapters.auths_ports.SignatureInput),\n AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify suite input =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ()) ↔\n Auths.Crypto.Strict.Acceptance.P256Accepts decode parse equation ↑input.verification_key ↑input.signing_preimage\n ↑input.signature", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "AuthsSuiteAdapters.P256Sha256Suite", + "LE.le", + "List.length", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "AuthsSuiteAdapters.auths_ports.SignatureInput", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signature", + "AuthsSuiteAdapters.auths_ports.SignatureInput.signing_preimage", + "AuthsSuiteAdapters.auths_ports.SignatureInput.verification_key", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.Acceptance.P256Accepts", + "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1540,9 +5274,23 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.chain_counts_part", - "statement": "∀ (links : List Auths.Product.CeilingCount.Link) (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.countsAdmit (List.map counts (Auths.Product.CeilingCount.countKeys links).dedup)\n (List.map (Auths.Product.CeilingCount.countCapacity links) (Auths.Product.CeilingCount.countKeys links).dedup) =\n true ↔\n ∀ link ∈ links, counts (Auths.Product.CeilingCount.countKey link) < link.2.maxCount" + "module": "Auths.Crypto.SuiteAdapterExamples", + "name": "Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted", + "statement": "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify Auths.Crypto.SuiteAdapterExamples.p256Suite\n Auths.Crypto.SuiteAdapterExamples.p256Input =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ())", + "statement_constants": [ + "Eq", + "Unit", + "Unit.unit", + "Aeneas.Std.Result", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.SuiteAdapterExamples.p256Input", + "Auths.Crypto.SuiteAdapterExamples.p256Suite", + "Aeneas.Std.core.result.Result", + "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1551,52 +5299,103 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.chain_sums_part", - "statement": "∀ (text : Auths.Product.CeilingCount.Name → Option Auths.Product.CeilingCount.Name)\n (links : List Auths.Product.CeilingCount.Link) (value : ℕ) (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.sumsAdmit (List.map counts (Auths.Product.CeilingCount.sumKeys text links).dedup) value\n (List.map (Auths.Product.CeilingCount.sumCapacity text links)\n (Auths.Product.CeilingCount.sumKeys text links).dedup) =\n true ↔\n ∀ entry ∈ Auths.Product.CeilingCount.sumEntries text links, counts entry.1 + value ≤ entry.2" + "module": "Auths.Crypto.SuiteAdapterExamples", + "name": "Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused", + "statement": "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify Auths.Crypto.SuiteAdapterExamples.p256Suite\n Auths.Crypto.SuiteAdapterExamples.p256Changed =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err AuthsSuiteAdapters.auths_ports.SignatureError.InvalidSignature)", + "statement_constants": [ + "Eq", + "Unit", + "Aeneas.Std.Result", + "AuthsSuiteAdapters.auths_ports.SignatureError", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.SuiteAdapterExamples.p256Changed", + "Auths.Crypto.SuiteAdapterExamples.p256Suite", + "AuthsSuiteAdapters.auths_ports.SignatureError.InvalidSignature", + "Aeneas.Std.core.result.Result", + "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify", + "Aeneas.Std.core.result.Result.Err" + ] }, { - "axioms": [ - "propext", - "Quot.sound" - ], + "axioms": [], "kind": "theorem", - "module": "Auths.Product.CeilingCount", - "name": "Auths.Product.CeilingCount.chain_admits_parts", - "statement": "∀ (facts : Auths.Product.CeilingCount.Facts) (value : ℕ) (links : List Auths.Product.CeilingCount.Link)\n (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.chainAdmits facts value links counts = true ↔\n (∀ link ∈ links,\n facts.argument link.2.argument = some value ∧\n value ≤ link.2.ceiling ∧\n Auths.Product.CeilingCount.scopeAdmits facts.text link.2.scope = true ∧\n ∀ bound ∈ link.2.sum, Auths.Product.CeilingCount.partitionAdmits facts.text bound.partition = true) ∧\n (∀ link ∈ links, counts (Auths.Product.CeilingCount.countKey link) < link.2.maxCount) ∧\n ∀ entry ∈ Auths.Product.CeilingCount.sumEntries facts.text links, counts entry.1 + value ≤ entry.2" + "module": "qualification.aeneas.generated.suite_adapter.FunsExternal", + "name": "AuthsSuiteAdapters.ed_error_to_from", + "statement": "∀ (reason : auths_signature_core.Ed25519Error),\n AuthsSuiteAdapters.toEdError (AuthsSuiteAdapters.fromEdError reason) = reason", + "statement_constants": [ + "Eq", + "AuthsSuiteAdapters.fromEdError", + "AuthsSuiteAdapters.toEdError", + "auths_signature_core.Ed25519Error" + ] }, { "axioms": [], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.capability_total_deterministic", - "statement": "∀ (declarations : Auths.Product.Recovery.Declarations),\n ∃! result, Auths.Product.Recovery.capability declarations = result ∧ result.writeIsConditional = false" + "module": "qualification.aeneas.generated.suite_adapter.FunsExternal", + "name": "AuthsSuiteAdapters.ed_error_from_to", + "statement": "∀ (reason : AuthsSuiteAdapters.auths_signature_core.Ed25519Error),\n AuthsSuiteAdapters.fromEdError (AuthsSuiteAdapters.toEdError reason) = reason", + "statement_constants": [ + "Eq", + "AuthsSuiteAdapters.fromEdError", + "AuthsSuiteAdapters.toEdError", + "AuthsSuiteAdapters.auths_signature_core.Ed25519Error" + ] }, { - "axioms": [ - "propext" - ], + "axioms": [], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.class_matches_declarations", - "statement": "∀ (declarations : Auths.Product.Recovery.Declarations),\n ((Auths.Product.Recovery.capability declarations).recoveryClass = Auths.Product.Recovery.RecoveryClass.linked ↔\n declarations.observation = Auths.Product.Recovery.Observation.verifiedLocator ∧ declarations.echo = true) ∧\n ((Auths.Product.Recovery.capability declarations).recoveryClass =\n Auths.Product.Recovery.RecoveryClass.linkedAfterResponse ↔\n declarations.observation = Auths.Product.Recovery.Observation.responseLocator ∧ declarations.echo = true) ∧\n ((Auths.Product.Recovery.capability declarations).recoveryClass = Auths.Product.Recovery.RecoveryClass.observed ↔\n declarations.observation ≠ Auths.Product.Recovery.Observation.none ∧ declarations.echo = false) ∧\n ((Auths.Product.Recovery.capability declarations).recoveryClass =\n Auths.Product.Recovery.RecoveryClass.recorded ↔\n declarations.observation = Auths.Product.Recovery.Observation.none) ∧\n ((Auths.Product.Recovery.capability declarations).unknownResolution =\n Auths.Product.Recovery.Resolution.gatewayReobservation ↔\n (Auths.Product.Recovery.capability declarations).recoveryClass =\n Auths.Product.Recovery.RecoveryClass.linked) ∧\n (Auths.Product.Recovery.capability declarations).stateObservation = declarations.observation ∧\n ((Auths.Product.Recovery.capability declarations).providerLink =\n if declarations.echo = true then declarations.observation\n else Auths.Product.Recovery.Observation.none) ∧\n (Auths.Product.Recovery.capability declarations).lostClaimReentry = declarations.idempotency ∧\n (Auths.Product.Recovery.capability declarations).preEntryReread = declarations.preEntry" + "module": "qualification.aeneas.generated.suite_adapter.FunsExternal", + "name": "AuthsSuiteAdapters.p256_error_to_from", + "statement": "∀ (reason : AuthsNativeP256.P256Error),\n AuthsSuiteAdapters.toP256Error (AuthsSuiteAdapters.fromP256Error reason) = reason", + "statement_constants": [ + "Eq", + "AuthsNativeP256.P256Error", + "AuthsSuiteAdapters.fromP256Error", + "AuthsSuiteAdapters.toP256Error" + ] }, { "axioms": [], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.write_never_conditional", - "statement": "∀ (declarations : Auths.Product.Recovery.Declarations),\n (Auths.Product.Recovery.capability declarations).writeIsConditional = false" + "module": "qualification.aeneas.generated.suite_adapter.FunsExternal", + "name": "AuthsSuiteAdapters.p256_error_from_to", + "statement": "∀ (reason : AuthsSuiteAdapters.auths_signature_core.P256Error),\n AuthsSuiteAdapters.fromP256Error (AuthsSuiteAdapters.toP256Error reason) = reason", + "statement_constants": [ + "Eq", + "AuthsSuiteAdapters.fromP256Error", + "AuthsSuiteAdapters.toP256Error", + "AuthsSuiteAdapters.auths_signature_core.P256Error" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.unknown_resolves_only_linked", - "statement": "(∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validTransition old new = true →\n old.stage = Auths.Product.Recovery.Stage.unknown →\n new.stage = Auths.Product.Recovery.Stage.observedByProvider ∧\n old.link = Auths.Product.Recovery.Link.verified ∧\n new.link = Auths.Product.Recovery.Link.verified ∧ new.evidence = true) ∧\n (∀ (views : List Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validChain views →\n ∀ (index : ℕ) (bound : index + 1 < views.length),\n views[index].stage = Auths.Product.Recovery.Stage.unknown →\n views[index + 1].stage = Auths.Product.Recovery.Stage.observedByProvider ∧\n views[index + 1].link = Auths.Product.Recovery.Link.verified ∧ views[index + 1].evidence = true) ∧\n ∀ (declarations : Auths.Product.Recovery.Declarations),\n Auths.Product.Recovery.linkOf (Auths.Product.Recovery.capability declarations).providerLink =\n Auths.Product.Recovery.Link.verified ↔\n (Auths.Product.Recovery.capability declarations).recoveryClass = Auths.Product.Recovery.RecoveryClass.linked" + "module": "qualification.aeneas.generated.suite_adapter.FunsExternal", + "name": "AuthsSuiteAdapters.ed25519_delegates", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (key message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsSuiteAdapters.auths_signature_core.verify_ed25519 key message signature = do\n let result ← auths_signature_core.verify_ed25519 key message signature\n Aeneas.Std.Result.ok (AuthsSuiteAdapters.edResult result)", + "statement_constants": [ + "Eq", + "Unit", + "AuthsSuiteAdapters.edResult", + "Bind.bind", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.instBindResult", + "Auths.Crypto.Ed25519Primitives", + "AuthsSuiteAdapters.auths_signature_core.Ed25519Error", + "AuthsSuiteAdapters.auths_signature_core.verify_ed25519", + "Aeneas.Std.Result.ok", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -1605,19 +5404,60 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.provider_claim_requires_evidence", - "statement": "(∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validTransition old new = true →\n new.stage = Auths.Product.Recovery.Stage.observedByProvider →\n new.evidence = true ∧\n Auths.Product.Recovery.hasLink new.link = true ∧\n new.link = old.link ∧\n (old.stage = Auths.Product.Recovery.Stage.responseRecorded ∨\n (old.stage = Auths.Product.Recovery.Stage.attempting ∨\n old.stage = Auths.Product.Recovery.Stage.unknown) ∧\n old.link = Auths.Product.Recovery.Link.verified)) ∧\n ∀ (first : Auths.Product.Recovery.AttemptView) (rest : List Auths.Product.Recovery.AttemptView),\n first.stage = Auths.Product.Recovery.Stage.attempting →\n Auths.Product.Recovery.consistent first = true →\n Auths.Product.Recovery.validChain (first :: rest) →\n ∀ (index : ℕ) (bound : index < rest.length),\n rest[index].stage = Auths.Product.Recovery.Stage.observedByProvider →\n rest[index].evidence = true ∧\n rest[index].link = first.link ∧\n Auths.Product.Recovery.hasLink first.link = true ∧\n ((first :: rest)[index].stage = Auths.Product.Recovery.Stage.responseRecorded ∨\n ((first :: rest)[index].stage = Auths.Product.Recovery.Stage.attempting ∨\n (first :: rest)[index].stage = Auths.Product.Recovery.Stage.unknown) ∧\n first.link = Auths.Product.Recovery.Link.verified)" + "module": "qualification.aeneas.generated.suite_adapter.FunsExternal", + "name": "AuthsSuiteAdapters.p256_delegates", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (key message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsSuiteAdapters.auths_signature_core.verify_p256_sha256 key message signature = do\n let result ← AuthsNativeP256.verify_p256_sha256 key message signature\n Aeneas.Std.Result.ok (AuthsSuiteAdapters.p256Result result)", + "statement_constants": [ + "Eq", + "Unit", + "AuthsNativeP256.verify_p256_sha256", + "AuthsSuiteAdapters.p256Result", + "Bind.bind", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.instBindResult", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "AuthsSuiteAdapters.auths_signature_core.P256Error", + "AuthsSuiteAdapters.auths_signature_core.verify_p256_sha256", + "Aeneas.Std.Result.ok", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.terminal_stages_final", - "statement": "(∀ (stage : Auths.Product.Recovery.Stage),\n Auths.Product.Recovery.terminalStage stage = true ↔\n stage = Auths.Product.Recovery.Stage.notEntered ∨\n stage = Auths.Product.Recovery.Stage.observed ∨ stage = Auths.Product.Recovery.Stage.observedByProvider) ∧\n (∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.terminalStage old.stage = true → Auths.Product.Recovery.validTransition old new = false) ∧\n ∀ (views : List Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validChain views →\n ∀ (index : ℕ) (bound : index < views.length),\n Auths.Product.Recovery.terminalStage views[index].stage = true → index + 1 = views.length" + "module": "Auths.Crypto.P256Encoding", + "name": "Auths.Crypto.P256Encoding.guard_refines", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.p256_key_encoding_is_canonical input =\n Aeneas.Std.Result.ok (decide (Auths.Crypto.P256Encoding.Encoding (List.map Aeneas.Std.UScalar.val ↑input)))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "AuthsNativeP256.p256_key_encoding_is_canonical", + "Decidable.decide", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Encoding.Encoding", + "Auths.Crypto.Encoding.P256.instDecidableEncoding" + ] }, { "axioms": [ @@ -1626,117 +5466,420 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Recovery", - "name": "Auths.Product.Recovery.transitions_preserve_identity", - "statement": "(∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.consistent old = true →\n Auths.Product.Recovery.validTransition old new = true → Auths.Product.Recovery.Keeps old new) ∧\n ∀ (views : List Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validChain views →\n (∀ (bound : 0 < views.length), Auths.Product.Recovery.consistent views[0] = true) →\n ∀ (earlier later : ℕ) (order : earlier ≤ later) (bound : later < views.length),\n Auths.Product.Recovery.Keeps views[earlier] views[later]" + "module": "Auths.Crypto.P256LowScan", + "name": "Auths.Crypto.P256LowScan.loop_refines", + "statement": "∀ (input : Auths.Crypto.P256LowScan.Input) (remaining : ℕ) (index : Aeneas.Std.Usize),\n ↑index + remaining = 32 →\n Aeneas.Std.WP.spec (AuthsNativeP256.p256_signature_is_low_s_loop input index) fun result =>\n result =\n Auths.Crypto.ByteLex.le (List.drop (32 + ↑index) ↑input) (List.drop ↑index ↑AuthsNativeP256.P256_HALF_ORDER)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "AuthsNativeP256.P256_HALF_ORDER", + "AuthsNativeP256.p256_signature_is_low_s_loop", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAdd.hAdd", + "LE.le", + "List.drop", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Crypto.ByteLex.le", + "Auths.Crypto.P256LowScan.Input", + "Auths.Crypto.P256LowScan.Input._proof_1" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.lease_requires_verified_claim", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event) (mode : Auths.Product.SubmitOrder.Mode),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.lease mode →\n event = Auths.Product.SubmitOrder.Event.reload true ∧\n (Auths.Product.SubmitOrder.stateAfter plan pre).phase = Auths.Product.SubmitOrder.Phase.reload mode ∧\n (∃ argument, Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument) ∧\n (mode = Auths.Product.SubmitOrder.Mode.reobserve →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.replay)) ∧\n (mode ≠ Auths.Product.SubmitOrder.Mode.reobserve →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.inserted))" + "module": "Auths.Crypto.P256LowContract", + "name": "Auths.Crypto.P256LowContract.guard_refines", + "statement": "∀ (input : Auths.Crypto.P256LowScan.Input),\n AuthsNativeP256.p256_signature_is_low_s input =\n Aeneas.Std.Result.ok\n (decide (Auths.Crypto.ByteLex.value (List.drop 32 ↑input) ≤ Auths.Crypto.P256LowContract.order / 2))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instHDiv", + "instLENat", + "instOfNatNat", + "AuthsNativeP256.p256_signature_is_low_s", + "Decidable.decide", + "HDiv.hDiv", + "LE.le", + "List.drop", + "List.length", + "Nat.decLe", + "Nat.instDiv", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.ByteLex.value", + "Auths.Crypto.P256LowContract.order", + "Auths.Crypto.P256LowScan.Input", + "Auths.Crypto.P256LowScan.Input._proof_1" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.send_requires_lease_and_deadline", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.send →\n event = Auths.Product.SubmitOrder.Event.deadline true ∧\n (Auths.Product.SubmitOrder.stateAfter plan pre).phase = Auths.Product.SubmitOrder.Phase.deadline ∧\n (∃ argument, Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.inserted) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.lease Auths.Product.SubmitOrder.Mode.entry)\n (Auths.Product.SubmitOrder.Event.lease true) ∧\n (plan.preEntry = true →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.preEntry\n (Auths.Product.SubmitOrder.Event.preEntry Auths.Product.SubmitOrder.PreEntryResult.satisfied)) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.entryReload (Auths.Product.SubmitOrder.Event.reload true)" + "module": "Auths.Crypto.P256LowContract", + "name": "Auths.Crypto.P256LowContract.r_bytes_irrelevant", + "statement": "∀ (left right : Auths.Crypto.P256LowScan.Input),\n List.drop 32 ↑left = List.drop 32 ↑right →\n AuthsNativeP256.p256_signature_is_low_s left = AuthsNativeP256.p256_signature_is_low_s right", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instOfNatNat", + "AuthsNativeP256.p256_signature_is_low_s", + "List.drop", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.P256LowScan.Input", + "Auths.Crypto.P256LowScan.Input._proof_1" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.send_requires_credential_checks", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.send →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.prefixGuard Auths.Product.SubmitOrder.Mode.entry)\n (Auths.Product.SubmitOrder.Event.prefixGuard true) ∧\n (plan.accountRead = true →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.account Auths.Product.SubmitOrder.Mode.entry)\n (Auths.Product.SubmitOrder.Event.account Auths.Product.SubmitOrder.AccountResult.equal)) ∧\n ∀ index < plan.deniedReads,\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.denied Auths.Product.SubmitOrder.Mode.entry index)\n (Auths.Product.SubmitOrder.Event.denied Auths.Product.SubmitOrder.DeniedResult.refused)" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.decode_leaf_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.decode_p256_point bytes = Aeneas.Std.Result.ok (Auths.Crypto.P256Native.keyOption (decode ↑bytes))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "AuthsNativeP256.decode_p256_point", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_13", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Native.keyOption", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.send_requires_relative_ceiling", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.send →\n plan.relativeCeiling = true →\n ∃ argument basis,\n Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument ∧\n (∀ (other : ℕ),\n Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) other → other = argument) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.ceiling\n (Auths.Product.SubmitOrder.Event.ceiling (Auths.Product.SubmitOrder.CeilingRead.read basis true)) ∧\n Auths.Product.RelativeCeiling.admits argument basis plan.basisPoints = true" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.parse_leaf_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (bytes : Aeneas.Std.Array Aeneas.Std.U8 64#usize),\n AuthsNativeP256.parse_p256_signature bytes =\n Aeneas.Std.Result.ok (Auths.Crypto.P256Native.signatureOption (parse ↑bytes))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "AuthsNativeP256.parse_p256_signature", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_12", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Native.signatureOption", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.account_scope_requires_binding", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.claim →\n plan.accountScope = true →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.scope (Auths.Product.SubmitOrder.Event.scope true) ∧\n ∃ argument, Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.equation_leaf_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (key : Auths.Crypto.P256Primitives.Key) (message : Aeneas.Std.Slice Aeneas.Std.U8)\n (signature : Auths.Crypto.P256Primitives.Signature),\n AuthsNativeP256.verify_p256_equation key message signature =\n Aeneas.Std.Result.ok (equation key (↑message) signature)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "AuthsNativeP256.verify_p256_equation", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.at_most_one_send", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (events : List Auths.Product.SubmitOrder.Event),\n List.count Auths.Product.SubmitOrder.Action.send\n (List.map Auths.Product.SubmitOrder.Step.action (Auths.Product.SubmitOrder.steps plan events)) ≤\n 1 ∧\n (Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan events)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.replay) →\n ¬Auths.Product.SubmitOrder.Emitted (Auths.Product.SubmitOrder.steps plan events)\n Auths.Product.SubmitOrder.Action.send)" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.decode_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.decode_p256_key_with bytes =\n Aeneas.Std.Result.ok (Auths.Crypto.P256Native.keyResult (Auths.Crypto.Strict.SuiteModel.p256Key decode ↑bytes))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "AuthsNativeP256.decode_p256_key_with", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_3", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Native.keyResult", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature", + "Auths.Crypto.Strict.SuiteModel.p256Key" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.pre_claim_refusal_stores_nothing", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.stop Auths.Product.SubmitOrder.Stop.refused →\n ∀ step ∈ Auths.Product.SubmitOrder.steps plan pre,\n Auths.Product.SubmitOrder.preClaimAction step.action = true ∧\n Auths.Product.SubmitOrder.writesStore step.action = false ∧\n Auths.Product.SubmitOrder.leasesOrSends step.action = false" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.public_verify_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.verify_p256_sha256 bytes message signature =\n Aeneas.Std.Result.ok\n (Auths.Crypto.P256Native.verifyResult\n (Auths.Crypto.Strict.SuiteModel.p256Verify decode parse equation ↑bytes ↑message ↑signature))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "AuthsNativeP256.verify_p256_sha256", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Native.verifyResult", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature", + "Auths.Crypto.Strict.SuiteModel.p256Verify" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.not_entered_refusal_table", - "statement": "∀ (state : Auths.Product.SubmitOrder.State) (event : Auths.Product.SubmitOrder.Event)\n (refusal : Auths.Product.SubmitOrder.Refusal),\n (Auths.Product.SubmitOrder.nextStep state event).action = Auths.Product.SubmitOrder.Action.recordNotEntered refusal ↔\n Auths.Product.SubmitOrder.refusalOf state event = some refusal" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.public_accepts_iff", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.verify_p256_sha256 bytes message signature =\n Aeneas.Std.Result.ok (AuthsNativeP256.core.qualified_p256_type_decls_0.Ok ()) ↔\n Auths.Crypto.Strict.Acceptance.P256Accepts decode parse equation ↑bytes ↑message ↑signature", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "instLENat", + "AuthsNativeP256.verify_p256_sha256", + "LE.le", + "List.length", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature", + "AuthsNativeP256.core.qualified_p256_type_decls_0.Ok", + "Auths.Crypto.Strict.Acceptance.P256Accepts" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.SubmitOrder", - "name": "Auths.Product.SubmitOrder.post_claim_refusal_records_not_entered", - "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event) (refusal : Auths.Product.SubmitOrder.Refusal),\n ((Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.recordNotEntered refusal ↔\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.inserted) ∧\n Auths.Product.SubmitOrder.refusalOf (Auths.Product.SubmitOrder.stateAfter plan pre) event = some refusal) ∧\n ((Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.recordNotEntered refusal →\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).state.phase =\n Auths.Product.SubmitOrder.Phase.recordNotEntered ∧\n (Auths.Product.SubmitOrder.Emitted (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Action.send →\n refusal = Auths.Product.SubmitOrder.Refusal.transportNotEntered))" + "module": "Auths.Crypto.P256Native", + "name": "Auths.Crypto.P256Native.public_validate_refines", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Key)\n (parse : List Aeneas.Std.U8 → Option Auths.Crypto.P256Primitives.Signature)\n (equation : Auths.Crypto.P256Primitives.Key → List Aeneas.Std.U8 → Auths.Crypto.P256Primitives.Signature → Bool),\n Auths.Crypto.P256Native.Contract decode parse equation →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.validate_p256_key bytes =\n Aeneas.Std.Result.ok\n (Auths.Crypto.P256Native.verifyResult do\n let __discr ← Auths.Crypto.Strict.SuiteModel.p256Key decode ↑bytes\n have x : Auths.Crypto.P256Primitives.Key := __discr\n pure ())", + "statement_constants": [ + "Bool", + "Eq", + "Except", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "Applicative.toPure", + "AuthsNativeP256.validate_p256_key", + "Bind.bind", + "Except.instMonad", + "LE.le", + "List.length", + "Monad.toApplicative", + "Monad.toBind", + "Pure.pure", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Native.verifyResult", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature", + "Auths.Crypto.Strict.SuiteModel.Failure", + "Auths.Crypto.Strict.SuiteModel.p256Key" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RelativeCeiling", - "name": "Auths.Product.RelativeCeiling.relative_ceiling_exact", - "statement": "∀ (argument basis basisPoints : ℕ),\n Auths.Product.RelativeCeiling.admits argument basis basisPoints = true ↔\n argument ≤ basis * basisPoints / Auths.Product.RelativeCeiling.basisPointsPerWhole" + "module": "Auths.Crypto.P256Examples", + "name": "Auths.Crypto.P256Examples.public_call_forwards_exact_bytes", + "statement": "AuthsNativeP256.verify_p256_sha256 Auths.Crypto.P256Examples.key Auths.Crypto.P256Examples.message\n Auths.Crypto.P256Examples.signature =\n Aeneas.Std.Result.ok (AuthsNativeP256.core.qualified_p256_type_decls_0.Ok ())", + "statement_constants": [ + "Eq", + "AuthsNativeP256.verify_p256_sha256", + "Unit.unit", + "Aeneas.Std.Result", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.P256Examples.key", + "Auths.Crypto.P256Examples.message", + "Auths.Crypto.P256Examples.signature", + "AuthsNativeP256.core.qualified_p256_type_decls_0.Ok" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RelativeCeiling", - "name": "Auths.Product.RelativeCeiling.relative_ceiling_never_exceeds_ratio", - "statement": "∀ (argument basis basisPoints : ℕ),\n Auths.Product.RelativeCeiling.admits argument basis basisPoints = true →\n argument * Auths.Product.RelativeCeiling.basisPointsPerWhole ≤ basis * basisPoints" + "module": "Auths.Crypto.P256Examples", + "name": "Auths.Crypto.P256Examples.changed_message_is_refused", + "statement": "AuthsNativeP256.verify_p256_sha256 Auths.Crypto.P256Examples.key Auths.Crypto.P256Examples.changedMessage\n Auths.Crypto.P256Examples.signature =\n Aeneas.Std.Result.ok\n (AuthsNativeP256.core.qualified_p256_type_decls_0.Err AuthsNativeP256.P256Error.VerificationFailed)", + "statement_constants": [ + "Eq", + "AuthsNativeP256.verify_p256_sha256", + "Aeneas.Std.Result", + "AuthsNativeP256.P256Error.VerificationFailed", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.changedMessage", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.P256Examples.key", + "Auths.Crypto.P256Examples.signature", + "AuthsNativeP256.core.qualified_p256_type_decls_0.Err" + ] }, { "axioms": [ @@ -1745,9 +5888,22 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RelativeCeiling", - "name": "Auths.Product.RelativeCeiling.relative_ceiling_monotone", - "statement": "(∀ (argument argument' basis basis' basisPoints basisPoints' : ℕ),\n argument' ≤ argument →\n basis ≤ basis' →\n basisPoints ≤ basisPoints' →\n Auths.Product.RelativeCeiling.admits argument basis basisPoints = true →\n Auths.Product.RelativeCeiling.admits argument' basis' basisPoints' = true) ∧\n (∀ (argument basisPoints : ℕ), Auths.Product.RelativeCeiling.admits argument 0 basisPoints = true ↔ argument = 0) ∧\n ∀ (argument basis : ℕ), Auths.Product.RelativeCeiling.admits argument basis 0 = true ↔ argument = 0" + "module": "Auths.Crypto.P256Examples", + "name": "Auths.Crypto.P256Examples.changed_key_is_refused", + "statement": "AuthsNativeP256.verify_p256_sha256 Auths.Crypto.P256Examples.changedKey Auths.Crypto.P256Examples.message\n Auths.Crypto.P256Examples.signature =\n Aeneas.Std.Result.ok\n (AuthsNativeP256.core.qualified_p256_type_decls_0.Err AuthsNativeP256.P256Error.VerificationFailed)", + "statement_constants": [ + "Eq", + "AuthsNativeP256.verify_p256_sha256", + "Aeneas.Std.Result", + "AuthsNativeP256.P256Error.VerificationFailed", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.changedKey", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.P256Examples.message", + "Auths.Crypto.P256Examples.signature", + "AuthsNativeP256.core.qualified_p256_type_decls_0.Err" + ] }, { "axioms": [ @@ -1756,63 +5912,144 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RelativeCeiling", - "name": "Auths.Product.RelativeCeiling.relative_basis_never_negative", - "statement": "∀ (value : ℕ),\n Auths.Product.RelativeCeiling.relativeBasis value none = some value ∧\n (∀ (second basis : ℕ),\n Auths.Product.RelativeCeiling.relativeBasis value (some second) = some basis ↔\n second ≤ value ∧ basis + second = value) ∧\n (∀ (second : ℕ), Auths.Product.RelativeCeiling.relativeBasis value (some second) = none ↔ value < second) ∧\n ∀ (subtrahend : Option ℕ) (basis : ℕ),\n Auths.Product.RelativeCeiling.relativeBasis value subtrahend = some basis → basis ≤ value" + "module": "Auths.Crypto.P256Examples", + "name": "Auths.Crypto.P256Examples.changed_signature_is_refused", + "statement": "AuthsNativeP256.verify_p256_sha256 Auths.Crypto.P256Examples.key Auths.Crypto.P256Examples.message\n Auths.Crypto.P256Examples.changedSignature =\n Aeneas.Std.Result.ok\n (AuthsNativeP256.core.qualified_p256_type_decls_0.Err AuthsNativeP256.P256Error.VerificationFailed)", + "statement_constants": [ + "Eq", + "AuthsNativeP256.verify_p256_sha256", + "Aeneas.Std.Result", + "AuthsNativeP256.P256Error.VerificationFailed", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.changedSignature", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.P256Examples.key", + "Auths.Crypto.P256Examples.message", + "AuthsNativeP256.core.qualified_p256_type_decls_0.Err" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RequestConstruction", - "name": "Auths.Product.RequestConstruction.method_and_origin_fixed", - "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n request.method = plan.method ∧ plan.origin <+: request.url) ∧\n ∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n request.method = Auths.Product.RequestConstruction.Method.get ∧ plan.origin <+: request.url" + "module": "Auths.Crypto.P256Examples", + "name": "Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract", + "statement": "∀ [P : Auths.Crypto.P256Primitives] (message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeP256.verify_p256_sha256 Auths.Crypto.P256Examples.empty message signature =\n Aeneas.Std.Result.ok (AuthsNativeP256.core.qualified_p256_type_decls_0.Err AuthsNativeP256.P256Error.InvalidKey)", + "statement_constants": [ + "Eq", + "AuthsNativeP256.verify_p256_sha256", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.P256Primitives", + "AuthsNativeP256.P256Error.InvalidKey", + "AuthsNativeP256.core.qualified_p256_type_decls_0", + "Aeneas.Std.Result.ok", + "Auths.Crypto.P256Examples.empty", + "AuthsNativeP256.core.qualified_p256_type_decls_0.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RequestConstruction", - "name": "Auths.Product.RequestConstruction.path_from_declared_segments", - "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n request.url = plan.origin ++ Auths.Product.RequestConstruction.renderPath arguments plan.path ∧\n ∀ segment ∈ plan.path,\n match segment with\n | Auths.Product.RequestConstruction.Segment.fixed value => True\n | Auths.Product.RequestConstruction.Segment.field index =>\n ∃ text,\n arguments[index]? = some (Auths.Product.RequestConstruction.Arg.text text) ∧\n Auths.Product.RequestConstruction.segmentValueValid text = true ∧\n Auths.Product.RequestConstruction.segmentBytes arguments segment =\n Auths.Product.RequestConstruction.pathEncode text) ∧\n (∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n request.url = plan.origin ++ Auths.Product.RequestConstruction.renderPath arguments plan.path) ∧\n ∀ (text : Auths.Product.RequestConstruction.Bytes) (separator : ℕ),\n separator = 47 ∨ separator = 63 ∨ separator = 35 → separator ∉ Auths.Product.RequestConstruction.pathEncode text" + "module": "Auths.Crypto.P256Examples", + "name": "Auths.Crypto.P256Examples.forwarding_contract", + "statement": "Auths.Crypto.P256Native.Contract (fun bytes => some bytes) (fun bytes => some bytes) Auths.Crypto.P256Examples.equation", + "statement_constants": [ + "List", + "Option.some", + "Aeneas.Std.U8", + "Auths.Crypto.P256Examples.equation", + "Auths.Crypto.P256Examples.forwardingPrimitive", + "Auths.Crypto.P256Native.Contract", + "Auths.Crypto.P256Primitives.Key", + "Auths.Crypto.P256Primitives.Signature" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RequestConstruction", - "name": "Auths.Product.RequestConstruction.headers_within_declaration", - "statement": "∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n ∀ header ∈ request.headers,\n header ∈ plan.headers.versions ∨\n (∃ scope, plan.headers.scope = some scope ∧ header.name = scope.name) ∨\n ∃ «name», plan.idempotency = some «name» ∧ header = { «name» := «name», value := key }" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.identifier_total", + "statement": "∀ (kind : auths_codec.hash.IdentifierType) (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_codec.hash.identifier_preimage kind payload) fun result =>\n Auths.Crypto.FramingTotality.IdentifierResult payload result", + "statement_constants": [ + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.WP.spec", + "Auths.Crypto.FramingTotality.IdentifierResult", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RequestConstruction", - "name": "Auths.Product.RequestConstruction.account_scope_header_exact", - "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request)\n (scope : Auths.Product.RequestConstruction.ScopePlan),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n plan.headers.scope = some scope →\n ∃ value,\n arguments[scope.field]? = some (Auths.Product.RequestConstruction.Arg.text value) ∧\n Auths.Product.RequestConstruction.scopeValueValid value = true ∧\n { «name» := scope.name, value := value } ∈ request.headers) ∧\n (∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request) (scope : Auths.Product.RequestConstruction.ScopePlan),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n plan.headers.scope = some scope →\n ∃ value,\n arguments[scope.field]? = some (Auths.Product.RequestConstruction.Arg.text value) ∧\n Auths.Product.RequestConstruction.scopeValueValid value = true ∧\n request.headers = plan.headers.versions ++ [{ «name» := scope.name, value := value }]) ∧\n (∀ (plan : Auths.Product.RequestConstruction.CredentialPlan),\n (Auths.Product.RequestConstruction.constructCredentialRead plan).headers = plan.versions) ∧\n (∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n plan.headers.scope = none →\n request.headers = Auths.Product.RequestConstruction.writeHeaders plan plan.headers.versions key) ∧\n ∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n plan.headers.scope = none → request.headers = plan.headers.versions" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Product.RequestConstruction", - "name": "Auths.Product.RequestConstruction.credential_reads_fixed", - "statement": "∀ (plan : Auths.Product.RequestConstruction.CredentialPlan),\n (Auths.Product.RequestConstruction.constructCredentialRead plan).method = plan.method ∧\n (Auths.Product.RequestConstruction.constructCredentialRead plan).url =\n plan.origin ++ List.flatMap (fun segment => 47 :: segment) plan.path ∧\n (Auths.Product.RequestConstruction.constructCredentialRead plan).headers = plan.versions ∧\n (Auths.Product.RequestConstruction.constructCredentialRead plan).body = [] ∧\n (plan.method = Auths.Product.RequestConstruction.Method.get ∨\n plan.method = Auths.Product.RequestConstruction.Method.head →\n (Auths.Product.RequestConstruction.constructCredentialRead plan).method =\n Auths.Product.RequestConstruction.Method.get ∨\n (Auths.Product.RequestConstruction.constructCredentialRead plan).method =\n Auths.Product.RequestConstruction.Method.head)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.identifier_accepts_iff", + "statement": "∀ (kind : auths_codec.hash.IdentifierType) (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n (∃ output,\n auths_codec.hash.identifier_preimage kind payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output)) ↔\n Auths.Crypto.FramingTotality.IdentifierAdmissible payload", + "statement_constants": [ + "Eq", + "Exists", + "Iff", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.FramingTotality.IdentifierAdmissible", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.RequestConstruction", - "name": "Auths.Product.RequestConstruction.body_bounded", - "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n 0 < List.length request.body ∧\n List.length request.body ≤ Auths.Product.RequestConstruction.maxBodyBytes ∧\n request.body = Auths.Product.RequestConstruction.renderBody arguments echo plan.body) ∧\n ∀ (plan : Auths.Product.RequestConstruction.BodyPlan) (echo : Auths.Product.RequestConstruction.Bytes)\n (left right : List Auths.Product.RequestConstruction.Arg),\n (∀ index ∈ Auths.Product.RequestConstruction.bodyFields plan, left[index]? = right[index]?) →\n Auths.Product.RequestConstruction.renderBody left echo plan =\n Auths.Product.RequestConstruction.renderBody right echo plan" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.identifier_refuses_iff", + "statement": "∀ (kind : auths_codec.hash.IdentifierType) (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_codec.hash.identifier_preimage kind payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded) ↔\n ¬Auths.Crypto.FramingTotality.IdentifierAdmissible payload", + "statement_constants": [ + "Eq", + "Iff", + "Not", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.FramingTotality.IdentifierAdmissible", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -1821,19 +6058,47 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_start_refines_model", - "statement": "∀ (plan : auths_gateway_kernel.order.SubmitPlan),\n ∃ state,\n auths_gateway_kernel.order.start plan = Aeneas.Std.Result.ok state ∧\n Auths.Product.Refinement.Gateway.stateOf state =\n Auths.Product.SubmitOrder.start (Auths.Product.Refinement.Gateway.planOf plan)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.application_total", + "statement": "∀ (domain : Aeneas.Std.Str) (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_codec.hash.commitment_preimage domain payload) fun result =>\n Auths.Crypto.FramingTotality.ApplicationResult domain payload result", + "statement_constants": [ + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.WP.spec", + "Auths.Crypto.FramingTotality.ApplicationResult", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_recovery_capability_refines_model", - "statement": "∀ (declarations : auths_gateway_kernel.recovery.RecoveryDeclarations),\n Aeneas.Std.WP.spec (auths_gateway_kernel.recovery.recovery_capability declarations) fun capability =>\n Auths.Product.Refinement.Gateway.capabilityOf capability =\n Auths.Product.Recovery.capability (Auths.Product.Refinement.Gateway.declarationsOf declarations)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.application_accepts_iff", + "statement": "∀ (domain : Aeneas.Std.Str) (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n (∃ output,\n auths_codec.hash.commitment_preimage domain payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output)) ↔\n Auths.Crypto.FramingTotality.ApplicationAdmissible domain payload", + "statement_constants": [ + "Eq", + "Exists", + "Iff", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.FramingTotality.ApplicationAdmissible", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1842,9 +6107,26 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_construct_write_refines_model", - "statement": "∀ (plan : auths_gateway_kernel.construct.WritePlan)\n (arguments : Aeneas.Std.Slice auths_gateway_kernel.construct.ArgumentValue)\n (echo key : Aeneas.Std.Slice Aeneas.Std.U8),\n Auths.Product.Refinement.Gateway.WriteFits plan arguments echo key →\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.construct_write plan arguments echo key) fun result =>\n Auths.Product.Refinement.Gateway.resultOf Auths.Product.Refinement.Gateway.requestOf result =\n Auths.Product.RequestConstruction.constructWrite (Auths.Product.Refinement.Gateway.writePlanOf plan)\n (Auths.Product.Refinement.Gateway.argsOf arguments) (Auths.Product.Refinement.Gateway.byteList ↑echo)\n (Auths.Product.Refinement.Gateway.byteList ↑key)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.application_refuses_iff", + "statement": "∀ (domain : Aeneas.Std.Str) (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage domain payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded) ↔\n ¬Auths.Crypto.FramingTotality.ApplicationAdmissible domain payload", + "statement_constants": [ + "Eq", + "Iff", + "Not", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.FramingTotality.ApplicationAdmissible", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -1853,9 +6135,22 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_construct_action_read_refines_model", - "statement": "∀ (plan : auths_gateway_kernel.construct.ActionReadPlan)\n (arguments : Aeneas.Std.Slice auths_gateway_kernel.construct.ArgumentValue),\n Auths.Product.Refinement.Gateway.ReadFits plan arguments →\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.construct_action_read plan arguments) fun result =>\n Auths.Product.Refinement.Gateway.resultOf Auths.Product.Refinement.Gateway.requestOf result =\n Auths.Product.RequestConstruction.constructActionRead (Auths.Product.Refinement.Gateway.readPlanOf plan)\n (Auths.Product.Refinement.Gateway.argsOf arguments)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.signing_total", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_codec.hash.signing_preimage kind profile version payload) fun result =>\n Auths.Crypto.FramingTotality.SigningResult profile payload result", + "statement_constants": [ + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.WP.spec", + "Auths.Crypto.FramingTotality.SigningResult", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -1864,9 +6159,27 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_construct_credential_read_refines_model", - "statement": "∀ (plan : auths_gateway_kernel.construct.CredentialReadPlan),\n Auths.Product.Refinement.Gateway.CredentialFits plan →\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.construct_credential_read plan) fun request =>\n Auths.Product.Refinement.Gateway.requestOf request =\n Auths.Product.RequestConstruction.constructCredentialRead\n (Auths.Product.Refinement.Gateway.credentialPlanOf plan)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.signing_accepts_iff", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n (∃ output,\n auths_codec.hash.signing_preimage kind profile version payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output)) ↔\n Auths.Crypto.FramingTotality.SigningAdmissible profile payload", + "statement_constants": [ + "Eq", + "Exists", + "Iff", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.FramingTotality.SigningAdmissible", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1875,9 +6188,28 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_next_step_refines_model", - "statement": "∀ (state : auths_gateway_kernel.order.SubmitState) (event : auths_gateway_kernel.order.SubmitEvent),\n Aeneas.Std.WP.spec (auths_gateway_kernel.order.next_step state event) fun decision =>\n Auths.Product.Refinement.Gateway.decisionOf decision =\n Auths.Product.SubmitOrder.nextStep (Auths.Product.Refinement.Gateway.stateOf state)\n (Auths.Product.Refinement.Gateway.eventOf event)" + "module": "Auths.Crypto.FramingTotality", + "name": "Auths.Crypto.FramingTotality.signing_refuses_iff", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (payload : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_codec.hash.signing_preimage kind profile version payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded) ↔\n ¬Auths.Crypto.FramingTotality.SigningAdmissible profile payload", + "statement_constants": [ + "Eq", + "Iff", + "Not", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.FramingTotality.SigningAdmissible", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -1886,9 +6218,24 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_valid_transition_refines_model", - "statement": "∀ (old new : auths_gateway_kernel.transition.AttemptView),\n Aeneas.Std.WP.spec (auths_gateway_kernel.transition.valid_transition old new) fun valid =>\n valid =\n Auths.Product.Recovery.validTransition (Auths.Product.Refinement.Gateway.viewOf old)\n (Auths.Product.Refinement.Gateway.viewOf new)" + "module": "Auths.Crypto.CommitmentValidity", + "name": "Auths.Crypto.CommitmentValidity.application_accepted_frame_valid", + "statement": "∀ (domain : Aeneas.Std.Str) (payload : Aeneas.Std.Slice Aeneas.Std.U8)\n (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage domain payload = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n (Auths.Crypto.CommitmentRefinement.applicationFrame domain payload).Valid", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.CommitmentRefinement.applicationFrame", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.CommitmentFrames.Application.Valid", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1897,9 +6244,24 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_relative_basis_refines_model", - "statement": "∀ (value : Aeneas.Std.U64) (subtrahend : Option Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_gateway_kernel.ratio.relative_basis value subtrahend) fun basis =>\n Option.map (fun x => ↑x) basis =\n Auths.Product.RelativeCeiling.relativeBasis (↑value) (Option.map (fun x => ↑x) subtrahend)" + "module": "Auths.Crypto.CommitmentValidity", + "name": "Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid", + "statement": "∀ (kind : auths_codec.hash.IdentifierType) (payload : Aeneas.Std.Slice Aeneas.Std.U8)\n (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.identifier_preimage kind payload = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n (Auths.Crypto.CommitmentRefinement.identifierFrame kind payload).Valid", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.CommitmentRefinement.identifierFrame", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.CommitmentFrames.Identifier.Valid", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1908,78 +6270,261 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Gateway", - "name": "Auths.Product.Refinement.Gateway.translated_relative_ceiling_admits_refines_model", - "statement": "∀ (argument basis : Aeneas.Std.U64) (basisPoints : Aeneas.Std.U16),\n Aeneas.Std.WP.spec (auths_gateway_kernel.ratio.relative_ceiling_admits argument basis basisPoints) fun admitted =>\n admitted = Auths.Product.RelativeCeiling.admits ↑argument ↑basis ↑basisPoints" + "module": "Auths.Crypto.CommitmentValidity", + "name": "Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind", + "statement": "∀ (leftDomain rightDomain : Aeneas.Std.Str) (leftPayload rightPayload : Aeneas.Std.Slice Aeneas.Std.U8)\n (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage leftDomain leftPayload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok leftOutput) →\n auths_codec.hash.commitment_preimage rightDomain rightPayload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rightOutput) →\n ↑leftOutput = ↑rightOutput → leftDomain = rightDomain ∧ leftPayload = rightPayload", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.retained_generation_exact", - "statement": "∀ (record : ℕ) (stored : List ℕ) (result : ℕ),\n Auths.Product.ConnectionGenerations.retainedGeneration record stored = some result ↔\n result ∈ stored ∧ result ≤ record ∧ ∀ x ∈ stored, x ≤ record → x ≤ result" + "module": "Auths.Crypto.CommitmentValidity", + "name": "Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind", + "statement": "∀ (leftKind rightKind : auths_codec.hash.IdentifierType) (leftPayload rightPayload : Aeneas.Std.Slice Aeneas.Std.U8)\n (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.identifier_preimage leftKind leftPayload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok leftOutput) →\n auths_codec.hash.identifier_preimage rightKind rightPayload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rightOutput) →\n ↑leftOutput = ↑rightOutput → leftKind = rightKind ∧ leftPayload = rightPayload", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.lease_generation_exact", - "statement": "∀ (record credential : ℕ) (stored : List ℕ) (result : ℕ),\n Auths.Product.ConnectionGenerations.leaseGeneration record credential stored = some result ↔\n result = credential ∧ credential ∈ stored ∧ credential ≤ record ∧ ∀ x ∈ stored, x ≤ record → x ≤ credential" + "module": "Auths.Crypto.CommitmentValidity", + "name": "Auths.Crypto.CommitmentValidity.application_output_length", + "statement": "∀ (domain : Aeneas.Std.Str) (payload : Aeneas.Std.Slice Aeneas.Std.U8)\n (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage domain payload = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n (↑output).length = 28 + (↑domain).length + (↑payload).length", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.credential_generation_le_generation", - "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n Auths.Product.ConnectionGenerations.Reachable σ →\n σ.record.generations.credentialGeneration ≤ σ.record.generations.generation" + "module": "Auths.Crypto.CommitmentValidity", + "name": "Auths.Crypto.CommitmentValidity.identifier_output_length", + "statement": "∀ (kind : auths_codec.hash.IdentifierType) (payload : Aeneas.Std.Slice Aeneas.Std.U8)\n (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.identifier_preimage kind payload = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n (↑output).length = 20 + (↑payload).length", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.state_change_preserves_credential_generation", - "statement": "(∀ (current next : Auths.Product.ConnectionGenerations.Generations),\n Auths.Product.ConnectionGenerations.stateChange current = some next →\n next.generation = current.generation + 1 ∧ next.credentialGeneration = current.credentialGeneration) ∧\n ∀ (σ : Auths.Product.ConnectionGenerations.System) (change : Auths.Product.ConnectionGenerations.StateChange),\n ∃ generation state,\n ((Auths.Product.ConnectionGenerations.step σ change.event).record =\n have __src := σ.record;\n {\n generations :=\n have __src := σ.record.generations;\n { generation := generation, credentialGeneration := __src.credentialGeneration },\n state := state, secret := __src.secret }) ∧\n (Auths.Product.ConnectionGenerations.step σ change.event).stores = σ.stores ∧\n (generation = σ.record.generations.generation ∨ generation = σ.record.generations.generation + 1)" + "module": "Auths.Crypto.BufferAllocation", + "name": "Auths.Crypto.BufferAllocation.buffer_refines", + "statement": "∀ (capacity : Aeneas.Std.Usize),\n auths_codec.hash.preimage_buffer capacity =\n Aeneas.Std.Result.ok\n (if Auths.Crypto.BufferAllocation.Fits capacity then\n Aeneas.Std.core.result.Result.Ok (Aeneas.Std.alloc.vec.Vec.new Aeneas.Std.U8)\n else Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded)", + "statement_constants": [ + "Eq", + "Int", + "instNatCastInt", + "ite", + "Int.decLe", + "Nat.cast", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.error.CodecError", + "auths_codec.hash.preimage_buffer", + "Aeneas.Std.Isize.max", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Auths.Crypto.BufferAllocation.Fits", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.alloc.vec.Vec.new", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.lease_selects_credential_generation", - "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n Auths.Product.ConnectionGenerations.Reachable σ →\n ∀ (host selected : ℕ),\n Auths.Product.ConnectionGenerations.lease σ.record (σ.stores host) = some selected ↔\n σ.record.state ≠ Auths.Product.ConnectionGenerations.ConnectionState.revoked ∧\n selected = σ.record.generations.credentialGeneration ∧\n (σ.record.generations.credentialGeneration, σ.record.secret) ∈ σ.stores host" + "module": "Auths.Crypto.BufferAllocation", + "name": "Auths.Crypto.BufferAllocation.accepted_empty", + "statement": "∀ (capacity : Aeneas.Std.Usize) (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.preimage_buffer capacity = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n ↑output = []", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "List.nil", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.error.CodecError", + "auths_codec.hash.preimage_buffer", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.join_after_state_changes", - "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n Auths.Product.ConnectionGenerations.Reachable σ →\n σ.record.state ≠ Auths.Product.ConnectionGenerations.ConnectionState.revoked →\n ∀ (changes : List Auths.Product.ConnectionGenerations.StateChange) (host : ℕ),\n Auths.Product.ConnectionGenerations.lease\n (Auths.Product.ConnectionGenerations.step (Auths.Product.ConnectionGenerations.applyChanges σ changes)\n (Auths.Product.ConnectionGenerations.Event.join host σ.record.secret)).record\n ((Auths.Product.ConnectionGenerations.step (Auths.Product.ConnectionGenerations.applyChanges σ changes)\n (Auths.Product.ConnectionGenerations.Event.join host σ.record.secret)).stores\n host) =\n some σ.record.generations.credentialGeneration" + "module": "Auths.Crypto.BufferAllocation", + "name": "Auths.Crypto.BufferAllocation.accepted_capacity_fits", + "statement": "∀ (capacity : Aeneas.Std.Usize) (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.preimage_buffer capacity = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n Auths.Crypto.BufferAllocation.Fits capacity", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.error.CodecError", + "auths_codec.hash.preimage_buffer", + "Aeneas.Std.Result.ok", + "Auths.Crypto.BufferAllocation.Fits", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.ConnectionGenerations", - "name": "Auths.Product.ConnectionGenerations.revoked_never_leases", - "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n σ.record.state = Auths.Product.ConnectionGenerations.ConnectionState.revoked →\n ∀ (events : List Auths.Product.ConnectionGenerations.Event) (host : ℕ),\n Auths.Product.ConnectionGenerations.lease (Auths.Product.ConnectionGenerations.run σ events).record\n ((Auths.Product.ConnectionGenerations.run σ events).stores host) =\n none" + "module": "Auths.Crypto.CommitmentRefinement", + "name": "Auths.Crypto.CommitmentRefinement.application_preimage_exact", + "statement": "∀ (domain : Aeneas.Std.Str) (payload : Aeneas.Std.Slice Aeneas.Std.U8)\n (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage domain payload = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n List.map Aeneas.Std.UScalar.val ↑output =\n Auths.Crypto.CommitmentFrames.application (Auths.Crypto.CommitmentRefinement.applicationFrame domain payload)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.CommitmentFrames.application", + "Auths.Crypto.CommitmentRefinement.applicationFrame", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1988,9 +6533,35 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Connections", - "name": "Auths.Product.Refinement.Connections.translated_next_generation_refines_model", - "statement": "∀ (generation : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.next_generation generation) fun next =>\n Option.map (fun x => ↑x) next = Auths.Product.ConnectionGenerations.nextGeneration ↑generation" + "module": "Auths.Crypto.CommitmentRefinement", + "name": "Auths.Crypto.CommitmentRefinement.identifier_preimage_exact", + "statement": "∀ (kind : auths_codec.hash.IdentifierType) (payload : Aeneas.Std.Slice Aeneas.Std.U8)\n (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.identifier_preimage kind payload = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n List.map Aeneas.Std.UScalar.val ↑output =\n Auths.Crypto.CommitmentFrames.identifier (Auths.Crypto.CommitmentRefinement.identifierFrame kind payload)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.CommitmentFrames.identifier", + "Auths.Crypto.CommitmentRefinement.identifierFrame", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -1999,9 +6570,40 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Connections", - "name": "Auths.Product.Refinement.Connections.translated_state_change_refines_model", - "statement": "∀ (current : auths_connections.kernel.Generations),\n Aeneas.Std.WP.spec (auths_connections.kernel.state_change current) fun next =>\n Option.map Auths.Product.Refinement.Connections.generationsOf next =\n Auths.Product.ConnectionGenerations.stateChange (Auths.Product.Refinement.Connections.generationsOf current)" + "module": "Auths.Crypto.Sha256Native", + "name": "Auths.Crypto.Sha256Native.raw_hash_refines", + "statement": "∀ [P : Auths.Crypto.Sha256Primitives] (sha256 : List Aeneas.Std.U8 → Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n Auths.Crypto.Sha256Native.Contract sha256 →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n AuthsNativeSha256.hash.raw_sha256 bytes = Aeneas.Std.Result.ok (sha256 ↑bytes)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.Sha256Primitives", + "AuthsNativeSha256.auths_model.Digest", + "AuthsNativeSha256.hash.raw_sha256", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Sha256Native.Contract" + ] }, { "axioms": [ @@ -2010,9 +6612,23 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Connections", - "name": "Auths.Product.Refinement.Connections.translated_rotation_refines_model", - "statement": "∀ (current : auths_connections.kernel.Generations),\n Aeneas.Std.WP.spec (auths_connections.kernel.rotation current) fun next =>\n Option.map Auths.Product.Refinement.Connections.generationsOf next =\n Auths.Product.ConnectionGenerations.rotation (Auths.Product.Refinement.Connections.generationsOf current)" + "module": "Auths.Crypto.CommitmentExamples", + "name": "Auths.Crypto.CommitmentExamples.empty_domain_refused", + "statement": "∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage Auths.Crypto.CommitmentExamples.emptyDomain bytes =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.CommitmentExamples.emptyDomain", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -2021,9 +6637,23 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Connections", - "name": "Auths.Product.Refinement.Connections.translated_retained_generation_refines_model", - "statement": "∀ (record : Aeneas.Std.U64) (stored : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.retained_generation record stored) fun result =>\n Option.map (fun x => ↑x) result =\n Auths.Product.ConnectionGenerations.retainedGeneration (↑record) (List.map (fun x => ↑x) ↑stored)" + "module": "Auths.Crypto.CommitmentExamples", + "name": "Auths.Crypto.CommitmentExamples.oversized_domain_refused", + "statement": "∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_codec.hash.commitment_preimage Auths.Crypto.CommitmentExamples.tooLongDomain bytes =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.CommitmentExamples.tooLongDomain", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ @@ -2032,9 +6662,23 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Product.Refinement.Connections", - "name": "Auths.Product.Refinement.Connections.translated_lease_generation_refines_model", - "statement": "∀ (record credential : Aeneas.Std.U64) (stored : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.lease_generation record credential stored) fun result =>\n Option.map (fun x => ↑x) result =\n Auths.Product.ConnectionGenerations.leaseGeneration (↑record) (↑credential) (List.map (fun x => ↑x) ↑stored)" + "module": "Auths.Crypto.CommitmentExamples", + "name": "Auths.Crypto.CommitmentExamples.application_sample_admitted", + "statement": "∃ output,\n auths_codec.hash.commitment_preimage Auths.Crypto.CommitmentExamples.sampleDomain\n Auths.Crypto.CommitmentExamples.payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output)", + "statement_constants": [ + "Eq", + "Exists", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.commitment_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.CommitmentExamples.payload", + "Auths.Crypto.CommitmentExamples.sampleDomain", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2043,180 +6687,562 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.additive_capacity_success_positive", - "statement": "∀ {ceiling committed active requested : ℕ},\n Auths.Lifecycle.additiveCapacityAvailable ceiling committed active requested = true → 0 < ceiling ∧ 0 < requested" + "module": "Auths.Crypto.CommitmentExamples", + "name": "Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted", + "statement": "∀ (kind : auths_codec.hash.IdentifierType),\n ∃ output,\n auths_codec.hash.identifier_preimage kind Auths.Crypto.CommitmentExamples.payload =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output)", + "statement_constants": [ + "Eq", + "Exists", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.IdentifierType", + "auths_codec.hash.identifier_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.CommitmentExamples.payload", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.additive_capacity_success_conserves", - "statement": "∀ {ceiling committed active requested : ℕ},\n Auths.Lifecycle.additiveCapacityAvailable ceiling committed active requested = true →\n committed + active + requested ≤ ceiling" + "module": "Auths.Crypto.Sha256Examples", + "name": "Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest", + "statement": "AuthsNativeSha256.hash.raw_sha256 ⟨[42#u8], Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest._proof_1⟩ =\n Aeneas.Std.Result.ok (Aeneas.Std.Array.repeat 32#usize 42#u8)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.mk", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "AuthsNativeSha256.auths_model.Digest", + "AuthsNativeSha256.hash.raw_sha256", + "Aeneas.Std.Array.repeat", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Sha256Examples.forwardingPrimitive", + "Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest._proof_1" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.additive_capacity_success_never_overflows_u64", - "statement": "∀ {ceiling committed active requested : ℕ},\n Auths.Lifecycle.additiveCapacityAvailable ceiling committed active requested = true →\n committed + active ≤ Auths.Lifecycle.u64Max ∧ committed + active + requested ≤ Auths.Lifecycle.u64Max" + "module": "Auths.Crypto.Sha256Examples", + "name": "Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest", + "statement": "AuthsNativeSha256.hash.raw_sha256\n ⟨[43#u8], Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest._proof_1⟩ =\n Aeneas.Std.Result.ok (Aeneas.Std.Array.repeat 32#usize 43#u8)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.mk", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "AuthsNativeSha256.auths_model.Digest", + "AuthsNativeSha256.hash.raw_sha256", + "Aeneas.Std.Array.repeat", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Sha256Examples.forwardingPrimitive", + "Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest._proof_1" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.reserve_preserves_capacity", - "statement": "∀ {ledger next : Auths.Lifecycle.CapacityLedger} {requested : ℕ},\n ledger.valid → ledger.reserve requested = some next → next.valid" + "module": "Auths.Crypto.BufferAllocation", + "name": "Auths.Crypto.BufferAllocation.signed_bounds_iff", + "statement": "∀ (capacity : Aeneas.Std.Usize),\n Aeneas.Std.IScalar.inBounds Aeneas.Std.IScalarTy.Isize ↑↑capacity ↔ Auths.Crypto.BufferAllocation.Fits capacity", + "statement_constants": [ + "Iff", + "Int", + "instNatCastInt", + "Nat.cast", + "Aeneas.Std.Usize", + "Aeneas.Std.IScalar.inBounds", + "Aeneas.Std.IScalarTy.Isize", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Auths.Crypto.BufferAllocation.Fits" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.commit_preserves_capacity", - "statement": "∀ {ledger next : Auths.Lifecycle.CapacityLedger} {amount : ℕ},\n ledger.valid → ledger.commit amount = some next → next.valid" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.application_length", + "statement": "∀ (frame : Auths.Crypto.CommitmentFrames.Application),\n (Auths.Crypto.CommitmentFrames.application frame).length = 28 + frame.domain.length + frame.payload.length", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instOfNatNat", + "HAdd.hAdd", + "List.length", + "OfNat.ofNat", + "Auths.Crypto.CommitmentFrames.Application", + "Auths.Crypto.CommitmentFrames.application", + "Auths.Crypto.CommitmentFrames.Application.domain", + "Auths.Crypto.CommitmentFrames.Application.payload" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.release_preserves_capacity", - "statement": "∀ {ledger next : Auths.Lifecycle.CapacityLedger} {amount : ℕ},\n ledger.valid → ledger.release amount = some next → next.valid" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.exact_replay_is_stable", - "statement": "Auths.Lifecycle.replayCode true true = Auths.Lifecycle.ReplayCode.exactReplay" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.identifier_length", + "statement": "∀ (frame : Auths.Crypto.CommitmentFrames.Identifier),\n (Auths.Crypto.CommitmentFrames.identifier frame).length = 20 + frame.payload.length", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instOfNatNat", + "HAdd.hAdd", + "List.length", + "OfNat.ofNat", + "Auths.Crypto.CommitmentFrames.Identifier", + "Auths.Crypto.CommitmentFrames.identifier", + "Auths.Crypto.CommitmentFrames.Identifier.payload" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.conflicting_replay_is_not_exact", - "statement": "Auths.Lifecycle.replayCode true false = Auths.Lifecycle.ReplayCode.conflict" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.application_unambiguous", + "statement": "∀ (left right : Auths.Crypto.CommitmentFrames.Application),\n left.Valid →\n right.Valid →\n Auths.Crypto.CommitmentFrames.application left = Auths.Crypto.CommitmentFrames.application right → left = right", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Auths.Crypto.CommitmentFrames.Application", + "Auths.Crypto.CommitmentFrames.application", + "Auths.Crypto.CommitmentFrames.Application.Valid" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.absent_replay_never_claims_effect", - "statement": "∀ (commitmentsEqual : Bool), Auths.Lifecycle.replayCode false commitmentsEqual = Auths.Lifecycle.ReplayCode.absent" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.identifier_unambiguous", + "statement": "∀ (left right : Auths.Crypto.CommitmentFrames.Identifier),\n left.Valid →\n right.Valid →\n Auths.Crypto.CommitmentFrames.identifier left = Auths.Crypto.CommitmentFrames.identifier right → left = right", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Auths.Crypto.CommitmentFrames.Identifier", + "Auths.Crypto.CommitmentFrames.identifier", + "Auths.Crypto.CommitmentFrames.Identifier.Valid" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.start_attempt_requires_credential", - "statement": "∀ {gates : Auths.Lifecycle.Gates},\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executionIntentRecorded)\n Auths.Lifecycle.Operation.startAttempt gates =\n Auths.Lifecycle.Code.applied Auths.Lifecycle.State.executing →\n gates.credentialAuthorized = true" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.application_identifier_separate", + "statement": "∀ (left : Auths.Crypto.CommitmentFrames.Application) (right : Auths.Crypto.CommitmentFrames.Identifier),\n Auths.Crypto.CommitmentFrames.application left ≠ Auths.Crypto.CommitmentFrames.identifier right", + "statement_constants": [ + "List", + "Nat", + "Ne", + "Auths.Crypto.CommitmentFrames.Application", + "Auths.Crypto.CommitmentFrames.Identifier", + "Auths.Crypto.CommitmentFrames.application", + "Auths.Crypto.CommitmentFrames.identifier" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.provider_call_requires_attempt", - "statement": "∀ {gates : Auths.Lifecycle.Gates},\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executing)\n Auths.Lifecycle.Operation.markProviderCallEntered gates =\n Auths.Lifecycle.Code.applied Auths.Lifecycle.State.executing →\n gates.attemptPresent = true" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.signing_application_separate", + "statement": "∀ (left : Auths.Crypto.Framing.Frame) (right : Auths.Crypto.CommitmentFrames.Application),\n Auths.Crypto.Framing.encode left ≠ Auths.Crypto.CommitmentFrames.application right", + "statement_constants": [ + "List", + "Nat", + "Ne", + "Auths.Crypto.CommitmentFrames.Application", + "Auths.Crypto.CommitmentFrames.application", + "Auths.Crypto.Framing.Frame", + "Auths.Crypto.Framing.encode" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.commit_requires_provider_entry_and_effect", - "statement": "∀ {gates : Auths.Lifecycle.Gates},\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executing) Auths.Lifecycle.Operation.commit gates =\n Auths.Lifecycle.Code.applied Auths.Lifecycle.State.committed →\n gates.attemptPresent = true ∧ gates.providerCallEntered = true ∧ gates.definiteEffect = true" + "module": "Auths.Crypto.CommitmentFrames", + "name": "Auths.Crypto.CommitmentFrames.signing_identifier_separate", + "statement": "∀ (left : Auths.Crypto.Framing.Frame) (right : Auths.Crypto.CommitmentFrames.Identifier),\n Auths.Crypto.Framing.encode left ≠ Auths.Crypto.CommitmentFrames.identifier right", + "statement_constants": [ + "List", + "Nat", + "Ne", + "Auths.Crypto.CommitmentFrames.Identifier", + "Auths.Crypto.CommitmentFrames.identifier", + "Auths.Crypto.Framing.Frame", + "Auths.Crypto.Framing.encode" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.outcome_unknown_cannot_release", - "statement": "∀ (gates : Auths.Lifecycle.Gates),\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.outcomeUnknown) Auths.Lifecycle.Operation.release gates =\n Auths.Lifecycle.Code.illegalTransition" + "module": "Auths.Crypto.CommitmentRefinement", + "name": "Auths.Crypto.CommitmentRefinement.identifier_tag_word", + "statement": "∀ (kind : auths_codec.hash.IdentifierType),\n Aeneas.Std.IScalar.hcast Aeneas.Std.UScalarTy.U16 (Aeneas.Std.read_discriminant kind) =\n match kind with\n | auths_codec.hash.IdentifierType.Grant => 1#u16\n | auths_codec.hash.IdentifierType.Action => 2#u16\n | auths_codec.hash.IdentifierType.Plan => 3#u16\n | auths_codec.hash.IdentifierType.Evidence => 4#u16\n | auths_codec.hash.IdentifierType.PrincipalStatus => 5#u16\n | auths_codec.hash.IdentifierType.GrantStatus => 6#u16\n | auths_codec.hash.IdentifierType.Context => 9#u16\n | auths_codec.hash.IdentifierType.ObservationRequirement => 11#u16\n | auths_codec.hash.IdentifierType.ApprovalRequirement => 12#u16", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Unit", + "id", + "instDiscriminantIdentifierTypeIsize", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.Isize", + "Aeneas.Std.UScalar", + "auths_codec.hash.IdentifierType", + "Aeneas.Std.Discriminant.read_discriminant", + "Aeneas.Std.IScalar.hcast", + "Aeneas.Std.IScalarTy.Isize", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Crypto.CommitmentRefinement.identifierTag.match_1" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.outcome_unknown_only_reconciliation_can_terminate", - "statement": "∀ {operation : Auths.Lifecycle.Operation} {gates : Auths.Lifecycle.Gates} {terminal : Auths.Lifecycle.State},\n terminal = Auths.Lifecycle.State.reconciledCommitted ∨ terminal = Auths.Lifecycle.State.reconciledReleased →\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.outcomeUnknown) operation gates =\n Auths.Lifecycle.Code.applied terminal →\n operation = Auths.Lifecycle.Operation.reconcileEffect ∨ operation = Auths.Lifecycle.Operation.reconcileNonEffect" + "module": "Auths.Crypto.Sha256Examples", + "name": "Auths.Crypto.Sha256Examples.forwarding_contract", + "statement": "Auths.Crypto.Sha256Native.Contract Auths.Crypto.Sha256Examples.echo", + "statement_constants": [ + "Auths.Crypto.Sha256Examples.echo", + "Auths.Crypto.Sha256Examples.forwardingPrimitive", + "Auths.Crypto.Sha256Native.Contract" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.configuration_mismatch_stops_reservation", - "statement": "∀ (gates : Auths.Lifecycle.Gates),\n gates.configurationMatches = false →\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.decisionRecorded) Auths.Lifecycle.Operation.reserve\n gates =\n Auths.Lifecycle.Code.configurationMismatch" + "module": "Auths.Crypto.NativeContract", + "name": "Auths.Crypto.Native.decode_leaf_refines", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (bytes : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n auths_signature_core.decode_ed25519_point bytes = Aeneas.Std.Result.ok (decode ↑bytes)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.decode_ed25519_point", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "ed25519_dalek.verifying.VerifyingKey", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.configuration_mismatch_stops_credential", - "statement": "∀ (gates : Auths.Lifecycle.Gates),\n gates.configurationMatches = false →\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executionIntentRecorded)\n Auths.Lifecycle.Operation.authorizeCredential gates =\n Auths.Lifecycle.Code.configurationMismatch" + "module": "Auths.Crypto.NativeContract", + "name": "Auths.Crypto.Native.equation_leaf_refines", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (key : Auths.Crypto.Ed25519Primitives.Key) (message : Aeneas.Std.Slice Aeneas.Std.U8)\n (bytes : Aeneas.Std.Array Aeneas.Std.U8 64#usize),\n auths_signature_core.verify_ed25519_equation key message bytes =\n Aeneas.Std.Result.ok (equation key ↑message ↑bytes)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.verify_ed25519_equation", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Theorems", - "name": "Auths.Lifecycle.terminal_states_never_transition", - "statement": "∀ (state : Auths.Lifecycle.State) (operation : Auths.Lifecycle.Operation) (gates : Auths.Lifecycle.Gates),\n state.isTerminal = true → Auths.Lifecycle.transitionCode (some state) operation gates = Auths.Lifecycle.Code.terminal" + "module": "Auths.Crypto.NativeContract", + "name": "Auths.Crypto.Native.public_verify_refines", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_ed25519 bytes message signature =\n Aeneas.Std.Result.ok\n (Auths.Crypto.Strict.SuiteModel.sourceEd\n (Auths.Crypto.Strict.SuiteModel.edVerify decode equation ↑bytes ↑message ↑signature))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.edVerify", + "Auths.Crypto.Strict.SuiteModel.sourceEd" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Refinement", - "name": "Auths.Lifecycle.Refinement.translated_terminal_refines_rich", - "statement": "∀ (state : Auths.Lifecycle.State),\n (Auths.Lifecycle.Refinement.generatedState state).is_terminal = Aeneas.Std.Result.ok state.isTerminal" + "module": "Auths.Crypto.NativeContract", + "name": "Auths.Crypto.Native.public_verify_accepts_iff", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_ed25519 bytes message signature =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ()) ↔\n Auths.Crypto.Strict.Acceptance.EdAccepts decode equation ↑bytes ↑message ↑signature", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Unit.unit", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.Acceptance.EdAccepts", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Refinement", - "name": "Auths.Lifecycle.Refinement.translated_transition_refines_rich", - "statement": "∀ (current : Option Auths.Lifecycle.State) (operation : Auths.Lifecycle.Operation) (gates : Auths.Lifecycle.Gates),\n auths_lifecycle.kernel.transition_code (Option.map Auths.Lifecycle.Refinement.generatedState current)\n (Auths.Lifecycle.Refinement.generatedOperation operation) (Auths.Lifecycle.Refinement.generatedGates gates) =\n Aeneas.Std.Result.ok\n (Auths.Lifecycle.Refinement.generatedCode (Auths.Lifecycle.transitionCode current operation gates))" + "module": "Auths.Crypto.NativeContract", + "name": "Auths.Crypto.Native.public_validate_refines", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (decode : List Aeneas.Std.U8 → Option Auths.Crypto.Ed25519Primitives.Key)\n (signatureValue : List Aeneas.Std.U8 → Auths.Crypto.Ed25519Primitives.Signature)\n (equation : Auths.Crypto.Ed25519Primitives.Key → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n Auths.Crypto.Native.Ed25519Contract decode signatureValue equation →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.validate_ed25519_key bytes =\n Aeneas.Std.Result.ok\n (Auths.Crypto.Strict.SuiteModel.sourceEd\n (Except.map (fun x => ()) (Auths.Crypto.Strict.SuiteModel.edKey decode ↑bytes)))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Unit", + "instLENat", + "Except.map", + "LE.le", + "List.length", + "Subtype.val", + "Unit.unit", + "auths_signature_core.Ed25519Error", + "auths_signature_core.validate_ed25519_key", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Ed25519Primitives.Signature", + "Auths.Crypto.Native.Ed25519Contract", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.Failure", + "Auths.Crypto.Strict.SuiteModel.edKey", + "Auths.Crypto.Strict.SuiteModel.sourceEd" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Lifecycle.Refinement", - "name": "Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich", - "statement": "∀ (hasLiveOwner ownerIsExactReplay : Bool),\n auths_lifecycle.kernel.exclusive_capacity_available hasLiveOwner ownerIsExactReplay =\n Aeneas.Std.Result.ok (Auths.Lifecycle.exclusiveCapacityAvailable hasLiveOwner ownerIsExactReplay)" + "module": "Auths.Crypto.NativeExamples", + "name": "Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes", + "statement": "auths_signature_core.verify_ed25519 Auths.Crypto.NativeExamples.key Auths.Crypto.NativeExamples.message\n Auths.Crypto.NativeExamples.signature =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ())", + "statement_constants": [ + "Eq", + "Unit", + "Unit.unit", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.NativeExamples.forwardingPrimitive", + "Auths.Crypto.NativeExamples.key", + "Auths.Crypto.NativeExamples.message", + "Auths.Crypto.NativeExamples.signature", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2225,116 +7251,16795 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Lifecycle.Refinement", - "name": "Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich", - "statement": "∀ (ceiling committed active requested : Aeneas.Std.U64),\n auths_lifecycle.kernel.additive_capacity_available ceiling committed active requested =\n Aeneas.Std.Result.ok (Auths.Lifecycle.additiveCapacityAvailable ↑ceiling ↑committed ↑active ↑requested)" + "module": "Auths.Crypto.NativeExamples", + "name": "Auths.Crypto.NativeExamples.changed_message_is_refused", + "statement": "auths_signature_core.verify_ed25519 Auths.Crypto.NativeExamples.key Auths.Crypto.NativeExamples.changedMessage\n Auths.Crypto.NativeExamples.signature =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_signature_core.Ed25519Error.VerificationFailed)", + "statement_constants": [ + "Eq", + "Unit", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519", + "Aeneas.Std.Result", + "auths_signature_core.Ed25519Error.VerificationFailed", + "Aeneas.Std.Result.ok", + "Auths.Crypto.NativeExamples.changedMessage", + "Auths.Crypto.NativeExamples.forwardingPrimitive", + "Auths.Crypto.NativeExamples.key", + "Auths.Crypto.NativeExamples.signature", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Lifecycle.Refinement", - "name": "Auths.Lifecycle.Refinement.translated_replay_refines_rich", - "statement": "∀ (recordExists commitmentsEqual : Bool),\n auths_lifecycle.kernel.replay_code recordExists commitmentsEqual =\n Aeneas.Std.Result.ok\n (Auths.Lifecycle.Refinement.generatedReplayCode (Auths.Lifecycle.replayCode recordExists commitmentsEqual))" + "module": "Auths.Crypto.NativeExamples", + "name": "Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract", + "statement": "∀ [P : Auths.Crypto.Ed25519Primitives] (message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_ed25519 Auths.Crypto.NativeExamples.empty message signature =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_signature_core.Ed25519Error.InvalidKey)", + "statement_constants": [ + "Eq", + "Unit", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives", + "auths_signature_core.Ed25519Error.InvalidKey", + "Aeneas.Std.Result.ok", + "Auths.Crypto.NativeExamples.empty", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.all_commutative", - "statement": "∀ (left right : Auths.Truth), Auths.all left right = Auths.all right left" + "module": "Auths.Crypto.NativeExamples", + "name": "Auths.Crypto.NativeExamples.forwarding_contract", + "statement": "Auths.Crypto.Native.Ed25519Contract (fun x => some ()) id Auths.Crypto.NativeExamples.equation", + "statement_constants": [ + "List", + "id", + "Option.some", + "Unit.unit", + "Aeneas.Std.U8", + "Auths.Crypto.Ed25519Primitives.Key", + "Auths.Crypto.Native.Ed25519Contract", + "Auths.Crypto.NativeExamples.equation", + "Auths.Crypto.NativeExamples.forwardingPrimitive" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.all_associative", - "statement": "∀ (a b c : Auths.Truth), Auths.all (Auths.all a b) c = Auths.all a (Auths.all b c)" + "module": "Auths.Crypto.Strict.ByteLex", + "name": "Auths.Crypto.ByteLex.value_bound", + "statement": "∀ (bytes : List Aeneas.Std.U8), Auths.Crypto.ByteLex.value bytes < 256 ^ bytes.length", + "statement_constants": [ + "List", + "Nat", + "instHPow", + "instLTNat", + "instOfNatNat", + "HPow.hPow", + "LT.lt", + "List.length", + "Monoid.toPow", + "Nat.instMonoid", + "OfNat.ofNat", + "Aeneas.Std.U8", + "Auths.Crypto.ByteLex.value" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.all_idempotent", - "statement": "∀ (value : Auths.Truth), Auths.all value value = value" + "module": "Auths.Crypto.Strict.ByteLex", + "name": "Auths.Crypto.ByteLex.value_cons", + "statement": "∀ (head : Aeneas.Std.U8) (tail : List Aeneas.Std.U8),\n Auths.Crypto.ByteLex.value (head :: tail) = ↑head * 256 ^ tail.length + Auths.Crypto.ByteLex.value tail", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHMul", + "instHPow", + "instMulNat", + "instOfNatNat", + "HAdd.hAdd", + "HMul.hMul", + "HPow.hPow", + "List.cons", + "List.length", + "Monoid.toPow", + "Nat.instMonoid", + "OfNat.ofNat", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Auths.Crypto.ByteLex.value" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.any_commutative", - "statement": "∀ (left right : Auths.Truth), Auths.any left right = Auths.any right left" + "module": "Auths.Crypto.Strict.ByteLex", + "name": "Auths.Crypto.ByteLex.le_numeric", + "statement": "∀ (left right : List Aeneas.Std.U8),\n left.length = right.length →\n (Auths.Crypto.ByteLex.le left right = true ↔ Auths.Crypto.ByteLex.value left ≤ Auths.Crypto.ByteLex.value right)", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "instLENat", + "Bool.true", + "LE.le", + "List.length", + "Aeneas.Std.U8", + "Auths.Crypto.ByteLex.le", + "Auths.Crypto.ByteLex.value" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.LowScan", + "name": "Auths.Crypto.LowScan.loop_refines", + "statement": "∀ (input : Auths.Crypto.LowScan.Input) (remaining : ℕ) (index : Aeneas.Std.Usize),\n ↑index + remaining = 32 →\n Aeneas.Std.WP.spec (auths_signature_core.p256_signature_is_low_s_loop input index) fun result =>\n result =\n Auths.Crypto.ByteLex.le (List.drop (32 + ↑index) ↑input)\n (List.drop ↑index ↑auths_signature_core.P256_HALF_ORDER)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAdd.hAdd", + "LE.le", + "List.drop", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.P256_HALF_ORDER", + "auths_signature_core.p256_signature_is_low_s_loop", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Crypto.ByteLex.le", + "Auths.Crypto.LowScan.Input", + "Auths.Crypto.LowScan.Input._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.LowContract", + "name": "Auths.Crypto.LowContract.half_order_exact", + "statement": "Auths.Crypto.ByteLex.value ↑auths_signature_core.P256_HALF_ORDER = Auths.Crypto.LowContract.order / 2", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instHDiv", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HDiv.hDiv", + "LE.le", + "List.length", + "Nat.decLe", + "Nat.instDiv", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.P256_HALF_ORDER", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.ByteLex.value", + "Auths.Crypto.LowContract.order" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.LowContract", + "name": "Auths.Crypto.LowContract.guard_refines", + "statement": "∀ (input : Auths.Crypto.LowScan.Input),\n auths_signature_core.p256_signature_is_low_s input =\n Aeneas.Std.Result.ok\n (decide (Auths.Crypto.ByteLex.value (List.drop 32 ↑input) ≤ Auths.Crypto.LowContract.order / 2))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instHDiv", + "instLENat", + "instOfNatNat", + "Decidable.decide", + "HDiv.hDiv", + "LE.le", + "List.drop", + "List.length", + "Nat.decLe", + "Nat.instDiv", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.p256_signature_is_low_s", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.ByteLex.value", + "Auths.Crypto.LowContract.order", + "Auths.Crypto.LowScan.Input", + "Auths.Crypto.LowScan.Input._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.LowContract", + "name": "Auths.Crypto.LowContract.r_bytes_irrelevant", + "statement": "∀ (left right : Auths.Crypto.LowScan.Input),\n List.drop 32 ↑left = List.drop 32 ↑right →\n auths_signature_core.p256_signature_is_low_s left = auths_signature_core.p256_signature_is_low_s right", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instOfNatNat", + "List.drop", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.p256_signature_is_low_s", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.LowScan.Input", + "Auths.Crypto.LowScan.Input._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.CoordinateModel", + "name": "Auths.Crypto.CoordinateModel.ordinate_eq_iff", + "statement": "∀ (input expected : Auths.Crypto.Encoding.Encoded.Input),\n Auths.Crypto.Encoding.Encoded.ordinate input = Auths.Crypto.Encoding.Encoded.ordinate expected ↔\n List.take 31 ↑input = List.take 31 ↑expected ∧\n ↑(Auths.Crypto.Encoding.Encoded.last input) % 128 = ↑(Auths.Crypto.Encoding.Encoded.last expected) % 128", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Nat", + "instHMod", + "instOfNatNat", + "HMod.hMod", + "List.length", + "List.take", + "Nat.instMod", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.last", + "Auths.Crypto.Encoding.Encoded.ordinate", + "Auths.Crypto.Encoding.Encoded.Input._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.CoordinateScan", + "name": "Auths.Crypto.CoordinateScan.loop_refines", + "statement": "∀ (input expected : Auths.Crypto.Encoding.Encoded.Input) (remaining : ℕ) (index : Aeneas.Std.Usize),\n ↑index + remaining = 31 →\n Aeneas.Std.WP.spec (auths_signature_core.ed25519_same_coordinate_loop input expected index) fun result =>\n result = decide (List.take remaining (List.drop ↑index ↑input) = List.take remaining (List.drop ↑index ↑expected))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instAddNat", + "instDecidableEqList", + "instHAdd", + "instOfNatNat", + "Decidable.decide", + "HAdd.hAdd", + "List.drop", + "List.length", + "List.take", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.ed25519_same_coordinate_loop", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.instDecidableEqUScalar_1", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.Input._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.CoordinateContract", + "name": "Auths.Crypto.CoordinateContract.guard_refines", + "statement": "∀ (input expected : Auths.Crypto.Encoding.Encoded.Input),\n auths_signature_core.ed25519_same_coordinate input expected =\n Aeneas.Std.Result.ok\n (decide (Auths.Crypto.Encoding.Encoded.ordinate input = Auths.Crypto.Encoding.Encoded.ordinate expected))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instDecidableEqNat", + "Decidable.decide", + "auths_signature_core.ed25519_same_coordinate", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.WeakContract", + "name": "Auths.Crypto.WeakContract.zero_value", + "statement": "Auths.Crypto.Encoding.Encoded.ordinate auths_signature_core.ED25519_WEAK_ZERO = 0", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "auths_signature_core.ED25519_WEAK_ZERO", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.WeakContract", + "name": "Auths.Crypto.WeakContract.one_value", + "statement": "Auths.Crypto.Encoding.Encoded.ordinate auths_signature_core.ED25519_WEAK_ONE = 1", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "auths_signature_core.ED25519_WEAK_ONE", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.WeakContract", + "name": "Auths.Crypto.WeakContract.minus_one_value", + "statement": "Auths.Crypto.Encoding.Encoded.ordinate auths_signature_core.ED25519_WEAK_MINUS_ONE =\n Auths.Crypto.Encoding.Coordinate.prime - 1", + "statement_constants": [ + "Eq", + "Nat", + "instHSub", + "instOfNatNat", + "instSubNat", + "HSub.hSub", + "OfNat.ofNat", + "auths_signature_core.ED25519_WEAK_MINUS_ONE", + "Auths.Crypto.Encoding.Coordinate.prime", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.WeakContract", + "name": "Auths.Crypto.WeakContract.order_eight_a_value", + "statement": "Auths.Crypto.Encoding.Encoded.ordinate auths_signature_core.ED25519_WEAK_ORDER_EIGHT_A =\n Auths.Crypto.WeakContract.orderEightY", + "statement_constants": [ + "Eq", + "Nat", + "auths_signature_core.ED25519_WEAK_ORDER_EIGHT_A", + "Auths.Crypto.WeakContract.orderEightY", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.WeakContract", + "name": "Auths.Crypto.WeakContract.order_eight_b_value", + "statement": "Auths.Crypto.Encoding.Encoded.ordinate auths_signature_core.ED25519_WEAK_ORDER_EIGHT_B =\n Auths.Crypto.Encoding.Coordinate.prime - Auths.Crypto.WeakContract.orderEightY", + "statement_constants": [ + "Eq", + "Nat", + "instHSub", + "instSubNat", + "HSub.hSub", + "auths_signature_core.ED25519_WEAK_ORDER_EIGHT_B", + "Auths.Crypto.WeakContract.orderEightY", + "Auths.Crypto.Encoding.Coordinate.prime", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.WeakContract", + "name": "Auths.Crypto.WeakContract.guard_refines", + "statement": "∀ (input : Auths.Crypto.Encoding.Encoded.Input),\n auths_signature_core.ed25519_has_small_order_coordinate input =\n Aeneas.Std.Result.ok\n (decide (Auths.Crypto.WeakContract.WeakCoordinate (Auths.Crypto.Encoding.Encoded.ordinate input)))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "auths_signature_core.ed25519_has_small_order_coordinate", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.WeakContract.WeakCoordinate", + "Auths.Crypto.WeakContract.instDecidableWeakCoordinate", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.ordinate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.RContract", + "name": "Auths.Crypto.RContract.guard_refines", + "statement": "∀ (input : Auths.Crypto.RContract.Input),\n auths_signature_core.ed25519_signature_r_is_allowed input =\n Aeneas.Std.Result.ok (decide (Auths.Crypto.RContract.Allowed input))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "auths_signature_core.ed25519_signature_r_is_allowed", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.RContract.Allowed", + "Auths.Crypto.RContract.Input", + "Auths.Crypto.RContract.instDecidableAllowed" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SuiteRefinement", + "name": "Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines", + "statement": "∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.ed25519_key_encoding bytes =\n Aeneas.Std.Result.ok (Auths.Crypto.Strict.SuiteModel.sourceEd (Auths.Crypto.Strict.SuiteModel.keyEncoding ↑bytes))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.Ed25519Error", + "auths_signature_core.ed25519_key_encoding", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Strict.SuiteModel.keyEncoding", + "Auths.Crypto.Strict.SuiteModel.sourceEd" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SuiteRefinement", + "name": "Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines", + "statement": "∀ {K D : Type} (primitive : Aeneas.Std.core.ops.function.FnOnce D (Aeneas.Std.Array Aeneas.Std.U8 32#usize) (Option K))\n (decoder : D) (decode : List Aeneas.Std.U8 → Option K),\n (∀ (array : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n primitive.call_once decoder array = Aeneas.Std.Result.ok (decode ↑array)) →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.decode_ed25519_key_with primitive bytes decoder =\n Aeneas.Std.Result.ok\n (Auths.Crypto.Strict.SuiteModel.sourceEd (Auths.Crypto.Strict.SuiteModel.edKey decode ↑bytes))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.Ed25519Error", + "auths_signature_core.decode_ed25519_key_with", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.edKey", + "Auths.Crypto.Strict.SuiteModel.sourceEd", + "Aeneas.Std.core.ops.function.FnOnce", + "Aeneas.Std.core.ops.function.FnOnce.call_once" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SuiteRefinement", + "name": "Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines", + "statement": "∀ {T K S : Type} (primitive : auths_signature_core.P256Primitive T K S) (decode : List Aeneas.Std.U8 → Option K),\n (∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8), primitive.decode bytes = Aeneas.Std.Result.ok (decode ↑bytes)) →\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.decode_p256_key_with primitive bytes =\n Aeneas.Std.Result.ok\n (Auths.Crypto.Strict.SuiteModel.sourceP256 (Auths.Crypto.Strict.SuiteModel.p256Key decode ↑bytes))", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "auths_signature_core.P256Error", + "auths_signature_core.P256Primitive", + "auths_signature_core.decode_p256_key_with", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_signature_core.P256Primitive.decode", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.p256Key", + "Auths.Crypto.Strict.SuiteModel.sourceP256" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SuiteRefinement", + "name": "Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines", + "statement": "∀ {K D V : Type}\n (decoderPrimitive : Aeneas.Std.core.ops.function.FnOnce D (Aeneas.Std.Array Aeneas.Std.U8 32#usize) (Option K))\n (verifierPrimitive :\n Aeneas.Std.core.ops.function.FnOnce V (K × Aeneas.Std.Slice Aeneas.Std.U8 × Aeneas.Std.Array Aeneas.Std.U8 64#usize)\n Bool)\n (decoder : D) (verifier : V) (decode : List Aeneas.Std.U8 → Option K)\n (equation : K → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n (∀ (array : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n decoderPrimitive.call_once decoder array = Aeneas.Std.Result.ok (decode ↑array)) →\n (∀ (key : K) (message : Aeneas.Std.Slice Aeneas.Std.U8) (signature : Aeneas.Std.Array Aeneas.Std.U8 64#usize),\n verifierPrimitive.call_once verifier (key, message, signature) =\n Aeneas.Std.Result.ok (equation key ↑message ↑signature)) →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_ed25519_with decoderPrimitive verifierPrimitive bytes message signature decoder\n verifier =\n Aeneas.Std.Result.ok\n (Auths.Crypto.Strict.SuiteModel.sourceEd\n (Auths.Crypto.Strict.SuiteModel.edVerify decode equation ↑bytes ↑message ↑signature))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "Unit", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Subtype.val", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519_with", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.edVerify", + "Auths.Crypto.Strict.SuiteModel.sourceEd", + "Aeneas.Std.core.ops.function.FnOnce", + "Aeneas.Std.core.ops.function.FnOnce.call_once" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SuiteRefinement", + "name": "Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines", + "statement": "∀ {T K S : Type} (primitive : auths_signature_core.P256Primitive T K S) (decode : List Aeneas.Std.U8 → Option K)\n (parse : List Aeneas.Std.U8 → Option S) (equation : K → List Aeneas.Std.U8 → S → Bool),\n (∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8), primitive.decode bytes = Aeneas.Std.Result.ok (decode ↑bytes)) →\n (∀ (array : Aeneas.Std.Array Aeneas.Std.U8 64#usize), primitive.parse array = Aeneas.Std.Result.ok (parse ↑array)) →\n (∀ (key : K) (message : Aeneas.Std.Slice Aeneas.Std.U8) (signature : S),\n primitive.verify key message signature = Aeneas.Std.Result.ok (equation key (↑message) signature)) →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_p256_sha256_with primitive bytes message signature =\n Aeneas.Std.Result.ok\n (Auths.Crypto.Strict.SuiteModel.sourceP256\n (Auths.Crypto.Strict.SuiteModel.p256Verify decode parse equation ↑bytes ↑message ↑signature))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Unit", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.P256Error", + "auths_signature_core.P256Primitive", + "auths_signature_core.verify_p256_sha256_with", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_signature_core.P256Primitive.decode", + "auths_signature_core.P256Primitive.parse", + "auths_signature_core.P256Primitive.verify", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.SuiteModel.p256Verify", + "Auths.Crypto.Strict.SuiteModel.sourceP256" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Acceptance", + "name": "Auths.Crypto.Strict.Acceptance.key_encoding_accepts_iff", + "statement": "∀ (bytes : List Aeneas.Std.U8) (encoded : Auths.Crypto.Encoding.Encoded.Input),\n Auths.Crypto.Strict.SuiteModel.keyEncoding bytes = Except.ok encoded ↔\n ↑encoded = bytes ∧ Auths.Crypto.Encoding.Encoded.Encoding encoded", + "statement_constants": [ + "And", + "Eq", + "Except", + "Iff", + "List", + "Nat", + "instOfNatNat", + "Except.ok", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Encoding.Encoded.Encoding", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Strict.SuiteModel.Failure", + "Auths.Crypto.Strict.SuiteModel.keyEncoding", + "Auths.Crypto.Encoding.Encoded.Input._proof_1" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Acceptance", + "name": "Auths.Crypto.Strict.Acceptance.p256_key_accepts_iff", + "statement": "∀ {K : Type} (decode : List Aeneas.Std.U8 → Option K) (bytes : List Aeneas.Std.U8) (point : K),\n Auths.Crypto.Strict.SuiteModel.p256Key decode bytes = Except.ok point ↔\n Auths.Crypto.Encoding.P256.Encoding (List.map Aeneas.Std.UScalar.val bytes) ∧ decode bytes = some point", + "statement_constants": [ + "And", + "Eq", + "Except", + "Iff", + "List", + "Nat", + "Option", + "Except.ok", + "List.map", + "Option.some", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Auths.Crypto.Encoding.P256.Encoding", + "Auths.Crypto.Strict.SuiteModel.Failure", + "Auths.Crypto.Strict.SuiteModel.p256Key" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Acceptance", + "name": "Auths.Crypto.Strict.Acceptance.ed_accepts_iff", + "statement": "∀ {K : Type} (decode : List Aeneas.Std.U8 → Option K) (equation : K → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool)\n (key message signature : List Aeneas.Std.U8),\n Auths.Crypto.Strict.SuiteModel.edVerify decode equation key message signature = Except.ok () ↔\n Auths.Crypto.Strict.Acceptance.EdAccepts decode equation key message signature", + "statement_constants": [ + "Bool", + "Eq", + "Except", + "Iff", + "List", + "Option", + "Unit", + "Except.ok", + "Unit.unit", + "Aeneas.Std.U8", + "Auths.Crypto.Strict.Acceptance.EdAccepts", + "Auths.Crypto.Strict.SuiteModel.Failure", + "Auths.Crypto.Strict.SuiteModel.edVerify" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Acceptance", + "name": "Auths.Crypto.Strict.Acceptance.p256_accepts_iff", + "statement": "∀ {K S : Type} (decode : List Aeneas.Std.U8 → Option K) (parse : List Aeneas.Std.U8 → Option S)\n (equation : K → List Aeneas.Std.U8 → S → Bool) (key message signature : List Aeneas.Std.U8),\n Auths.Crypto.Strict.SuiteModel.p256Verify decode parse equation key message signature = Except.ok () ↔\n Auths.Crypto.Strict.Acceptance.P256Accepts decode parse equation key message signature", + "statement_constants": [ + "Bool", + "Eq", + "Except", + "Iff", + "List", + "Option", + "Unit", + "Except.ok", + "Unit.unit", + "Aeneas.Std.U8", + "Auths.Crypto.Strict.Acceptance.P256Accepts", + "Auths.Crypto.Strict.SuiteModel.Failure", + "Auths.Crypto.Strict.SuiteModel.p256Verify" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SourceAcceptance", + "name": "Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff", + "statement": "∀ {K D V : Type}\n (decoderPrimitive : Aeneas.Std.core.ops.function.FnOnce D (Aeneas.Std.Array Aeneas.Std.U8 32#usize) (Option K))\n (verifierPrimitive :\n Aeneas.Std.core.ops.function.FnOnce V (K × Aeneas.Std.Slice Aeneas.Std.U8 × Aeneas.Std.Array Aeneas.Std.U8 64#usize)\n Bool)\n (decoder : D) (verifier : V) (decode : List Aeneas.Std.U8 → Option K)\n (equation : K → List Aeneas.Std.U8 → List Aeneas.Std.U8 → Bool),\n (∀ (array : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n decoderPrimitive.call_once decoder array = Aeneas.Std.Result.ok (decode ↑array)) →\n (∀ (key : K) (message : Aeneas.Std.Slice Aeneas.Std.U8) (signature : Aeneas.Std.Array Aeneas.Std.U8 64#usize),\n verifierPrimitive.call_once verifier (key, message, signature) =\n Aeneas.Std.Result.ok (equation key ↑message ↑signature)) →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_ed25519_with decoderPrimitive verifierPrimitive bytes message signature decoder\n verifier =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ()) ↔\n Auths.Crypto.Strict.Acceptance.EdAccepts decode equation ↑bytes ↑message ↑signature", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Prod", + "Unit", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "Subtype.val", + "Unit.unit", + "auths_signature_core.Ed25519Error", + "auths_signature_core.verify_ed25519_with", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.Acceptance.EdAccepts", + "Aeneas.Std.core.ops.function.FnOnce", + "Aeneas.Std.core.result.Result.Ok", + "Aeneas.Std.core.ops.function.FnOnce.call_once" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.SourceAcceptance", + "name": "Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff", + "statement": "∀ {T K S : Type} (primitive : auths_signature_core.P256Primitive T K S) (decode : List Aeneas.Std.U8 → Option K)\n (parse : List Aeneas.Std.U8 → Option S) (equation : K → List Aeneas.Std.U8 → S → Bool),\n (∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8), primitive.decode bytes = Aeneas.Std.Result.ok (decode ↑bytes)) →\n (∀ (array : Aeneas.Std.Array Aeneas.Std.U8 64#usize), primitive.parse array = Aeneas.Std.Result.ok (parse ↑array)) →\n (∀ (key : K) (message : Aeneas.Std.Slice Aeneas.Std.U8) (signature : S),\n primitive.verify key message signature = Aeneas.Std.Result.ok (equation key (↑message) signature)) →\n ∀ (bytes message signature : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.verify_p256_sha256_with primitive bytes message signature =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ()) ↔\n Auths.Crypto.Strict.Acceptance.P256Accepts decode parse equation ↑bytes ↑message ↑signature", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Unit", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Unit.unit", + "auths_signature_core.P256Error", + "auths_signature_core.P256Primitive", + "auths_signature_core.verify_p256_sha256_with", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_signature_core.P256Primitive.decode", + "auths_signature_core.P256Primitive.parse", + "auths_signature_core.P256Primitive.verify", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Strict.Acceptance.P256Accepts", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.zero_s_form_allowed", + "statement": "auths_signature_core.p256_signature_is_low_s Auths.Crypto.Strict.Examples.zero = Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "auths_signature_core.p256_signature_is_low_s", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Strict.Examples.zero" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.half_s_form_allowed", + "statement": "auths_signature_core.p256_signature_is_low_s Auths.Crypto.Strict.Examples.half = Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "auths_signature_core.p256_signature_is_low_s", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Strict.Examples.half" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.above_half_s_refused", + "statement": "auths_signature_core.p256_signature_is_low_s Auths.Crypto.Strict.Examples.aboveHalf = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "auths_signature_core.p256_signature_is_low_s", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Strict.Examples.aboveHalf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.maximum_s_refused", + "statement": "auths_signature_core.p256_signature_is_low_s Auths.Crypto.Strict.Examples.maximum = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "auths_signature_core.p256_signature_is_low_s", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Strict.Examples.maximum" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.identity_coordinate_is_weak", + "statement": "auths_signature_core.ed25519_has_small_order_coordinate Auths.Crypto.Encoding.Examples.canonicalIdentity =\n Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "auths_signature_core.ed25519_has_small_order_coordinate", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Examples.canonicalIdentity" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak", + "statement": "auths_signature_core.ed25519_has_small_order_coordinate Auths.Crypto.Encoding.Examples.rfcPublicKey =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "auths_signature_core.ed25519_has_small_order_coordinate", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Examples.rfcPublicKey" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.weak_r_form_refused", + "statement": "auths_signature_core.ed25519_signature_r_is_allowed Auths.Crypto.Strict.Examples.zero = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "auths_signature_core.ed25519_signature_r_is_allowed", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Strict.Examples.zero" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Strict.Examples", + "name": "Auths.Crypto.Strict.Examples.public_r_form_allowed", + "statement": "auths_signature_core.ed25519_signature_r_is_allowed Auths.Crypto.Strict.Examples.publicR = Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "auths_signature_core.ed25519_signature_r_is_allowed", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Strict.Examples.publicR" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Support.UnitCallback", + "name": "Auths.Support.UnitCallback.erase_restore", + "statement": "∀ {S : Type} (operation : Aeneas.Std.Result S),\n Auths.Support.UnitCallback.erase (Auths.Support.UnitCallback.restore operation) = operation", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Auths.Support.UnitCallback.erase", + "Auths.Support.UnitCallback.restore" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Support.UnitCallback", + "name": "Auths.Support.UnitCallback.restore_erase", + "statement": "∀ {S : Type} (operation : Aeneas.Std.Result (Unit × S)),\n Auths.Support.UnitCallback.restore (Auths.Support.UnitCallback.erase operation) = operation", + "statement_constants": [ + "Eq", + "Prod", + "Unit", + "Aeneas.Std.Result", + "Auths.Support.UnitCallback.erase", + "Auths.Support.UnitCallback.restore" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Facade", + "name": "Auths.Composition.Facade.event_outcome_exact", + "statement": "auths_composition.EvaluationEvent.outcome = fun event =>\n Aeneas.Std.Result.ok (Auths.Composition.Facade.eventOutcome (Auths.Composition.PlanModel.eventView event))", + "statement_constants": [ + "Eq", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "Aeneas.Std.Result", + "auths_composition.EvaluationEvent.outcome", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.Facade.eventOutcome", + "Auths.Composition.PlanModel.eventView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Facade", + "name": "Auths.Composition.Facade.observer_mut_exact", + "statement": "∀ {B : Type}\n (branch : Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (state : auths_composition.evaluate.closure B) (event : auths_composition.EvaluationEvent),\n auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut branch state event =\n Aeneas.Std.Result.ok state", + "statement_constants": [ + "Eq", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "Aeneas.Std.Result", + "auths_composition.auths_model.ProofRef", + "auths_composition.evaluate.closure", + "Aeneas.Std.Result.ok", + "Aeneas.Std.core.ops.function.FnMut", + "auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Facade", + "name": "Auths.Composition.Facade.observer_once_exact", + "statement": "∀ {B : Type}\n (branch : Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (state : auths_composition.evaluate.closure B) (event : auths_composition.EvaluationEvent),\n auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple.call_once branch state event =\n Aeneas.Std.Result.ok ()", + "statement_constants": [ + "Eq", + "Unit", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "Aeneas.Std.Result", + "auths_composition.auths_model.ProofRef", + "auths_composition.evaluate.closure", + "Aeneas.Std.Result.ok", + "Aeneas.Std.core.ops.function.FnMut", + "auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple.call_once" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Facade", + "name": "Auths.Composition.Facade.evaluate_refines", + "statement": "∀ {B : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan) (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n ∀ (state : B),\n auths_composition.evaluate nativeBranch plan limits state =\n have expected :=\n Auths.Composition.ValidationPublic.evaluateChecked modelBranch (fun observer x => observer)\n (Auths.Composition.ValidationModel.sourceLimits limits) (Auths.Composition.PlanModel.viewPlan plan)\n state ();\n Aeneas.Std.Result.ok (expected.1, expected.2.1)", + "statement_constants": [ + "Eq", + "Prod", + "Unit", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.evaluate", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.Event", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationPublic.evaluateChecked", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Facade", + "name": "Auths.Composition.Facade.invalid_plan_preserves_callback", + "statement": "∀ {B : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (plan : auths_composition.auths_model.AuthorizationPlan) (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n ¬Auths.Composition.ValidationModel.Valid (Auths.Composition.ValidationModel.sourceLimits limits)\n (Auths.Composition.PlanModel.viewPlan plan) →\n ∀ (state : B),\n auths_composition.evaluate nativeBranch plan limits state =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid,\n state)", + "statement_constants": [ + "Eq", + "Not", + "Prod", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.FacadeExamples", + "name": "Auths.Composition.FacadeExamples.conjunction_authorizes", + "statement": "auths_composition.evaluate Auths.Composition.PlanExamples.branch Auths.Composition.PlanExamples.twoLeaves\n Auths.Composition.ValidationExamples.limits 0 =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok auths_composition.BranchOutcome.Authorized, 2)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.PlanExamples.twoLeaves", + "Auths.Composition.ValidationExamples.limits", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.FacadeExamples", + "name": "Auths.Composition.FacadeExamples.duplicate_refused", + "statement": "auths_composition.evaluate Auths.Composition.PlanExamples.branch Auths.Composition.ValidationExamples.duplicate\n Auths.Composition.ValidationExamples.limits 5 =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid, 5)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate", + "Aeneas.Std.Result", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.ValidationExamples.duplicate", + "Auths.Composition.ValidationExamples.limits", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.FacadeExamples", + "name": "Auths.Composition.FacadeExamples.threshold_indeterminate", + "statement": "auths_composition.evaluate Auths.Composition.PlanExamples.mixedBranch\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.KOfN 2#u16 Auths.Composition.PlanExamples.threeMembers))\n Auths.Composition.ValidationExamples.limits 0 =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok\n (auths_composition.BranchOutcome.Indeterminate\n auths_composition.auths_model.Requirement.ExternalFactUnavailable),\n 3)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Indeterminate", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.PlanExamples.threeMembers", + "Auths.Composition.ValidationExamples.limits", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.KOfN", + "auths_composition.auths_model.Requirement.ExternalFactUnavailable", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Byte", + "name": "Auths.Crypto.Encoding.Byte.lower_seven", + "statement": "∀ (byte : Aeneas.Std.U8), ↑(byte &&& 127#u8) = ↑byte % 128", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instHMod", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAnd.hAnd", + "HMod.hMod", + "LE.le", + "Nat.decLe", + "Nat.instMod", + "OfNat.ofNat", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.instHAndUScalar", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Byte", + "name": "Auths.Crypto.Encoding.Byte.sign_bit", + "statement": "∀ (byte : Aeneas.Std.U8), (byte &&& 128#u8 != 0#u8) = decide (128 ≤ ↑byte)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "bne", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAnd.hAnd", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.instBEqUScalar_1", + "Aeneas.Std.instHAndUScalar", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Digits", + "name": "Auths.Crypto.Encoding.Digits.value_bound", + "statement": "∀ (digits : List ℕ), (∀ byte ∈ digits, byte < 256) → Nat.ofDigits 256 digits < 256 ^ digits.length", + "statement_constants": [ + "List", + "Nat", + "instHPow", + "instLTNat", + "instOfNatNat", + "HPow.hPow", + "LT.lt", + "List.instMembership", + "List.length", + "Membership.mem", + "Monoid.toPow", + "Nat.instMonoid", + "Nat.instSemiring", + "Nat.ofDigits", + "OfNat.ofNat" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Digits", + "name": "Auths.Crypto.Encoding.Digits.maximum_iff", + "statement": "∀ (digits : List ℕ),\n (∀ byte ∈ digits, byte < 256) →\n (Nat.ofDigits 256 digits = 256 ^ digits.length - 1 ↔ digits = List.replicate digits.length 255)", + "statement_constants": [ + "Eq", + "Iff", + "List", + "Nat", + "instHPow", + "instHSub", + "instLTNat", + "instOfNatNat", + "instSubNat", + "HPow.hPow", + "HSub.hSub", + "LT.lt", + "List.instMembership", + "List.length", + "List.replicate", + "Membership.mem", + "Monoid.toPow", + "Nat.instMonoid", + "Nat.instSemiring", + "Nat.ofDigits", + "OfNat.ofNat" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Digits", + "name": "Auths.Crypto.Encoding.Digits.zero_iff", + "statement": "∀ (digits : List ℕ),\n (∀ byte ∈ digits, byte < 256) → (Nat.ofDigits 256 digits = 0 ↔ digits = List.replicate digits.length 0)", + "statement_constants": [ + "Eq", + "Iff", + "List", + "Nat", + "instLTNat", + "instOfNatNat", + "LT.lt", + "List.instMembership", + "List.length", + "List.replicate", + "Membership.mem", + "Nat.instSemiring", + "Nat.ofDigits", + "OfNat.ofNat" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Coordinate", + "name": "Auths.Crypto.Encoding.Coordinate.encoding_criterion", + "statement": "∀ (first upper : ℕ) (negative : Prop),\n first < 256 →\n upper ≤ Auths.Crypto.Encoding.Coordinate.upperMaximum →\n (Auths.Crypto.Encoding.Coordinate.Encoding (first + 256 * upper) negative ↔\n ¬(upper = Auths.Crypto.Encoding.Coordinate.upperMaximum ∧ 237 ≤ first) ∧\n ¬(negative ∧ (upper = 0 ∧ first = 1 ∨ upper = Auths.Crypto.Encoding.Coordinate.upperMaximum ∧ first = 236)))", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Nat", + "Not", + "Or", + "instAddNat", + "instHAdd", + "instHMul", + "instLENat", + "instLTNat", + "instMulNat", + "instOfNatNat", + "HAdd.hAdd", + "HMul.hMul", + "LE.le", + "LT.lt", + "OfNat.ofNat", + "Auths.Crypto.Encoding.Coordinate.Encoding", + "Auths.Crypto.Encoding.Coordinate.upperMaximum" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Scan", + "name": "Auths.Crypto.Encoding.Scan.loop_refines", + "statement": "∀ (encoded : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (remaining : ℕ)\n (range : Aeneas.Std.core.ops.range.Range Aeneas.Std.Usize) (maximum zero : Bool),\n ↑range.end ≤ 31 →\n ↑range.start + remaining = ↑range.end →\n Aeneas.Std.WP.spec (auths_signature_core.ed25519_point_encoding_is_canonical_loop range encoded maximum zero)\n fun result =>\n result = Auths.Crypto.Encoding.Scan.scan (List.take remaining (List.drop ↑range.start ↑encoded)) maximum zero", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAdd.hAdd", + "LE.le", + "List.drop", + "List.length", + "List.take", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "auths_signature_core.ed25519_point_encoding_is_canonical_loop", + "Aeneas.Std.Array", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Crypto.Encoding.Scan.scan", + "Aeneas.Std.core.ops.range.Range", + "Aeneas.Std.core.ops.range.Range.end", + "Aeneas.Std.core.ops.range.Range.start" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Encoded", + "name": "Auths.Crypto.Encoding.Encoded.input_decomposes", + "statement": "∀ (input : Auths.Crypto.Encoding.Encoded.Input),\n ↑input =\n Auths.Crypto.Encoding.Encoded.first input :: Auths.Crypto.Encoding.Encoded.middle input ++\n [Auths.Crypto.Encoding.Encoded.last input]", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instHAppendOfAppend", + "instOfNatNat", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.length", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.first", + "Auths.Crypto.Encoding.Encoded.last", + "Auths.Crypto.Encoding.Encoded.middle", + "Auths.Crypto.Encoding.Encoded.Input._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Encoded", + "name": "Auths.Crypto.Encoding.Encoded.ordinate_frame", + "statement": "∀ (input : Auths.Crypto.Encoding.Encoded.Input),\n Auths.Crypto.Encoding.Encoded.ordinate input =\n ↑(Auths.Crypto.Encoding.Encoded.first input) + 256 * Auths.Crypto.Encoding.Encoded.upperValue input", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instHMul", + "instMulNat", + "instOfNatNat", + "HAdd.hAdd", + "HMul.hMul", + "OfNat.ofNat", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.first", + "Auths.Crypto.Encoding.Encoded.ordinate", + "Auths.Crypto.Encoding.Encoded.upperValue" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.RootFlags", + "name": "Auths.Crypto.Encoding.RootFlags.root_flags", + "statement": "∀ (input : Auths.Crypto.Encoding.Encoded.Input),\n Aeneas.Std.WP.spec\n (auths_signature_core.ed25519_point_encoding_is_canonical_loop { start := 1#usize, «end» := 31#usize } input\n (decide (Auths.Crypto.Encoding.Encoded.last input &&& 127#u8 = 127#u8))\n (decide (Auths.Crypto.Encoding.Encoded.last input &&& 127#u8 = 0#u8)))\n fun result =>\n (result.1 = true ↔ Auths.Crypto.Encoding.Encoded.upperValue input = Auths.Crypto.Encoding.Coordinate.upperMaximum) ∧\n (result.2 = true ↔ Auths.Crypto.Encoding.Encoded.upperValue input = 0)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAnd.hAnd", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Prod.fst", + "Prod.snd", + "auths_signature_core.ed25519_point_encoding_is_canonical_loop", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Usize", + "Aeneas.Std.instDecidableEqUScalar_1", + "Aeneas.Std.instHAndUScalar", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Crypto.Encoding.Coordinate.upperMaximum", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.last", + "Auths.Crypto.Encoding.Encoded.upperValue", + "Aeneas.Std.core.ops.range.Range.mk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Ed25519", + "name": "Auths.Crypto.Encoding.Ed25519.guard_refines", + "statement": "∀ (input : Auths.Crypto.Encoding.Encoded.Input),\n auths_signature_core.ed25519_point_encoding_is_canonical input =\n Aeneas.Std.Result.ok (decide (Auths.Crypto.Encoding.Encoded.Encoding input))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "auths_signature_core.ed25519_point_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Encoded.Encoding", + "Auths.Crypto.Encoding.Encoded.Input", + "Auths.Crypto.Encoding.Encoded.instDecidableEncoding" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.P256", + "name": "Auths.Crypto.Encoding.P256.guard_refines", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8),\n auths_signature_core.p256_key_encoding_is_canonical input =\n Aeneas.Std.Result.ok (decide (Auths.Crypto.Encoding.P256.Encoding (List.map Aeneas.Std.UScalar.val ↑input)))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "auths_signature_core.p256_key_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Encoding.P256.Encoding", + "Auths.Crypto.Encoding.P256.instDecidableEncoding" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted", + "statement": "auths_signature_core.ed25519_point_encoding_is_canonical Auths.Crypto.Encoding.Examples.rfcPublicKey =\n Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "auths_signature_core.ed25519_point_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Examples.rfcPublicKey" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.field_alias_refused", + "statement": "auths_signature_core.ed25519_point_encoding_is_canonical Auths.Crypto.Encoding.Examples.noncanonicalField =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "auths_signature_core.ed25519_point_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Examples.noncanonicalField" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.negative_zero_refused", + "statement": "auths_signature_core.ed25519_point_encoding_is_canonical Auths.Crypto.Encoding.Examples.negativeZero =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "auths_signature_core.ed25519_point_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Examples.negativeZero" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted", + "statement": "auths_signature_core.ed25519_point_encoding_is_canonical Auths.Crypto.Encoding.Examples.canonicalIdentity =\n Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "auths_signature_core.ed25519_point_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Encoding.Examples.canonicalIdentity" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.compressed_form_accepted", + "statement": "auths_signature_core.p256_key_encoding_is_canonical\n ⟨have y :=\n have y :=\n have y := [0#u8, 0#u8, 0#u8, 0#u8, 0#u8];\n 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n have y := 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n have y :=\n have y := 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n have y := 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n 2#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y,\n Auths.Crypto.Encoding.Examples.compressed_form_accepted._proof_1⟩ =\n Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.mk", + "auths_signature_core.p256_key_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Encoding.Examples.compressed_form_accepted._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.uncompressed_tag_refused", + "statement": "auths_signature_core.p256_key_encoding_is_canonical\n ⟨have y :=\n have y :=\n have y := [0#u8, 0#u8, 0#u8, 0#u8, 0#u8];\n 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n have y := 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n have y :=\n have y := 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n have y := 0#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y;\n 4#u8 :: 0#u8 :: 0#u8 :: 0#u8 :: y,\n Auths.Crypto.Encoding.Examples.uncompressed_tag_refused._proof_1⟩ =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.mk", + "auths_signature_core.p256_key_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Encoding.Examples.uncompressed_tag_refused._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Encoding.Examples", + "name": "Auths.Crypto.Encoding.Examples.short_compressed_refused", + "statement": "auths_signature_core.p256_key_encoding_is_canonical\n ⟨[2#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8,\n 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8],\n Auths.Crypto.Encoding.Examples.short_compressed_refused._proof_1⟩ =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.mk", + "auths_signature_core.p256_key_encoding_is_canonical", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Encoding.Examples.short_compressed_refused._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Order", + "name": "Auths.Composition.Order.reference_key_injective", + "statement": "Function.Injective Auths.Composition.Order.referenceKey", + "statement_constants": [ + "List", + "Nat", + "Function.Injective", + "auths_composition.auths_model.ProofRef", + "Auths.Composition.Order.referenceKey" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Order", + "name": "Auths.Composition.Order.reference_comparison", + "statement": "∀ (left right : auths_composition.auths_model.ProofRef),\n auths_composition.auths_model.ProofRef.Insts.CoreCmpOrd.cmp left right =\n Aeneas.Std.Result.ok\n (List.compareLex compare (Auths.Composition.Order.referenceKey left) (Auths.Composition.Order.referenceKey right))", + "statement_constants": [ + "Eq", + "Nat", + "Ordering", + "instOrdNat", + "List.compareLex", + "Ord.compare", + "Aeneas.Std.Result", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.Order.referenceKey", + "auths_composition.auths_model.ProofRef.Insts.CoreCmpOrd.cmp" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.SetModel", + "name": "Auths.Composition.SetModel.insert_values", + "statement": "∀ (value : Auths.Composition.SetModel.Reference) (values : List Auths.Composition.SetModel.Reference),\n List.Pairwise Auths.Composition.SetModel.Before values →\n ∃ added updated,\n alloc.collections.btree.set.insertValues Auths.Composition.SetModel.referenceOrder value values =\n Aeneas.Std.Result.ok (added, updated) ∧\n List.Pairwise Auths.Composition.SetModel.Before updated ∧\n (∀ (item : auths_composition.auths_model.ProofRef), item ∈ updated ↔ item = value ∨ item ∈ values) ∧\n (added = true ↔ value ∉ values) ∧ updated.length = values.length + if added = true then 1 else 0", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Iff", + "List", + "Nat", + "Not", + "Or", + "Prod", + "instAddNat", + "instDecidableEqBool", + "instHAdd", + "instOfNatNat", + "ite", + "Bool.true", + "HAdd.hAdd", + "List.Pairwise", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Result", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.SetModel.Before", + "Auths.Composition.SetModel.Reference", + "Auths.Composition.SetModel.referenceOrder", + "alloc.collections.btree.set.insertValues" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.SetModel", + "name": "Auths.Composition.SetModel.ordered_nodup", + "statement": "∀ (values : List Auths.Composition.SetModel.Reference),\n List.Pairwise Auths.Composition.SetModel.Before values → values.Nodup", + "statement_constants": [ + "List", + "List.Nodup", + "List.Pairwise", + "Auths.Composition.SetModel.Before", + "Auths.Composition.SetModel.Reference" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.SetModel", + "name": "Auths.Composition.SetModel.insert_set", + "statement": "∀ (allocator : Aeneas.Std.core.clone.Clone Aeneas.Std.Global) (value : Auths.Composition.SetModel.Reference)\n (state : alloc.collections.btree.set.BTreeSet Auths.Composition.SetModel.Reference Aeneas.Std.Global),\n List.Pairwise Auths.Composition.SetModel.Before state.values →\n state.values.length < Aeneas.Std.Usize.max →\n ∃ added updated,\n alloc.collections.btree.set.BTreeSet.insert allocator Auths.Composition.SetModel.referenceOrder state value =\n Aeneas.Std.Result.ok (added, updated) ∧\n List.Pairwise Auths.Composition.SetModel.Before updated.values ∧\n (∀ (item : auths_composition.auths_model.ProofRef),\n item ∈ updated.values ↔ item = value ∨ item ∈ state.values) ∧\n (added = true ↔ value ∉ state.values) ∧\n updated.values.length = state.values.length + if added = true then 1 else 0", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Iff", + "List", + "Nat", + "Not", + "Or", + "Prod", + "instAddNat", + "instDecidableEqBool", + "instHAdd", + "instLTNat", + "instOfNatNat", + "ite", + "Bool.true", + "HAdd.hAdd", + "LT.lt", + "List.Pairwise", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Prod.mk", + "Aeneas.Std.Global", + "Aeneas.Std.Result", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Composition.SetModel.Before", + "Auths.Composition.SetModel.Reference", + "Auths.Composition.SetModel.referenceOrder", + "Aeneas.Std.core.clone.Clone", + "alloc.collections.btree.set.BTreeSet", + "alloc.collections.btree.set.BTreeSet.insert", + "alloc.collections.btree.set.BTreeSet.values" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Collect", + "name": "Auths.Composition.Collect.push_exact", + "statement": "∀ (state : auths_composition.alloc.vec.Vec auths_composition.auths_model.ProofRef)\n (value : auths_composition.auths_model.ProofRef),\n state.size < Aeneas.Std.Usize.max →\n Aeneas.Std.WP.spec (state.push value) fun updated => updated.elements.toList = state.elements.toList ++ [value]", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instHAppendOfAppend", + "instLTNat", + "HAppend.hAppend", + "LT.lt", + "List.cons", + "List.instAppend", + "List.nil", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "auths_composition.alloc.vec.Vec", + "auths_composition.alloc.vec.SizedList.toList", + "auths_composition.alloc.vec.Vec.elements", + "auths_composition.alloc.vec.Vec.push", + "auths_composition.alloc.vec.Vec.size" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Collect", + "name": "Auths.Composition.Collect.collect_exact", + "statement": "∀ (remaining : List auths_composition.auths_model.ProofRef)\n (iterator : alloc.collections.btree.set.IntoIter auths_composition.auths_model.ProofRef Aeneas.Std.Global)\n (state : auths_composition.alloc.vec.Vec auths_composition.auths_model.ProofRef),\n iterator.values = remaining →\n state.size + remaining.length ≤ Aeneas.Std.Usize.max →\n Aeneas.Std.WP.spec (auths_composition.auths_model.AuthorizationPlan.validate_loop iterator state) fun updated =>\n updated.elements.toList = state.elements.toList ++ remaining", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHAppendOfAppend", + "instLENat", + "HAdd.hAdd", + "HAppend.hAppend", + "LE.le", + "List.instAppend", + "List.length", + "Aeneas.Std.Global", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "auths_composition.alloc.vec.Vec", + "auths_composition.auths_model.AuthorizationPlan.validate_loop", + "alloc.collections.btree.set.IntoIter", + "auths_composition.alloc.vec.SizedList.toList", + "auths_composition.alloc.vec.Vec.elements", + "auths_composition.alloc.vec.Vec.size", + "alloc.collections.btree.set.IntoIter.values" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationCapacity", + "name": "Auths.Composition.ValidationCapacity.checker_preserves_capacity", + "statement": "∀ {R : Type} [inst : DecidableEq R] (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationCapacity.NodeCapacity plan", + "statement_constants": [ + "DecidableEq", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationCapacity.NodeCapacity" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationProgress", + "name": "Auths.Composition.ValidationProgress.progress_append", + "statement": "∀ {R : Type} [inst : DecidableEq R] (before middle after : Finset R) (left right : List R),\n Auths.Composition.ValidationProgress.Progress before left middle →\n Auths.Composition.ValidationProgress.Progress middle right after →\n Auths.Composition.ValidationProgress.Progress before (left ++ right) after", + "statement_constants": [ + "DecidableEq", + "Finset", + "List", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "Auths.Composition.ValidationProgress.Progress" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationProgress", + "name": "Auths.Composition.ValidationProgress.progress_card", + "statement": "∀ {R : Type} [inst : DecidableEq R] (before after : Finset R) (references : List R),\n Auths.Composition.ValidationProgress.Progress before references after → after.card = before.card + references.length", + "statement_constants": [ + "DecidableEq", + "Eq", + "Finset", + "List", + "Nat", + "instAddNat", + "instHAdd", + "Finset.card", + "HAdd.hAdd", + "List.length", + "Auths.Composition.ValidationProgress.Progress" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationProgress", + "name": "Auths.Composition.ValidationProgress.checker_progress", + "statement": "∀ {R : Type} [inst : DecidableEq R] (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationProgress.NodeProgress plan", + "statement_constants": [ + "DecidableEq", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationProgress.NodeProgress" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationShape", + "name": "Auths.Composition.ValidationShape.checker_shape", + "statement": "∀ {R : Type} [inst : DecidableEq R] (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationShape.NodeShape plan", + "statement_constants": [ + "DecidableEq", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationShape.NodeShape" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationComplete", + "name": "Auths.Composition.ValidationComplete.checker_complete", + "statement": "∀ {R : Type} [inst : DecidableEq R] (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationComplete.NodeComplete plan", + "statement_constants": [ + "DecidableEq", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationComplete.NodeComplete" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationComplete", + "name": "Auths.Composition.ValidationComplete.valid_is_accepted", + "statement": "∀ {R : Type} [inst : DecidableEq R] (limits : Auths.Composition.ValidationModel.Limits)\n (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationModel.Valid limits plan →\n ∃ next,\n Auths.Composition.ValidationModel.checkPlan limits 1 plan Auths.Composition.ValidationModel.rootState =\n Except.ok next", + "statement_constants": [ + "DecidableEq", + "Eq", + "Except", + "Exists", + "Nat", + "instOfNatNat", + "Except.ok", + "OfNat.ofNat", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationModel.Limits", + "Auths.Composition.ValidationModel.ShapeError", + "Auths.Composition.ValidationModel.State", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.checkPlan", + "Auths.Composition.ValidationModel.rootState" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationSoundness", + "name": "Auths.Composition.ValidationSoundness.accepted_is_valid", + "statement": "∀ {R : Type} [inst : DecidableEq R] (limits : Auths.Composition.ValidationModel.Limits)\n (plan : Auths.Composition.PlanModel.Plan R) (next : Auths.Composition.ValidationModel.State R),\n Auths.Composition.ValidationModel.checkPlan limits 1 plan Auths.Composition.ValidationModel.rootState =\n Except.ok next →\n Auths.Composition.ValidationModel.Valid limits plan", + "statement_constants": [ + "DecidableEq", + "Eq", + "Except", + "Nat", + "instOfNatNat", + "Except.ok", + "OfNat.ofNat", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationModel.Limits", + "Auths.Composition.ValidationModel.ShapeError", + "Auths.Composition.ValidationModel.State", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.checkPlan", + "Auths.Composition.ValidationModel.rootState" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationSoundness", + "name": "Auths.Composition.ValidationSoundness.accepted_iff_valid", + "statement": "∀ {R : Type} [inst : DecidableEq R] (limits : Auths.Composition.ValidationModel.Limits)\n (plan : Auths.Composition.PlanModel.Plan R),\n (∃ next,\n Auths.Composition.ValidationModel.checkPlan limits 1 plan Auths.Composition.ValidationModel.rootState =\n Except.ok next) ↔\n Auths.Composition.ValidationModel.Valid limits plan", + "statement_constants": [ + "DecidableEq", + "Eq", + "Except", + "Exists", + "Iff", + "Nat", + "instOfNatNat", + "Except.ok", + "OfNat.ofNat", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationModel.Limits", + "Auths.Composition.ValidationModel.ShapeError", + "Auths.Composition.ValidationModel.State", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.checkPlan", + "Auths.Composition.ValidationModel.rootState" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationSoundness", + "name": "Auths.Composition.ValidationSoundness.operators_are_proper", + "statement": "∀ {R : Type} (limits : Auths.Composition.ValidationModel.Limits) (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationModel.operatorsValid limits plan → Auths.Composition.Bounds.proper plan", + "statement_constants": [ + "Auths.Composition.Bounds.proper", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationModel.Limits", + "Auths.Composition.ValidationModel.operatorsValid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationSoundness", + "name": "Auths.Composition.ValidationSoundness.valid_has_bounded_events", + "statement": "∀ {R : Type} (limits : Auths.Composition.ValidationModel.Limits) (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.ValidationModel.Valid limits plan →\n limits.depth ≤ 16 → limits.leaves ≤ 128 → Auths.Composition.Work.nodes plan ≤ 2048", + "statement_constants": [ + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "OfNat.ofNat", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.ValidationModel.Limits", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.Work.nodes", + "Auths.Composition.ValidationModel.Limits.depth", + "Auths.Composition.ValidationModel.Limits.leaves" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationLeaves", + "name": "Auths.Composition.ValidationLeaves.word_max_exact", + "statement": "∀ (left right : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_composition.core.cmp.Ord.max.default Aeneas.Std.core.cmp.OrdUsize left right) fun result =>\n ↑result = max ↑left ↑right", + "statement_constants": [ + "Eq", + "Nat", + "Max.max", + "Nat.instMax", + "Aeneas.Std.Usize", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.cmp.OrdUsize", + "auths_composition.core.cmp.Ord.max.default" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationLeaves", + "name": "Auths.Composition.ValidationLeaves.proof_leaf_exact", + "statement": "∀ (reference : auths_composition.auths_model.ProofRef) (depth maximum : Aeneas.Std.Usize)\n (limits : auths_composition.auths_model.VerifierLimits)\n (refs : alloc.collections.btree.set.BTreeSet auths_composition.auths_model.ProofRef Aeneas.Std.Global),\n List.Pairwise Auths.Composition.SetModel.Before refs.values →\n refs.values.length < Aeneas.Std.Usize.max →\n Aeneas.Std.WP.spec\n (auths_composition.auths_model.AuthorizationPlan.validate.walk\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.Proof reference))\n depth limits refs maximum)\n fun result =>\n Auths.Composition.ValidationLeaves.Corresponds\n (Auths.Composition.ValidationModel.checkPlan (Auths.Composition.ValidationModel.sourceLimits limits) (↑depth)\n (Auths.Composition.PlanModel.Plan.proof reference)\n (Auths.Composition.ValidationLeaves.viewState refs maximum))\n result", + "statement_constants": [ + "Nat", + "Prod", + "Unit", + "instLTNat", + "LT.lt", + "List.Pairwise", + "List.length", + "Aeneas.Std.Global", + "Aeneas.Std.Usize", + "auths_composition.auths_model.ModelError", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Composition.Order.referenceDecidableEq", + "Auths.Composition.SetModel.Before", + "Auths.Composition.SetModel.Reference", + "Auths.Composition.ValidationLeaves.Corresponds", + "Auths.Composition.ValidationLeaves.viewState", + "Auths.Composition.ValidationModel.checkPlan", + "Auths.Composition.ValidationModel.sourceLimits", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.Proof", + "Aeneas.Std.core.result.Result", + "Auths.Composition.PlanModel.Plan.proof", + "alloc.collections.btree.set.BTreeSet", + "auths_composition.auths_model.AuthorizationPlan.validate.walk", + "alloc.collections.btree.set.BTreeSet.values" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationRefinement", + "name": "Auths.Composition.ValidationRefinement.walk_refines", + "statement": "∀ (plan : auths_composition.auths_model.AuthorizationPlan) (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n ∀ (depth maximum : Aeneas.Std.Usize) (refs : Auths.Composition.ValidationRefinement.NativeSet),\n ↑depth ≤ 17 →\n Auths.Composition.ValidationRefinement.GoodSet limits refs →\n Aeneas.Std.WP.spec\n (auths_composition.auths_model.AuthorizationPlan.validate.walk plan depth limits refs maximum) fun result =>\n Auths.Composition.ValidationLeaves.Corresponds\n (Auths.Composition.ValidationModel.checkPlan (Auths.Composition.ValidationModel.sourceLimits limits)\n (↑depth) (Auths.Composition.PlanModel.viewPlan plan)\n (Auths.Composition.ValidationLeaves.viewState refs maximum))\n result", + "statement_constants": [ + "Nat", + "Prod", + "Unit", + "instLENat", + "instOfNatNat", + "LE.le", + "OfNat.ofNat", + "Aeneas.Std.Global", + "Aeneas.Std.Usize", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ModelError", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.WP.spec", + "Auths.Composition.Order.referenceDecidableEq", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationLeaves.Corresponds", + "Auths.Composition.ValidationLeaves.viewState", + "Auths.Composition.ValidationModel.checkPlan", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationRefinement.GoodSet", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "Auths.Composition.ValidationRefinement.NativeSet", + "Aeneas.Std.core.result.Result", + "alloc.collections.btree.set.BTreeSet", + "auths_composition.auths_model.AuthorizationPlan.validate.walk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationPublic", + "name": "Auths.Composition.ValidationPublic.validator_refines", + "statement": "∀ (plan : auths_composition.auths_model.AuthorizationPlan) (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n Aeneas.Std.WP.spec (plan.validate limits) fun result =>\n Auths.Composition.ValidationPublic.ShapeCorresponds\n (Auths.Composition.ValidationModel.checkPlan (Auths.Composition.ValidationModel.sourceLimits limits) 1\n (Auths.Composition.PlanModel.viewPlan plan) Auths.Composition.ValidationModel.rootState)\n result", + "statement_constants": [ + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ModelError", + "auths_composition.auths_model.PlanShape", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.WP.spec", + "Auths.Composition.Order.referenceDecidableEq", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.checkPlan", + "Auths.Composition.ValidationModel.rootState", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationPublic.ShapeCorresponds", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "auths_composition.auths_model.AuthorizationPlan.validate", + "Aeneas.Std.core.result.Result" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationPublic", + "name": "Auths.Composition.ValidationPublic.public_evaluator_refines", + "statement": "∀ {B O : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (nativeObserver : Aeneas.Std.core.ops.function.FnMut O auths_composition.EvaluationEvent Unit)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B)\n (modelObserver : O → Auths.Composition.PlanModel.Event auths_composition.auths_model.ProofRef → O),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n (∀ (state : O) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut state event =\n Aeneas.Std.Result.ok ((), modelObserver state (Auths.Composition.PlanModel.eventView event))) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan)\n (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n ∀ (state : B) (observer : O),\n auths_composition.evaluate_observed nativeBranch nativeObserver plan limits state observer =\n Aeneas.Std.Result.ok\n (Auths.Composition.ValidationPublic.evaluateChecked modelBranch modelObserver\n (Auths.Composition.ValidationModel.sourceLimits limits) (Auths.Composition.PlanModel.viewPlan plan)\n state observer)", + "statement_constants": [ + "Eq", + "Prod", + "Unit", + "Prod.mk", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.Event", + "Auths.Composition.PlanModel.eventView", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationPublic.evaluateChecked", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationContract", + "name": "Auths.Composition.ValidationContract.source_accepts_iff_valid", + "statement": "∀ (plan : auths_composition.auths_model.AuthorizationPlan) (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n ((∃ shape, plan.validate limits = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok shape)) ↔\n Auths.Composition.ValidationModel.Valid (Auths.Composition.ValidationModel.sourceLimits limits)\n (Auths.Composition.PlanModel.viewPlan plan))", + "statement_constants": [ + "Eq", + "Exists", + "Iff", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ModelError", + "auths_composition.auths_model.PlanShape", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "auths_composition.auths_model.AuthorizationPlan.validate", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationContract", + "name": "Auths.Composition.ValidationContract.valid_public_evaluator_refines", + "statement": "∀ {B O : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (nativeObserver : Aeneas.Std.core.ops.function.FnMut O auths_composition.EvaluationEvent Unit)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B)\n (modelObserver : O → Auths.Composition.PlanModel.Event auths_composition.auths_model.ProofRef → O),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n (∀ (state : O) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut state event =\n Aeneas.Std.Result.ok ((), modelObserver state (Auths.Composition.PlanModel.eventView event))) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan)\n (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n Auths.Composition.ValidationModel.Valid (Auths.Composition.ValidationModel.sourceLimits limits)\n (Auths.Composition.PlanModel.viewPlan plan) →\n ∀ (state : B) (observer : O),\n auths_composition.evaluate_observed nativeBranch nativeObserver plan limits state observer =\n have expected :=\n Auths.Composition.PlanModel.evaluate modelBranch modelObserver\n (Auths.Composition.PlanModel.viewPlan plan) state observer;\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok expected.1, expected.2.1, expected.2.2)", + "statement_constants": [ + "Eq", + "Prod", + "Unit", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.Event", + "Auths.Composition.PlanModel.evaluate", + "Auths.Composition.PlanModel.eventView", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.result.Result.Ok", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationContract", + "name": "Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks", + "statement": "∀ {B O : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (nativeObserver : Aeneas.Std.core.ops.function.FnMut O auths_composition.EvaluationEvent Unit)\n (plan : auths_composition.auths_model.AuthorizationPlan) (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n ¬Auths.Composition.ValidationModel.Valid (Auths.Composition.ValidationModel.sourceLimits limits)\n (Auths.Composition.PlanModel.viewPlan plan) →\n ∀ (state : B) (observer : O),\n auths_composition.evaluate_observed nativeBranch nativeObserver plan limits state observer =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid,\n state, observer)", + "statement_constants": [ + "Eq", + "Not", + "Prod", + "Unit", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationContract", + "name": "Auths.Composition.ValidationContract.public_event_bound", + "statement": "∀ {B : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (nativeObserver : Aeneas.Std.core.ops.function.FnMut ℕ auths_composition.EvaluationEvent Unit)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n (∀ (count : ℕ) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut count event = Aeneas.Std.Result.ok ((), count + 1)) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan)\n (limits : auths_composition.auths_model.VerifierLimits),\n Auths.Composition.ValidationRefinement.LimitsBounded limits →\n Auths.Composition.ValidationModel.Valid (Auths.Composition.ValidationModel.sourceLimits limits)\n (Auths.Composition.PlanModel.viewPlan plan) →\n ∀ (state : B) (count : ℕ),\n ∃ outcome next finalCount,\n auths_composition.evaluate_observed nativeBranch nativeObserver plan limits state count =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok outcome, next, finalCount) ∧\n finalCount ≤ count + 2048", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Nat", + "Prod", + "Unit", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "OfNat.ofNat", + "Prod.mk", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.ProofRef", + "auths_composition.auths_model.VerifierLimits", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "Auths.Composition.ValidationRefinement.LimitsBounded", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.result.Result.Ok", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.conjunction_valid", + "statement": "Auths.Composition.ValidationModel.Valid\n (Auths.Composition.ValidationModel.sourceLimits Auths.Composition.ValidationExamples.limits)\n (Auths.Composition.PlanModel.viewPlan Auths.Composition.PlanExamples.twoLeaves)", + "statement_constants": [ + "auths_composition.auths_model.ProofRef", + "Auths.Composition.PlanExamples.twoLeaves", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationExamples.limits", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.public_conjunction", + "statement": "auths_composition.evaluate_observed Auths.Composition.PlanExamples.branch Auths.Composition.PlanExamples.observer\n Auths.Composition.PlanExamples.twoLeaves Auths.Composition.ValidationExamples.limits 0 0 =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok auths_composition.BranchOutcome.Authorized, 2, 3)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.PlanExamples.observer", + "Auths.Composition.PlanExamples.twoLeaves", + "Auths.Composition.ValidationExamples.limits", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.duplicate_refused", + "statement": "auths_composition.evaluate_observed Auths.Composition.PlanExamples.branch Auths.Composition.PlanExamples.observer\n Auths.Composition.ValidationExamples.duplicate Auths.Composition.ValidationExamples.limits 5 9 =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid, 5, 9)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.PlanExamples.observer", + "Auths.Composition.ValidationExamples.duplicate", + "Auths.Composition.ValidationExamples.limits", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.zero_threshold_refused", + "statement": "auths_composition.evaluate_observed Auths.Composition.PlanExamples.mixedBranch Auths.Composition.PlanExamples.events\n Auths.Composition.ValidationExamples.impossibleThreshold Auths.Composition.ValidationExamples.limits 4 [] =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid, 4, [])", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Prod", + "instOfNatNat", + "List.nil", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.events", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.ValidationExamples.impossibleThreshold", + "Auths.Composition.ValidationExamples.limits", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.empty_invalid", + "statement": "¬Auths.Composition.ValidationModel.Valid\n (Auths.Composition.ValidationModel.sourceLimits Auths.Composition.ValidationExamples.limits)\n (Auths.Composition.PlanModel.viewPlan\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.AnyOf\n (auths_composition.alloc.vec.Vec.ofBase ⟨[], Auths.Composition.ValidationExamples.empty_invalid._proof_1⟩))))", + "statement_constants": [ + "List", + "Nat", + "Not", + "instLENat", + "LE.le", + "List.length", + "List.nil", + "Subtype.mk", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Usize.max", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationExamples.limits", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.AnyOf", + "Auths.Composition.ValidationExamples.empty_invalid._proof_1", + "auths_composition.alloc.vec.Vec.ofBase" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.mixed_threshold_valid", + "statement": "Auths.Composition.ValidationModel.Valid\n (Auths.Composition.ValidationModel.sourceLimits Auths.Composition.ValidationExamples.limits)\n (Auths.Composition.PlanModel.viewPlan\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.KOfN 2#u16 Auths.Composition.PlanExamples.threeMembers)))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.PlanExamples.threeMembers", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.ValidationExamples.limits", + "Auths.Composition.ValidationModel.Valid", + "Auths.Composition.ValidationModel.sourceLimits", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.KOfN" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.public_threshold_indeterminate", + "statement": "auths_composition.evaluate_observed Auths.Composition.PlanExamples.mixedBranch Auths.Composition.PlanExamples.events\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.KOfN 2#u16 Auths.Composition.PlanExamples.threeMembers))\n Auths.Composition.ValidationExamples.limits 0 [] =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok\n (auths_composition.BranchOutcome.Indeterminate\n auths_composition.auths_model.Requirement.ExternalFactUnavailable),\n 3,\n Auths.Composition.PlanExamples.mixedLeaves ++\n [auths_composition.EvaluationEvent.Aggregate 3#usize 2#u16 1#usize 1#usize\n (auths_composition.BranchOutcome.Indeterminate\n auths_composition.auths_model.Requirement.ExternalFactUnavailable)])", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAppend.hAppend", + "LE.le", + "List.cons", + "List.instAppend", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Indeterminate", + "auths_composition.EvaluationEvent.Aggregate", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Composition.PlanExamples.events", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.PlanExamples.mixedLeaves", + "Auths.Composition.PlanExamples.threeMembers", + "Auths.Composition.ValidationExamples.limits", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.KOfN", + "auths_composition.auths_model.Requirement.ExternalFactUnavailable", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.narrow_refused", + "statement": "auths_composition.evaluate_observed Auths.Composition.PlanExamples.branch Auths.Composition.PlanExamples.observer\n Auths.Composition.PlanExamples.twoLeaves Auths.Composition.ValidationExamples.narrow 5 9 =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid, 5, 9)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.PlanExamples.observer", + "Auths.Composition.PlanExamples.twoLeaves", + "Auths.Composition.ValidationExamples.narrow", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.ValidationExamples", + "name": "Auths.Composition.ValidationExamples.shallow_refused", + "statement": "auths_composition.evaluate_observed Auths.Composition.PlanExamples.branch Auths.Composition.PlanExamples.observer\n Auths.Composition.PlanExamples.twoLeaves Auths.Composition.ValidationExamples.shallow 5 9 =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Err auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid, 5, 9)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate_observed", + "Aeneas.Std.Result", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.PlanExamples.observer", + "Auths.Composition.PlanExamples.twoLeaves", + "Auths.Composition.ValidationExamples.shallow", + "auths_composition.auths_model.DenialReason.AuthorizationPlanInvalid", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Bounds", + "name": "Auths.Composition.Bounds.node_bound", + "statement": "∀ {R : Type} (plan : Auths.Composition.PlanModel.Plan R), Auths.Composition.Bounds.NodeBound plan", + "statement_constants": [ + "Auths.Composition.Bounds.NodeBound", + "Auths.Composition.PlanModel.Plan" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Bounds", + "name": "Auths.Composition.Bounds.bounded_events", + "statement": "∀ {R : Type} (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.Bounds.proper plan →\n Auths.Composition.Bounds.depth plan ≤ 16 →\n (Auths.Composition.Work.leaves plan).length ≤ 128 → Auths.Composition.Work.nodes plan ≤ 2048", + "statement_constants": [ + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Auths.Composition.Bounds.depth", + "Auths.Composition.Bounds.proper", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.Work.leaves", + "Auths.Composition.Work.nodes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Bounds", + "name": "Auths.Composition.Bounds.source_bounded_events", + "statement": "∀ {B : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (nativeObserver : Aeneas.Std.core.ops.function.FnMut ℕ auths_composition.EvaluationEvent Unit)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n (∀ (count : ℕ) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut count event = Aeneas.Std.Result.ok ((), count + 1)) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan) (state : B) (count : ℕ),\n Auths.Composition.Bounds.proper (Auths.Composition.PlanModel.viewPlan plan) →\n Auths.Composition.Bounds.depth (Auths.Composition.PlanModel.viewPlan plan) ≤ 16 →\n (Auths.Composition.Work.leaves (Auths.Composition.PlanModel.viewPlan plan)).length ≤ 128 →\n ∃ outcome next finalCount,\n auths_composition.evaluate_node nativeBranch nativeObserver plan state count =\n Aeneas.Std.Result.ok (outcome, next, finalCount) ∧\n finalCount ≤ count + 2048", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Nat", + "Prod", + "Unit", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.mk", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.Bounds.depth", + "Auths.Composition.Bounds.proper", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.Work.leaves", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Support.PositiveVec", + "name": "auths_composition.alloc.vec.Vec.toBase_ofBase", + "statement": "∀ {α : Type u} (value : Aeneas.Std.alloc.vec.Vec α), (auths_composition.alloc.vec.Vec.ofBase value).toBase = value", + "statement_constants": [ + "Eq", + "Aeneas.Std.alloc.vec.Vec", + "auths_composition.alloc.vec.Vec.ofBase", + "auths_composition.alloc.vec.Vec.toBase" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Support.PositiveVec", + "name": "auths_composition.alloc.vec.Vec.ofBase_toBase", + "statement": "∀ {α : Type u} (value : auths_composition.alloc.vec.Vec α), auths_composition.alloc.vec.Vec.ofBase value.toBase = value", + "statement_constants": [ + "Eq", + "auths_composition.alloc.vec.Vec", + "auths_composition.alloc.vec.Vec.ofBase", + "auths_composition.alloc.vec.Vec.toBase" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Support.PositiveVec", + "name": "auths_composition.alloc.vec.Vec.toBase_injective", + "statement": "∀ {α : Type u} (left right : auths_composition.alloc.vec.Vec α), left.toBase = right.toBase → left = right", + "statement_constants": [ + "Eq", + "auths_composition.alloc.vec.Vec", + "Aeneas.Std.alloc.vec.Vec", + "auths_composition.alloc.vec.Vec.toBase" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Support.PositiveVec", + "name": "auths_composition.alloc.vec.Vec.deref_exact", + "statement": "∀ {α : Type} (value : auths_composition.alloc.vec.Vec α), ↑value.deref = value.elements.toList", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Usize.max", + "auths_composition.alloc.vec.Vec", + "auths_composition.alloc.vec.SizedList.toList", + "auths_composition.alloc.vec.Vec.deref", + "auths_composition.alloc.vec.Vec.elements", + "auths_composition.alloc.vec.Vec.size" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Traversal", + "name": "Auths.Composition.Traversal.evaluator_refines", + "statement": "∀ {B O : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (nativeObserver : Aeneas.Std.core.ops.function.FnMut O auths_composition.EvaluationEvent Unit)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B)\n (modelObserver : O → Auths.Composition.PlanModel.Event auths_composition.auths_model.ProofRef → O),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n (∀ (state : O) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut state event =\n Aeneas.Std.Result.ok ((), modelObserver state (Auths.Composition.PlanModel.eventView event))) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan) (branch : B) (observer : O),\n auths_composition.evaluate_node nativeBranch nativeObserver plan branch observer =\n Aeneas.Std.Result.ok\n (Auths.Composition.PlanModel.evaluate modelBranch modelObserver (Auths.Composition.PlanModel.viewPlan plan)\n branch observer)", + "statement_constants": [ + "Eq", + "Prod", + "Unit", + "Prod.mk", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.Event", + "Auths.Composition.PlanModel.evaluate", + "Auths.Composition.PlanModel.eventView", + "Auths.Composition.PlanModel.viewPlan", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Work", + "name": "Auths.Composition.Work.event_count", + "statement": "∀ {R B : Type} (branch : B → R → auths_composition.BranchOutcome × B) (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.Work.NodeCountCorrect branch plan", + "statement_constants": [ + "Prod", + "auths_composition.BranchOutcome", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.Work.NodeCountCorrect" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Work", + "name": "Auths.Composition.Work.leaf_order", + "statement": "∀ {R B : Type} (branch : B → R → auths_composition.BranchOutcome × B) (plan : Auths.Composition.PlanModel.Plan R),\n Auths.Composition.Work.NodeOrderCorrect branch plan", + "statement_constants": [ + "Prod", + "auths_composition.BranchOutcome", + "Auths.Composition.PlanModel.Plan", + "Auths.Composition.Work.NodeOrderCorrect" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Work", + "name": "Auths.Composition.Work.source_event_count", + "statement": "∀ {B : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n ∀ (nativeObserver : Aeneas.Std.core.ops.function.FnMut ℕ auths_composition.EvaluationEvent Unit),\n (∀ (count : ℕ) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut count event = Aeneas.Std.Result.ok ((), count + 1)) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan) (state : B) (count : ℕ),\n ∃ outcome next,\n auths_composition.evaluate_node nativeBranch nativeObserver plan state count =\n Aeneas.Std.Result.ok\n (outcome, next, count + Auths.Composition.Work.nodes (Auths.Composition.PlanModel.viewPlan plan))", + "statement_constants": [ + "Eq", + "Exists", + "Nat", + "Prod", + "Unit", + "instAddNat", + "instHAdd", + "instOfNatNat", + "HAdd.hAdd", + "OfNat.ofNat", + "Prod.mk", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.Work.nodes", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Work", + "name": "Auths.Composition.Work.source_leaf_order", + "statement": "∀ {B : Type}\n (nativeBranch :\n Aeneas.Std.core.ops.function.FnMut B auths_composition.auths_model.ProofRef auths_composition.BranchOutcome)\n (modelBranch : B → auths_composition.auths_model.ProofRef → auths_composition.BranchOutcome × B),\n (∀ (state : B) (reference : auths_composition.auths_model.ProofRef),\n nativeBranch.call_mut state reference = Aeneas.Std.Result.ok (modelBranch state reference)) →\n ∀\n (nativeObserver :\n Aeneas.Std.core.ops.function.FnMut (List auths_composition.auths_model.ProofRef)\n auths_composition.EvaluationEvent Unit),\n (∀ (trace : List auths_composition.auths_model.ProofRef) (event : auths_composition.EvaluationEvent),\n nativeObserver.call_mut trace event =\n Aeneas.Std.Result.ok\n ((), Auths.Composition.Work.recordLeaf trace (Auths.Composition.PlanModel.eventView event))) →\n ∀ (plan : auths_composition.auths_model.AuthorizationPlan) (state : B)\n (trace : List auths_composition.auths_model.ProofRef),\n ∃ outcome next,\n auths_composition.evaluate_node nativeBranch nativeObserver plan state trace =\n Aeneas.Std.Result.ok\n (outcome, next, trace ++ Auths.Composition.Work.leaves (Auths.Composition.PlanModel.viewPlan plan))", + "statement_constants": [ + "Eq", + "Exists", + "List", + "Prod", + "Unit", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "Prod.mk", + "Unit.unit", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.auths_model.AuthorizationPlan", + "auths_composition.auths_model.ProofRef", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanModel.eventView", + "Auths.Composition.PlanModel.viewPlan", + "Auths.Composition.Work.leaves", + "Auths.Composition.Work.recordLeaf", + "Aeneas.Std.core.ops.function.FnMut", + "Aeneas.Std.core.ops.function.FnMut.call_mut" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.PlanExamples", + "name": "Auths.Composition.PlanExamples.two_leaf_conjunction", + "statement": "auths_composition.evaluate_node Auths.Composition.PlanExamples.branch Auths.Composition.PlanExamples.observer\n Auths.Composition.PlanExamples.twoLeaves 0 0 =\n Aeneas.Std.Result.ok (auths_composition.BranchOutcome.Authorized, 2, 3)", + "statement_constants": [ + "Eq", + "Nat", + "Prod", + "instOfNatNat", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "Aeneas.Std.Result.ok", + "Auths.Composition.PlanExamples.branch", + "Auths.Composition.PlanExamples.observer", + "Auths.Composition.PlanExamples.twoLeaves" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.PlanExamples", + "name": "Auths.Composition.PlanExamples.all_visits_after_denial", + "statement": "auths_composition.evaluate_node Auths.Composition.PlanExamples.mixedBranch Auths.Composition.PlanExamples.events\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.AllOf Auths.Composition.PlanExamples.threeMembers))\n 0 [] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.PermissionNotGranted, 3,\n Auths.Composition.PlanExamples.mixedLeaves ++\n [auths_composition.EvaluationEvent.Aggregate 3#usize 3#u16 1#usize 1#usize\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.PermissionNotGranted)])", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAppend.hAppend", + "LE.le", + "List.cons", + "List.instAppend", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Denied", + "auths_composition.EvaluationEvent.Aggregate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Composition.PlanExamples.events", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.PlanExamples.mixedLeaves", + "Auths.Composition.PlanExamples.threeMembers", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.AllOf", + "auths_composition.auths_model.DenialReason.PermissionNotGranted" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.PlanExamples", + "name": "Auths.Composition.PlanExamples.any_visits_after_authorization", + "statement": "auths_composition.evaluate_node Auths.Composition.PlanExamples.mixedBranch Auths.Composition.PlanExamples.events\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.AnyOf Auths.Composition.PlanExamples.threeMembers))\n 0 [] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Authorized, 3,\n Auths.Composition.PlanExamples.mixedLeaves ++\n [auths_composition.EvaluationEvent.Aggregate 3#usize 1#u16 1#usize 1#usize\n auths_composition.BranchOutcome.Authorized])", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAppend.hAppend", + "LE.le", + "List.cons", + "List.instAppend", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.EvaluationEvent.Aggregate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Composition.PlanExamples.events", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.PlanExamples.mixedLeaves", + "Auths.Composition.PlanExamples.threeMembers", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.AnyOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.PlanExamples", + "name": "Auths.Composition.PlanExamples.threshold_indeterminate", + "statement": "auths_composition.evaluate_node Auths.Composition.PlanExamples.mixedBranch Auths.Composition.PlanExamples.events\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.KOfN 2#u16 Auths.Composition.PlanExamples.threeMembers))\n 0 [] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.ExternalFactUnavailable, 3,\n Auths.Composition.PlanExamples.mixedLeaves ++\n [auths_composition.EvaluationEvent.Aggregate 3#usize 2#u16 1#usize 1#usize\n (auths_composition.BranchOutcome.Indeterminate\n auths_composition.auths_model.Requirement.ExternalFactUnavailable)])", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAppend.hAppend", + "LE.le", + "List.cons", + "List.instAppend", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Indeterminate", + "auths_composition.EvaluationEvent.Aggregate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Composition.PlanExamples.events", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.PlanExamples.mixedLeaves", + "Auths.Composition.PlanExamples.threeMembers", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.KOfN", + "auths_composition.auths_model.Requirement.ExternalFactUnavailable" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.PlanExamples", + "name": "Auths.Composition.PlanExamples.threshold_refused", + "statement": "auths_composition.evaluate_node Auths.Composition.PlanExamples.mixedBranch Auths.Composition.PlanExamples.events\n (auths_composition.auths_model.AuthorizationPlan.mk\n (auths_composition.auths_model.AuthorizationPlanNode.KOfN 3#u16 Auths.Composition.PlanExamples.threeMembers))\n 0 [] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.PermissionNotGranted, 3,\n Auths.Composition.PlanExamples.mixedLeaves ++\n [auths_composition.EvaluationEvent.Aggregate 3#usize 3#u16 1#usize 1#usize\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.PermissionNotGranted)])", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAppend.hAppend", + "LE.le", + "List.cons", + "List.instAppend", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "Prod.mk", + "auths_composition.BranchOutcome", + "auths_composition.EvaluationEvent", + "auths_composition.evaluate_node", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Denied", + "auths_composition.EvaluationEvent.Aggregate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Composition.PlanExamples.events", + "Auths.Composition.PlanExamples.mixedBranch", + "Auths.Composition.PlanExamples.mixedLeaves", + "Auths.Composition.PlanExamples.threeMembers", + "auths_composition.auths_model.AuthorizationPlan.mk", + "auths_composition.auths_model.AuthorizationPlanNode.KOfN", + "auths_composition.auths_model.DenialReason.PermissionNotGranted" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.least_none_iff_empty", + "statement": "∀ {α : Type} (rank : α → ℕ) (inputs : List α) (selected : Option α),\n Auths.Composition.Model.Least rank inputs selected → (selected = none ↔ inputs = [])", + "statement_constants": [ + "Eq", + "Iff", + "List", + "Nat", + "Option", + "List.nil", + "Option.none", + "Auths.Composition.Model.Least" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.all_children_authorize_iff", + "statement": "∀ (outcomes : List auths_composition.BranchOutcome),\n Auths.Composition.Model.allOutcome (Auths.Composition.Model.summarize outcomes) =\n auths_composition.BranchOutcome.Authorized ↔\n ∀ outcome ∈ outcomes, outcome = auths_composition.BranchOutcome.Authorized", + "statement_constants": [ + "Eq", + "Iff", + "List", + "List.instMembership", + "Membership.mem", + "auths_composition.BranchOutcome", + "auths_composition.BranchOutcome.Authorized", + "Auths.Composition.Model.allOutcome", + "Auths.Composition.Model.summarize" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.threshold_children_authorize_iff", + "statement": "∀ (required : ℕ) (outcomes : List auths_composition.BranchOutcome),\n Auths.Composition.Model.thresholdOutcome required (Auths.Composition.Model.summarize outcomes) =\n auths_composition.BranchOutcome.Authorized ↔\n required ≤ Auths.Composition.Model.authorizedCount outcomes", + "statement_constants": [ + "Eq", + "Iff", + "List", + "Nat", + "instLENat", + "LE.le", + "auths_composition.BranchOutcome", + "auths_composition.BranchOutcome.Authorized", + "Auths.Composition.Model.authorizedCount", + "Auths.Composition.Model.summarize", + "Auths.Composition.Model.thresholdOutcome" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Composition.Diagnostics", + "name": "Auths.Composition.Model.denial_rank_lexical", + "statement": "∀ (left right : auths_composition.auths_model.DenialReason),\n Auths.Composition.Model.denialRank left < Auths.Composition.Model.denialRank right ↔\n List.Lex (fun x1 x2 => x1 < x2) (Auths.Composition.Model.denialCode left) (Auths.Composition.Model.denialCode right)", + "statement_constants": [ + "Iff", + "Nat", + "instLTNat", + "LT.lt", + "List.Lex", + "auths_composition.auths_model.DenialReason", + "Auths.Composition.Model.denialCode", + "Auths.Composition.Model.denialRank" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Composition.Diagnostics", + "name": "Auths.Composition.Model.requirement_rank_lexical", + "statement": "∀ (left right : auths_composition.auths_model.Requirement),\n Auths.Composition.Model.requirementRank left < Auths.Composition.Model.requirementRank right ↔\n List.Lex (fun x1 x2 => x1 < x2) (Auths.Composition.Model.requirementCode left)\n (Auths.Composition.Model.requirementCode right)", + "statement_constants": [ + "Iff", + "Nat", + "instLTNat", + "LT.lt", + "List.Lex", + "auths_composition.auths_model.Requirement", + "Auths.Composition.Model.requirementCode", + "Auths.Composition.Model.requirementRank" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.retain_minimum_least", + "statement": "∀ {α : Type} (rank : α → ℕ) (inputs : List α) (previous : Option α) (candidate : α),\n Auths.Composition.Model.Least rank inputs previous →\n Auths.Composition.Model.Least rank (inputs ++ [candidate])\n (Auths.Composition.Model.retainMinimum rank previous candidate)", + "statement_constants": [ + "List", + "Nat", + "Option", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.nil", + "Auths.Composition.Model.Least", + "Auths.Composition.Model.retainMinimum" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.record_matches", + "statement": "∀ (state : Auths.Composition.Model.Summary) (outcomes : List auths_composition.BranchOutcome)\n (outcome : auths_composition.BranchOutcome),\n Auths.Composition.Model.Matches state outcomes →\n Auths.Composition.Model.Matches (Auths.Composition.Model.record state outcome) (outcomes ++ [outcome])", + "statement_constants": [ + "List", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.nil", + "auths_composition.BranchOutcome", + "Auths.Composition.Model.Matches", + "Auths.Composition.Model.Summary", + "Auths.Composition.Model.record" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.summarize_matches", + "statement": "∀ (outcomes : List auths_composition.BranchOutcome),\n Auths.Composition.Model.Matches (Auths.Composition.Model.summarize outcomes) outcomes", + "statement_constants": [ + "List", + "auths_composition.BranchOutcome", + "Auths.Composition.Model.Matches", + "Auths.Composition.Model.summarize" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.threshold_authorized_iff", + "statement": "∀ (required : ℕ) (state : Auths.Composition.Model.Summary),\n Auths.Composition.Model.thresholdOutcome required state = auths_composition.BranchOutcome.Authorized ↔\n required ≤ state.authorized", + "statement_constants": [ + "Eq", + "Iff", + "Nat", + "instLENat", + "LE.le", + "auths_composition.BranchOutcome", + "auths_composition.BranchOutcome.Authorized", + "Auths.Composition.Model.Summary", + "Auths.Composition.Model.thresholdOutcome", + "Auths.Composition.Model.Summary.authorized" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition.Model", + "name": "Auths.Composition.Model.all_authorized_iff", + "statement": "∀ (state : Auths.Composition.Model.Summary),\n Auths.Composition.Model.allOutcome state = auths_composition.BranchOutcome.Authorized ↔\n state.denial = none ∧ state.requirement = none", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Option", + "Option.none", + "auths_composition.BranchOutcome", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.auths_model.DenialReason", + "auths_composition.auths_model.Requirement", + "Auths.Composition.Model.Summary", + "Auths.Composition.Model.allOutcome", + "Auths.Composition.Model.Summary.denial", + "Auths.Composition.Model.Summary.requirement" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.denial_order_exact", + "statement": "∀ (value : auths_composition.auths_model.DenialReason),\n Aeneas.Std.WP.spec value.code_order fun result => ↑result = Auths.Composition.Model.denialRank value", + "statement_constants": [ + "Eq", + "Nat", + "Aeneas.Std.U8", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.WP.spec", + "Auths.Composition.Model.denialRank", + "auths_composition.auths_model.DenialReason.code_order" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.denial_precedes_exact", + "statement": "∀ (left right : auths_composition.auths_model.DenialReason),\n Aeneas.Std.WP.spec (left.code_precedes right) fun result =>\n result = decide (Auths.Composition.Model.denialRank left < Auths.Composition.Model.denialRank right)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instLTNat", + "Decidable.decide", + "LT.lt", + "Nat.decLt", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.WP.spec", + "Auths.Composition.Model.denialRank", + "auths_composition.auths_model.DenialReason.code_precedes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.requirement_order_exact", + "statement": "∀ (value : auths_composition.auths_model.Requirement),\n Aeneas.Std.WP.spec value.code_order fun result => ↑result = Auths.Composition.Model.requirementRank value", + "statement_constants": [ + "Eq", + "Nat", + "Aeneas.Std.U8", + "auths_composition.auths_model.Requirement", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.WP.spec", + "Auths.Composition.Model.requirementRank", + "auths_composition.auths_model.Requirement.code_order" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.requirement_precedes_exact", + "statement": "∀ (left right : auths_composition.auths_model.Requirement),\n Aeneas.Std.WP.spec (left.code_precedes right) fun result =>\n result = decide (Auths.Composition.Model.requirementRank left < Auths.Composition.Model.requirementRank right)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instLTNat", + "Decidable.decide", + "LT.lt", + "Nat.decLt", + "auths_composition.auths_model.Requirement", + "Aeneas.Std.WP.spec", + "Auths.Composition.Model.requirementRank", + "auths_composition.auths_model.Requirement.code_precedes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.push_exact", + "statement": "∀ (state : auths_composition.summary.Summary) (outcome : auths_composition.BranchOutcome),\n ↑state.authorized + 1 ≤ Aeneas.Std.Usize.max →\n ↑state.indeterminate + 1 ≤ Aeneas.Std.Usize.max →\n Aeneas.Std.WP.spec (auths_composition.summary.push state outcome) fun result =>\n Auths.Composition.Refinement.view result =\n Auths.Composition.Model.record (Auths.Composition.Refinement.view state) outcome", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "auths_composition.summary.Summary", + "auths_composition.summary.push", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Composition.Model.Summary", + "Auths.Composition.Model.record", + "Auths.Composition.Refinement.view", + "auths_composition.summary.Summary.authorized", + "auths_composition.summary.Summary.indeterminate" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.all_exact", + "statement": "∀ (state : auths_composition.summary.Summary),\n auths_composition.summary.all state =\n Aeneas.Std.Result.ok (Auths.Composition.Model.allOutcome (Auths.Composition.Refinement.view state))", + "statement_constants": [ + "Eq", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.summary.Summary", + "auths_composition.summary.all", + "Aeneas.Std.Result.ok", + "Auths.Composition.Model.allOutcome", + "Auths.Composition.Refinement.view" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.saturating_add_exact", + "statement": "∀ (left right : Aeneas.Std.Usize),\n ↑(Aeneas.Std.core.num.Usize.saturating_add left right) = min Aeneas.Std.Usize.max (↑left + ↑right)", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instMinNat", + "HAdd.hAdd", + "Min.min", + "Aeneas.Std.Usize", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.core.num.Usize.saturating_add" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.threshold_exact", + "statement": "∀ (state : auths_composition.summary.Summary) (required : Aeneas.Std.U16),\n auths_composition.summary.threshold state required =\n Aeneas.Std.Result.ok\n (Auths.Composition.Model.thresholdOutcome (↑required) (Auths.Composition.Refinement.view state))", + "statement_constants": [ + "Eq", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "Aeneas.Std.U16", + "auths_composition.summary.Summary", + "auths_composition.summary.threshold", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Model.thresholdOutcome", + "Auths.Composition.Refinement.view" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.denial_precedes_lexical", + "statement": "∀ (left right : auths_composition.auths_model.DenialReason),\n left.code_precedes right =\n Aeneas.Std.Result.ok\n (decide\n (List.Lex (fun x1 x2 => x1 < x2) (Auths.Composition.Model.denialCode left)\n (Auths.Composition.Model.denialCode right)))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instDecidableEqNat", + "instLTNat", + "Decidable.decide", + "LT.lt", + "List.Lex", + "Nat.decLt", + "Aeneas.Std.Result", + "List.Lex.decidableRel", + "auths_composition.auths_model.DenialReason", + "Aeneas.Std.Result.ok", + "Auths.Composition.Model.denialCode", + "auths_composition.auths_model.DenialReason.code_precedes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.requirement_precedes_lexical", + "statement": "∀ (left right : auths_composition.auths_model.Requirement),\n left.code_precedes right =\n Aeneas.Std.Result.ok\n (decide\n (List.Lex (fun x1 x2 => x1 < x2) (Auths.Composition.Model.requirementCode left)\n (Auths.Composition.Model.requirementCode right)))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instDecidableEqNat", + "instLTNat", + "Decidable.decide", + "LT.lt", + "List.Lex", + "Nat.decLt", + "Aeneas.Std.Result", + "List.Lex.decidableRel", + "auths_composition.auths_model.Requirement", + "Aeneas.Std.Result.ok", + "Auths.Composition.Model.requirementCode", + "auths_composition.auths_model.Requirement.code_precedes" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.threshold_authorized_exact", + "statement": "∀ (state : auths_composition.summary.Summary) (required : Aeneas.Std.U16),\n auths_composition.summary.threshold state required = Aeneas.Std.Result.ok auths_composition.BranchOutcome.Authorized ↔\n ↑required ≤ ↑state.authorized", + "statement_constants": [ + "Eq", + "Iff", + "Nat", + "instLENat", + "LE.le", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "Aeneas.Std.U16", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.summary.Summary", + "auths_composition.summary.threshold", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "auths_composition.summary.Summary.authorized" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Refinement", + "name": "Auths.Composition.Refinement.source_fold_exact", + "statement": "∀ (state : auths_composition.summary.Summary) (outcomes : List auths_composition.BranchOutcome),\n ↑state.authorized + outcomes.length ≤ Aeneas.Std.Usize.max →\n ↑state.indeterminate + outcomes.length ≤ Aeneas.Std.Usize.max →\n Aeneas.Std.WP.spec (Auths.Composition.Refinement.sourceFold state outcomes) fun result =>\n Auths.Composition.Refinement.view result =\n List.foldl Auths.Composition.Model.record (Auths.Composition.Refinement.view state) outcomes", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "HAdd.hAdd", + "LE.le", + "List.foldl", + "List.length", + "auths_composition.BranchOutcome", + "auths_composition.summary.Summary", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Composition.Model.Summary", + "Auths.Composition.Model.record", + "Auths.Composition.Refinement.sourceFold", + "Auths.Composition.Refinement.view", + "auths_composition.summary.Summary.authorized", + "auths_composition.summary.Summary.indeterminate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.all_positive", + "statement": "Auths.Composition.Examples.decideChildren true 2#u16\n [auths_composition.BranchOutcome.Authorized, auths_composition.BranchOutcome.Authorized] =\n Aeneas.Std.Result.ok auths_composition.BranchOutcome.Authorized", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.all_denial_before_missing", + "statement": "Auths.Composition.Examples.decideChildren true 2#u16\n [auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus,\n auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Denied", + "auths_composition.BranchOutcome.Indeterminate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.InvalidSignature", + "auths_composition.auths_model.Requirement.StaleStatus" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.all_smallest_code", + "statement": "Auths.Composition.Examples.decideChildren true 3#u16\n [auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature,\n auths_composition.BranchOutcome.StructurallyInvalid auths_composition.auths_model.DenialReason.ActionBodyMismatch,\n auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.MissingReference] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.ActionBodyMismatch)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Denied", + "auths_composition.BranchOutcome.StructurallyInvalid", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.ActionBodyMismatch", + "auths_composition.auths_model.DenialReason.InvalidSignature", + "auths_composition.auths_model.DenialReason.MissingReference" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.any_positive_overrides_invalid", + "statement": "Auths.Composition.Examples.decideChildren false 1#u16\n [auths_composition.BranchOutcome.StructurallyInvalid auths_composition.auths_model.DenialReason.MissingReference,\n auths_composition.BranchOutcome.Authorized] =\n Aeneas.Std.Result.ok auths_composition.BranchOutcome.Authorized", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.BranchOutcome.StructurallyInvalid", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.MissingReference" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.any_missing_before_denial", + "statement": "Auths.Composition.Examples.decideChildren false 1#u16\n [auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature,\n auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Denied", + "auths_composition.BranchOutcome.Indeterminate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.InvalidSignature", + "auths_composition.auths_model.Requirement.StaleStatus" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.any_smallest_requirement", + "statement": "Auths.Composition.Examples.decideChildren false 1#u16\n [auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus,\n auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.ApprovalUnavailable] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.ApprovalUnavailable)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Indeterminate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.Requirement.ApprovalUnavailable", + "auths_composition.auths_model.Requirement.StaleStatus" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.threshold_lower_bound", + "statement": "Auths.Composition.Examples.decideChildren false 1#u16\n [auths_composition.BranchOutcome.Authorized,\n auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus,\n auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature] =\n Aeneas.Std.Result.ok auths_composition.BranchOutcome.Authorized", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.BranchOutcome.Denied", + "auths_composition.BranchOutcome.Indeterminate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.InvalidSignature", + "auths_composition.auths_model.Requirement.StaleStatus" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.threshold_reachable", + "statement": "Auths.Composition.Examples.decideChildren false 2#u16\n [auths_composition.BranchOutcome.Authorized,\n auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus,\n auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.BranchOutcome.Denied", + "auths_composition.BranchOutcome.Indeterminate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.InvalidSignature", + "auths_composition.auths_model.Requirement.StaleStatus" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition.Examples", + "name": "Auths.Composition.Examples.threshold_impossible", + "statement": "Auths.Composition.Examples.decideChildren false 3#u16\n [auths_composition.BranchOutcome.Authorized,\n auths_composition.BranchOutcome.Indeterminate auths_composition.auths_model.Requirement.StaleStatus,\n auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature] =\n Aeneas.Std.Result.ok\n (auths_composition.BranchOutcome.Denied auths_composition.auths_model.DenialReason.InvalidSignature)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "auths_composition.BranchOutcome", + "Aeneas.Std.Result", + "auths_composition.BranchOutcome.Authorized", + "auths_composition.BranchOutcome.Denied", + "auths_composition.BranchOutcome.Indeterminate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Auths.Composition.Examples.decideChildren", + "auths_composition.auths_model.DenialReason.InvalidSignature", + "auths_composition.auths_model.Requirement.StaleStatus" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Framing", + "name": "Auths.Crypto.Framing.length_exact", + "statement": "∀ (frame : Auths.Crypto.Framing.Frame),\n (Auths.Crypto.Framing.encode frame).length = 21 + frame.profile.length + frame.statement.length", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instOfNatNat", + "HAdd.hAdd", + "List.length", + "OfNat.ofNat", + "Auths.Crypto.Framing.Frame", + "Auths.Crypto.Framing.encode", + "Auths.Crypto.Framing.Frame.profile", + "Auths.Crypto.Framing.Frame.statement" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Framing", + "name": "Auths.Crypto.Framing.framing_is_unambiguous", + "statement": "∀ (left right : Auths.Crypto.Framing.Frame),\n left.Valid → right.Valid → Auths.Crypto.Framing.encode left = Auths.Crypto.Framing.encode right → left = right", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Auths.Crypto.Framing.Frame", + "Auths.Crypto.Framing.encode", + "Auths.Crypto.Framing.Frame.Valid" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Framing", + "name": "Auths.Crypto.Framing.different_tags_separate", + "statement": "∀ (left right : Auths.Crypto.Framing.Frame),\n left.Valid →\n right.Valid →\n left.objectTag ≠ right.objectTag → Auths.Crypto.Framing.encode left ≠ Auths.Crypto.Framing.encode right", + "statement_constants": [ + "List", + "Nat", + "Ne", + "Auths.Crypto.Framing.Frame", + "Auths.Crypto.Framing.encode", + "Auths.Crypto.Framing.Frame.Valid", + "Auths.Crypto.Framing.Frame.objectTag" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Endian", + "name": "Auths.Crypto.Endian.be16_exact", + "statement": "∀ (value : Aeneas.Std.U16),\n List.map (fun x => ↑x) ↑(Aeneas.Std.core.num.U16.to_be_bytes value) = Auths.Codec.bigEndian 2 ↑value", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "Auths.Codec.bigEndian", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.num.U16.to_be_bytes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Endian", + "name": "Auths.Crypto.Endian.be64_exact", + "statement": "∀ (value : Aeneas.Std.U64),\n List.map (fun x => ↑x) ↑(Aeneas.Std.core.num.U64.to_be_bytes value) = Auths.Codec.bigEndian 8 ↑value", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Auths.Codec.bigEndian", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.core.num.U64.to_be_bytes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Refinement", + "name": "Auths.Crypto.Refinement.signing_preimage_exact", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (statement : Aeneas.Std.Slice Aeneas.Std.U8) (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.signing_preimage kind profile version statement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n List.map (fun x => ↑x) ↑output =\n Auths.Crypto.Framing.encode (Auths.Crypto.Refinement.inputFrame kind profile version statement)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Framing.encode", + "Auths.Crypto.Refinement.inputFrame", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Refinement", + "name": "Auths.Crypto.Refinement.accepted_frame_valid", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (statement : Aeneas.Std.Slice Aeneas.Std.U8) (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.signing_preimage kind profile version statement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n (Auths.Crypto.Refinement.inputFrame kind profile version statement).Valid", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Auths.Crypto.Refinement.inputFrame", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Framing.Frame.Valid", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Refinement", + "name": "Auths.Crypto.Refinement.accepted_preimages_bind_inputs", + "statement": "∀ (leftKind rightKind : auths_codec.hash.ObjectType) (leftProfile rightProfile : Aeneas.Std.Str)\n (leftVersion rightVersion : Aeneas.Std.U16) (leftStatement rightStatement : Aeneas.Std.Slice Aeneas.Std.U8)\n (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.signing_preimage leftKind leftProfile leftVersion leftStatement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok leftOutput) →\n auths_codec.hash.signing_preimage rightKind rightProfile rightVersion rightStatement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rightOutput) →\n ↑leftOutput = ↑rightOutput →\n leftKind = rightKind ∧ leftProfile = rightProfile ∧ leftVersion = rightVersion ∧ leftStatement = rightStatement", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Refinement", + "name": "Auths.Crypto.Refinement.preimage_length_exact", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (statement : Aeneas.Std.Slice Aeneas.Std.U8) (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.signing_preimage kind profile version statement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok output) →\n (↑output).length = 21 + (↑profile).length + (↑statement).length", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Refinement", + "name": "Auths.Crypto.Refinement.object_domains_separate", + "statement": "∀ (leftKind rightKind : auths_codec.hash.ObjectType) (leftProfile rightProfile : Aeneas.Std.Str)\n (leftVersion rightVersion : Aeneas.Std.U16) (leftStatement rightStatement : Aeneas.Std.Slice Aeneas.Std.U8)\n (leftOutput rightOutput : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.hash.signing_preimage leftKind leftProfile leftVersion leftStatement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok leftOutput) →\n auths_codec.hash.signing_preimage rightKind rightProfile rightVersion rightStatement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok rightOutput) →\n leftKind ≠ rightKind → ↑leftOutput ≠ ↑rightOutput", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Ne", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Refinement", + "name": "Auths.Crypto.Refinement.profile_limit_refused", + "statement": "∀ (kind : auths_codec.hash.ObjectType) (profile : Aeneas.Std.Str) (version : Aeneas.Std.U16)\n (statement : Aeneas.Std.Slice Aeneas.Std.U8),\n 65535 < (↑profile).length →\n auths_codec.hash.signing_preimage kind profile version statement =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.error.CodecError", + "auths_codec.hash.ObjectType", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Examples", + "name": "Auths.Crypto.Examples.minimal_preimage_exact", + "statement": "auths_codec.hash.signing_preimage auths_codec.hash.ObjectType.Grant (Aeneas.Std.toStr \"t\" ⋯) 1#u16\n ⟨[1#u8], Auths.Crypto.Examples.minimal_preimage_exact._proof_2⟩ =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok Auths.Crypto.Examples.minimalPreimage)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "ByteArray.size", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "String.toByteArray", + "Subtype.mk", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.toStr", + "auths_codec.error.CodecError", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.U32.max", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Examples.minimalPreimage", + "auths_codec.hash.ObjectType.Grant", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Examples.minimal_preimage_exact._proof_1", + "Auths.Crypto.Examples.minimal_preimage_exact._proof_2", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Crypto.Examples", + "name": "Auths.Crypto.Examples.unicode_preimage_exact", + "statement": "auths_codec.hash.signing_preimage auths_codec.hash.ObjectType.Approval (Aeneas.Std.toStr \"λ\" ⋯) 65535#u16\n ⟨[1#u8], Auths.Crypto.Examples.minimal_preimage_exact._proof_2⟩ =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok Auths.Crypto.Examples.unicodePreimage)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "ByteArray.size", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.cons", + "List.length", + "List.nil", + "Nat.decLe", + "OfNat.ofNat", + "String.toByteArray", + "Subtype.mk", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.toStr", + "auths_codec.error.CodecError", + "auths_codec.hash.signing_preimage", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.U32.max", + "Aeneas.Std.U8.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Auths.Crypto.Examples.unicodePreimage", + "auths_codec.hash.ObjectType.Approval", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Crypto.Examples.minimal_preimage_exact._proof_2", + "Auths.Crypto.Examples.unicode_preimage_exact._proof_1", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.identifier_exact", + "statement": "∀ (value : String) (maximum : Aeneas.Std.Usize) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n auths_codec.auths_model.identifier.bounded_identifier_valid (Aeneas.Std.toStr value bounded) maximum =\n Aeneas.Std.Result.ok (Auths.Codec.Constructors.identifierDecision value ↑maximum)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instLENat", + "ByteArray.size", + "LE.le", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.Usize", + "Aeneas.Std.toStr", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Auths.Codec.Constructors.identifierDecision", + "auths_codec.auths_model.identifier.bounded_identifier_valid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.identifier_decision_valid", + "statement": "∀ (value : String) (maximum : ℕ),\n Auths.Codec.Constructors.identifierDecision value maximum = true ↔\n Auths.Codec.Constructors.IdentifierValid value maximum", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "Nat", + "String", + "Bool.true", + "Auths.Codec.Constructors.IdentifierValid", + "Auths.Codec.Constructors.identifierDecision" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.media_type_parse_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n auths_codec.auths_model.MediaType.parse (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok\n (if Auths.Codec.Constructors.identifierDecision value 128 = true then Aeneas.Std.core.result.Result.Ok value\n else Aeneas.Std.core.result.Result.Err auths_codec.auths_model.ModelError.InvalidMediaType)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instDecidableEqBool", + "instLENat", + "instOfNatNat", + "ite", + "Bool.true", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "auths_codec.auths_model.MediaType", + "auths_codec.auths_model.ModelError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "Auths.Codec.Constructors.identifierDecision", + "auths_codec.auths_model.MediaType.parse", + "auths_codec.auths_model.ModelError.InvalidMediaType", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.profile_id_parse_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n auths_codec.auths_model.ProfileId.parse (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok\n (if Auths.Codec.Constructors.identifierDecision value 128 = true then Aeneas.Std.core.result.Result.Ok value\n else Aeneas.Std.core.result.Result.Err auths_codec.auths_model.ModelError.InvalidProfile)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instDecidableEqBool", + "instLENat", + "instOfNatNat", + "ite", + "Bool.true", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "auths_codec.auths_model.ModelError", + "auths_codec.auths_model.ProfileId", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "Auths.Codec.Constructors.identifierDecision", + "auths_codec.auths_model.ModelError.InvalidProfile", + "auths_codec.auths_model.ProfileId.parse", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.capability_id_parse_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n auths_codec.auths_model.CapabilityId.parse (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok\n (if Auths.Codec.Constructors.identifierDecision value 128 = true then Aeneas.Std.core.result.Result.Ok value\n else Aeneas.Std.core.result.Result.Err auths_codec.auths_model.ModelError.InvalidCapability)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instDecidableEqBool", + "instLENat", + "instOfNatNat", + "ite", + "Bool.true", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "auths_codec.auths_model.CapabilityId", + "auths_codec.auths_model.ModelError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "Auths.Codec.Constructors.identifierDecision", + "auths_codec.auths_model.CapabilityId.parse", + "auths_codec.auths_model.ModelError.InvalidCapability", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.resource_id_parse_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n auths_codec.auths_model.ResourceId.parse (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok\n (if Auths.Codec.Constructors.identifierDecision value 1024 = true then Aeneas.Std.core.result.Result.Ok value\n else Aeneas.Std.core.result.Result.Err auths_codec.auths_model.ModelError.InvalidResource)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instDecidableEqBool", + "instLENat", + "instOfNatNat", + "ite", + "Bool.true", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "auths_codec.auths_model.ModelError", + "auths_codec.auths_model.ResourceId", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "Auths.Codec.Constructors.identifierDecision", + "auths_codec.auths_model.ModelError.InvalidResource", + "auths_codec.auths_model.ResourceId.parse", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.budget_algebra_id_parse_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n auths_codec.auths_model.BudgetAlgebraId.parse (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok\n (if Auths.Codec.Constructors.identifierDecision value 128 = true then Aeneas.Std.core.result.Result.Ok value\n else Aeneas.Std.core.result.Result.Err auths_codec.auths_model.ModelError.InvalidRegistryId)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "String", + "instDecidableEqBool", + "instLENat", + "instOfNatNat", + "ite", + "Bool.true", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "auths_codec.auths_model.BudgetAlgebraId", + "auths_codec.auths_model.ModelError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "Auths.Codec.Constructors.identifierDecision", + "auths_codec.auths_model.BudgetAlgebraId.parse", + "auths_codec.auths_model.ModelError.InvalidRegistryId", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Constructors", + "name": "Auths.Codec.Constructors.canonical_action_new_exact", + "statement": "∀ (profile : auths_codec.auths_model.ProfileRef) (mediaType : auths_codec.auths_model.MediaType)\n (body : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8) (permission : auths_codec.auths_model.Permission)\n (budget : Option auths_codec.auths_model.BudgetCeiling),\n auths_codec.auths_model.CanonicalAction.new profile mediaType body permission budget =\n Aeneas.Std.Result.ok\n (if 0 < (↑body).length ∧ (↑body).length ≤ 8388608 then\n Aeneas.Std.core.result.Result.Ok\n { profile := profile, media_type := mediaType, body := body, permission := permission,\n requested_budget := budget,\n detached_attachments := Aeneas.Std.alloc.vec.Vec.new auths_codec.auths_model.DetachedAttachment }\n else Aeneas.Std.core.result.Result.Err auths_codec.auths_model.ModelError.InvalidCanonicalAction)", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "instDecidableAnd", + "instLENat", + "instLTNat", + "instOfNatNat", + "ite", + "LE.le", + "LT.lt", + "List.length", + "Nat.decLe", + "Nat.decLt", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "auths_codec.auths_model.BudgetCeiling", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.DetachedAttachment", + "auths_codec.auths_model.MediaType", + "auths_codec.auths_model.ModelError", + "auths_codec.auths_model.Permission", + "auths_codec.auths_model.ProfileRef", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "auths_codec.auths_model.CanonicalAction.mk", + "auths_codec.auths_model.CanonicalAction.new", + "auths_codec.auths_model.ModelError.InvalidCanonicalAction", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.alloc.vec.Vec.new", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.ByteFields", + "name": "Auths.Codec.Action.bounded_bytes_valid", + "statement": "∀ (decoder next : auths_codec.cbor.Decoder) (maximum : Aeneas.Std.Usize) (nonEmpty : Bool)\n (bytes : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8),\n auths_codec.decode.bounded_bytes decoder maximum nonEmpty =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok bytes, next) →\n (↑bytes).length ≤ ↑maximum ∧ (nonEmpty = true → 0 < (↑bytes).length)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "instLENat", + "instLTNat", + "instOfNatNat", + "Bool.true", + "LE.le", + "LT.lt", + "List.length", + "OfNat.ofNat", + "Prod.mk", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.cbor.Decoder", + "auths_codec.decode.bounded_bytes", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.ActionValidity", + "name": "Auths.Codec.Action.decoded_body_valid", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (limits : auths_codec.auths_model.VerifierLimits)\n (action : auths_codec.auths_model.CanonicalAction),\n auths_codec.decode.decode_canonical_action input limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok action) →\n 0 < (↑action.body).length ∧ (↑action.body).length ≤ 8388608", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.VerifierLimits", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "auths_codec.auths_model.CanonicalAction.body", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.ActionValidity", + "name": "Auths.Codec.Action.decoded_body_within_deployment", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (limits : auths_codec.auths_model.VerifierLimits)\n (action : auths_codec.auths_model.CanonicalAction),\n auths_codec.decode.decode_canonical_action input limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok action) →\n (↑action.body).length ≤ ↑limits.canonical_body_bytes", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.VerifierLimits", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "auths_codec.auths_model.CanonicalAction.body", + "auths_codec.auths_model.VerifierLimits.canonical_body_bytes", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.minimal_limits_valid", + "statement": "Auths.Codec.Examples.minimalLimits.validate = Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok ())", + "statement_constants": [ + "Eq", + "Unit", + "Unit.unit", + "Aeneas.Std.Result", + "auths_codec.auths_model.ModelError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.minimalLimits", + "auths_codec.auths_model.VerifierLimits.validate", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.minimal_encoding_exact", + "statement": "auths_codec.encode.encode_canonical_action Auths.Codec.Examples.minimalAction =\n Aeneas.Std.Result.ok\n (Aeneas.Std.core.result.Result.Ok\n ⟨↑Auths.Codec.Examples.minimalInput, Auths.Codec.Examples.minimal_encoding_exact._proof_1⟩)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.mk", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.U8", + "auths_codec.encode.encode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Codec.Examples.minimalAction", + "Auths.Codec.Examples.minimalInput", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Codec.Examples.minimal_encoding_exact._proof_1", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.minimal_action_accepted", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.minimalInput Auths.Codec.Examples.minimalLimits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok Auths.Codec.Examples.minimalAction)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.minimalAction", + "Auths.Codec.Examples.minimalInput", + "Auths.Codec.Examples.minimalLimits", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.duplicate_key_refused", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.duplicateKeyInput Auths.Codec.Examples.minimalLimits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.NonCanonical)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.duplicateKeyInput", + "Auths.Codec.Examples.minimalLimits", + "auths_codec.error.CodecError.NonCanonical", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.nonminimal_integer_refused", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.nonminimalIntegerInput\n Auths.Codec.Examples.minimalLimits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.NonCanonical)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.minimalLimits", + "Auths.Codec.Examples.nonminimalIntegerInput", + "auths_codec.error.CodecError.NonCanonical", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.invalid_utf8_refused", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.invalidUtf8Input Auths.Codec.Examples.minimalLimits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.Malformed)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.invalidUtf8Input", + "Auths.Codec.Examples.minimalLimits", + "auths_codec.error.CodecError.Malformed", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.truncated_refused", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.truncatedInput Auths.Codec.Examples.minimalLimits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.Malformed)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.minimalLimits", + "Auths.Codec.Examples.truncatedInput", + "auths_codec.error.CodecError.Malformed", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.trailing_byte_refused", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.trailingByteInput Auths.Codec.Examples.minimalLimits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.Malformed)", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Auths.Codec.Examples.minimalLimits", + "Auths.Codec.Examples.trailingByteInput", + "auths_codec.error.CodecError.Malformed", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.action_byte_limit_refused", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.minimalInput\n (have __src := Auths.Codec.Examples.minimalLimits;\n { bundle_bytes := __src.bundle_bytes, action_bytes := 25#usize, context_bytes := __src.context_bytes,\n grants := __src.grants, actions := __src.actions, plan_leaves := __src.plan_leaves,\n plan_depth := __src.plan_depth, plan_branching := __src.plan_branching, evidence := __src.evidence,\n evidence_bytes := __src.evidence_bytes, bindings := __src.bindings, principal_status := __src.principal_status,\n grant_status := __src.grant_status, attachments := __src.attachments, attachment_bytes := __src.attachment_bytes,\n signatures := __src.signatures, signature_bytes := __src.signature_bytes, permissions := __src.permissions,\n audiences := __src.audiences, extensions := __src.extensions, extension_bytes := __src.extension_bytes,\n body_digests := __src.body_digests, binding_evidence := __src.binding_evidence,\n canonical_body_bytes := __src.canonical_body_bytes, registry_entries := __src.registry_entries,\n trust_anchors := __src.trust_anchors, work_units := __src.work_units, approvals := __src.approvals,\n approver_anchors := __src.approver_anchors, approval_requirements := __src.approval_requirements }) =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.LimitExceeded)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.VerifierLimits", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Codec.Examples.minimalInput", + "Auths.Codec.Examples.minimalLimits", + "auths_codec.auths_model.VerifierLimits.actions", + "auths_codec.auths_model.VerifierLimits.approval_requirements", + "auths_codec.auths_model.VerifierLimits.approvals", + "auths_codec.auths_model.VerifierLimits.approver_anchors", + "auths_codec.auths_model.VerifierLimits.attachment_bytes", + "auths_codec.auths_model.VerifierLimits.attachments", + "auths_codec.auths_model.VerifierLimits.audiences", + "auths_codec.auths_model.VerifierLimits.binding_evidence", + "auths_codec.auths_model.VerifierLimits.bindings", + "auths_codec.auths_model.VerifierLimits.body_digests", + "auths_codec.auths_model.VerifierLimits.bundle_bytes", + "auths_codec.auths_model.VerifierLimits.canonical_body_bytes", + "auths_codec.auths_model.VerifierLimits.context_bytes", + "auths_codec.auths_model.VerifierLimits.evidence", + "auths_codec.auths_model.VerifierLimits.evidence_bytes", + "auths_codec.auths_model.VerifierLimits.extension_bytes", + "auths_codec.auths_model.VerifierLimits.extensions", + "auths_codec.auths_model.VerifierLimits.grant_status", + "auths_codec.auths_model.VerifierLimits.grants", + "auths_codec.auths_model.VerifierLimits.mk", + "auths_codec.auths_model.VerifierLimits.permissions", + "auths_codec.auths_model.VerifierLimits.plan_branching", + "auths_codec.auths_model.VerifierLimits.plan_depth", + "auths_codec.auths_model.VerifierLimits.plan_leaves", + "auths_codec.auths_model.VerifierLimits.principal_status", + "auths_codec.auths_model.VerifierLimits.registry_entries", + "auths_codec.auths_model.VerifierLimits.signature_bytes", + "auths_codec.auths_model.VerifierLimits.signatures", + "auths_codec.auths_model.VerifierLimits.trust_anchors", + "auths_codec.auths_model.VerifierLimits.work_units", + "auths_codec.error.CodecError.LimitExceeded", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Examples", + "name": "Auths.Codec.Examples.action_byte_limit_exact", + "statement": "auths_codec.decode.decode_canonical_action Auths.Codec.Examples.minimalInput\n (have __src := Auths.Codec.Examples.minimalLimits;\n { bundle_bytes := __src.bundle_bytes, action_bytes := 26#usize, context_bytes := __src.context_bytes,\n grants := __src.grants, actions := __src.actions, plan_leaves := __src.plan_leaves,\n plan_depth := __src.plan_depth, plan_branching := __src.plan_branching, evidence := __src.evidence,\n evidence_bytes := __src.evidence_bytes, bindings := __src.bindings, principal_status := __src.principal_status,\n grant_status := __src.grant_status, attachments := __src.attachments, attachment_bytes := __src.attachment_bytes,\n signatures := __src.signatures, signature_bytes := __src.signature_bytes, permissions := __src.permissions,\n audiences := __src.audiences, extensions := __src.extensions, extension_bytes := __src.extension_bytes,\n body_digests := __src.body_digests, binding_evidence := __src.binding_evidence,\n canonical_body_bytes := __src.canonical_body_bytes, registry_entries := __src.registry_entries,\n trust_anchors := __src.trust_anchors, work_units := __src.work_units, approvals := __src.approvals,\n approver_anchors := __src.approver_anchors, approval_requirements := __src.approval_requirements }) =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok Auths.Codec.Examples.minimalAction)", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.Result", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.VerifierLimits", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Auths.Codec.Examples.minimalAction", + "Auths.Codec.Examples.minimalInput", + "Auths.Codec.Examples.minimalLimits", + "auths_codec.auths_model.VerifierLimits.actions", + "auths_codec.auths_model.VerifierLimits.approval_requirements", + "auths_codec.auths_model.VerifierLimits.approvals", + "auths_codec.auths_model.VerifierLimits.approver_anchors", + "auths_codec.auths_model.VerifierLimits.attachment_bytes", + "auths_codec.auths_model.VerifierLimits.attachments", + "auths_codec.auths_model.VerifierLimits.audiences", + "auths_codec.auths_model.VerifierLimits.binding_evidence", + "auths_codec.auths_model.VerifierLimits.bindings", + "auths_codec.auths_model.VerifierLimits.body_digests", + "auths_codec.auths_model.VerifierLimits.bundle_bytes", + "auths_codec.auths_model.VerifierLimits.canonical_body_bytes", + "auths_codec.auths_model.VerifierLimits.context_bytes", + "auths_codec.auths_model.VerifierLimits.evidence", + "auths_codec.auths_model.VerifierLimits.evidence_bytes", + "auths_codec.auths_model.VerifierLimits.extension_bytes", + "auths_codec.auths_model.VerifierLimits.extensions", + "auths_codec.auths_model.VerifierLimits.grant_status", + "auths_codec.auths_model.VerifierLimits.grants", + "auths_codec.auths_model.VerifierLimits.mk", + "auths_codec.auths_model.VerifierLimits.permissions", + "auths_codec.auths_model.VerifierLimits.plan_branching", + "auths_codec.auths_model.VerifierLimits.plan_depth", + "auths_codec.auths_model.VerifierLimits.plan_leaves", + "auths_codec.auths_model.VerifierLimits.principal_status", + "auths_codec.auths_model.VerifierLimits.registry_entries", + "auths_codec.auths_model.VerifierLimits.signature_bytes", + "auths_codec.auths_model.VerifierLimits.signatures", + "auths_codec.auths_model.VerifierLimits.trust_anchors", + "auths_codec.auths_model.VerifierLimits.work_units", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Identifier", + "name": "Auths.Refinement.Identifier.identifier_string_exact", + "statement": "∀ (value : String) (maximum : Aeneas.Std.Usize) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n Aeneas.Std.WP.spec (auths_model.identifier.bounded_identifier_valid (Aeneas.Std.toStr value bounded) maximum)\n fun result =>\n result =\n (!(↑(Aeneas.Std.toStr value bounded)).isEmpty && decide ((↑(Aeneas.Std.toStr value bounded)).length ≤ ↑maximum) &&\n !(List.map Char.toNat value.toList).any fun scalar => decide (Auths.Model.Identifier.excluded scalar))", + "statement_constants": [ + "Bool", + "Char", + "Eq", + "List", + "Nat", + "String", + "instLENat", + "Bool.and", + "Bool.not", + "ByteArray.size", + "Char.toNat", + "Decidable.decide", + "LE.le", + "List.any", + "List.isEmpty", + "List.length", + "List.map", + "Nat.decLe", + "String.toByteArray", + "String.toList", + "Subtype.val", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Aeneas.Std.toStr", + "auths_model.identifier.bounded_identifier_valid", + "Aeneas.Std.U32.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Model.Identifier.excluded", + "Auths.Model.Identifier.instDecidableExcluded" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Action", + "name": "Auths.Codec.Action.decode_encode_exact", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (limits : auths_codec.auths_model.VerifierLimits)\n (action : auths_codec.auths_model.CanonicalAction),\n auths_codec.decode.decode_canonical_action input limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok action) →\n ∃ bytes,\n auths_codec.encode.encode_canonical_action action =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok bytes) ∧\n ↑bytes = ↑input", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.VerifierLimits", + "auths_codec.decode.decode_canonical_action", + "auths_codec.encode.encode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Action", + "name": "Auths.Codec.Action.accepted_encoding_unique", + "statement": "∀ (left right : Aeneas.Std.Slice Aeneas.Std.U8) (limits : auths_codec.auths_model.VerifierLimits)\n (action : auths_codec.auths_model.CanonicalAction),\n auths_codec.decode.decode_canonical_action left limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok action) →\n auths_codec.decode.decode_canonical_action right limits =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok action) →\n ↑left = ↑right", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.auths_model.CanonicalAction", + "auths_codec.auths_model.VerifierLimits", + "auths_codec.decode.decode_canonical_action", + "auths_codec.error.CodecError", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.String", + "name": "Auths.Codec.StringRefinement.string_copy_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n alloc.string.String.Insts.CoreConvertFromShared0Str.from (Aeneas.Std.toStr value bounded) = Aeneas.Std.Result.ok value", + "statement_constants": [ + "Eq", + "Nat", + "String", + "instLENat", + "ByteArray.size", + "LE.le", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.toStr", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "alloc.string.String.Insts.CoreConvertFromShared0Str.from" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.String", + "name": "Auths.Codec.StringRefinement.string_borrow_exact", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n alloc.string.String.Insts.CoreOpsDerefDerefStr.deref value = Aeneas.Std.Result.ok (Aeneas.Std.toStr value bounded)", + "statement_constants": [ + "Eq", + "Nat", + "String", + "instLENat", + "ByteArray.size", + "LE.le", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.Str", + "Aeneas.Std.toStr", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "alloc.string.String.Insts.CoreOpsDerefDerefStr.deref" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.String", + "name": "Auths.Codec.StringRefinement.utf8_accepts_string", + "statement": "∀ (value : String) (bounded : value.toByteArray.size ≤ Aeneas.Std.U32.max),\n core.str.converts.from_utf8 (Aeneas.Std.toStr value bounded) =\n Aeneas.Std.Result.ok (Aeneas.Std.core.result.Result.Ok (Aeneas.Std.toStr value bounded))", + "statement_constants": [ + "Eq", + "Nat", + "String", + "instLENat", + "ByteArray.size", + "LE.le", + "String.toByteArray", + "Aeneas.Std.Result", + "Aeneas.Std.Str", + "Aeneas.Std.toStr", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U32.max", + "core.str.converts.from_utf8", + "core.str.error.Utf8Error", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Model.IdentifierSemantics", + "name": "Auths.Model.Identifier.contains_encoded_scalars", + "statement": "∀ (scalars : List ℕ),\n (∀ scalar ∈ scalars, scalar ≤ 1114111) →\n Auths.Model.Identifier.containsExcluded (List.flatMap Auths.Model.Identifier.utf8 scalars) =\n scalars.any fun scalar => decide (Auths.Model.Identifier.excluded scalar)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "Decidable.decide", + "LE.le", + "List.any", + "List.flatMap", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Model.Identifier.containsExcluded", + "Auths.Model.Identifier.excluded", + "Auths.Model.Identifier.instDecidableExcluded", + "Auths.Model.Identifier.utf8" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Identifier", + "name": "Auths.Refinement.Identifier.forbidden_at_exact", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_model.identifier.forbidden_identifier_at input position) fun result =>\n result = Auths.Refinement.Identifier.excludedPrefix (List.drop ↑position ↑input)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.drop", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_model.identifier.forbidden_identifier_at", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Refinement.Identifier.excludedPrefix" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Identifier", + "name": "Auths.Refinement.Identifier.scan_exact", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_model.identifier.contains_forbidden_identifier_loop input position) fun result =>\n result = Auths.Refinement.Identifier.containsExcluded (List.drop ↑position ↑input)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.drop", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_model.identifier.contains_forbidden_identifier_loop", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Refinement.Identifier.containsExcluded" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Identifier", + "name": "Auths.Refinement.Identifier.identifier_exact", + "statement": "∀ (value : Aeneas.Std.Str) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_model.identifier.bounded_identifier_valid value maximum) fun result =>\n result =\n (!(↑value).isEmpty && decide ((↑value).length ≤ ↑maximum) && !Auths.Refinement.Identifier.containsExcluded ↑value)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Bool.and", + "Bool.not", + "Decidable.decide", + "LE.le", + "List.isEmpty", + "List.length", + "Nat.decLe", + "Subtype.val", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_model.identifier.bounded_identifier_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Refinement.Identifier.containsExcluded" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Identifier", + "name": "Auths.Refinement.Identifier.identifier_unicode_exact", + "statement": "∀ (value : Aeneas.Std.Str) (maximum : Aeneas.Std.Usize) (scalars : List ℕ),\n List.map (fun x => ↑x) ↑value = List.flatMap Auths.Model.Identifier.utf8 scalars →\n (∀ scalar ∈ scalars, scalar ≤ 1114111) →\n Aeneas.Std.WP.spec (auths_model.identifier.bounded_identifier_valid value maximum) fun result =>\n result =\n (!(↑value).isEmpty && decide ((↑value).length ≤ ↑maximum) &&\n !scalars.any fun scalar => decide (Auths.Model.Identifier.excluded scalar))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "Bool.and", + "Bool.not", + "Decidable.decide", + "LE.le", + "List.any", + "List.flatMap", + "List.instMembership", + "List.isEmpty", + "List.length", + "List.map", + "Membership.mem", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_model.identifier.bounded_identifier_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Model.Identifier.excluded", + "Auths.Model.Identifier.instDecidableExcluded", + "Auths.Model.Identifier.utf8" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Encoder", + "name": "Auths.Codec.Refinement.Encoder.append_tail_exact", + "statement": "∀ (output : Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8) (value : Aeneas.Std.U64) (remaining : Aeneas.Std.U8),\n ↑remaining ≤ 8 →\n (↑output).length + ↑remaining ≤ Aeneas.Std.Usize.max →\n Aeneas.Std.WP.spec (auths_codec.cbor.append_tail output value remaining) fun encoded =>\n Auths.Codec.Refinement.byteList ↑encoded =\n Auths.Codec.Refinement.byteList ↑output ++ Auths.Codec.bigEndian ↑remaining ↑value", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "HAppend.hAppend", + "LE.le", + "List.instAppend", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Auths.Codec.bigEndian", + "auths_codec.cbor.append_tail", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Refinement.byteList", + "Aeneas.Std.alloc.vec.Vec" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Encoder", + "name": "Auths.Codec.Refinement.Encoder.encode_head_refines", + "statement": "∀ (major : Aeneas.Std.U8) (argument : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_codec.cbor.encode_head major argument) fun result =>\n Auths.Codec.Refinement.Encoder.EncodingRefines major argument result", + "statement_constants": [ + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Error", + "auths_codec.cbor.encode_head", + "Aeneas.Std.WP.spec", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Codec.Refinement.Encoder.EncodingRefines" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Encoder", + "name": "Auths.Codec.Refinement.Encoder.encode_head_byte_bound", + "statement": "∀ (major : Aeneas.Std.U8) (argument : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_codec.cbor.encode_head major argument) fun result =>\n match result with\n | Aeneas.Std.core.result.Result.Err a => 7 < ↑major\n | Aeneas.Std.core.result.Result.Ok output => 1 ≤ (↑output).length ∧ (↑output).length ≤ 9", + "statement_constants": [ + "And", + "List", + "Nat", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Error", + "auths_codec.cbor.encode_head", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Auths.Codec.Refinement.Encoder.EncodingRefines.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Encoder", + "name": "Auths.Codec.Refinement.Encoder.encode_head_roundtrip", + "statement": "∀ (major : Aeneas.Std.U8) (argument : Aeneas.Std.U64),\n ↑major < 8 →\n Aeneas.Std.WP.spec (auths_codec.cbor.encode_head major argument) fun result =>\n ∃ output,\n result = Aeneas.Std.core.result.Result.Ok output ∧\n ∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize) (tail : List ℕ),\n List.drop (↑position) (Auths.Codec.Refinement.byteList ↑input) =\n Auths.Codec.Refinement.byteList ↑output ++ tail →\n Aeneas.Std.WP.spec (auths_codec.cbor.read_head input position) fun decoded =>\n ∃ head,\n decoded = Aeneas.Std.core.result.Result.Ok head ∧\n Auths.Codec.Refinement.headView head = { major := ↑major, argument := ↑argument } ∧\n List.drop (↑head.next) (Auths.Codec.Refinement.byteList ↑input) = tail ∧\n ↑head.next ≤ (↑input).length", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "instHAppendOfAppend", + "instLENat", + "instLTNat", + "instOfNatNat", + "HAppend.hAppend", + "LE.le", + "LT.lt", + "List.drop", + "List.instAppend", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Auths.Codec.Head", + "auths_codec.cbor.Error", + "auths_codec.cbor.Head", + "auths_codec.cbor.encode_head", + "auths_codec.cbor.read_head", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Head.mk", + "Auths.Codec.Refinement.byteList", + "Auths.Codec.Refinement.headView", + "auths_codec.cbor.Head.next", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.EntryDeadline", + "name": "Auths.Product.EntryDeadline.permits_fold", + "statement": "∀ (bounds : List Auths.Product.EntryDeadline.Bound) (initial : Auths.Product.EntryDeadline.Bound) (now : ℕ),\n Auths.Product.EntryDeadline.permits (List.foldl Auths.Product.EntryDeadline.meet initial bounds) now ↔\n Auths.Product.EntryDeadline.permits initial now ∧ ∀ bound ∈ bounds, Auths.Product.EntryDeadline.permits bound now", + "statement_constants": [ + "And", + "Iff", + "List", + "Nat", + "List.foldl", + "List.instMembership", + "Membership.mem", + "Auths.Product.EntryDeadline.Bound", + "Auths.Product.EntryDeadline.meet", + "Auths.Product.EntryDeadline.permits" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.EntryDeadline", + "name": "Auths.Product.EntryDeadline.exclusive_endpoint_refuses", + "statement": "∀ (evaluatedAt endpoint : ℕ),\n ¬Auths.Product.EntryDeadline.admits evaluatedAt { deadline := endpoint, inclusive := false } endpoint", + "statement_constants": [ + "Nat", + "Not", + "Bool.false", + "Auths.Product.EntryDeadline.admits", + "Auths.Product.EntryDeadline.Bound.mk" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.EntryDeadline", + "name": "Auths.Product.EntryDeadline.inclusive_endpoint_admits", + "statement": "∀ (evaluatedAt endpoint : ℕ),\n evaluatedAt ≤ endpoint →\n Auths.Product.EntryDeadline.admits evaluatedAt { deadline := endpoint, inclusive := true } endpoint", + "statement_constants": [ + "Nat", + "instLENat", + "Bool.true", + "LE.le", + "Auths.Product.EntryDeadline.admits", + "Auths.Product.EntryDeadline.Bound.mk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.EntryDeadline", + "name": "Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model", + "statement": "∀ (evaluatedAt now : Aeneas.Std.U64) (bound : auths_gateway_kernel.deadline.EntryBound),\n auths_gateway_kernel.deadline.entry_time_allows evaluatedAt now bound =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Product.EntryDeadline.admits (↑evaluatedAt) (Auths.Product.Refinement.EntryDeadline.boundView bound)\n ↑now))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_gateway_kernel.deadline.EntryBound", + "auths_gateway_kernel.deadline.entry_time_allows", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.EntryDeadline.admits", + "Auths.Product.EntryDeadline.instDecidableAdmits", + "Auths.Product.Refinement.EntryDeadline.boundView" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.EntryDeadline", + "name": "Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model", + "statement": "∀ (left right : auths_gateway_kernel.deadline.EntryBound),\n Aeneas.Std.WP.spec (auths_gateway_kernel.deadline.intersect_entry_bounds left right) fun result =>\n Auths.Product.Refinement.EntryDeadline.boundView result =\n Auths.Product.EntryDeadline.meet (Auths.Product.Refinement.EntryDeadline.boundView left)\n (Auths.Product.Refinement.EntryDeadline.boundView right)", + "statement_constants": [ + "Eq", + "auths_gateway_kernel.deadline.EntryBound", + "auths_gateway_kernel.deadline.intersect_entry_bounds", + "Aeneas.Std.WP.spec", + "Auths.Product.EntryDeadline.Bound", + "Auths.Product.EntryDeadline.meet", + "Auths.Product.Refinement.EntryDeadline.boundView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.EntryDeadline", + "name": "Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses", + "statement": "∀ (evaluatedAt now : Aeneas.Std.U64) (bound : auths_gateway_kernel.deadline.EntryBound),\n ↑now < ↑evaluatedAt →\n auths_gateway_kernel.deadline.entry_time_allows evaluatedAt now bound = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instLTNat", + "Bool.false", + "LT.lt", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_gateway_kernel.deadline.EntryBound", + "auths_gateway_kernel.deadline.entry_time_allows", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CollectionFence", + "name": "Auths.Product.CollectionFence.collection_cannot_reopen_window", + "statement": "∀ (cutoff expiry : ℕ) {current : Option ℕ},\n Auths.Product.CollectionFence.History (some cutoff) current →\n Auths.Product.CollectionFence.openWindow current expiry → cutoff < expiry", + "statement_constants": [ + "Nat", + "Option", + "instLTNat", + "LT.lt", + "Option.some", + "Auths.Product.CollectionFence.History", + "Auths.Product.CollectionFence.openWindow" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CollectionFence", + "name": "Auths.Product.CollectionFence.swept_window_cannot_readmit", + "statement": "∀ (cutoff expiry : ℕ) {current : Option ℕ},\n Auths.Product.CollectionFence.History (some cutoff) current →\n expiry ≤ cutoff → ¬Auths.Product.CollectionFence.openWindow current expiry", + "statement_constants": [ + "Nat", + "Not", + "Option", + "instLENat", + "LE.le", + "Option.some", + "Auths.Product.CollectionFence.History", + "Auths.Product.CollectionFence.openWindow" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.CollectionFence", + "name": "Auths.Product.CollectionFence.later_window_admits", + "statement": "∀ (cutoff expiry : ℕ), cutoff < expiry → Auths.Product.CollectionFence.openWindow (some cutoff) expiry", + "statement_constants": [ + "Nat", + "instLTNat", + "LT.lt", + "Option.some", + "Auths.Product.CollectionFence.openWindow" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.CollectionFence", + "name": "Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model", + "statement": "∀ (expiry : Aeneas.Std.U64) (current : Option Aeneas.Std.U64),\n auths_stores.gateway_fence.gateway_window_open expiry current =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Product.CollectionFence.openWindow (Auths.Product.Refinement.CollectionFence.cutoffView current)\n ↑expiry))", + "statement_constants": [ + "Bool", + "Eq", + "Option", + "Decidable.decide", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_stores.gateway_fence.gateway_window_open", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.CollectionFence.instDecidableOpenWindow", + "Auths.Product.CollectionFence.openWindow", + "Auths.Product.Refinement.CollectionFence.cutoffView" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.CollectionFence", + "name": "Auths.Product.Refinement.CollectionFence.translated_advance_refines_model", + "statement": "∀ (current : Option Aeneas.Std.U64) (requested : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_stores.gateway_fence.advance_gateway_collection current requested) fun result =>\n ↑result =\n Auths.Product.CollectionFence.advance (Auths.Product.Refinement.CollectionFence.cutoffView current) ↑requested", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Aeneas.Std.U64", + "auths_stores.gateway_fence.advance_gateway_collection", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.Product.CollectionFence.advance", + "Auths.Product.Refinement.CollectionFence.cutoffView" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.CollectionFence", + "name": "Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses", + "statement": "∀ (cutoff : ℕ) (expiry : Aeneas.Std.U64) (current : Option Aeneas.Std.U64),\n Auths.Product.CollectionFence.History (some cutoff) (Auths.Product.Refinement.CollectionFence.cutoffView current) →\n ↑expiry ≤ cutoff → auths_stores.gateway_fence.gateway_window_open expiry current = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Option", + "instLENat", + "Bool.false", + "LE.le", + "Option.some", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_stores.gateway_fence.gateway_window_open", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.CollectionFence.History", + "Auths.Product.Refinement.CollectionFence.cutoffView" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Semantics", + "name": "Auths.Codec.readHead_encodeHead", + "statement": "∀ (head : Auths.Codec.Head),\n head.Valid → ∀ (tail : List ℕ), Auths.Codec.readHead (Auths.Codec.encodeHead head ++ tail) = some (head, tail)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "Option.some", + "Prod.mk", + "Auths.Codec.Head", + "Auths.Codec.encodeHead", + "Auths.Codec.readHead", + "Auths.Codec.Head.Valid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Refinement", + "name": "Auths.Codec.Refinement.read_head_refines", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_codec.cbor.read_head input position) fun result =>\n Auths.Codec.Refinement.HeadRefines input position result", + "statement_constants": [ + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.cbor.Error", + "auths_codec.cbor.Head", + "auths_codec.cbor.read_head", + "Aeneas.Std.WP.spec", + "Auths.Codec.Refinement.HeadRefines", + "Aeneas.Std.core.result.Result" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Refinement", + "name": "Auths.Codec.Refinement.read_tail_bounded", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize) (remaining : Aeneas.Std.U8),\n ↑position ≤ (↑input).length →\n ↑remaining ≤ 8 →\n Aeneas.Std.WP.spec (auths_codec.cbor.read_tail input position remaining 0#u64) fun result =>\n match result with\n | Aeneas.Std.core.result.Result.Err a => (↑input).length < ↑position + ↑remaining\n | Aeneas.Std.core.result.Result.Ok (decoded, next) =>\n ↑position + ↑remaining ≤ (↑input).length ∧\n ↑decoded =\n Auths.Codec.unsigned\n (List.take (↑remaining) (List.drop (↑position) (Auths.Codec.Refinement.byteList ↑input))) ∧\n ↑next = ↑position + ↑remaining", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instAddNat", + "instHAdd", + "instLENat", + "instLTNat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.drop", + "List.length", + "List.take", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Auths.Codec.unsigned", + "auths_codec.cbor.Error", + "auths_codec.cbor.read_tail", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Refinement.byteList", + "Aeneas.Std.core.result.Result", + "Auths.Codec.Refinement.read_tail_safety.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Codec.Refinement", + "name": "Auths.Codec.Refinement.read_head_accepts_encoding", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize) (head : Auths.Codec.Head) (tail : List ℕ),\n head.Valid →\n List.drop (↑position) (Auths.Codec.Refinement.byteList ↑input) = Auths.Codec.encodeHead head ++ tail →\n Aeneas.Std.WP.spec (auths_codec.cbor.read_head input position) fun result =>\n ∃ decoded,\n result = Aeneas.Std.core.result.Result.Ok decoded ∧\n Auths.Codec.Refinement.headView decoded = head ∧\n List.drop (↑decoded.next) (Auths.Codec.Refinement.byteList ↑input) = tail ∧\n ↑decoded.next ≤ (↑input).length", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "instHAppendOfAppend", + "instLENat", + "HAppend.hAppend", + "LE.le", + "List.drop", + "List.instAppend", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "Auths.Codec.Head", + "Auths.Codec.encodeHead", + "auths_codec.cbor.Error", + "auths_codec.cbor.Head", + "auths_codec.cbor.read_head", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Head.Valid", + "Auths.Codec.Refinement.byteList", + "Auths.Codec.Refinement.headView", + "auths_codec.cbor.Head.next", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.finiteSet_subset_refl", + "statement": "∀ {α : Type u} (set : Auths.Rich.FiniteSet α), set ⊆ set", + "statement_constants": [ + "Finset.instHasSubset", + "HasSubset.Subset", + "Auths.Rich.FiniteSet" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.finiteSet_subset_trans", + "statement": "∀ {α : Type u} {a b c : Auths.Rich.FiniteSet α}, a ⊆ b → b ⊆ c → a ⊆ c", + "statement_constants": [ + "Finset.instHasSubset", + "HasSubset.Subset", + "Auths.Rich.FiniteSet" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.finiteSet_subset_antisymm", + "statement": "∀ {α : Type u} {a b : Auths.Rich.FiniteSet α}, a ⊆ b → b ⊆ a → a = b", + "statement_constants": [ + "Eq", + "Finset.instHasSubset", + "HasSubset.Subset", + "Auths.Rich.FiniteSet" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.finiteSet_membership_monotone", + "statement": "∀ {α : Type u} {child parent : Auths.Rich.FiniteSet α} {item : α}, child ⊆ parent → item ∈ child → item ∈ parent", + "statement_constants": [ + "Finset.instHasSubset", + "Finset.instSetLike", + "HasSubset.Subset", + "Membership.mem", + "SetLike.instMembership", + "Auths.Rich.FiniteSet" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.window_contained_refl", + "statement": "∀ (window : Auths.Rich.InclusiveWindow), Auths.Rich.windowContained window window", + "statement_constants": [ + "Auths.Rich.InclusiveWindow", + "Auths.Rich.windowContained" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.window_contained_trans", + "statement": "∀ {a b c : Auths.Rich.InclusiveWindow},\n Auths.Rich.windowContained a b → Auths.Rich.windowContained b c → Auths.Rich.windowContained a c", + "statement_constants": [ + "Auths.Rich.InclusiveWindow", + "Auths.Rich.windowContained" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.window_contained_antisymm", + "statement": "∀ {a b : Auths.Rich.InclusiveWindow}, Auths.Rich.windowContained a b → Auths.Rich.windowContained b a → a = b", + "statement_constants": [ + "Eq", + "Auths.Rich.InclusiveWindow", + "Auths.Rich.windowContained" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.window_coverage_monotone", + "statement": "∀ {action child parent : Auths.Rich.InclusiveWindow},\n Auths.Rich.windowContained child parent →\n Auths.Rich.windowContained action child → Auths.Rich.windowContained action parent", + "statement_constants": [ + "Auths.Rich.InclusiveWindow", + "Auths.Rich.windowContained" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.action_constraint_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} (constraint : Auths.Rich.ActionConstraint v),\n Auths.Rich.actionConstraintLe constraint constraint", + "statement_constants": [ + "Auths.Rich.ActionConstraint", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionConstraintLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.action_constraint_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Auths.Rich.ActionConstraint v},\n Auths.Rich.actionConstraintLe a b → Auths.Rich.actionConstraintLe b c → Auths.Rich.actionConstraintLe a c", + "statement_constants": [ + "Auths.Rich.ActionConstraint", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionConstraintLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.action_constraint_antisymm", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.ActionConstraint v},\n Auths.Rich.actionConstraintLe a b →\n Auths.Rich.actionConstraintLe b a →\n ∀ (digest : Auths.Rich.Digest v),\n Auths.Rich.actionConstraintAllows a digest ↔ Auths.Rich.actionConstraintAllows b digest", + "statement_constants": [ + "Iff", + "Auths.Rich.ActionConstraint", + "Auths.Rich.Digest", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionConstraintAllows", + "Auths.Rich.actionConstraintLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.action_constraint_canonical_antisymm", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.ActionConstraint v},\n Auths.Rich.actionConstraintCanonical a →\n Auths.Rich.actionConstraintCanonical b →\n Auths.Rich.actionConstraintLe a b → Auths.Rich.actionConstraintLe b a → a = b", + "statement_constants": [ + "Eq", + "Auths.Rich.ActionConstraint", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionConstraintCanonical", + "Auths.Rich.actionConstraintLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.action_constraint_allows_monotone", + "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent : Auths.Rich.ActionConstraint v} {digest : Auths.Rich.Digest v},\n Auths.Rich.actionConstraintLe child parent →\n Auths.Rich.actionConstraintAllows child digest → Auths.Rich.actionConstraintAllows parent digest", + "statement_constants": [ + "Auths.Rich.ActionConstraint", + "Auths.Rich.Digest", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionConstraintAllows", + "Auths.Rich.actionConstraintLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.budget_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} (budget : Option (Auths.Rich.BudgetCeiling v)), Auths.Rich.budgetLe budget budget", + "statement_constants": [ + "Option", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.Vocabulary", + "Auths.Rich.budgetLe" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.budget_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Option (Auths.Rich.BudgetCeiling v)},\n Auths.Rich.budgetLe a b → Auths.Rich.budgetLe b c → Auths.Rich.budgetLe a c", + "statement_constants": [ + "Option", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.Vocabulary", + "Auths.Rich.budgetLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.budget_antisymm", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Option (Auths.Rich.BudgetCeiling v)},\n Auths.Rich.budgetLe a b → Auths.Rich.budgetLe b a → a = b", + "statement_constants": [ + "Eq", + "Option", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.Vocabulary", + "Auths.Rich.budgetLe" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.budget_coverage_monotone", + "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent requested : Option (Auths.Rich.BudgetCeiling v)},\n Auths.Rich.budgetLe child parent → Auths.Rich.budgetCovers child requested → Auths.Rich.budgetCovers parent requested", + "statement_constants": [ + "Option", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.Vocabulary", + "Auths.Rich.budgetCovers", + "Auths.Rich.budgetLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.budget_action_coverage_monotone", + "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent requested : Option (Auths.Rich.BudgetCeiling v)}\n {expression : Auths.Rich.BudgetExpression},\n Auths.Rich.budgetLe child parent →\n Auths.Rich.budgetCoversAction child requested expression → Auths.Rich.budgetCoversAction parent requested expression", + "statement_constants": [ + "Option", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.BudgetExpression", + "Auths.Rich.Vocabulary", + "Auths.Rich.budgetCoversAction", + "Auths.Rich.budgetLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.budgetCoversAction_expressible_absent_bounded", + "statement": "∀ {v : Auths.Rich.Vocabulary} (ceiling : Auths.Rich.BudgetCeiling v),\n ¬Auths.Rich.budgetCoversAction (some ceiling) none Auths.Rich.BudgetExpression.expressible", + "statement_constants": [ + "Not", + "Option.none", + "Option.some", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.Vocabulary", + "Auths.Rich.budgetCoversAction", + "Auths.Rich.BudgetExpression.expressible" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ (extensions : Option (Auths.Rich.CriticalExtensions v)), Auths.Rich.extensionsLe extensions extensions", + "statement_constants": [ + "Option", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {a b c : Option (Auths.Rich.CriticalExtensions v)},\n Auths.Rich.extensionsLe a b → Auths.Rich.extensionsLe b c → Auths.Rich.extensionsLe a c", + "statement_constants": [ + "Option", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_pinned_iff", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (child parent : Auths.Rich.CriticalExtensions v),\n Auths.Rich.extensionsLe (some child) (some parent) ↔ Auths.Rich.extensionsAttenuate child parent", + "statement_constants": [ + "Iff", + "Option.some", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsAttenuate", + "Auths.Rich.extensionsLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_false_of_dropped", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.CriticalExtensions v),\n ¬Auths.Rich.extensionsLe none (some parent)", + "statement_constants": [ + "Not", + "Option.none", + "Option.some", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsLe" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_false_of_stripped", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.CriticalExtensions v}\n {entry : Auths.Rich.CriticalExtension v},\n entry ∈ parent.entries →\n (∀ candidate ∈ child.entries, candidate.id ≠ entry.id) → ¬Auths.Rich.extensionsLe (some child) (some parent)", + "statement_constants": [ + "List", + "Ne", + "Not", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Rich.CriticalExtension", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionId", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsLe", + "Auths.Rich.CriticalExtension.id", + "Auths.Rich.CriticalExtensions.entries" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_false_of_refused", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.CriticalExtensions v}\n {childEntry parentEntry : Auths.Rich.CriticalExtension v},\n parentEntry ∈ parent.entries →\n childEntry ∈ child.entries →\n childEntry.id = parentEntry.id →\n ¬Auths.Rich.extensionLawAccepts parentEntry.id (some childEntry.body) (some parentEntry.body) →\n ¬Auths.Rich.extensionsLe (some child) (some parent)", + "statement_constants": [ + "Eq", + "List", + "Not", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Rich.CriticalExtension", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionBody", + "Auths.Rich.ExtensionId", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionLawAccepts", + "Auths.Rich.extensionsLe", + "Auths.Rich.CriticalExtension.body", + "Auths.Rich.CriticalExtension.id", + "Auths.Rich.CriticalExtensions.entries" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_false_of_refused_addition", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.CriticalExtensions v}\n {entry : Auths.Rich.CriticalExtension v},\n entry ∈ child.entries →\n (∀ candidate ∈ parent.entries, candidate.id ≠ entry.id) →\n ¬Auths.Rich.extensionLawAccepts entry.id (some entry.body) none →\n ¬Auths.Rich.extensionsLe (some child) (some parent)", + "statement_constants": [ + "List", + "Ne", + "Not", + "List.instMembership", + "Membership.mem", + "Option.none", + "Option.some", + "Auths.Rich.CriticalExtension", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionBody", + "Auths.Rich.ExtensionId", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionLawAccepts", + "Auths.Rich.extensionsLe", + "Auths.Rich.CriticalExtension.body", + "Auths.Rich.CriticalExtension.id", + "Auths.Rich.CriticalExtensions.entries" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_refuses_a_dropped_singleton", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (extension : Auths.Rich.CriticalExtension v)\n (bodyBounded : v.extensionBodySize extension.body.value ≤ Auths.Rich.hardMaxExtensionBytes),\n ¬Auths.Rich.extensionsLe (some (Auths.Rich.CriticalExtensions.empty v))\n (some (Auths.Rich.CriticalExtensions.singleton extension bodyBounded))", + "statement_constants": [ + "Nat", + "Not", + "instLENat", + "LE.le", + "Option.some", + "Auths.Rich.CriticalExtension", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsLe", + "Auths.Rich.hardMaxExtensionBytes", + "Auths.Rich.CriticalExtension.body", + "Auths.Rich.CriticalExtensions.empty", + "Auths.Rich.CriticalExtensions.singleton", + "Auths.Rich.ExtensionBody.value", + "Auths.Rich.Vocabulary.extensionBodySize" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_le_narrows", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {child parent : Option (Auths.Rich.CriticalExtensions v)},\n Auths.Rich.extensionsLe child parent →\n ∀ {world : Auths.Rich.ExtensionLaws.World v},\n Auths.Rich.extensionsAdmit child world → Auths.Rich.extensionsAdmit parent world", + "statement_constants": [ + "Option", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsAdmit", + "Auths.Rich.extensionsLe", + "Auths.Rich.ExtensionLaws.World" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.status_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} (status : Auths.Rich.StatusPolicy v), Auths.Rich.statusLe status status", + "statement_constants": [ + "Auths.Rich.StatusPolicy", + "Auths.Rich.Vocabulary", + "Auths.Rich.statusLe" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.status_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Auths.Rich.StatusPolicy v},\n Auths.Rich.statusLe a b → Auths.Rich.statusLe b c → Auths.Rich.statusLe a c", + "statement_constants": [ + "Auths.Rich.StatusPolicy", + "Auths.Rich.Vocabulary", + "Auths.Rich.statusLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.status_antisymm", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.StatusPolicy v},\n Auths.Rich.statusLe a b → Auths.Rich.statusLe b a → a = b", + "statement_constants": [ + "Eq", + "Auths.Rich.StatusPolicy", + "Auths.Rich.Vocabulary", + "Auths.Rich.statusLe" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.status_satisfaction_monotone", + "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent : Auths.Rich.StatusPolicy v} {facts : Auths.Rich.EvidenceFacts v},\n Auths.Rich.statusLe child parent → Auths.Rich.statusSatisfied child facts → Auths.Rich.statusSatisfied parent facts", + "statement_constants": [ + "Auths.Rich.EvidenceFacts", + "Auths.Rich.StatusPolicy", + "Auths.Rich.Vocabulary", + "Auths.Rich.statusLe", + "Auths.Rich.statusSatisfied" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.profile_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} (profile : Auths.Rich.ProfileScope v), Auths.Rich.profileLe profile profile", + "statement_constants": [ + "Auths.Rich.ProfileScope", + "Auths.Rich.Vocabulary", + "Auths.Rich.profileLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.profile_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b c : Auths.Rich.ProfileScope v},\n Auths.Rich.profileLe a b → Auths.Rich.profileLe b c → Auths.Rich.profileLe a c", + "statement_constants": [ + "Auths.Rich.ProfileScope", + "Auths.Rich.Vocabulary", + "Auths.Rich.profileLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.profile_antisymm", + "statement": "∀ {v : Auths.Rich.Vocabulary} {a b : Auths.Rich.ProfileScope v},\n Auths.Rich.profileLe a b → Auths.Rich.profileLe b a → a = b", + "statement_constants": [ + "Eq", + "Auths.Rich.ProfileScope", + "Auths.Rich.Vocabulary", + "Auths.Rich.profileLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.profile_coverage_monotone", + "statement": "∀ {v : Auths.Rich.Vocabulary} {child parent : Auths.Rich.ProfileScope v} {profile : Auths.Rich.Profile v},\n Auths.Rich.profileLe child parent → Auths.Rich.profileAllows child profile → Auths.Rich.profileAllows parent profile", + "statement_constants": [ + "Auths.Rich.Profile", + "Auths.Rich.ProfileScope", + "Auths.Rich.Vocabulary", + "Auths.Rich.profileAllows", + "Auths.Rich.profileLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.structural_scope_le_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v → ∀ (scope : Auths.Rich.AuthorityScope v), Auths.Rich.structuralScopeLe scope scope", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.structuralScopeLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.structural_scope_le_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {a b c : Auths.Rich.AuthorityScope v},\n Auths.Rich.structuralScopeLe a b → Auths.Rich.structuralScopeLe b c → Auths.Rich.structuralScopeLe a c", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.structuralScopeLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.scope_le_canonical_antisymmetry", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {a b : Auths.Rich.AuthorityScope v},\n Auths.Rich.actionConstraintCanonical a.actionConstraint →\n Auths.Rich.actionConstraintCanonical b.actionConstraint →\n Auths.Rich.structuralScopeLe a b → Auths.Rich.structuralScopeLe b a → a.extensions = b.extensions → a = b", + "statement_constants": [ + "Eq", + "Option", + "Auths.Rich.AuthorityScope", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionConstraintCanonical", + "Auths.Rich.structuralScopeLe", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.extensions" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.action_coverage_downward_closed", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.AuthorityScope v}\n {action : Auths.Rich.Action v} {expression : Auths.Rich.BudgetExpression},\n Auths.Rich.structuralScopeLe child parent →\n Auths.Rich.actionCovers child action expression → Auths.Rich.actionCovers parent action expression", + "statement_constants": [ + "Auths.Rich.Action", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetExpression", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionCovers", + "Auths.Rich.structuralScopeLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.evidence_requirements_downward_closed", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {child parent : Auths.Rich.AuthorityScope v}\n {facts : Auths.Rich.EvidenceFacts v},\n Auths.Rich.structuralScopeLe child parent →\n Auths.Rich.evidenceRequirementsSatisfied child facts → Auths.Rich.evidenceRequirementsSatisfied parent facts", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.EvidenceFacts", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.evidenceRequirementsSatisfied", + "Auths.Rich.structuralScopeLe" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.complete_admission_downward_closed", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {child parent : Auths.Rich.AuthorityScope v} {facts : Auths.Rich.AuthorizationFacts v},\n Auths.Rich.structuralScopeLe child parent → Auths.Rich.admits child facts → Auths.Rich.admits parent facts", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.AuthorizationFacts", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.admits", + "Auths.Rich.structuralScopeLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.semantic_attenuation_preorder_refl", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (scope : Auths.Rich.AuthorityScope v),\n Auths.Rich.semanticAttenuates scope scope", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.semanticAttenuates" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.semantic_attenuation_preorder_trans", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {a b c : Auths.Rich.AuthorityScope v},\n Auths.Rich.semanticAttenuates a b → Auths.Rich.semanticAttenuates b c → Auths.Rich.semanticAttenuates a c", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.semanticAttenuates" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.structural_scope_le_implies_semantic_attenuation", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {child parent : Auths.Rich.AuthorityScope v},\n Auths.Rich.structuralScopeLe child parent → Auths.Rich.semanticAttenuates child parent", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.semanticAttenuates", + "Auths.Rich.structuralScopeLe" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.scope_semantic_equivalence", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (scope : Auths.Rich.AuthorityScope v),\n Auths.Rich.scopeSemanticEquivalent scope scope", + "statement_constants": [ + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.scopeSemanticEquivalent" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.structural_scope_le_decides_declared_v1_relation", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (child parent : Auths.Rich.AuthorityScope v),\n Auths.Rich.structuralScopeLeDecide child parent = true ↔ Auths.Rich.structuralScopeLe child parent", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "Bool.true", + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.structuralScopeLe", + "Auths.Rich.structuralScopeLeDecide" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_implies_scope_le", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → Auths.Rich.structuralScopeLe child.scope parent.scope", + "statement_constants": [ + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.structuralScopeLe", + "Auths.Rich.ChainState.scope" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_preserves_root", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → child.root = parent.root", + "statement_constants": [ + "Eq", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Principal", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.ChainState.root" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_updates_subject_and_parent", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → child.subject = grant.subject ∧ child.lastGrant = some grantId", + "statement_constants": [ + "And", + "Eq", + "Option", + "Option.some", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Principal", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.ChainState.lastGrant", + "Auths.Rich.ChainState.subject", + "Auths.Rich.Grant.subject" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.anchored_chain_preserves_provenance", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v]\n {trusted : Auths.Rich.FiniteSet (Auths.Rich.Principal v)} {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.AnchoredChain trusted start rest →\n ∀ (state : Auths.Rich.ChainState v),\n state = start ∨ state ∈ rest → state.root = start.root ∧ Auths.Rich.rooted state ∧ state.root ∈ trusted", + "statement_constants": [ + "And", + "Eq", + "List", + "Or", + "Finset.instSetLike", + "List.instMembership", + "Membership.mem", + "SetLike.instMembership", + "Auths.Rich.AnchoredChain", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.FiniteSet", + "Auths.Rich.Principal", + "Auths.Rich.Vocabulary", + "Auths.Rich.rooted", + "Auths.Rich.ChainState.root" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.singleton_context_selects_fresh_self_rooted_start", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (start : Auths.Rich.ChainState v),\n start.root = start.subject → start.lastGrant = none → Auths.Rich.AnchoredChain {start.root} start []", + "statement_constants": [ + "Eq", + "Option", + "Finset.instSingleton", + "List.nil", + "Option.none", + "Singleton.singleton", + "Auths.Rich.AnchoredChain", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.FiniteSet", + "Auths.Rich.GrantId", + "Auths.Rich.Principal", + "Auths.Rich.Vocabulary", + "Auths.Rich.ChainState.lastGrant", + "Auths.Rich.ChainState.root", + "Auths.Rich.ChainState.subject" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Authority", + "name": "Auths.Authority.chain_descends_from_one_root", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v]\n {trusted : Auths.Rich.FiniteSet (Auths.Rich.Principal v)} {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.AnchoredChain trusted start rest →\n ∀ (state : Auths.Rich.ChainState v),\n state = start ∨ state ∈ rest → state.root = start.root ∧ Auths.Rich.rooted state ∧ state.root ∈ trusted", + "statement_constants": [ + "And", + "Eq", + "List", + "Or", + "Finset.instSetLike", + "List.instMembership", + "Membership.mem", + "SetLike.instMembership", + "Auths.Rich.AnchoredChain", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.FiniteSet", + "Auths.Rich.Principal", + "Auths.Rich.Vocabulary", + "Auths.Rich.rooted", + "Auths.Rich.ChainState.root" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_strict_depth", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → child.remainingDepth < parent.remainingDepth", + "statement_constants": [ + "Nat", + "instLTNat", + "LT.lt", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.ChainState.remainingDepth" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_never_widens", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → Auths.Rich.structuralScopeLe child.scope parent.scope", + "statement_constants": [ + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.structuralScopeLe", + "Auths.Rich.ChainState.scope" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.remaining_depth_well_founded", + "statement": "∀ {v : Auths.Rich.Vocabulary}, WellFounded fun child parent => child.remainingDepth < parent.remainingDepth", + "statement_constants": [ + "Nat", + "WellFounded", + "instLTNat", + "LT.lt", + "Auths.Rich.ChainState", + "Auths.Rich.Vocabulary", + "Auths.Rich.ChainState.remainingDepth" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.finite_delegation_chain", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)}, Auths.Rich.DelegationChain start rest → rest.length ≤ start.remainingDepth", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationChain", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.ChainState.remainingDepth" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.chain_transitive_attenuation", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {root middle terminal : Auths.Rich.ChainState v} {firstId secondId : Auths.Rich.GrantId v}\n {firstGrant secondGrant : Auths.Rich.Grant v},\n Auths.Rich.delegates root firstId firstGrant middle →\n Auths.Rich.delegates middle secondId secondGrant terminal →\n Auths.Rich.structuralScopeLe terminal.scope root.scope", + "statement_constants": [ + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.structuralScopeLe", + "Auths.Rich.ChainState.scope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.authorized_action_covered", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v} {action : Auths.Rich.Action v}\n {expression : Auths.Rich.BudgetExpression},\n Auths.Rich.delegates parent grantId grant child →\n Auths.Rich.actionCovers child.scope action expression → Auths.Rich.actionCovers parent.scope action expression", + "statement_constants": [ + "Auths.Rich.Action", + "Auths.Rich.BudgetExpression", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.actionCovers", + "Auths.Rich.delegates", + "Auths.Rich.ChainState.scope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_dimension_is_exact", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v),\n (Auths.Rich.delegationProjection parent grant).value.extensionsAttenuate = true ↔\n Auths.Rich.extensionsLe (some grant.extensions) parent.scope.extensions", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "Bool.true", + "Option.some", + "Auths.Rich.ChainState", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegationProjection", + "Auths.Rich.extensionsLe", + "Auths.Generated.AttenuationProjection.extensionsAttenuate", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.CertifiedProjection.value", + "Auths.Rich.ChainState.scope", + "Auths.Rich.Grant.extensions" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.extensions_dimension_false_of_stripped", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v) (pinned : Auths.Rich.CriticalExtensions v),\n parent.scope.extensions = some pinned →\n ∀ {entry : Auths.Rich.CriticalExtension v},\n entry ∈ pinned.entries →\n (∀ candidate ∈ grant.extensions.entries, candidate.id ≠ entry.id) →\n (Auths.Rich.delegationProjection parent grant).value.extensionsAttenuate = false", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Ne", + "Option", + "Bool.false", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Rich.ChainState", + "Auths.Rich.CriticalExtension", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionId", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegationProjection", + "Auths.Generated.AttenuationProjection.extensionsAttenuate", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.CertifiedProjection.value", + "Auths.Rich.ChainState.scope", + "Auths.Rich.CriticalExtension.id", + "Auths.Rich.CriticalExtensions.entries", + "Auths.Rich.Grant.extensions" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.altered_extensions_deny_every_projection", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v),\n ¬Auths.Rich.extensionsLe (some grant.extensions) parent.scope.extensions →\n Auths.Rich.certifiedAccepts (Auths.Rich.delegationProjection parent grant) = false", + "statement_constants": [ + "Bool", + "Eq", + "Not", + "Bool.false", + "Option.some", + "Auths.Rich.ChainState", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.Vocabulary", + "Auths.Rich.certifiedAccepts", + "Auths.Rich.delegationProjection", + "Auths.Rich.extensionsLe", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.ChainState.scope", + "Auths.Rich.Grant.extensions" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_attenuates_pinned_extensions", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent child : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child →\n ∀ (pinned : Auths.Rich.CriticalExtensions v),\n parent.scope.extensions = some pinned →\n child.scope.extensions = some grant.extensions ∧ Auths.Rich.extensionsAttenuate grant.extensions pinned", + "statement_constants": [ + "And", + "Eq", + "Option", + "Option.some", + "Auths.Rich.ChainState", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.extensionsAttenuate", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.ChainState.scope", + "Auths.Rich.Grant.extensions" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.chain_retains_pinned_extension_identifiers", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {start : Auths.Rich.ChainState v}\n {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.DelegationChain start rest →\n ∀ (pinned : Auths.Rich.CriticalExtensions v),\n start.scope.extensions = some pinned →\n ∀ state ∈ rest,\n ∃ carried, state.scope.extensions = some carried ∧ ∀ entry ∈ pinned.entries, carried.carries entry.id", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Option", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Rich.ChainState", + "Auths.Rich.CriticalExtension", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.DelegationChain", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.ChainState.scope", + "Auths.Rich.CriticalExtension.id", + "Auths.Rich.CriticalExtensions.carries", + "Auths.Rich.CriticalExtensions.entries" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.delegate_never_widens_authority", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {parent child : Auths.Rich.ChainState v} {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v},\n Auths.Rich.delegates parent grantId grant child → Auths.Rich.semanticAttenuates child.scope parent.scope", + "statement_constants": [ + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.semanticAttenuates", + "Auths.Rich.ChainState.scope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.chain_never_widens_authority", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n Auths.Rich.ExtensionLawsNarrow v →\n ∀ {start : Auths.Rich.ChainState v} {rest : List (Auths.Rich.ChainState v)},\n Auths.Rich.DelegationChain start rest → ∀ state ∈ rest, Auths.Rich.semanticAttenuates state.scope start.scope", + "statement_constants": [ + "List", + "List.instMembership", + "Membership.mem", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationChain", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.semanticAttenuates", + "Auths.Rich.ChainState.scope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.rich_projection_accepts_iff_root_and_scope_depth_checks", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grant : Auths.Rich.Grant v),\n Auths.Rich.certifiedAccepts (Auths.Rich.delegationProjection parent grant) = true ↔\n Auths.Rich.rootPreserved parent grant ∧ Auths.Rich.scopeDepthChecks parent grant", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "Bool.true", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.Vocabulary", + "Auths.Rich.certifiedAccepts", + "Auths.Rich.delegationProjection", + "Auths.Rich.rootPreserved", + "Auths.Rich.scopeDepthChecks" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.apply_grant_success_iff_linked_and_projection", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v) (child : Auths.Rich.ChainState v),\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted child ↔\n Auths.Rich.linked parent grant ∧\n Auths.Rich.certifiedAccepts (Auths.Rich.delegationProjection parent grant) = true ∧\n ∃ (checks : Auths.Rich.scopeDepthChecks parent grant),\n child = Auths.Rich.acceptedNextState parent grantId grant checks", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "Iff", + "Bool.true", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.acceptedNextState", + "Auths.Rich.certifiedAccepts", + "Auths.Rich.delegationProjection", + "Auths.Rich.evaluateGrant", + "Auths.Rich.linked", + "Auths.Rich.scopeDepthChecks", + "Auths.Rich.DelegationDecision.accepted" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.apply_grant_success_iff_delegates", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v) (child : Auths.Rich.ChainState v),\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted child ↔\n Auths.Rich.delegates parent grantId grant child", + "statement_constants": [ + "Eq", + "Iff", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.delegates", + "Auths.Rich.evaluateGrant", + "Auths.Rich.DelegationDecision.accepted" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.apply_grant_success_unique", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n {grantId : Auths.Rich.GrantId v} {grant : Auths.Rich.Grant v} {left right : Auths.Rich.ChainState v},\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted left →\n Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted right → left = right", + "statement_constants": [ + "Eq", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateGrant", + "Auths.Rich.DelegationDecision.accepted" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.authority_delegate_diagnostic_sound_complete", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v),\n (∃ child, Auths.Rich.evaluateGrant parent grantId grant = Auths.Rich.DelegationDecision.accepted child) ↔\n Auths.Rich.linked parent grant ∧ Auths.Rich.scopeDepthChecks parent grant", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Iff", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateGrant", + "Auths.Rich.linked", + "Auths.Rich.scopeDepthChecks", + "Auths.Rich.DelegationDecision.accepted" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.authority_delegate_first_failure", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent : Auths.Rich.ChainState v)\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v),\n (Auths.Rich.evaluateGrant parent grantId grant =\n Auths.Rich.DelegationDecision.denied Auths.Rich.DelegationDiagnostic.brokenGrantChain ↔\n ¬Auths.Rich.linked parent grant) ∧\n (Auths.Rich.evaluateGrant parent grantId grant =\n Auths.Rich.DelegationDecision.denied Auths.Rich.DelegationDiagnostic.delegationExpanded ↔\n Auths.Rich.linked parent grant ∧ ¬Auths.Rich.scopeDepthChecks parent grant)", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Not", + "Auths.Rich.ChainState", + "Auths.Rich.DelegationDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateGrant", + "Auths.Rich.linked", + "Auths.Rich.scopeDepthChecks", + "Auths.Rich.DelegationDecision.denied", + "Auths.Rich.DelegationDiagnostic.brokenGrantChain", + "Auths.Rich.DelegationDiagnostic.delegationExpanded" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.author_planning_diagnostic_sound_complete", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] (parent child : Auths.Rich.AuthorityScope v)\n (parentDepth childDepth : ℕ),\n Auths.Rich.evaluateAuthorScope parent child parentDepth childDepth = Auths.Rich.AuthorDecision.accepted ↔\n Auths.Rich.structuralScopeLe child parent ∧ 0 < parentDepth ∧ childDepth < parentDepth", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Nat", + "instLTNat", + "instOfNatNat", + "LT.lt", + "OfNat.ofNat", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.structuralScopeLe", + "Auths.Rich.AuthorDecision.accepted" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.coverage_decision_ok_iff_covers", + "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (authority : Auths.Rich.ChainState v)\n (action : Auths.Rich.Action v) (expression : Auths.Rich.BudgetExpression),\n Auths.Rich.evaluateCoverage authority action expression = Auths.Rich.CoverageDecision.authorized ↔\n Auths.Rich.terminalCovers authority action expression", + "statement_constants": [ + "Eq", + "Iff", + "Auths.Rich.Action", + "Auths.Rich.BudgetExpression", + "Auths.Rich.ChainState", + "Auths.Rich.CoverageDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.terminalCovers", + "Auths.Rich.CoverageDecision.authorized" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.rooted_of_origin", + "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (state : Auths.Rich.ChainState v),\n state.root = state.subject → state.lastGrant = none → Auths.Rich.rooted state", + "statement_constants": [ + "Eq", + "Option", + "Option.none", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.GrantId", + "Auths.Rich.Principal", + "Auths.Rich.Vocabulary", + "Auths.Rich.rooted", + "Auths.Rich.ChainState.lastGrant", + "Auths.Rich.ChainState.root", + "Auths.Rich.ChainState.subject" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.reachable_accepted", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n (grantId : Auths.Rich.GrantId v) (grant : Auths.Rich.Grant v),\n Auths.Rich.ReachableFromRoot parent →\n grant.issuer = parent.subject →\n ∀ (checks : Auths.Rich.scopeDepthChecks parent grant),\n Auths.Rich.ReachableFromRoot (Auths.Rich.acceptedNextState parent grantId grant checks)", + "statement_constants": [ + "Eq", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.GrantId", + "Auths.Rich.Principal", + "Auths.Rich.ReachableFromRoot", + "Auths.Rich.Vocabulary", + "Auths.Rich.acceptedNextState", + "Auths.Rich.scopeDepthChecks", + "Auths.Rich.ChainState.subject", + "Auths.Rich.Grant.issuer" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.rooted_of_reachable", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {state : Auths.Rich.ChainState v},\n Auths.Rich.ReachableFromRoot state → Auths.Rich.rooted state", + "statement_constants": [ + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ReachableFromRoot", + "Auths.Rich.Vocabulary", + "Auths.Rich.rooted" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.registry_coverage_decision_ok_iff_covers", + "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (authority : Auths.Rich.ChainState v)\n (action : Auths.Rich.Action v) (registry : Auths.Rich.BudgetExpressionRegistry v),\n Auths.Rich.evaluateCoverageWithRegistry authority action registry = Auths.Rich.CoverageDecision.authorized ↔\n Auths.Rich.terminalCoversWithRegistry authority action registry", + "statement_constants": [ + "Eq", + "Iff", + "Auths.Rich.Action", + "Auths.Rich.BudgetExpressionRegistry", + "Auths.Rich.ChainState", + "Auths.Rich.CoverageDecision", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateCoverageWithRegistry", + "Auths.Rich.terminalCoversWithRegistry", + "Auths.Rich.CoverageDecision.authorized" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.CertifiedProjection.extensions_not_forgeable", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n {grant : Auths.Rich.Grant v} (certified : Auths.Rich.CertifiedProjection parent grant),\n ¬Auths.Rich.extensionsLe (some grant.extensions) parent.scope.extensions → certified.value.extensionsAttenuate = false", + "statement_constants": [ + "Bool", + "Eq", + "Not", + "Bool.false", + "Option.some", + "Auths.Rich.CertifiedProjection", + "Auths.Rich.ChainState", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionsLe", + "Auths.Generated.AttenuationProjection.extensionsAttenuate", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.CertifiedProjection.value", + "Auths.Rich.ChainState.scope", + "Auths.Rich.Grant.extensions" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.CertifiedProjection.root_not_forgeable", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v] {parent : Auths.Rich.ChainState v}\n {grant : Auths.Rich.Grant v} (certified : Auths.Rich.CertifiedProjection parent grant),\n ¬Auths.Rich.rootPreserved parent grant → certified.value.rootPreserved = false", + "statement_constants": [ + "Bool", + "Eq", + "Not", + "Bool.false", + "Auths.Rich.CertifiedProjection", + "Auths.Rich.ChainState", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Grant", + "Auths.Rich.Vocabulary", + "Auths.Rich.rootPreserved", + "Auths.Generated.AttenuationProjection.rootPreserved", + "Auths.Rich.CertifiedProjection.value" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.validity_start_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 5 10 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 3 10 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.validity", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.validity", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.window" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.validity_end_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 5 10 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions,\n validity := Auths.Rich.Mutations.window✝ 5 12 ⋯, audiences := __src.audiences,\n actionConstraint := __src.actionConstraint, budget := __src.budget, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.validity", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.validity", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.window" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.permission_subset_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := {{ value := 0 }, { value := 1 }}, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := {{ value := 0 }}, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Finset.instInsert", + "Finset.instSingleton", + "Insert.insert", + "OfNat.ofNat", + "Singleton.singleton", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.FiniteSet", + "Auths.Rich.Permission", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.instDecidableEqPermission", + "Auths.Rich.AuthorDecision.accepted", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Permission.mk", + "Auths.Rich.Vocabulary.PermissionCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.audience_subset_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := {{ value := 0 }, { value := 1 }}, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := {{ value := 0 }}, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Finset.instInsert", + "Finset.instSingleton", + "Insert.insert", + "OfNat.ofNat", + "Singleton.singleton", + "Auths.Rich.Audience", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.FiniteSet", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.instDecidableEqAudience", + "Auths.Rich.Audience.mk", + "Auths.Rich.AuthorDecision.accepted", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.AudienceCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.permission_membership_decision", + "statement": "Auths.Rich.evaluateCoverage (Auths.Rich.Mutations.baseState✝ 0 0 2 none) Auths.Rich.Mutations.baseAction✝\n Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.authorized", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.none", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.CoverageDecision", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.BudgetExpression.expressible", + "Auths.Rich.CoverageDecision.authorized", + "Auths.Rich.Mutations.V", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseAction", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.audience_membership_decision", + "statement": "Auths.Rich.evaluateCoverage (Auths.Rich.Mutations.baseState✝ 0 0 2 none) Auths.Rich.Mutations.baseAction✝\n Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.authorized", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.none", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.CoverageDecision", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.BudgetExpression.expressible", + "Auths.Rich.CoverageDecision.authorized", + "Auths.Rich.Mutations.V", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseAction", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.body_digest_membership_decision", + "statement": "Auths.Rich.evaluateCoverage\n (have __src := Auths.Rich.Mutations.baseState✝ 0 0 2 none;\n { root := __src.root, subject := __src.subject,\n scope :=\n have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences,\n actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }}, budget := __src.budget,\n status := __src.status, assurance := __src.assurance, extensions := __src.extensions },\n remainingDepth := __src.remainingDepth, lastGrant := __src.lastGrant })\n Auths.Rich.Mutations.baseAction✝ Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.authorized", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Finset.instSingleton", + "OfNat.ofNat", + "Option.none", + "Singleton.singleton", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.ChainState", + "Auths.Rich.CoverageDecision", + "Auths.Rich.Digest", + "Auths.Rich.FiniteSet", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.ActionConstraint.allowedBodyDigests", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.BudgetExpression.expressible", + "Auths.Rich.ChainState.lastGrant", + "Auths.Rich.ChainState.mk", + "Auths.Rich.ChainState.remainingDepth", + "Auths.Rich.ChainState.root", + "Auths.Rich.ChainState.subject", + "Auths.Rich.CoverageDecision.authorized", + "Auths.Rich.Digest.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Vocabulary.DigestCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseAction", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.body_digest_subset_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences,\n actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }, { value := 1 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Finset.instInsert", + "Finset.instSingleton", + "Insert.insert", + "OfNat.ofNat", + "Singleton.singleton", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.Digest", + "Auths.Rich.FiniteSet", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.instDecidableEqDigest", + "Auths.Rich.ActionConstraint.allowedBodyDigests", + "Auths.Rich.AuthorDecision.accepted", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.Digest.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.DigestCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.action_exact_equality", + "statement": "Auths.Rich.evaluateCoverage\n (have __src := Auths.Rich.Mutations.baseState✝ 0 0 2 none;\n { root := __src.root, subject := __src.subject,\n scope :=\n have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.exactBodyDigest { value := 0 },\n budget := __src.budget, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions },\n remainingDepth := __src.remainingDepth, lastGrant := __src.lastGrant })\n (Auths.Rich.Mutations.baseAction✝ 0 none 0 0 0 1) Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.denied Auths.Rich.CoverageDiagnostic.actionConstraintMismatch", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.none", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.ChainState", + "Auths.Rich.CoverageDecision", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.ActionConstraint.exactBodyDigest", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.BudgetExpression.expressible", + "Auths.Rich.ChainState.lastGrant", + "Auths.Rich.ChainState.mk", + "Auths.Rich.ChainState.remainingDepth", + "Auths.Rich.ChainState.root", + "Auths.Rich.ChainState.subject", + "Auths.Rich.CoverageDecision.denied", + "Auths.Rich.CoverageDiagnostic.actionConstraintMismatch", + "Auths.Rich.Digest.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Vocabulary.DigestCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseAction", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.action_constructor_fallback", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.exactBodyDigest { value := 0 },\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences,\n actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }, { value := 1 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.actionConstraint", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Finset.instInsert", + "Finset.instSingleton", + "Insert.insert", + "OfNat.ofNat", + "Singleton.singleton", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.Digest", + "Auths.Rich.FiniteSet", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.instDecidableEqDigest", + "Auths.Rich.ActionConstraint.allowedBodyDigests", + "Auths.Rich.ActionConstraint.exactBodyDigest", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.Digest.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.DigestCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.action_singleton_exact_rejection", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.exactBodyDigest { value := 0 },\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := Auths.Rich.ActionConstraint.allowedBodyDigests {{ value := 0 }},\n budget := __src.budget, status := __src.status, assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.accepted", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Finset.instSingleton", + "OfNat.ofNat", + "Singleton.singleton", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.Digest", + "Auths.Rich.FiniteSet", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.ActionConstraint.allowedBodyDigests", + "Auths.Rich.ActionConstraint.exactBodyDigest", + "Auths.Rich.AuthorDecision.accepted", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.Digest.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.DigestCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.budget_value_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 3 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.budget", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.some", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.budget", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.BudgetAlgebra.mk", + "Auths.Rich.BudgetCeiling.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.BudgetAlgebraCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.budget_algebra_equality", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 1 }, value := 1 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.budget", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.some", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.budget", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.BudgetAlgebra.mk", + "Auths.Rich.BudgetCeiling.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.BudgetAlgebraCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.optional_budget_bounded_parent", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status, assurance := __src.assurance,\n extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := none, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.budget", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.none", + "Option.some", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.budget", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.BudgetAlgebra.mk", + "Auths.Rich.BudgetCeiling.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.BudgetAlgebraCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.optional_budget_no_request", + "statement": "Auths.Rich.evaluateCoverage\n (have __src := Auths.Rich.Mutations.baseState✝ 0 0 2 none;\n { root := __src.root, subject := __src.subject,\n scope :=\n have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint,\n budget := some { algebra := { value := 0 }, value := 5 }, status := __src.status,\n assurance := __src.assurance, extensions := __src.extensions },\n remainingDepth := __src.remainingDepth, lastGrant := __src.lastGrant })\n Auths.Rich.Mutations.baseAction✝ Auths.Rich.BudgetExpression.expressible =\n Auths.Rich.CoverageDecision.denied Auths.Rich.CoverageDiagnostic.budgetCeilingExceeded", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.none", + "Option.some", + "Auths.Rich.AuthorityScope", + "Auths.Rich.BudgetCeiling", + "Auths.Rich.ChainState", + "Auths.Rich.CoverageDecision", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.BudgetAlgebra.mk", + "Auths.Rich.BudgetCeiling.mk", + "Auths.Rich.BudgetExpression.expressible", + "Auths.Rich.ChainState.lastGrant", + "Auths.Rich.ChainState.mk", + "Auths.Rich.ChainState.remainingDepth", + "Auths.Rich.ChainState.root", + "Auths.Rich.ChainState.subject", + "Auths.Rich.CoverageDecision.denied", + "Auths.Rich.CoverageDiagnostic.budgetCeilingExceeded", + "Auths.Rich.Mutations.V", + "Auths.Rich.Vocabulary.BudgetAlgebraCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseAction", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.delegation_depth_strictness", + "statement": "Auths.Rich.Mutations.delegationDeniedWith✝ Auths.Rich.DelegationDiagnostic.delegationExpanded\n (Auths.Rich.evaluateGrant (Auths.Rich.Mutations.baseState✝ 0 0 3 none) { value := 0 }\n (Auths.Rich.Mutations.baseGrant✝ 0 3)) =\n true", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instOfNatNat", + "Bool.true", + "OfNat.ofNat", + "Option.none", + "Auths.Rich.evaluateGrant", + "Auths.Rich.DelegationDiagnostic.delegationExpanded", + "Auths.Rich.GrantId.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.GrantIdCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseGrant", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.delegationDeniedWith" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.status_age_direction", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 0 } { seconds := 5, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 0 } { seconds := 10, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.status", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLTNat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LT.lt", + "Nat.decLt", + "OfNat.ofNat", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.status", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.FreshnessLimit.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.StatusMethod.mk", + "Auths.Rich.StatusPolicy.snapshotRequired", + "Auths.Rich.Vocabulary.StatusMethodCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.status_method_equality", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 0 } { seconds := 5, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := Auths.Rich.StatusPolicy.snapshotRequired { value := 1 } { seconds := 5, positive := ⋯ },\n assurance := __src.assurance, extensions := __src.extensions })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.status", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLTNat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LT.lt", + "Nat.decLt", + "OfNat.ofNat", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.status", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.extensions", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.FreshnessLimit.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.StatusMethod.mk", + "Auths.Rich.StatusPolicy.snapshotRequired", + "Auths.Rich.Vocabulary.StatusMethodCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.assurance_equality", + "statement": "Auths.Rich.evaluateAuthorScope Auths.Rich.Mutations.baseScope✝ (Auths.Rich.Mutations.baseScope✝ 1) 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.assurance", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Auths.Rich.AuthorDecision", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.assurance", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.critical_extension_law", + "statement": "Auths.Rich.evaluateAuthorScope\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance,\n extensions := some (Auths.Rich.Mutations.singletonExtension✝ 0 0) })\n (have __src := Auths.Rich.Mutations.baseScope✝;\n { profileScope := __src.profileScope, permissions := __src.permissions, validity := __src.validity,\n audiences := __src.audiences, actionConstraint := __src.actionConstraint, budget := __src.budget,\n status := __src.status, assurance := __src.assurance,\n extensions := some (Auths.Rich.Mutations.singletonExtension✝ 0 1) })\n 2 1 =\n Auths.Rich.AuthorDecision.denied Auths.Rich.AuthorDiagnostic.extensions", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Option.some", + "Auths.Rich.AuthorDecision", + "Auths.Rich.AuthorityScope", + "Auths.Rich.CriticalExtensions", + "Auths.Rich.evaluateAuthorScope", + "Auths.Rich.AuthorDecision.denied", + "Auths.Rich.AuthorDiagnostic.extensions", + "Auths.Rich.AuthorityScope.actionConstraint", + "Auths.Rich.AuthorityScope.assurance", + "Auths.Rich.AuthorityScope.audiences", + "Auths.Rich.AuthorityScope.budget", + "Auths.Rich.AuthorityScope.mk", + "Auths.Rich.AuthorityScope.permissions", + "Auths.Rich.AuthorityScope.profileScope", + "Auths.Rich.AuthorityScope.status", + "Auths.Rich.AuthorityScope.validity", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseScope", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.singletonExtension" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.critical_extensions_reversed_not_sorted", + "statement": "¬List.Pairwise Auths.Rich.criticalExtensionLt [Auths.Rich.Mutations.extension✝ 1 0, Auths.Rich.Mutations.extension✝ 0 0]", + "statement_constants": [ + "Nat", + "Not", + "instOfNatNat", + "List.Pairwise", + "List.cons", + "List.nil", + "OfNat.ofNat", + "Auths.Rich.CriticalExtension", + "Auths.Rich.criticalExtensionLt", + "Auths.Rich.Mutations.V", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.extension" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.profile_version_equality", + "statement": "auths_model.profile_ref_equal { id := \"auths.opentofu.saved-plan-apply\", version := 2#u16 }\n { id := \"auths.opentofu.saved-plan-apply\", version := 1#u16 } =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.false", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "auths_model.profile_ref_equal", + "Aeneas.Std.Result", + "auths_model.ProfileRef.mk", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.principal_linkage_equality", + "statement": "Auths.Rich.Mutations.delegationDeniedWith✝ Auths.Rich.DelegationDiagnostic.brokenGrantChain\n (Auths.Rich.evaluateGrant (Auths.Rich.Mutations.baseState✝ 0 0 1 none) { value := 0 }\n (Auths.Rich.Mutations.baseGrant✝ 1)) =\n true", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instOfNatNat", + "Bool.true", + "OfNat.ofNat", + "Option.none", + "Auths.Rich.evaluateGrant", + "Auths.Rich.DelegationDiagnostic.brokenGrantChain", + "Auths.Rich.GrantId.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.GrantIdCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseGrant", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.delegationDeniedWith" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Mutations", + "name": "Auths.Rich.Mutations.grant_linkage_equality", + "statement": "Auths.Rich.Mutations.delegationDeniedWith✝ Auths.Rich.DelegationDiagnostic.brokenGrantChain\n (Auths.Rich.evaluateGrant (Auths.Rich.Mutations.baseState✝ 0 0 1 (some 0)) { value := 2 }\n (Auths.Rich.Mutations.baseGrant✝ 0 0 (some 1))) =\n true", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instOfNatNat", + "Bool.true", + "OfNat.ofNat", + "Option.some", + "Auths.Rich.evaluateGrant", + "Auths.Rich.DelegationDiagnostic.brokenGrantChain", + "Auths.Rich.GrantId.mk", + "Auths.Rich.Mutations.V", + "Auths.Rich.Mutations.instExtensionLawsNatVocabulary", + "Auths.Rich.Vocabulary.GrantIdCarrier", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseGrant", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.baseState", + "_private.Auths.Rich.Mutations.0.Auths.Rich.Mutations.delegationDeniedWith" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Rich.Theorems", + "name": "Auths.Rich.coverage_diagnostic_sound_complete", + "statement": "∀ {v : Auths.Rich.Vocabulary} [Auths.Rich.ExtensionLaws v] (authority : Auths.Rich.ChainState v)\n (action : Auths.Rich.Action v) (expression : Auths.Rich.BudgetExpression),\n (Auths.Rich.evaluateCoverage authority action expression = Auths.Rich.CoverageDecision.authorized ↔\n Auths.Rich.terminalCovers authority action expression) ∧\n ∀ (reason : Auths.Rich.CoverageDiagnostic),\n Auths.Rich.evaluateCoverage authority action expression = Auths.Rich.CoverageDecision.denied reason →\n ¬Auths.Rich.terminalCovers authority action expression", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Not", + "Auths.Rich.Action", + "Auths.Rich.BudgetExpression", + "Auths.Rich.ChainState", + "Auths.Rich.CoverageDecision", + "Auths.Rich.CoverageDiagnostic", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.Vocabulary", + "Auths.Rich.evaluateCoverage", + "Auths.Rich.terminalCovers", + "Auths.Rich.CoverageDecision.authorized", + "Auths.Rich.CoverageDecision.denied" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_rust_refines_rich_spec", + "statement": "∀ {L : Type} (inst : auths_authority.auths_model.CriticalExtensionLaws L) (laws : L)\n [inst_1 : Auths.Rich.ExtensionLaws Auths.Refinement.ProductionVocabulary],\n Auths.Refinement.LawsRefine inst laws Auths.Refinement.productionLaw →\n ∀ (parent child : auths_authority.auths_model.ScopeAuthorityView)\n (parentValid : Auths.Refinement.ScopeAuthorityViewValid parent)\n (childValid : Auths.Refinement.ScopeAuthorityViewValid child),\n Aeneas.Std.WP.spec (auths_authority.evaluate_author_scope_view inst parent child laws) fun result =>\n result = Auths.Refinement.richAuthorScopeDecision parent child parentValid childValid", + "statement_constants": [ + "Eq", + "auths_authority.AuthorScopeDecision", + "auths_authority.evaluate_author_scope_view", + "Auths.Refinement.LawsRefine", + "Auths.Refinement.ProductionVocabulary", + "Auths.Refinement.ScopeAuthorityViewValid", + "Auths.Refinement.productionLaw", + "Auths.Refinement.richAuthorScopeDecision", + "Auths.Rich.ExtensionLaws", + "auths_authority.auths_model.CriticalExtensionLaws", + "auths_authority.auths_model.ScopeAuthorityView", + "Aeneas.Std.WP.spec" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_coverage_refines_rich_spec", + "statement": "∀ (authority : auths_authority.AuthorityStateView) (action : auths_authority.auths_model.ActionAuthorityView)\n (authorityValid : Auths.Refinement.AuthorityStateViewValid authority)\n (actionValid : Auths.Refinement.ActionAuthorityViewValid action) (expression : auths_model.ProfileBudgetExpression),\n Aeneas.Std.WP.spec (auths_authority.evaluate_action_coverage_view authority action expression) fun result =>\n result =\n Auths.Refinement.productionCoverageDecision\n (Auths.Rich.evaluateCoverage (Auths.Refinement.richAuthorityState authority authorityValid)\n (Auths.Refinement.richAction action actionValid) (Auths.Refinement.richBudgetExpression expression))", + "statement_constants": [ + "Eq", + "auths_authority.AuthorityStateView", + "auths_authority.CoverageDecision", + "auths_authority.evaluate_action_coverage_view", + "auths_model.ProfileBudgetExpression", + "Auths.Refinement.ActionAuthorityViewValid", + "Auths.Refinement.AuthorityStateViewValid", + "Auths.Refinement.ProductionVocabulary", + "Auths.Refinement.productionCoverageDecision", + "Auths.Refinement.richAction", + "Auths.Refinement.richAuthorityState", + "Auths.Refinement.richBudgetExpression", + "Auths.Rich.evaluateCoverage", + "auths_authority.auths_model.ActionAuthorityView", + "Aeneas.Std.WP.spec" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_delegation_refines_rich_spec", + "statement": "∀ {L : Type} (inst : auths_authority.auths_model.CriticalExtensionLaws L) (laws : L)\n [inst_1 : Auths.Rich.ExtensionLaws Auths.Refinement.ProductionVocabulary],\n Auths.Refinement.LawsRefine inst laws Auths.Refinement.productionLaw →\n ∀ (parent : auths_authority.AuthorityStateView) (grantId : auths_model.GrantId)\n (grant : auths_authority.auths_model.GrantAuthorityView)\n (parentValid : Auths.Refinement.AuthorityStateViewValid parent)\n (grantValid : Auths.Refinement.GrantAuthorityViewValid grant),\n Aeneas.Std.WP.spec (auths_authority.evaluate_grant_view inst parent grantId grant laws) fun result =>\n result.outcome =\n Auths.Refinement.productionDelegationOutcome\n (Auths.Rich.evaluateGrant (Auths.Refinement.richAuthorityState parent parentValid)\n (Auths.Refinement.richGrantId grantId) (Auths.Refinement.richGrant grant grantValid))\n grantId grant", + "statement_constants": [ + "Eq", + "auths_authority.AuthorityStateView", + "auths_authority.DelegationEvaluation", + "auths_authority.DelegationOutcome", + "auths_authority.evaluate_grant_view", + "auths_model.GrantId", + "Auths.Refinement.AuthorityStateViewValid", + "Auths.Refinement.GrantAuthorityViewValid", + "Auths.Refinement.LawsRefine", + "Auths.Refinement.ProductionVocabulary", + "Auths.Refinement.productionDelegationOutcome", + "Auths.Refinement.productionLaw", + "Auths.Refinement.richAuthorityState", + "Auths.Refinement.richGrant", + "Auths.Refinement.richGrantId", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.evaluateGrant", + "auths_authority.DelegationEvaluation.outcome", + "auths_authority.auths_model.CriticalExtensionLaws", + "auths_authority.auths_model.GrantAuthorityView", + "Aeneas.Std.WP.spec" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_bounded_ceiling_denies_absent_request", + "statement": "∀ (ceiling : auths_model.BudgetCeiling),\n auths_model.optional_budget_covers (some ceiling) none = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Option.none", + "Option.some", + "auths_model.BudgetCeiling", + "auths_model.optional_budget_covers", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_expressible_absent_request_is_denied", + "statement": "∀ (ceiling : auths_model.BudgetCeiling),\n auths_model.budget_ceiling_covers_action (some ceiling) none auths_model.ProfileBudgetExpression.Expressible =\n Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Option.none", + "Option.some", + "auths_model.BudgetCeiling", + "auths_model.budget_ceiling_covers_action", + "Aeneas.Std.Result", + "auths_model.ProfileBudgetExpression.Expressible", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_inexpressible_absent_request_is_covered", + "statement": "∀ (ceiling : auths_model.BudgetCeiling),\n auths_model.budget_ceiling_covers_action (some ceiling) none auths_model.ProfileBudgetExpression.Inexpressible =\n Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Option.none", + "Option.some", + "auths_model.BudgetCeiling", + "auths_model.budget_ceiling_covers_action", + "Aeneas.Std.Result", + "auths_model.ProfileBudgetExpression.Inexpressible", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Production", + "name": "Auths.Refinement.translated_absent_ceiling_covers_anything", + "statement": "∀ (requested : Option auths_model.BudgetCeiling) (expression : auths_model.ProfileBudgetExpression),\n auths_model.budget_ceiling_covers_action none requested expression = Aeneas.Std.Result.ok true", + "statement_constants": [ + "Bool", + "Eq", + "Option", + "Bool.true", + "Option.none", + "auths_model.BudgetCeiling", + "auths_model.ProfileBudgetExpression", + "auths_model.budget_ceiling_covers_action", + "Aeneas.Std.Result", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.Commitment", + "name": "Auths.Product.configuration_match_refl", + "statement": "∀ (configuration : Auths.Product.ConfigurationCommitment),\n Auths.Product.configurationMatch configuration configuration = Auths.Product.ConfigurationMatch.matches", + "statement_constants": [ + "Eq", + "Auths.Product.ConfigurationCommitment", + "Auths.Product.ConfigurationMatch", + "Auths.Product.configurationMatch", + "Auths.Product.ConfigurationMatch.matches" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Commitment", + "name": "Auths.Product.configuration_match_deterministic", + "statement": "∀ (required executed : Auths.Product.ConfigurationCommitment),\n ∃ result, Auths.Product.configurationMatch required executed = result", + "statement_constants": [ + "Eq", + "Exists", + "Auths.Product.ConfigurationCommitment", + "Auths.Product.ConfigurationMatch", + "Auths.Product.configurationMatch" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Arithmetic", + "name": "Auths.Product.checked_add_never_wraps", + "statement": "∀ {left right result : Auths.Product.UnitQuantity},\n Auths.Product.checkedAdd left right = Except.ok result →\n result.amount = left.amount + right.amount ∧ result.amount ≤ Auths.Product.u64Max", + "statement_constants": [ + "And", + "Eq", + "Except", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "Except.ok", + "HAdd.hAdd", + "LE.le", + "Auths.Product.ArithmeticFailure", + "Auths.Product.UnitQuantity", + "Auths.Product.checkedAdd", + "Auths.Product.u64Max", + "Auths.Product.UnitQuantity.amount" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Arithmetic", + "name": "Auths.Product.checked_sub_never_underflows", + "statement": "∀ {left right result : Auths.Product.UnitQuantity},\n Auths.Product.checkedSub left right = Except.ok result → right.amount ≤ left.amount", + "statement_constants": [ + "Eq", + "Except", + "Nat", + "instLENat", + "Except.ok", + "LE.le", + "Auths.Product.ArithmeticFailure", + "Auths.Product.UnitQuantity", + "Auths.Product.checkedSub", + "Auths.Product.UnitQuantity.amount" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.Arithmetic", + "name": "Auths.Product.checked_div_rejects_zero", + "statement": "∀ {quantity result : Auths.Product.UnitQuantity}, Auths.Product.checkedDiv quantity 0 = Except.ok result → False", + "statement_constants": [ + "Eq", + "Except", + "False", + "Nat", + "instOfNatNat", + "Except.ok", + "OfNat.ofNat", + "Auths.Product.ArithmeticFailure", + "Auths.Product.UnitQuantity", + "Auths.Product.checkedDiv" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Eligibility", + "name": "Auths.Product.three_way_partition", + "statement": "∀ (result : Auths.Product.Eligibility),\n (∃ outputs, result = Auths.Product.Eligibility.eligible outputs) ∨\n (∃ code stage, result = Auths.Product.Eligibility.denied code stage) ∨\n ∃ code stage, result = Auths.Product.Eligibility.indeterminate code stage", + "statement_constants": [ + "Eq", + "Exists", + "Or", + "Auths.Product.Eligibility", + "Auths.Product.OutputCommitments", + "Auths.Product.SemanticId", + "Auths.Product.Eligibility.denied", + "Auths.Product.Eligibility.eligible", + "Auths.Product.Eligibility.indeterminate" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.Theorems", + "name": "Auths.Product.product_contract_configuration_safety", + "statement": "∀ {required executed : Auths.Product.ConfigurationCommitment} {result : Auths.Product.Eligibility}\n {mismatchCode mismatchStage : Auths.Product.SemanticId},\n Auths.Product.configurationMatch required executed ≠ Auths.Product.ConfigurationMatch.matches →\n Auths.Product.isEligible (Auths.Product.gateConfiguration required executed result mismatchCode mismatchStage) =\n false", + "statement_constants": [ + "Bool", + "Eq", + "Ne", + "Bool.false", + "Auths.Product.ConfigurationCommitment", + "Auths.Product.ConfigurationMatch", + "Auths.Product.Eligibility", + "Auths.Product.SemanticId", + "Auths.Product.configurationMatch", + "Auths.Product.gateConfiguration", + "Auths.Product.isEligible", + "Auths.Product.ConfigurationMatch.matches" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Theorems", + "name": "Auths.Product.product_contract_output_completeness", + "statement": "∀ {result : Auths.Product.Eligibility},\n Auths.Product.isEligible result = true → ∃ outputs, result = Auths.Product.Eligibility.eligible outputs", + "statement_constants": [ + "Bool", + "Eq", + "Exists", + "Bool.true", + "Auths.Product.Eligibility", + "Auths.Product.OutputCommitments", + "Auths.Product.isEligible", + "Auths.Product.Eligibility.eligible" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_configuration_refines_projection", + "statement": "∀ (semanticEqual canonicalizationEqual digestEqual implementationEqualOrUnpinned : Bool),\n auths_bounded_policy.kernel.configuration_match_code semanticEqual canonicalizationEqual digestEqual\n implementationEqualOrUnpinned =\n Aeneas.Std.Result.ok\n (Auths.Product.Refinement.generatedConfigurationMatch\n (Auths.Product.projectedConfigurationMatch semanticEqual canonicalizationEqual digestEqual\n implementationEqualOrUnpinned))", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Auths.Product.projectedConfigurationMatch", + "auths_bounded_policy.kernel.ConfigurationMatchCode", + "auths_bounded_policy.kernel.configuration_match_code", + "Aeneas.Std.Result.ok", + "Auths.Product.Refinement.generatedConfigurationMatch" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_checked_add_refines_nat", + "statement": "∀ (left right : Aeneas.Std.U64),\n match auths_bounded_policy.kernel.checked_add_u64 left right with\n | Aeneas.Std.Result.ok (some result) => ↑left + ↑right ≤ Aeneas.Std.U64.max ∧ ↑result = ↑left + ↑right\n | Aeneas.Std.Result.ok none => Aeneas.Std.U64.max < ↑left + ↑right\n | Aeneas.Std.Result.fail e => False\n | Aeneas.Std.Result.div => False", + "statement_constants": [ + "And", + "Eq", + "False", + "Nat", + "Option", + "Unit", + "instAddNat", + "instHAdd", + "instLENat", + "instLTNat", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "Aeneas.Std.Error", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.checked_add_u64", + "Aeneas.Std.U64.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.Refinement.translated_checked_add_refines_nat.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_checked_sub_refines_nat", + "statement": "∀ (left right : Aeneas.Std.U64),\n match auths_bounded_policy.kernel.checked_sub_u64 left right with\n | Aeneas.Std.Result.ok (some result) => ↑right ≤ ↑left ∧ ↑result = ↑left - ↑right\n | Aeneas.Std.Result.ok none => ↑left < ↑right\n | Aeneas.Std.Result.fail e => False\n | Aeneas.Std.Result.div => False", + "statement_constants": [ + "And", + "Eq", + "False", + "Nat", + "Option", + "Unit", + "instHSub", + "instLENat", + "instLTNat", + "instSubNat", + "HSub.hSub", + "LE.le", + "LT.lt", + "Aeneas.Std.Error", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.checked_sub_u64", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.Refinement.translated_checked_add_refines_nat.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_checked_mul_refines_nat", + "statement": "∀ (left right : Aeneas.Std.U64),\n match auths_bounded_policy.kernel.checked_mul_u64 left right with\n | Aeneas.Std.Result.ok (some result) => ↑left * ↑right ≤ Aeneas.Std.U64.max ∧ ↑result = ↑left * ↑right\n | Aeneas.Std.Result.ok none => Aeneas.Std.U64.max < ↑left * ↑right\n | Aeneas.Std.Result.fail e => False\n | Aeneas.Std.Result.div => False", + "statement_constants": [ + "And", + "Eq", + "False", + "Nat", + "Option", + "Unit", + "instHMul", + "instLENat", + "instLTNat", + "instMulNat", + "HMul.hMul", + "LE.le", + "LT.lt", + "Aeneas.Std.Error", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.checked_mul_u64", + "Aeneas.Std.U64.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.Refinement.translated_checked_add_refines_nat.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_checked_div_rejects_zero", + "statement": "∀ (value : Aeneas.Std.U64), auths_bounded_policy.kernel.checked_div_u64 value 0#u64 = Aeneas.Std.Result.ok none", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Option.none", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.checked_div_u64", + "Aeneas.Std.Result.ok", + "Aeneas.Std.U64.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U64" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_window_index_refines_nat", + "statement": "∀ (now windowSeconds : Aeneas.Std.U64),\n ∃ result,\n auths_bounded_policy.kernel.window_index now windowSeconds = Aeneas.Std.Result.ok result ∧\n Option.map (fun x => ↑x) result = if ↑windowSeconds = 0 then none else some (↑now / ↑windowSeconds)", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Nat", + "Option", + "instDecidableEqNat", + "instHDiv", + "instOfNatNat", + "ite", + "HDiv.hDiv", + "Nat.instDiv", + "OfNat.ofNat", + "Option.map", + "Option.none", + "Option.some", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.window_index", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.BoundedPolicy", + "name": "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model", + "statement": "∀ (left right : auths_model.Digest),\n auths_model.bounded_policy.digest_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Product.Refinement.BoundedPolicy.digestBytes left =\n Auths.Product.Refinement.BoundedPolicy.digestBytes right))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instDecidableEqList", + "instDecidableEqNat", + "Decidable.decide", + "auths_model.Digest", + "Aeneas.Std.Result", + "auths_model.bounded_policy.digest_equal", + "Aeneas.Std.Result.ok", + "Auths.Product.Refinement.BoundedPolicy.digestBytes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.BoundedPolicy", + "name": "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model", + "statement": "∀ (childLink parentDigest : Option auths_model.Digest),\n auths_model.bounded_policy.bounded_policy_link_accepts childLink parentDigest =\n Aeneas.Std.Result.ok\n (Auths.Product.Refinement.BoundedPolicy.boundedPolicyLinkAccepts\n (Option.map Auths.Product.Refinement.BoundedPolicy.digestBytes childLink)\n (Option.map Auths.Product.Refinement.BoundedPolicy.digestBytes parentDigest))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Option.map", + "auths_model.Digest", + "Aeneas.Std.Result", + "auths_model.bounded_policy.bounded_policy_link_accepts", + "Aeneas.Std.Result.ok", + "Auths.Product.Refinement.BoundedPolicy.boundedPolicyLinkAccepts", + "Auths.Product.Refinement.BoundedPolicy.digestBytes" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_ceiling_count_refines_model", + "statement": "∀ (value ceiling count maxCount : Aeneas.Std.U64),\n auths_bounded_policy.kernel.ceiling_count_code value ceiling count maxCount =\n Aeneas.Std.Result.ok\n (Auths.Product.Refinement.generatedCeilingCountCode\n (Auths.Product.CeilingCount.codeOf ↑value ↑ceiling ↑count ↑maxCount))", + "statement_constants": [ + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.CeilingCountCode", + "auths_bounded_policy.kernel.ceiling_count_code", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.CeilingCount.codeOf", + "Auths.Product.Refinement.generatedCeilingCountCode" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_ceiling_count_tightens_refines_model", + "statement": "∀ (childCeiling childMax childWindow parentCeiling parentMax parentWindow : Aeneas.Std.U64),\n auths_bounded_policy.kernel.ceiling_count_tightens childCeiling childMax childWindow parentCeiling parentMax\n parentWindow =\n Aeneas.Std.Result.ok\n (Auths.Product.CeilingCount.numericTightens ↑childCeiling ↑childMax ↑childWindow ↑parentCeiling ↑parentMax\n ↑parentWindow)", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.ceiling_count_tightens", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.CeilingCount.numericTightens" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_chain_counts_admit_refines_model", + "statement": "∀ (counts capacities : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_bounded_policy.kernel.chain_counts_admit counts capacities) fun result =>\n result =\n Auths.Product.CeilingCount.countsAdmit (Auths.Product.Refinement.natList ↑counts)\n (Auths.Product.Refinement.natList ↑capacities)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.chain_counts_admit", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CeilingCount.countsAdmit", + "Auths.Product.Refinement.natList" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_chain_sums_admit_refines_model", + "statement": "∀ (sums : Aeneas.Std.Slice Aeneas.Std.U64) (argument : Aeneas.Std.U64) (capacities : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_bounded_policy.kernel.chain_sums_admit sums argument capacities) fun result =>\n result =\n Auths.Product.CeilingCount.sumsAdmit (Auths.Product.Refinement.natList ↑sums) (↑argument)\n (Auths.Product.Refinement.natList ↑capacities)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.chain_sums_admit", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CeilingCount.sumsAdmit", + "Auths.Product.Refinement.natList" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement", + "name": "Auths.Product.Refinement.translated_argument_policy_tightens_refines_model", + "statement": "∀ (child parent : auths_bounded_policy.kernel.PolicyMembers),\n Aeneas.Std.WP.spec (auths_bounded_policy.kernel.argument_policy_tightens child parent) fun result =>\n result =\n Auths.Product.CeilingCount.decider (Auths.Product.Refinement.policyOf child)\n (Auths.Product.Refinement.policyOf parent)", + "statement_constants": [ + "Bool", + "Eq", + "auths_bounded_policy.kernel.PolicyMembers", + "auths_bounded_policy.kernel.argument_policy_tightens", + "Aeneas.Std.WP.spec", + "Auths.Product.CeilingCount.decider", + "Auths.Product.Refinement.policyOf" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.code_eligible_iff", + "statement": "∀ (value ceiling count maxCount : ℕ),\n Auths.Product.CeilingCount.codeOf value ceiling count maxCount = Auths.Product.CeilingCount.Code.eligible ↔\n value ≤ ceiling ∧ count < maxCount", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Nat", + "instLENat", + "instLTNat", + "LE.le", + "LT.lt", + "Auths.Product.CeilingCount.Code", + "Auths.Product.CeilingCount.codeOf", + "Auths.Product.CeilingCount.Code.eligible" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.decider_iff_tightens", + "statement": "∀ (child parent : Auths.Product.CeilingCount.Policy),\n Auths.Product.CeilingCount.decider child parent = true ↔ Auths.Product.CeilingCount.tightens child parent", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "Bool.true", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.decider", + "Auths.Product.CeilingCount.tightens" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.tightening_never_admits_more", + "statement": "∀ {child parent : Auths.Product.CeilingCount.Policy} {context : Auths.Product.CeilingCount.Context},\n Auths.Product.CeilingCount.tightens child parent →\n Auths.Product.CeilingCount.admits child context → Auths.Product.CeilingCount.admits parent context", + "statement_constants": [ + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admits", + "Auths.Product.CeilingCount.tightens" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.decider_sound", + "statement": "∀ {child parent : Auths.Product.CeilingCount.Policy},\n Auths.Product.CeilingCount.decider child parent = true →\n ∀ (context : Auths.Product.CeilingCount.Context),\n Auths.Product.CeilingCount.admits child context → Auths.Product.CeilingCount.admits parent context", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admits", + "Auths.Product.CeilingCount.decider" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.smaller_ceiling_never_authorizes_more", + "statement": "∀ (policy : Auths.Product.CeilingCount.Policy) {ceiling : ℕ},\n ceiling ≤ policy.ceiling →\n ∀ {context : Auths.Product.CeilingCount.Context},\n Auths.Product.CeilingCount.admits\n { argument := policy.argument, ceiling := ceiling, window := policy.window, maxCount := policy.maxCount,\n sum := policy.sum, scope := policy.scope }\n context →\n Auths.Product.CeilingCount.admits policy context", + "statement_constants": [ + "Nat", + "instLENat", + "LE.le", + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admits", + "Auths.Product.CeilingCount.Policy.argument", + "Auths.Product.CeilingCount.Policy.ceiling", + "Auths.Product.CeilingCount.Policy.maxCount", + "Auths.Product.CeilingCount.Policy.mk", + "Auths.Product.CeilingCount.Policy.scope", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.Policy.window" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.smaller_count_never_authorizes_more", + "statement": "∀ (policy : Auths.Product.CeilingCount.Policy) {maxCount : ℕ},\n maxCount ≤ policy.maxCount →\n ∀ {context : Auths.Product.CeilingCount.Context},\n Auths.Product.CeilingCount.admits\n { argument := policy.argument, ceiling := policy.ceiling, window := policy.window, maxCount := maxCount,\n sum := policy.sum, scope := policy.scope }\n context →\n Auths.Product.CeilingCount.admits policy context", + "statement_constants": [ + "Nat", + "instLENat", + "LE.le", + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admits", + "Auths.Product.CeilingCount.Policy.argument", + "Auths.Product.CeilingCount.Policy.ceiling", + "Auths.Product.CeilingCount.Policy.maxCount", + "Auths.Product.CeilingCount.Policy.mk", + "Auths.Product.CeilingCount.Policy.scope", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.Policy.window" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.tightens_refl", + "statement": "∀ (policy : Auths.Product.CeilingCount.Policy), Auths.Product.CeilingCount.tightens policy policy", + "statement_constants": [ + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.tightens" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.tightens_trans", + "statement": "∀ {child middle parent : Auths.Product.CeilingCount.Policy},\n Auths.Product.CeilingCount.tightens child middle →\n Auths.Product.CeilingCount.tightens middle parent → Auths.Product.CeilingCount.tightens child parent", + "statement_constants": [ + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.tightens" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.bounded_policy_law_lawful", + "statement": "Auths.Product.CeilingCount.boundedPolicyLaw.Lawful", + "statement_constants": [ + "Auths.NarrowingLaw.Lawful", + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.boundedPolicyLaw" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.bounded_policy_law_accepts_addition", + "statement": "∀ (policy : Auths.Product.CeilingCount.Policy),\n Auths.Product.CeilingCount.boundedPolicyLaw.attenuates (some policy) none", + "statement_constants": [ + "Option.none", + "Option.some", + "Auths.NarrowingLaw.attenuates", + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.boundedPolicyLaw" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.ceiling_count_fixed_context_tightening", + "statement": "∀ {child parent : Auths.Product.CeilingCount.Policy} {context : Auths.Product.CeilingCount.Context}\n {childOutputs : Auths.Product.OutputCommitments},\n Auths.Product.CeilingCount.tightens child parent →\n Auths.Product.CeilingCount.evaluator.evaluate child context = Auths.Product.Eligibility.eligible childOutputs →\n ∃ parentOutputs,\n Auths.Product.CeilingCount.evaluator.evaluate parent context =\n Auths.Product.Eligibility.eligible parentOutputs ∧\n childOutputs = parentOutputs", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Auths.Product.Eligibility", + "Auths.Product.OutputCommitments", + "Auths.Product.CeilingCount.Context", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.evaluator", + "Auths.Product.CeilingCount.tightens", + "Auths.Product.ClosedEvaluator.evaluate", + "Auths.Product.Eligibility.eligible" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.reserve_all_or_none", + "statement": "∀ (facts : Auths.Product.CeilingCount.Facts) (links : List Auths.Product.CeilingCount.Link) (value : ℕ)\n (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.reserve facts links value counts = none ∨\n ∃ raised,\n Auths.Product.CeilingCount.reserve facts links value counts = some raised ∧\n (∀ key ∈ Auths.Product.CeilingCount.countKeys links, raised key = counts key + 1) ∧\n (∀ key ∈ Auths.Product.CeilingCount.sumKeys facts.text links, raised key = counts key + value) ∧\n ∀ key ∉ Auths.Product.CeilingCount.countKeys links,\n key ∉ Auths.Product.CeilingCount.sumKeys facts.text links → raised key = counts key", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Not", + "Option", + "Or", + "instAddNat", + "instHAdd", + "instOfNatNat", + "HAdd.hAdd", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Option.none", + "Option.some", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Facts", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.countKeys", + "Auths.Product.CeilingCount.reserve", + "Auths.Product.CeilingCount.sumKeys", + "Auths.Product.CeilingCount.Facts.text" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.aggregate_count_bound", + "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (link : Auths.Product.CeilingCount.Link),\n (Auths.Product.CeilingCount.containing link (Auths.Product.CeilingCount.admitAll counts arrivals).2).length ≤\n link.2.maxCount", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Prod.snd", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admitAll", + "Auths.Product.CeilingCount.containing", + "Auths.Product.CeilingCount.Policy.maxCount" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.aggregate_spend_bound", + "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (link : Auths.Product.CeilingCount.Link),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (Auths.Product.CeilingCount.containing link (Auths.Product.CeilingCount.admitAll counts arrivals).2)).sum ≤\n link.2.ceiling * link.2.maxCount", + "statement_constants": [ + "List", + "Nat", + "instAddNat", + "instHMul", + "instLENat", + "instMulNat", + "HMul.hMul", + "LE.le", + "List.map", + "List.sum", + "MulZeroClass.toZero", + "Nat.instMulZeroClass", + "Prod.snd", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admitAll", + "Auths.Product.CeilingCount.containing", + "Auths.Product.CeilingCount.Arrival.value", + "Auths.Product.CeilingCount.Policy.ceiling", + "Auths.Product.CeilingCount.Policy.maxCount" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.aggregate_sum_bound", + "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (link : Auths.Product.CeilingCount.Link) {bound : Auths.Product.CeilingCount.SumBound},\n link.2.sum = some bound →\n ∀ (partition : Auths.Product.CeilingCount.Name),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (Auths.Product.CeilingCount.containingIn link bound partition\n (Auths.Product.CeilingCount.admitAll counts arrivals).2)).sum ≤\n bound.limit", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instAddNat", + "instLENat", + "LE.le", + "List.map", + "List.sum", + "MulZeroClass.toZero", + "Nat.instMulZeroClass", + "Option.some", + "Prod.snd", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.SumBound", + "Auths.Product.CeilingCount.admitAll", + "Auths.Product.CeilingCount.containingIn", + "Auths.Product.CeilingCount.Arrival.value", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.SumBound.limit" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.delegation_never_multiplies", + "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (root : Auths.Product.CeilingCount.Link),\n (∀ arrival ∈ arrivals, root ∈ arrival.links) →\n (Auths.Product.CeilingCount.admitAll counts arrivals).2.length ≤ root.2.maxCount ∧\n (List.map Auths.Product.CeilingCount.Arrival.value (Auths.Product.CeilingCount.admitAll counts arrivals).2).sum ≤\n root.2.ceiling * root.2.maxCount", + "statement_constants": [ + "And", + "List", + "Nat", + "instAddNat", + "instHMul", + "instLENat", + "instMulNat", + "HMul.hMul", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "List.sum", + "Membership.mem", + "MulZeroClass.toZero", + "Nat.instMulZeroClass", + "Prod.snd", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.admitAll", + "Auths.Product.CeilingCount.Arrival.links", + "Auths.Product.CeilingCount.Arrival.value", + "Auths.Product.CeilingCount.Policy.ceiling", + "Auths.Product.CeilingCount.Policy.maxCount" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.sum_delegation_never_multiplies", + "statement": "∀ (counts : Auths.Product.CeilingCount.CounterKey → ℕ) (arrivals : List Auths.Product.CeilingCount.Arrival)\n (root : Auths.Product.CeilingCount.Link),\n (∀ arrival ∈ arrivals, root ∈ arrival.links) →\n ∀ {bound : Auths.Product.CeilingCount.SumBound},\n root.2.sum = some bound →\n ∀ (partition : Auths.Product.CeilingCount.Name),\n (List.map Auths.Product.CeilingCount.Arrival.value\n (List.filter\n (fun arrival =>\n decide (Auths.Product.CeilingCount.partitionValue arrival.facts.text bound.partition = partition))\n (Auths.Product.CeilingCount.admitAll counts arrivals).2)).sum ≤\n bound.limit", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instAddNat", + "instDecidableEqList", + "instDecidableEqNat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.filter", + "List.instMembership", + "List.map", + "List.sum", + "Membership.mem", + "MulZeroClass.toZero", + "Nat.instMulZeroClass", + "Option.some", + "Prod.snd", + "Auths.Product.CeilingCount.Arrival", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.SumBound", + "Auths.Product.CeilingCount.admitAll", + "Auths.Product.CeilingCount.partitionValue", + "Auths.Product.CeilingCount.Arrival.facts", + "Auths.Product.CeilingCount.Arrival.links", + "Auths.Product.CeilingCount.Arrival.value", + "Auths.Product.CeilingCount.Facts.text", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.SumBound.limit", + "Auths.Product.CeilingCount.SumBound.partition" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.scope_admits_only_listed", + "statement": "∀ {facts : Auths.Product.CeilingCount.Facts} {value : ℕ} {links : List Auths.Product.CeilingCount.Link}\n {counts : Auths.Product.CeilingCount.CounterKey → ℕ},\n Auths.Product.CeilingCount.chainAdmits facts value links counts = true →\n ∀ {link : Auths.Product.CeilingCount.Link},\n link ∈ links →\n (∀ (scope : Auths.Product.CeilingCount.Values),\n link.2.scope = some scope →\n ∃ listedValue, facts.text scope.argument = some listedValue ∧ listedValue ∈ scope.values) ∧\n ∀ (bound : Auths.Product.CeilingCount.SumBound) (partition : Auths.Product.CeilingCount.Values),\n link.2.sum = some bound →\n bound.partition = some partition →\n ∃ listedValue, facts.text partition.argument = some listedValue ∧ listedValue ∈ partition.values", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Nat", + "Option", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Option.some", + "Prod.snd", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Facts", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.SumBound", + "Auths.Product.CeilingCount.Values", + "Auths.Product.CeilingCount.chainAdmits", + "Auths.Product.CeilingCount.Facts.text", + "Auths.Product.CeilingCount.Policy.scope", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.SumBound.partition", + "Auths.Product.CeilingCount.Values.argument", + "Auths.Product.CeilingCount.Values.values" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.chain_counts_part", + "statement": "∀ (links : List Auths.Product.CeilingCount.Link) (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.countsAdmit (List.map counts (Auths.Product.CeilingCount.countKeys links).dedup)\n (List.map (Auths.Product.CeilingCount.countCapacity links) (Auths.Product.CeilingCount.countKeys links).dedup) =\n true ↔\n ∀ link ∈ links, counts (Auths.Product.CeilingCount.countKey link) < link.2.maxCount", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "instLTNat", + "Bool.true", + "LT.lt", + "List.dedup", + "List.instMembership", + "List.map", + "Membership.mem", + "Prod.snd", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.countCapacity", + "Auths.Product.CeilingCount.countKey", + "Auths.Product.CeilingCount.countKeys", + "Auths.Product.CeilingCount.countsAdmit", + "Auths.Product.CeilingCount.instDecidableEqCounterKey", + "Auths.Product.CeilingCount.Policy.maxCount" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.chain_sums_part", + "statement": "∀ (text : Auths.Product.CeilingCount.Name → Option Auths.Product.CeilingCount.Name)\n (links : List Auths.Product.CeilingCount.Link) (value : ℕ) (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.sumsAdmit (List.map counts (Auths.Product.CeilingCount.sumKeys text links).dedup) value\n (List.map (Auths.Product.CeilingCount.sumCapacity text links)\n (Auths.Product.CeilingCount.sumKeys text links).dedup) =\n true ↔\n ∀ entry ∈ Auths.Product.CeilingCount.sumEntries text links, counts entry.1 + value ≤ entry.2", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Prod", + "instAddNat", + "instHAdd", + "instLENat", + "Bool.true", + "HAdd.hAdd", + "LE.le", + "List.dedup", + "List.instMembership", + "List.map", + "Membership.mem", + "Prod.fst", + "Prod.snd", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.instDecidableEqCounterKey", + "Auths.Product.CeilingCount.sumCapacity", + "Auths.Product.CeilingCount.sumEntries", + "Auths.Product.CeilingCount.sumKeys", + "Auths.Product.CeilingCount.sumsAdmit" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CeilingCount", + "name": "Auths.Product.CeilingCount.chain_admits_parts", + "statement": "∀ (facts : Auths.Product.CeilingCount.Facts) (value : ℕ) (links : List Auths.Product.CeilingCount.Link)\n (counts : Auths.Product.CeilingCount.CounterKey → ℕ),\n Auths.Product.CeilingCount.chainAdmits facts value links counts = true ↔\n (∀ link ∈ links,\n facts.argument link.2.argument = some value ∧\n value ≤ link.2.ceiling ∧\n Auths.Product.CeilingCount.scopeAdmits facts.text link.2.scope = true ∧\n ∀ bound ∈ link.2.sum, Auths.Product.CeilingCount.partitionAdmits facts.text bound.partition = true) ∧\n (∀ link ∈ links, counts (Auths.Product.CeilingCount.countKey link) < link.2.maxCount) ∧\n ∀ entry ∈ Auths.Product.CeilingCount.sumEntries facts.text links, counts entry.1 + value ≤ entry.2", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "Prod", + "instAddNat", + "instHAdd", + "instLENat", + "instLTNat", + "Bool.true", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instMembership", + "Membership.mem", + "Option.instMembership", + "Option.some", + "Prod.fst", + "Prod.snd", + "Auths.Product.CeilingCount.CounterKey", + "Auths.Product.CeilingCount.Facts", + "Auths.Product.CeilingCount.Link", + "Auths.Product.CeilingCount.Name", + "Auths.Product.CeilingCount.Policy", + "Auths.Product.CeilingCount.SumBound", + "Auths.Product.CeilingCount.chainAdmits", + "Auths.Product.CeilingCount.countKey", + "Auths.Product.CeilingCount.partitionAdmits", + "Auths.Product.CeilingCount.scopeAdmits", + "Auths.Product.CeilingCount.sumEntries", + "Auths.Product.CeilingCount.Facts.argument", + "Auths.Product.CeilingCount.Facts.text", + "Auths.Product.CeilingCount.Policy.argument", + "Auths.Product.CeilingCount.Policy.ceiling", + "Auths.Product.CeilingCount.Policy.maxCount", + "Auths.Product.CeilingCount.Policy.scope", + "Auths.Product.CeilingCount.Policy.sum", + "Auths.Product.CeilingCount.SumBound.partition" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.capability_total_deterministic", + "statement": "∀ (declarations : Auths.Product.Recovery.Declarations),\n ∃! result, Auths.Product.Recovery.capability declarations = result ∧ result.writeIsConditional = false", + "statement_constants": [ + "And", + "Bool", + "Eq", + "ExistsUnique", + "Bool.false", + "Auths.Product.Recovery.Capability", + "Auths.Product.Recovery.Declarations", + "Auths.Product.Recovery.capability", + "Auths.Product.Recovery.Capability.writeIsConditional" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.class_matches_declarations", + "statement": "∀ (declarations : Auths.Product.Recovery.Declarations),\n ((Auths.Product.Recovery.capability declarations).recoveryClass = Auths.Product.Recovery.RecoveryClass.linked ↔\n declarations.observation = Auths.Product.Recovery.Observation.verifiedLocator ∧ declarations.echo = true) ∧\n ((Auths.Product.Recovery.capability declarations).recoveryClass =\n Auths.Product.Recovery.RecoveryClass.linkedAfterResponse ↔\n declarations.observation = Auths.Product.Recovery.Observation.responseLocator ∧ declarations.echo = true) ∧\n ((Auths.Product.Recovery.capability declarations).recoveryClass = Auths.Product.Recovery.RecoveryClass.observed ↔\n declarations.observation ≠ Auths.Product.Recovery.Observation.none ∧ declarations.echo = false) ∧\n ((Auths.Product.Recovery.capability declarations).recoveryClass =\n Auths.Product.Recovery.RecoveryClass.recorded ↔\n declarations.observation = Auths.Product.Recovery.Observation.none) ∧\n ((Auths.Product.Recovery.capability declarations).unknownResolution =\n Auths.Product.Recovery.Resolution.gatewayReobservation ↔\n (Auths.Product.Recovery.capability declarations).recoveryClass =\n Auths.Product.Recovery.RecoveryClass.linked) ∧\n (Auths.Product.Recovery.capability declarations).stateObservation = declarations.observation ∧\n ((Auths.Product.Recovery.capability declarations).providerLink =\n if declarations.echo = true then declarations.observation\n else Auths.Product.Recovery.Observation.none) ∧\n (Auths.Product.Recovery.capability declarations).lostClaimReentry = declarations.idempotency ∧\n (Auths.Product.Recovery.capability declarations).preEntryReread = declarations.preEntry", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "Ne", + "instDecidableEqBool", + "ite", + "Bool.false", + "Bool.true", + "Auths.Product.Recovery.Declarations", + "Auths.Product.Recovery.Observation", + "Auths.Product.Recovery.RecoveryClass", + "Auths.Product.Recovery.Reentry", + "Auths.Product.Recovery.Resolution", + "Auths.Product.Recovery.capability", + "Auths.Product.Recovery.Capability.lostClaimReentry", + "Auths.Product.Recovery.Capability.preEntryReread", + "Auths.Product.Recovery.Capability.providerLink", + "Auths.Product.Recovery.Capability.recoveryClass", + "Auths.Product.Recovery.Capability.stateObservation", + "Auths.Product.Recovery.Capability.unknownResolution", + "Auths.Product.Recovery.Declarations.echo", + "Auths.Product.Recovery.Declarations.idempotency", + "Auths.Product.Recovery.Declarations.observation", + "Auths.Product.Recovery.Declarations.preEntry", + "Auths.Product.Recovery.Observation.none", + "Auths.Product.Recovery.Observation.responseLocator", + "Auths.Product.Recovery.Observation.verifiedLocator", + "Auths.Product.Recovery.RecoveryClass.linked", + "Auths.Product.Recovery.RecoveryClass.linkedAfterResponse", + "Auths.Product.Recovery.RecoveryClass.observed", + "Auths.Product.Recovery.RecoveryClass.recorded", + "Auths.Product.Recovery.Resolution.gatewayReobservation" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.write_never_conditional", + "statement": "∀ (declarations : Auths.Product.Recovery.Declarations),\n (Auths.Product.Recovery.capability declarations).writeIsConditional = false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Auths.Product.Recovery.Declarations", + "Auths.Product.Recovery.capability", + "Auths.Product.Recovery.Capability.writeIsConditional" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.unknown_resolves_only_linked", + "statement": "(∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validTransition old new = true →\n old.stage = Auths.Product.Recovery.Stage.unknown →\n new.stage = Auths.Product.Recovery.Stage.observedByProvider ∧\n old.link = Auths.Product.Recovery.Link.verified ∧\n new.link = Auths.Product.Recovery.Link.verified ∧ new.evidence = true) ∧\n (∀ (views : List Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validChain views →\n ∀ (index : ℕ) (bound : index + 1 < views.length),\n views[index].stage = Auths.Product.Recovery.Stage.unknown →\n views[index + 1].stage = Auths.Product.Recovery.Stage.observedByProvider ∧\n views[index + 1].link = Auths.Product.Recovery.Link.verified ∧ views[index + 1].evidence = true) ∧\n ∀ (declarations : Auths.Product.Recovery.Declarations),\n Auths.Product.Recovery.linkOf (Auths.Product.Recovery.capability declarations).providerLink =\n Auths.Product.Recovery.Link.verified ↔\n (Auths.Product.Recovery.capability declarations).recoveryClass = Auths.Product.Recovery.RecoveryClass.linked", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Not", + "instAddNat", + "instHAdd", + "instLTNat", + "instOfNatNat", + "Bool.true", + "Decidable.byContradiction", + "GetElem.getElem", + "HAdd.hAdd", + "LT.lt", + "List.instGetElemNatLtLength", + "List.length", + "Nat.decLt", + "OfNat.ofNat", + "Auths.Product.Recovery.AttemptView", + "Auths.Product.Recovery.Declarations", + "Auths.Product.Recovery.Link", + "Auths.Product.Recovery.RecoveryClass", + "Auths.Product.Recovery.Stage", + "Auths.Product.Recovery.capability", + "Auths.Product.Recovery.linkOf", + "Auths.Product.Recovery.validChain", + "Auths.Product.Recovery.validTransition", + "Auths.Product.Recovery.AttemptView.evidence", + "Auths.Product.Recovery.AttemptView.link", + "Auths.Product.Recovery.AttemptView.stage", + "Auths.Product.Recovery.Capability.providerLink", + "Auths.Product.Recovery.Capability.recoveryClass", + "Auths.Product.Recovery.Link.verified", + "Auths.Product.Recovery.RecoveryClass.linked", + "Auths.Product.Recovery.Stage.observedByProvider", + "Auths.Product.Recovery.Stage.unknown", + "Auths.Product.Recovery.chain_step._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.provider_claim_requires_evidence", + "statement": "(∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validTransition old new = true →\n new.stage = Auths.Product.Recovery.Stage.observedByProvider →\n new.evidence = true ∧\n Auths.Product.Recovery.hasLink new.link = true ∧\n new.link = old.link ∧\n (old.stage = Auths.Product.Recovery.Stage.responseRecorded ∨\n (old.stage = Auths.Product.Recovery.Stage.attempting ∨\n old.stage = Auths.Product.Recovery.Stage.unknown) ∧\n old.link = Auths.Product.Recovery.Link.verified)) ∧\n ∀ (first : Auths.Product.Recovery.AttemptView) (rest : List Auths.Product.Recovery.AttemptView),\n first.stage = Auths.Product.Recovery.Stage.attempting →\n Auths.Product.Recovery.consistent first = true →\n Auths.Product.Recovery.validChain (first :: rest) →\n ∀ (index : ℕ) (bound : index < rest.length),\n rest[index].stage = Auths.Product.Recovery.Stage.observedByProvider →\n rest[index].evidence = true ∧\n rest[index].link = first.link ∧\n Auths.Product.Recovery.hasLink first.link = true ∧\n ((first :: rest)[index].stage = Auths.Product.Recovery.Stage.responseRecorded ∨\n ((first :: rest)[index].stage = Auths.Product.Recovery.Stage.attempting ∨\n (first :: rest)[index].stage = Auths.Product.Recovery.Stage.unknown) ∧\n first.link = Auths.Product.Recovery.Link.verified)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Not", + "Or", + "id", + "instAddNat", + "instHAdd", + "instLTNat", + "instOfNatNat", + "Bool.true", + "Decidable.byContradiction", + "GetElem.getElem", + "HAdd.hAdd", + "LT.lt", + "List.cons", + "List.instGetElemNatLtLength", + "List.length", + "Nat.decLt", + "OfNat.ofNat", + "Auths.Product.Recovery.AttemptView", + "Auths.Product.Recovery.Link", + "Auths.Product.Recovery.Stage", + "Auths.Product.Recovery.consistent", + "Auths.Product.Recovery.hasLink", + "Auths.Product.Recovery.validChain", + "Auths.Product.Recovery.validTransition", + "Auths.Product.Recovery.AttemptView.evidence", + "Auths.Product.Recovery.AttemptView.link", + "Auths.Product.Recovery.AttemptView.stage", + "Auths.Product.Recovery.Link.verified", + "Auths.Product.Recovery.Stage.attempting", + "Auths.Product.Recovery.Stage.observedByProvider", + "Auths.Product.Recovery.Stage.responseRecorded", + "Auths.Product.Recovery.Stage.unknown", + "Auths.Product.Recovery.provider_claim_requires_evidence._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.terminal_stages_final", + "statement": "(∀ (stage : Auths.Product.Recovery.Stage),\n Auths.Product.Recovery.terminalStage stage = true ↔\n stage = Auths.Product.Recovery.Stage.notEntered ∨\n stage = Auths.Product.Recovery.Stage.observed ∨ stage = Auths.Product.Recovery.Stage.observedByProvider) ∧\n (∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.terminalStage old.stage = true → Auths.Product.Recovery.validTransition old new = false) ∧\n ∀ (views : List Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validChain views →\n ∀ (index : ℕ) (bound : index < views.length),\n Auths.Product.Recovery.terminalStage views[index].stage = true → index + 1 = views.length", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Or", + "instAddNat", + "instHAdd", + "instLTNat", + "instOfNatNat", + "Bool.false", + "Bool.true", + "GetElem.getElem", + "HAdd.hAdd", + "LT.lt", + "List.instGetElemNatLtLength", + "List.length", + "OfNat.ofNat", + "Auths.Product.Recovery.AttemptView", + "Auths.Product.Recovery.Stage", + "Auths.Product.Recovery.terminalStage", + "Auths.Product.Recovery.validChain", + "Auths.Product.Recovery.validTransition", + "Auths.Product.Recovery.AttemptView.stage", + "Auths.Product.Recovery.Stage.notEntered", + "Auths.Product.Recovery.Stage.observed", + "Auths.Product.Recovery.Stage.observedByProvider" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Recovery", + "name": "Auths.Product.Recovery.transitions_preserve_identity", + "statement": "(∀ (old new : Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.consistent old = true →\n Auths.Product.Recovery.validTransition old new = true → Auths.Product.Recovery.Keeps old new) ∧\n ∀ (views : List Auths.Product.Recovery.AttemptView),\n Auths.Product.Recovery.validChain views →\n (∀ (bound : 0 < views.length), Auths.Product.Recovery.consistent views[0] = true) →\n ∀ (earlier later : ℕ) (order : earlier ≤ later) (bound : later < views.length),\n Auths.Product.Recovery.Keeps views[earlier] views[later]", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Not", + "instLENat", + "instLTNat", + "instOfNatNat", + "Bool.true", + "Decidable.byContradiction", + "GetElem.getElem", + "LE.le", + "LT.lt", + "List.instGetElemNatLtLength", + "List.length", + "Nat.decLt", + "OfNat.ofNat", + "Auths.Product.Recovery.AttemptView", + "Auths.Product.Recovery.Keeps", + "Auths.Product.Recovery.consistent", + "Auths.Product.Recovery.validChain", + "Auths.Product.Recovery.validTransition", + "Auths.Product.Recovery.chain_keeps._proof_1" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.lease_requires_verified_claim", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event) (mode : Auths.Product.SubmitOrder.Mode),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.lease mode →\n event = Auths.Product.SubmitOrder.Event.reload true ∧\n (Auths.Product.SubmitOrder.stateAfter plan pre).phase = Auths.Product.SubmitOrder.Phase.reload mode ∧\n (∃ argument, Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument) ∧\n (mode = Auths.Product.SubmitOrder.Mode.reobserve →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.replay)) ∧\n (mode ≠ Auths.Product.SubmitOrder.Mode.reobserve →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.inserted))", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Ne", + "Bool.true", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Mode", + "Auths.Product.SubmitOrder.Phase", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Verified", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.Action.lease", + "Auths.Product.SubmitOrder.ClaimResult.inserted", + "Auths.Product.SubmitOrder.ClaimResult.replay", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.Event.claim", + "Auths.Product.SubmitOrder.Event.reload", + "Auths.Product.SubmitOrder.Mode.reobserve", + "Auths.Product.SubmitOrder.Phase.claim", + "Auths.Product.SubmitOrder.Phase.reload", + "Auths.Product.SubmitOrder.State.phase" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.send_requires_lease_and_deadline", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.send →\n event = Auths.Product.SubmitOrder.Event.deadline true ∧\n (Auths.Product.SubmitOrder.stateAfter plan pre).phase = Auths.Product.SubmitOrder.Phase.deadline ∧\n (∃ argument, Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.inserted) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.lease Auths.Product.SubmitOrder.Mode.entry)\n (Auths.Product.SubmitOrder.Event.lease true) ∧\n (plan.preEntry = true →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.preEntry\n (Auths.Product.SubmitOrder.Event.preEntry Auths.Product.SubmitOrder.PreEntryResult.satisfied)) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.entryReload (Auths.Product.SubmitOrder.Event.reload true)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Nat", + "Bool.true", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Phase", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Verified", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.Action.send", + "Auths.Product.SubmitOrder.ClaimResult.inserted", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.Event.claim", + "Auths.Product.SubmitOrder.Event.deadline", + "Auths.Product.SubmitOrder.Event.lease", + "Auths.Product.SubmitOrder.Event.preEntry", + "Auths.Product.SubmitOrder.Event.reload", + "Auths.Product.SubmitOrder.Mode.entry", + "Auths.Product.SubmitOrder.Phase.claim", + "Auths.Product.SubmitOrder.Phase.deadline", + "Auths.Product.SubmitOrder.Phase.entryReload", + "Auths.Product.SubmitOrder.Phase.lease", + "Auths.Product.SubmitOrder.Phase.preEntry", + "Auths.Product.SubmitOrder.Plan.preEntry", + "Auths.Product.SubmitOrder.PreEntryResult.satisfied", + "Auths.Product.SubmitOrder.State.phase" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.send_requires_credential_checks", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.send →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.prefixGuard Auths.Product.SubmitOrder.Mode.entry)\n (Auths.Product.SubmitOrder.Event.prefixGuard true) ∧\n (plan.accountRead = true →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.account Auths.Product.SubmitOrder.Mode.entry)\n (Auths.Product.SubmitOrder.Event.account Auths.Product.SubmitOrder.AccountResult.equal)) ∧\n ∀ index < plan.deniedReads,\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n (Auths.Product.SubmitOrder.Phase.denied Auths.Product.SubmitOrder.Mode.entry index)\n (Auths.Product.SubmitOrder.Event.denied Auths.Product.SubmitOrder.DeniedResult.refused)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "instLTNat", + "Bool.true", + "LT.lt", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.AccountResult.equal", + "Auths.Product.SubmitOrder.Action.send", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.DeniedResult.refused", + "Auths.Product.SubmitOrder.Event.account", + "Auths.Product.SubmitOrder.Event.denied", + "Auths.Product.SubmitOrder.Event.prefixGuard", + "Auths.Product.SubmitOrder.Mode.entry", + "Auths.Product.SubmitOrder.Phase.account", + "Auths.Product.SubmitOrder.Phase.denied", + "Auths.Product.SubmitOrder.Phase.prefixGuard", + "Auths.Product.SubmitOrder.Plan.accountRead", + "Auths.Product.SubmitOrder.Plan.deniedReads" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.send_requires_relative_ceiling", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.send →\n plan.relativeCeiling = true →\n ∃ argument basis,\n Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument ∧\n (∀ (other : ℕ),\n Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) other → other = argument) ∧\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.ceiling\n (Auths.Product.SubmitOrder.Event.ceiling (Auths.Product.SubmitOrder.CeilingRead.read basis true)) ∧\n Auths.Product.RelativeCeiling.admits argument basis plan.basisPoints = true", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Nat", + "Bool.true", + "Auths.Product.RelativeCeiling.admits", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Verified", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.Action.send", + "Auths.Product.SubmitOrder.CeilingRead.read", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.Event.ceiling", + "Auths.Product.SubmitOrder.Phase.ceiling", + "Auths.Product.SubmitOrder.Plan.basisPoints", + "Auths.Product.SubmitOrder.Plan.relativeCeiling" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.account_scope_requires_binding", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.claim →\n plan.accountScope = true →\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.scope (Auths.Product.SubmitOrder.Event.scope true) ∧\n ∃ argument, Auths.Product.SubmitOrder.Verified (Auths.Product.SubmitOrder.steps plan pre) argument", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Nat", + "Bool.true", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Verified", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.Action.claim", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.Event.scope", + "Auths.Product.SubmitOrder.Phase.scope", + "Auths.Product.SubmitOrder.Plan.accountScope" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.at_most_one_send", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (events : List Auths.Product.SubmitOrder.Event),\n List.count Auths.Product.SubmitOrder.Action.send\n (List.map Auths.Product.SubmitOrder.Step.action (Auths.Product.SubmitOrder.steps plan events)) ≤\n 1 ∧\n (Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan events)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.replay) →\n ¬Auths.Product.SubmitOrder.Emitted (Auths.Product.SubmitOrder.steps plan events)\n Auths.Product.SubmitOrder.Action.send)", + "statement_constants": [ + "And", + "List", + "Nat", + "Not", + "instBEqOfDecidableEq", + "instLENat", + "instOfNatNat", + "LE.le", + "List.count", + "List.map", + "OfNat.ofNat", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Emitted", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Step", + "Auths.Product.SubmitOrder.instDecidableEqAction", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.Action.send", + "Auths.Product.SubmitOrder.ClaimResult.replay", + "Auths.Product.SubmitOrder.Event.claim", + "Auths.Product.SubmitOrder.Phase.claim", + "Auths.Product.SubmitOrder.Step.action" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.pre_claim_refusal_stores_nothing", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event),\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.stop Auths.Product.SubmitOrder.Stop.refused →\n ∀ step ∈ Auths.Product.SubmitOrder.steps plan pre,\n Auths.Product.SubmitOrder.preClaimAction step.action = true ∧\n Auths.Product.SubmitOrder.writesStore step.action = false ∧\n Auths.Product.SubmitOrder.leasesOrSends step.action = false", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Bool.false", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Step", + "Auths.Product.SubmitOrder.leasesOrSends", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.preClaimAction", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.writesStore", + "Auths.Product.SubmitOrder.Action.stop", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.Step.action", + "Auths.Product.SubmitOrder.Stop.refused" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.not_entered_refusal_table", + "statement": "∀ (state : Auths.Product.SubmitOrder.State) (event : Auths.Product.SubmitOrder.Event)\n (refusal : Auths.Product.SubmitOrder.Refusal),\n (Auths.Product.SubmitOrder.nextStep state event).action = Auths.Product.SubmitOrder.Action.recordNotEntered refusal ↔\n Auths.Product.SubmitOrder.refusalOf state event = some refusal", + "statement_constants": [ + "Eq", + "Iff", + "Option", + "Option.some", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Refusal", + "Auths.Product.SubmitOrder.State", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.refusalOf", + "Auths.Product.SubmitOrder.Action.recordNotEntered", + "Auths.Product.SubmitOrder.Decision.action" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SubmitOrder", + "name": "Auths.Product.SubmitOrder.post_claim_refusal_records_not_entered", + "statement": "∀ (plan : Auths.Product.SubmitOrder.Plan) (pre : List Auths.Product.SubmitOrder.Event)\n (event : Auths.Product.SubmitOrder.Event) (refusal : Auths.Product.SubmitOrder.Refusal),\n ((Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.recordNotEntered refusal ↔\n Auths.Product.SubmitOrder.Answered (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Phase.claim\n (Auths.Product.SubmitOrder.Event.claim Auths.Product.SubmitOrder.ClaimResult.inserted) ∧\n Auths.Product.SubmitOrder.refusalOf (Auths.Product.SubmitOrder.stateAfter plan pre) event = some refusal) ∧\n ((Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).action =\n Auths.Product.SubmitOrder.Action.recordNotEntered refusal →\n (Auths.Product.SubmitOrder.nextStep (Auths.Product.SubmitOrder.stateAfter plan pre) event).state.phase =\n Auths.Product.SubmitOrder.Phase.recordNotEntered ∧\n (Auths.Product.SubmitOrder.Emitted (Auths.Product.SubmitOrder.steps plan pre)\n Auths.Product.SubmitOrder.Action.send →\n refusal = Auths.Product.SubmitOrder.Refusal.transportNotEntered))", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Option", + "Option.some", + "Auths.Product.SubmitOrder.Action", + "Auths.Product.SubmitOrder.Answered", + "Auths.Product.SubmitOrder.Emitted", + "Auths.Product.SubmitOrder.Event", + "Auths.Product.SubmitOrder.Phase", + "Auths.Product.SubmitOrder.Plan", + "Auths.Product.SubmitOrder.Refusal", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.SubmitOrder.refusalOf", + "Auths.Product.SubmitOrder.stateAfter", + "Auths.Product.SubmitOrder.steps", + "Auths.Product.SubmitOrder.Action.recordNotEntered", + "Auths.Product.SubmitOrder.Action.send", + "Auths.Product.SubmitOrder.ClaimResult.inserted", + "Auths.Product.SubmitOrder.Decision.action", + "Auths.Product.SubmitOrder.Decision.state", + "Auths.Product.SubmitOrder.Event.claim", + "Auths.Product.SubmitOrder.Phase.claim", + "Auths.Product.SubmitOrder.Phase.recordNotEntered", + "Auths.Product.SubmitOrder.Refusal.transportNotEntered", + "Auths.Product.SubmitOrder.State.phase" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.RelativeCeiling", + "name": "Auths.Product.RelativeCeiling.relative_ceiling_exact", + "statement": "∀ (argument basis basisPoints : ℕ),\n Auths.Product.RelativeCeiling.admits argument basis basisPoints = true ↔\n argument ≤ basis * basisPoints / Auths.Product.RelativeCeiling.basisPointsPerWhole", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "Nat", + "instHDiv", + "instHMul", + "instLENat", + "instMulNat", + "Bool.true", + "HDiv.hDiv", + "HMul.hMul", + "LE.le", + "Nat.instDiv", + "Auths.Product.RelativeCeiling.admits", + "Auths.Product.RelativeCeiling.basisPointsPerWhole" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.RelativeCeiling", + "name": "Auths.Product.RelativeCeiling.relative_ceiling_never_exceeds_ratio", + "statement": "∀ (argument basis basisPoints : ℕ),\n Auths.Product.RelativeCeiling.admits argument basis basisPoints = true →\n argument * Auths.Product.RelativeCeiling.basisPointsPerWhole ≤ basis * basisPoints", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instHMul", + "instLENat", + "instMulNat", + "Bool.true", + "HMul.hMul", + "LE.le", + "Auths.Product.RelativeCeiling.admits", + "Auths.Product.RelativeCeiling.basisPointsPerWhole" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.RelativeCeiling", + "name": "Auths.Product.RelativeCeiling.relative_ceiling_monotone", + "statement": "(∀ (argument argument' basis basis' basisPoints basisPoints' : ℕ),\n argument' ≤ argument →\n basis ≤ basis' →\n basisPoints ≤ basisPoints' →\n Auths.Product.RelativeCeiling.admits argument basis basisPoints = true →\n Auths.Product.RelativeCeiling.admits argument' basis' basisPoints' = true) ∧\n (∀ (argument basisPoints : ℕ), Auths.Product.RelativeCeiling.admits argument 0 basisPoints = true ↔ argument = 0) ∧\n ∀ (argument basis : ℕ), Auths.Product.RelativeCeiling.admits argument basis 0 = true ↔ argument = 0", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "Nat", + "instLENat", + "instOfNatNat", + "Bool.true", + "LE.le", + "OfNat.ofNat", + "Auths.Product.RelativeCeiling.admits" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.RelativeCeiling", + "name": "Auths.Product.RelativeCeiling.relative_basis_never_negative", + "statement": "∀ (value : ℕ),\n Auths.Product.RelativeCeiling.relativeBasis value none = some value ∧\n (∀ (second basis : ℕ),\n Auths.Product.RelativeCeiling.relativeBasis value (some second) = some basis ↔\n second ≤ value ∧ basis + second = value) ∧\n (∀ (second : ℕ), Auths.Product.RelativeCeiling.relativeBasis value (some second) = none ↔ value < second) ∧\n ∀ (subtrahend : Option ℕ) (basis : ℕ),\n Auths.Product.RelativeCeiling.relativeBasis value subtrahend = some basis → basis ≤ value", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Nat", + "Option", + "instAddNat", + "instHAdd", + "instLENat", + "instLTNat", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "Option.none", + "Option.some", + "Auths.Product.RelativeCeiling.relativeBasis" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.RequestConstruction", + "name": "Auths.Product.RequestConstruction.method_and_origin_fixed", + "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n request.method = plan.method ∧ plan.origin <+: request.url) ∧\n ∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n request.method = Auths.Product.RequestConstruction.Method.get ∧ plan.origin <+: request.url", + "statement_constants": [ + "And", + "Eq", + "Except", + "List", + "Nat", + "Except.ok", + "List.IsPrefix", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.Method", + "Auths.Product.RequestConstruction.ReadPlan", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.WritePlan", + "Auths.Product.RequestConstruction.constructActionRead", + "Auths.Product.RequestConstruction.constructWrite", + "Auths.Product.RequestConstruction.Method.get", + "Auths.Product.RequestConstruction.ReadPlan.origin", + "Auths.Product.RequestConstruction.Request.method", + "Auths.Product.RequestConstruction.Request.url", + "Auths.Product.RequestConstruction.WritePlan.method", + "Auths.Product.RequestConstruction.WritePlan.origin" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.RequestConstruction", + "name": "Auths.Product.RequestConstruction.path_from_declared_segments", + "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n request.url = plan.origin ++ Auths.Product.RequestConstruction.renderPath arguments plan.path ∧\n ∀ segment ∈ plan.path,\n match segment with\n | Auths.Product.RequestConstruction.Segment.fixed value => True\n | Auths.Product.RequestConstruction.Segment.field index =>\n ∃ text,\n arguments[index]? = some (Auths.Product.RequestConstruction.Arg.text text) ∧\n Auths.Product.RequestConstruction.segmentValueValid text = true ∧\n Auths.Product.RequestConstruction.segmentBytes arguments segment =\n Auths.Product.RequestConstruction.pathEncode text) ∧\n (∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n request.url = plan.origin ++ Auths.Product.RequestConstruction.renderPath arguments plan.path) ∧\n ∀ (text : Auths.Product.RequestConstruction.Bytes) (separator : ℕ),\n separator = 47 ∨ separator = 63 ∨ separator = 35 → separator ∉ Auths.Product.RequestConstruction.pathEncode text", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Except", + "Exists", + "List", + "Nat", + "Not", + "Option", + "Or", + "True", + "instHAppendOfAppend", + "instLTNat", + "instOfNatNat", + "Bool.true", + "Except.ok", + "GetElem?.getElem?", + "HAppend.hAppend", + "LT.lt", + "List.instAppend", + "List.instGetElem?NatLtLength", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Option.some", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.ReadPlan", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.Segment", + "Auths.Product.RequestConstruction.WritePlan", + "Auths.Product.RequestConstruction.constructActionRead", + "Auths.Product.RequestConstruction.constructWrite", + "Auths.Product.RequestConstruction.pathEncode", + "Auths.Product.RequestConstruction.renderPath", + "Auths.Product.RequestConstruction.segmentBytes", + "Auths.Product.RequestConstruction.segmentValueValid", + "Auths.Product.RequestConstruction.Arg.text", + "Auths.Product.RequestConstruction.ReadPlan.origin", + "Auths.Product.RequestConstruction.ReadPlan.path", + "Auths.Product.RequestConstruction.Request.url", + "Auths.Product.RequestConstruction.WritePlan.origin", + "Auths.Product.RequestConstruction.WritePlan.path", + "Auths.Product.RequestConstruction.segmentError.match_5" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.RequestConstruction", + "name": "Auths.Product.RequestConstruction.headers_within_declaration", + "statement": "∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n ∀ header ∈ request.headers,\n header ∈ plan.headers.versions ∨\n (∃ scope, plan.headers.scope = some scope ∧ header.name = scope.name) ∨\n ∃ «name», plan.idempotency = some «name» ∧ header = { «name» := «name», value := key }", + "statement_constants": [ + "And", + "Eq", + "Except", + "Exists", + "List", + "Option", + "Or", + "Except.ok", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.Header", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.ScopePlan", + "Auths.Product.RequestConstruction.WritePlan", + "Auths.Product.RequestConstruction.constructWrite", + "Auths.Product.RequestConstruction.Header.mk", + "Auths.Product.RequestConstruction.Header.name", + "Auths.Product.RequestConstruction.HeaderPlan.scope", + "Auths.Product.RequestConstruction.HeaderPlan.versions", + "Auths.Product.RequestConstruction.Request.headers", + "Auths.Product.RequestConstruction.ScopePlan.name", + "Auths.Product.RequestConstruction.WritePlan.headers", + "Auths.Product.RequestConstruction.WritePlan.idempotency" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.RequestConstruction", + "name": "Auths.Product.RequestConstruction.account_scope_header_exact", + "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request)\n (scope : Auths.Product.RequestConstruction.ScopePlan),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n plan.headers.scope = some scope →\n ∃ value,\n arguments[scope.field]? = some (Auths.Product.RequestConstruction.Arg.text value) ∧\n Auths.Product.RequestConstruction.scopeValueValid value = true ∧\n { «name» := scope.name, value := value } ∈ request.headers) ∧\n (∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request) (scope : Auths.Product.RequestConstruction.ScopePlan),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n plan.headers.scope = some scope →\n ∃ value,\n arguments[scope.field]? = some (Auths.Product.RequestConstruction.Arg.text value) ∧\n Auths.Product.RequestConstruction.scopeValueValid value = true ∧\n request.headers = plan.headers.versions ++ [{ «name» := scope.name, value := value }]) ∧\n (∀ (plan : Auths.Product.RequestConstruction.CredentialPlan),\n (Auths.Product.RequestConstruction.constructCredentialRead plan).headers = plan.versions) ∧\n (∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n plan.headers.scope = none →\n request.headers = Auths.Product.RequestConstruction.writeHeaders plan plan.headers.versions key) ∧\n ∀ (plan : Auths.Product.RequestConstruction.ReadPlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructActionRead plan arguments = Except.ok request →\n plan.headers.scope = none → request.headers = plan.headers.versions", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Except", + "Exists", + "List", + "Nat", + "Option", + "instHAppendOfAppend", + "instLTNat", + "Bool.true", + "Except.ok", + "GetElem?.getElem?", + "HAppend.hAppend", + "LT.lt", + "List.cons", + "List.instAppend", + "List.instGetElem?NatLtLength", + "List.instMembership", + "List.length", + "List.nil", + "Membership.mem", + "Option.none", + "Option.some", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.CredentialPlan", + "Auths.Product.RequestConstruction.Header", + "Auths.Product.RequestConstruction.ReadPlan", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.ScopePlan", + "Auths.Product.RequestConstruction.WritePlan", + "Auths.Product.RequestConstruction.constructActionRead", + "Auths.Product.RequestConstruction.constructCredentialRead", + "Auths.Product.RequestConstruction.constructWrite", + "Auths.Product.RequestConstruction.scopeValueValid", + "Auths.Product.RequestConstruction.writeHeaders", + "Auths.Product.RequestConstruction.Arg.text", + "Auths.Product.RequestConstruction.CredentialPlan.versions", + "Auths.Product.RequestConstruction.Header.mk", + "Auths.Product.RequestConstruction.HeaderPlan.scope", + "Auths.Product.RequestConstruction.HeaderPlan.versions", + "Auths.Product.RequestConstruction.ReadPlan.headers", + "Auths.Product.RequestConstruction.Request.headers", + "Auths.Product.RequestConstruction.ScopePlan.field", + "Auths.Product.RequestConstruction.ScopePlan.name", + "Auths.Product.RequestConstruction.WritePlan.headers" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.RequestConstruction", + "name": "Auths.Product.RequestConstruction.credential_reads_fixed", + "statement": "∀ (plan : Auths.Product.RequestConstruction.CredentialPlan),\n (Auths.Product.RequestConstruction.constructCredentialRead plan).method = plan.method ∧\n (Auths.Product.RequestConstruction.constructCredentialRead plan).url =\n plan.origin ++ List.flatMap (fun segment => 47 :: segment) plan.path ∧\n (Auths.Product.RequestConstruction.constructCredentialRead plan).headers = plan.versions ∧\n (Auths.Product.RequestConstruction.constructCredentialRead plan).body = [] ∧\n (plan.method = Auths.Product.RequestConstruction.Method.get ∨\n plan.method = Auths.Product.RequestConstruction.Method.head →\n (Auths.Product.RequestConstruction.constructCredentialRead plan).method =\n Auths.Product.RequestConstruction.Method.get ∨\n (Auths.Product.RequestConstruction.constructCredentialRead plan).method =\n Auths.Product.RequestConstruction.Method.head)", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Or", + "instHAppendOfAppend", + "instOfNatNat", + "HAppend.hAppend", + "List.cons", + "List.flatMap", + "List.instAppend", + "List.nil", + "OfNat.ofNat", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.CredentialPlan", + "Auths.Product.RequestConstruction.Header", + "Auths.Product.RequestConstruction.Method", + "Auths.Product.RequestConstruction.constructCredentialRead", + "Auths.Product.RequestConstruction.CredentialPlan.method", + "Auths.Product.RequestConstruction.CredentialPlan.origin", + "Auths.Product.RequestConstruction.CredentialPlan.path", + "Auths.Product.RequestConstruction.CredentialPlan.versions", + "Auths.Product.RequestConstruction.Method.get", + "Auths.Product.RequestConstruction.Method.head", + "Auths.Product.RequestConstruction.Request.body", + "Auths.Product.RequestConstruction.Request.headers", + "Auths.Product.RequestConstruction.Request.method", + "Auths.Product.RequestConstruction.Request.url" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.RequestConstruction", + "name": "Auths.Product.RequestConstruction.body_bounded", + "statement": "(∀ (plan : Auths.Product.RequestConstruction.WritePlan) (arguments : List Auths.Product.RequestConstruction.Arg)\n (echo key : Auths.Product.RequestConstruction.Bytes) (request : Auths.Product.RequestConstruction.Request),\n Auths.Product.RequestConstruction.constructWrite plan arguments echo key = Except.ok request →\n 0 < List.length request.body ∧\n List.length request.body ≤ Auths.Product.RequestConstruction.maxBodyBytes ∧\n request.body = Auths.Product.RequestConstruction.renderBody arguments echo plan.body) ∧\n ∀ (plan : Auths.Product.RequestConstruction.BodyPlan) (echo : Auths.Product.RequestConstruction.Bytes)\n (left right : List Auths.Product.RequestConstruction.Arg),\n (∀ index ∈ Auths.Product.RequestConstruction.bodyFields plan, left[index]? = right[index]?) →\n Auths.Product.RequestConstruction.renderBody left echo plan =\n Auths.Product.RequestConstruction.renderBody right echo plan", + "statement_constants": [ + "And", + "Eq", + "Except", + "List", + "Nat", + "Option", + "instLENat", + "instLTNat", + "instOfNatNat", + "Except.ok", + "GetElem?.getElem?", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.RequestConstruction.Arg", + "Auths.Product.RequestConstruction.BodyPlan", + "Auths.Product.RequestConstruction.Bytes", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.WritePlan", + "Auths.Product.RequestConstruction.bodyFields", + "Auths.Product.RequestConstruction.constructWrite", + "Auths.Product.RequestConstruction.maxBodyBytes", + "Auths.Product.RequestConstruction.renderBody", + "Auths.Product.RequestConstruction.Request.body", + "Auths.Product.RequestConstruction.WritePlan.body" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_start_refines_model", + "statement": "∀ (plan : auths_gateway_kernel.order.SubmitPlan),\n ∃ state,\n auths_gateway_kernel.order.start plan = Aeneas.Std.Result.ok state ∧\n Auths.Product.Refinement.Gateway.stateOf state =\n Auths.Product.SubmitOrder.start (Auths.Product.Refinement.Gateway.planOf plan)", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Aeneas.Std.Result", + "auths_gateway_kernel.order.SubmitPlan", + "auths_gateway_kernel.order.SubmitState", + "auths_gateway_kernel.order.start", + "Aeneas.Std.Result.ok", + "Auths.Product.SubmitOrder.State", + "Auths.Product.SubmitOrder.start", + "Auths.Product.Refinement.Gateway.planOf", + "Auths.Product.Refinement.Gateway.stateOf" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_recovery_capability_refines_model", + "statement": "∀ (declarations : auths_gateway_kernel.recovery.RecoveryDeclarations),\n Aeneas.Std.WP.spec (auths_gateway_kernel.recovery.recovery_capability declarations) fun capability =>\n Auths.Product.Refinement.Gateway.capabilityOf capability =\n Auths.Product.Recovery.capability (Auths.Product.Refinement.Gateway.declarationsOf declarations)", + "statement_constants": [ + "Eq", + "auths_gateway_kernel.recovery.RecoveryCapability", + "auths_gateway_kernel.recovery.RecoveryDeclarations", + "auths_gateway_kernel.recovery.recovery_capability", + "Aeneas.Std.WP.spec", + "Auths.Product.Recovery.Capability", + "Auths.Product.Recovery.capability", + "Auths.Product.Refinement.Gateway.capabilityOf", + "Auths.Product.Refinement.Gateway.declarationsOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_construct_write_refines_model", + "statement": "∀ (plan : auths_gateway_kernel.construct.WritePlan)\n (arguments : Aeneas.Std.Slice auths_gateway_kernel.construct.ArgumentValue)\n (echo key : Aeneas.Std.Slice Aeneas.Std.U8),\n Auths.Product.Refinement.Gateway.WriteFits plan arguments echo key →\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.construct_write plan arguments echo key) fun result =>\n Auths.Product.Refinement.Gateway.resultOf Auths.Product.Refinement.Gateway.requestOf result =\n Auths.Product.RequestConstruction.constructWrite (Auths.Product.Refinement.Gateway.writePlanOf plan)\n (Auths.Product.Refinement.Gateway.argsOf arguments) (Auths.Product.Refinement.Gateway.byteList ↑echo)\n (Auths.Product.Refinement.Gateway.byteList ↑key)", + "statement_constants": [ + "Eq", + "Except", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.construct.ArgumentValue", + "auths_gateway_kernel.construct.BuiltRequest", + "auths_gateway_kernel.construct.ConstructError", + "auths_gateway_kernel.construct.WritePlan", + "auths_gateway_kernel.construct.construct_write", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.constructWrite", + "Aeneas.Std.core.result.Result", + "Auths.Product.Refinement.Gateway.WriteFits", + "Auths.Product.Refinement.Gateway.argsOf", + "Auths.Product.Refinement.Gateway.byteList", + "Auths.Product.Refinement.Gateway.requestOf", + "Auths.Product.Refinement.Gateway.resultOf", + "Auths.Product.Refinement.Gateway.writePlanOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_construct_action_read_refines_model", + "statement": "∀ (plan : auths_gateway_kernel.construct.ActionReadPlan)\n (arguments : Aeneas.Std.Slice auths_gateway_kernel.construct.ArgumentValue),\n Auths.Product.Refinement.Gateway.ReadFits plan arguments →\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.construct_action_read plan arguments) fun result =>\n Auths.Product.Refinement.Gateway.resultOf Auths.Product.Refinement.Gateway.requestOf result =\n Auths.Product.RequestConstruction.constructActionRead (Auths.Product.Refinement.Gateway.readPlanOf plan)\n (Auths.Product.Refinement.Gateway.argsOf arguments)", + "statement_constants": [ + "Eq", + "Except", + "Aeneas.Std.Slice", + "auths_gateway_kernel.construct.ActionReadPlan", + "auths_gateway_kernel.construct.ArgumentValue", + "auths_gateway_kernel.construct.BuiltRequest", + "auths_gateway_kernel.construct.ConstructError", + "auths_gateway_kernel.construct.construct_action_read", + "Aeneas.Std.WP.spec", + "Auths.Product.RequestConstruction.ConstructError", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.constructActionRead", + "Aeneas.Std.core.result.Result", + "Auths.Product.Refinement.Gateway.ReadFits", + "Auths.Product.Refinement.Gateway.argsOf", + "Auths.Product.Refinement.Gateway.readPlanOf", + "Auths.Product.Refinement.Gateway.requestOf", + "Auths.Product.Refinement.Gateway.resultOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_construct_credential_read_refines_model", + "statement": "∀ (plan : auths_gateway_kernel.construct.CredentialReadPlan),\n Auths.Product.Refinement.Gateway.CredentialFits plan →\n Aeneas.Std.WP.spec (auths_gateway_kernel.construct.construct_credential_read plan) fun request =>\n Auths.Product.Refinement.Gateway.requestOf request =\n Auths.Product.RequestConstruction.constructCredentialRead\n (Auths.Product.Refinement.Gateway.credentialPlanOf plan)", + "statement_constants": [ + "Eq", + "auths_gateway_kernel.construct.BuiltRequest", + "auths_gateway_kernel.construct.CredentialReadPlan", + "auths_gateway_kernel.construct.construct_credential_read", + "Aeneas.Std.WP.spec", + "Auths.Product.RequestConstruction.Request", + "Auths.Product.RequestConstruction.constructCredentialRead", + "Auths.Product.Refinement.Gateway.CredentialFits", + "Auths.Product.Refinement.Gateway.credentialPlanOf", + "Auths.Product.Refinement.Gateway.requestOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_next_step_refines_model", + "statement": "∀ (state : auths_gateway_kernel.order.SubmitState) (event : auths_gateway_kernel.order.SubmitEvent),\n Aeneas.Std.WP.spec (auths_gateway_kernel.order.next_step state event) fun decision =>\n Auths.Product.Refinement.Gateway.decisionOf decision =\n Auths.Product.SubmitOrder.nextStep (Auths.Product.Refinement.Gateway.stateOf state)\n (Auths.Product.Refinement.Gateway.eventOf event)", + "statement_constants": [ + "Eq", + "auths_gateway_kernel.order.SubmitDecision", + "auths_gateway_kernel.order.SubmitEvent", + "auths_gateway_kernel.order.SubmitState", + "auths_gateway_kernel.order.next_step", + "Aeneas.Std.WP.spec", + "Auths.Product.SubmitOrder.Decision", + "Auths.Product.SubmitOrder.nextStep", + "Auths.Product.Refinement.Gateway.decisionOf", + "Auths.Product.Refinement.Gateway.eventOf", + "Auths.Product.Refinement.Gateway.stateOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_valid_transition_refines_model", + "statement": "∀ (old new : auths_gateway_kernel.transition.AttemptView),\n Aeneas.Std.WP.spec (auths_gateway_kernel.transition.valid_transition old new) fun valid =>\n valid =\n Auths.Product.Recovery.validTransition (Auths.Product.Refinement.Gateway.viewOf old)\n (Auths.Product.Refinement.Gateway.viewOf new)", + "statement_constants": [ + "Bool", + "Eq", + "auths_gateway_kernel.transition.AttemptView", + "auths_gateway_kernel.transition.valid_transition", + "Aeneas.Std.WP.spec", + "Auths.Product.Recovery.validTransition", + "Auths.Product.Refinement.Gateway.viewOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_relative_basis_refines_model", + "statement": "∀ (value : Aeneas.Std.U64) (subtrahend : Option Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_gateway_kernel.ratio.relative_basis value subtrahend) fun basis =>\n Option.map (fun x => ↑x) basis =\n Auths.Product.RelativeCeiling.relativeBasis (↑value) (Option.map (fun x => ↑x) subtrahend)", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Option.map", + "Aeneas.Std.U64", + "auths_gateway_kernel.ratio.relative_basis", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.Product.RelativeCeiling.relativeBasis" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Gateway", + "name": "Auths.Product.Refinement.Gateway.translated_relative_ceiling_admits_refines_model", + "statement": "∀ (argument basis : Aeneas.Std.U64) (basisPoints : Aeneas.Std.U16),\n Aeneas.Std.WP.spec (auths_gateway_kernel.ratio.relative_ceiling_admits argument basis basisPoints) fun admitted =>\n admitted = Auths.Product.RelativeCeiling.admits ↑argument ↑basis ↑basisPoints", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.U16", + "Aeneas.Std.U64", + "auths_gateway_kernel.ratio.relative_ceiling_admits", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.Product.RelativeCeiling.admits" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.retained_generation_exact", + "statement": "∀ (record : ℕ) (stored : List ℕ) (result : ℕ),\n Auths.Product.ConnectionGenerations.retainedGeneration record stored = some result ↔\n result ∈ stored ∧ result ≤ record ∧ ∀ x ∈ stored, x ≤ record → x ≤ result", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Product.ConnectionGenerations.retainedGeneration" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.lease_generation_exact", + "statement": "∀ (record credential : ℕ) (stored : List ℕ) (result : ℕ),\n Auths.Product.ConnectionGenerations.leaseGeneration record credential stored = some result ↔\n result = credential ∧ credential ∈ stored ∧ credential ≤ record ∧ ∀ x ∈ stored, x ≤ record → x ≤ credential", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.instMembership", + "Membership.mem", + "Option.some", + "Auths.Product.ConnectionGenerations.leaseGeneration" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.credential_generation_le_generation", + "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n Auths.Product.ConnectionGenerations.Reachable σ →\n σ.record.generations.credentialGeneration ≤ σ.record.generations.generation", + "statement_constants": [ + "Nat", + "instLENat", + "LE.le", + "Auths.Product.ConnectionGenerations.Reachable", + "Auths.Product.ConnectionGenerations.System", + "Auths.Product.ConnectionGenerations.Generations.credentialGeneration", + "Auths.Product.ConnectionGenerations.Generations.generation", + "Auths.Product.ConnectionGenerations.Record.generations", + "Auths.Product.ConnectionGenerations.System.record" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.state_change_preserves_credential_generation", + "statement": "(∀ (current next : Auths.Product.ConnectionGenerations.Generations),\n Auths.Product.ConnectionGenerations.stateChange current = some next →\n next.generation = current.generation + 1 ∧ next.credentialGeneration = current.credentialGeneration) ∧\n ∀ (σ : Auths.Product.ConnectionGenerations.System) (change : Auths.Product.ConnectionGenerations.StateChange),\n ∃ generation state,\n ((Auths.Product.ConnectionGenerations.step σ change.event).record =\n have __src := σ.record;\n {\n generations :=\n have __src := σ.record.generations;\n { generation := generation, credentialGeneration := __src.credentialGeneration },\n state := state, secret := __src.secret }) ∧\n (Auths.Product.ConnectionGenerations.step σ change.event).stores = σ.stores ∧\n (generation = σ.record.generations.generation ∨ generation = σ.record.generations.generation + 1)", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Nat", + "Option", + "Or", + "instAddNat", + "instHAdd", + "instOfNatNat", + "HAdd.hAdd", + "OfNat.ofNat", + "Option.some", + "Auths.Product.ConnectionGenerations.ConnectionState", + "Auths.Product.ConnectionGenerations.Generations", + "Auths.Product.ConnectionGenerations.Record", + "Auths.Product.ConnectionGenerations.StateChange", + "Auths.Product.ConnectionGenerations.Store", + "Auths.Product.ConnectionGenerations.System", + "Auths.Product.ConnectionGenerations.stateChange", + "Auths.Product.ConnectionGenerations.step", + "Auths.Product.ConnectionGenerations.Generations.credentialGeneration", + "Auths.Product.ConnectionGenerations.Generations.generation", + "Auths.Product.ConnectionGenerations.Generations.mk", + "Auths.Product.ConnectionGenerations.Record.generations", + "Auths.Product.ConnectionGenerations.Record.mk", + "Auths.Product.ConnectionGenerations.Record.secret", + "Auths.Product.ConnectionGenerations.StateChange.event", + "Auths.Product.ConnectionGenerations.System.record", + "Auths.Product.ConnectionGenerations.System.stores" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.lease_selects_credential_generation", + "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n Auths.Product.ConnectionGenerations.Reachable σ →\n ∀ (host selected : ℕ),\n Auths.Product.ConnectionGenerations.lease σ.record (σ.stores host) = some selected ↔\n σ.record.state ≠ Auths.Product.ConnectionGenerations.ConnectionState.revoked ∧\n selected = σ.record.generations.credentialGeneration ∧\n (σ.record.generations.credentialGeneration, σ.record.secret) ∈ σ.stores host", + "statement_constants": [ + "And", + "Eq", + "Iff", + "Nat", + "Ne", + "Option", + "Prod", + "List.instMembership", + "Membership.mem", + "Option.some", + "Prod.mk", + "Auths.Product.ConnectionGenerations.ConnectionState", + "Auths.Product.ConnectionGenerations.Reachable", + "Auths.Product.ConnectionGenerations.Store", + "Auths.Product.ConnectionGenerations.System", + "Auths.Product.ConnectionGenerations.lease", + "Auths.Product.ConnectionGenerations.ConnectionState.revoked", + "Auths.Product.ConnectionGenerations.Generations.credentialGeneration", + "Auths.Product.ConnectionGenerations.Record.generations", + "Auths.Product.ConnectionGenerations.Record.secret", + "Auths.Product.ConnectionGenerations.Record.state", + "Auths.Product.ConnectionGenerations.System.record", + "Auths.Product.ConnectionGenerations.System.stores" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.join_after_state_changes", + "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n Auths.Product.ConnectionGenerations.Reachable σ →\n σ.record.state ≠ Auths.Product.ConnectionGenerations.ConnectionState.revoked →\n ∀ (changes : List Auths.Product.ConnectionGenerations.StateChange) (host : ℕ),\n Auths.Product.ConnectionGenerations.lease\n (Auths.Product.ConnectionGenerations.step (Auths.Product.ConnectionGenerations.applyChanges σ changes)\n (Auths.Product.ConnectionGenerations.Event.join host σ.record.secret)).record\n ((Auths.Product.ConnectionGenerations.step (Auths.Product.ConnectionGenerations.applyChanges σ changes)\n (Auths.Product.ConnectionGenerations.Event.join host σ.record.secret)).stores\n host) =\n some σ.record.generations.credentialGeneration", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Ne", + "Option", + "Option.some", + "Auths.Product.ConnectionGenerations.ConnectionState", + "Auths.Product.ConnectionGenerations.Reachable", + "Auths.Product.ConnectionGenerations.StateChange", + "Auths.Product.ConnectionGenerations.System", + "Auths.Product.ConnectionGenerations.applyChanges", + "Auths.Product.ConnectionGenerations.lease", + "Auths.Product.ConnectionGenerations.step", + "Auths.Product.ConnectionGenerations.ConnectionState.revoked", + "Auths.Product.ConnectionGenerations.Event.join", + "Auths.Product.ConnectionGenerations.Generations.credentialGeneration", + "Auths.Product.ConnectionGenerations.Record.generations", + "Auths.Product.ConnectionGenerations.Record.secret", + "Auths.Product.ConnectionGenerations.Record.state", + "Auths.Product.ConnectionGenerations.System.record", + "Auths.Product.ConnectionGenerations.System.stores" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionGenerations", + "name": "Auths.Product.ConnectionGenerations.revoked_never_leases", + "statement": "∀ {σ : Auths.Product.ConnectionGenerations.System},\n σ.record.state = Auths.Product.ConnectionGenerations.ConnectionState.revoked →\n ∀ (events : List Auths.Product.ConnectionGenerations.Event) (host : ℕ),\n Auths.Product.ConnectionGenerations.lease (Auths.Product.ConnectionGenerations.run σ events).record\n ((Auths.Product.ConnectionGenerations.run σ events).stores host) =\n none", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "Option.none", + "Auths.Product.ConnectionGenerations.ConnectionState", + "Auths.Product.ConnectionGenerations.Event", + "Auths.Product.ConnectionGenerations.System", + "Auths.Product.ConnectionGenerations.lease", + "Auths.Product.ConnectionGenerations.run", + "Auths.Product.ConnectionGenerations.ConnectionState.revoked", + "Auths.Product.ConnectionGenerations.Record.state", + "Auths.Product.ConnectionGenerations.System.record", + "Auths.Product.ConnectionGenerations.System.stores" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Connections", + "name": "Auths.Product.Refinement.Connections.translated_next_generation_refines_model", + "statement": "∀ (generation : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.next_generation generation) fun next =>\n Option.map (fun x => ↑x) next = Auths.Product.ConnectionGenerations.nextGeneration ↑generation", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Option.map", + "Aeneas.Std.U64", + "auths_connections.kernel.next_generation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionGenerations.nextGeneration" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Connections", + "name": "Auths.Product.Refinement.Connections.translated_state_change_refines_model", + "statement": "∀ (current : auths_connections.kernel.Generations),\n Aeneas.Std.WP.spec (auths_connections.kernel.state_change current) fun next =>\n Option.map Auths.Product.Refinement.Connections.generationsOf next =\n Auths.Product.ConnectionGenerations.stateChange (Auths.Product.Refinement.Connections.generationsOf current)", + "statement_constants": [ + "Eq", + "Option", + "Option.map", + "auths_connections.kernel.Generations", + "auths_connections.kernel.state_change", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionGenerations.Generations", + "Auths.Product.ConnectionGenerations.stateChange", + "Auths.Product.Refinement.Connections.generationsOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Connections", + "name": "Auths.Product.Refinement.Connections.translated_rotation_refines_model", + "statement": "∀ (current : auths_connections.kernel.Generations),\n Aeneas.Std.WP.spec (auths_connections.kernel.rotation current) fun next =>\n Option.map Auths.Product.Refinement.Connections.generationsOf next =\n Auths.Product.ConnectionGenerations.rotation (Auths.Product.Refinement.Connections.generationsOf current)", + "statement_constants": [ + "Eq", + "Option", + "Option.map", + "auths_connections.kernel.Generations", + "auths_connections.kernel.rotation", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionGenerations.Generations", + "Auths.Product.ConnectionGenerations.rotation", + "Auths.Product.Refinement.Connections.generationsOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Connections", + "name": "Auths.Product.Refinement.Connections.translated_retained_generation_refines_model", + "statement": "∀ (record : Aeneas.Std.U64) (stored : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.retained_generation record stored) fun result =>\n Option.map (fun x => ↑x) result =\n Auths.Product.ConnectionGenerations.retainedGeneration (↑record) (List.map (fun x => ↑x) ↑stored)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Option.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_connections.kernel.retained_generation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionGenerations.retainedGeneration" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.Refinement.Connections", + "name": "Auths.Product.Refinement.Connections.translated_lease_generation_refines_model", + "statement": "∀ (record credential : Aeneas.Std.U64) (stored : Aeneas.Std.Slice Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.lease_generation record credential stored) fun result =>\n Option.map (fun x => ↑x) result =\n Auths.Product.ConnectionGenerations.leaseGeneration (↑record) (↑credential) (List.map (fun x => ↑x) ↑stored)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Option.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_connections.kernel.lease_generation", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionGenerations.leaseGeneration" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.additive_capacity_success_positive", + "statement": "∀ {ceiling committed active requested : ℕ},\n Auths.Lifecycle.additiveCapacityAvailable ceiling committed active requested = true → 0 < ceiling ∧ 0 < requested", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Nat", + "instLTNat", + "instOfNatNat", + "Bool.true", + "LT.lt", + "OfNat.ofNat", + "Auths.Lifecycle.additiveCapacityAvailable" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.additive_capacity_success_conserves", + "statement": "∀ {ceiling committed active requested : ℕ},\n Auths.Lifecycle.additiveCapacityAvailable ceiling committed active requested = true →\n committed + active + requested ≤ ceiling", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "Bool.true", + "HAdd.hAdd", + "LE.le", + "Auths.Lifecycle.additiveCapacityAvailable" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.additive_capacity_success_never_overflows_u64", + "statement": "∀ {ceiling committed active requested : ℕ},\n Auths.Lifecycle.additiveCapacityAvailable ceiling committed active requested = true →\n committed + active ≤ Auths.Lifecycle.u64Max ∧ committed + active + requested ≤ Auths.Lifecycle.u64Max", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "Bool.true", + "HAdd.hAdd", + "LE.le", + "Auths.Lifecycle.additiveCapacityAvailable", + "Auths.Lifecycle.u64Max" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.reserve_preserves_capacity", + "statement": "∀ {ledger next : Auths.Lifecycle.CapacityLedger} {requested : ℕ},\n ledger.valid → ledger.reserve requested = some next → next.valid", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Option.some", + "Auths.Lifecycle.CapacityLedger", + "Auths.Lifecycle.CapacityLedger.reserve", + "Auths.Lifecycle.CapacityLedger.valid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.commit_preserves_capacity", + "statement": "∀ {ledger next : Auths.Lifecycle.CapacityLedger} {amount : ℕ},\n ledger.valid → ledger.commit amount = some next → next.valid", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Option.some", + "Auths.Lifecycle.CapacityLedger", + "Auths.Lifecycle.CapacityLedger.commit", + "Auths.Lifecycle.CapacityLedger.valid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.release_preserves_capacity", + "statement": "∀ {ledger next : Auths.Lifecycle.CapacityLedger} {amount : ℕ},\n ledger.valid → ledger.release amount = some next → next.valid", + "statement_constants": [ + "Eq", + "Nat", + "Option", + "Option.some", + "Auths.Lifecycle.CapacityLedger", + "Auths.Lifecycle.CapacityLedger.release", + "Auths.Lifecycle.CapacityLedger.valid" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.exact_replay_is_stable", + "statement": "Auths.Lifecycle.replayCode true true = Auths.Lifecycle.ReplayCode.exactReplay", + "statement_constants": [ + "Eq", + "Bool.true", + "Auths.Lifecycle.ReplayCode", + "Auths.Lifecycle.replayCode", + "Auths.Lifecycle.ReplayCode.exactReplay" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.conflicting_replay_is_not_exact", + "statement": "Auths.Lifecycle.replayCode true false = Auths.Lifecycle.ReplayCode.conflict", + "statement_constants": [ + "Eq", + "Bool.false", + "Bool.true", + "Auths.Lifecycle.ReplayCode", + "Auths.Lifecycle.replayCode", + "Auths.Lifecycle.ReplayCode.conflict" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.absent_replay_never_claims_effect", + "statement": "∀ (commitmentsEqual : Bool), Auths.Lifecycle.replayCode false commitmentsEqual = Auths.Lifecycle.ReplayCode.absent", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Auths.Lifecycle.ReplayCode", + "Auths.Lifecycle.replayCode", + "Auths.Lifecycle.ReplayCode.absent" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.start_attempt_requires_credential", + "statement": "∀ {gates : Auths.Lifecycle.Gates},\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executionIntentRecorded)\n Auths.Lifecycle.Operation.startAttempt gates =\n Auths.Lifecycle.Code.applied Auths.Lifecycle.State.executing →\n gates.credentialAuthorized = true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.applied", + "Auths.Lifecycle.Gates.credentialAuthorized", + "Auths.Lifecycle.Operation.startAttempt", + "Auths.Lifecycle.State.executing", + "Auths.Lifecycle.State.executionIntentRecorded" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.provider_call_requires_attempt", + "statement": "∀ {gates : Auths.Lifecycle.Gates},\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executing)\n Auths.Lifecycle.Operation.markProviderCallEntered gates =\n Auths.Lifecycle.Code.applied Auths.Lifecycle.State.executing →\n gates.attemptPresent = true", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.applied", + "Auths.Lifecycle.Gates.attemptPresent", + "Auths.Lifecycle.Operation.markProviderCallEntered", + "Auths.Lifecycle.State.executing" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.commit_requires_provider_entry_and_effect", + "statement": "∀ {gates : Auths.Lifecycle.Gates},\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executing) Auths.Lifecycle.Operation.commit gates =\n Auths.Lifecycle.Code.applied Auths.Lifecycle.State.committed →\n gates.attemptPresent = true ∧ gates.providerCallEntered = true ∧ gates.definiteEffect = true", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Bool.true", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.applied", + "Auths.Lifecycle.Gates.attemptPresent", + "Auths.Lifecycle.Gates.definiteEffect", + "Auths.Lifecycle.Gates.providerCallEntered", + "Auths.Lifecycle.Operation.commit", + "Auths.Lifecycle.State.committed", + "Auths.Lifecycle.State.executing" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.outcome_unknown_cannot_release", + "statement": "∀ (gates : Auths.Lifecycle.Gates),\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.outcomeUnknown) Auths.Lifecycle.Operation.release gates =\n Auths.Lifecycle.Code.illegalTransition", + "statement_constants": [ + "Eq", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.illegalTransition", + "Auths.Lifecycle.Operation.release", + "Auths.Lifecycle.State.outcomeUnknown" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.outcome_unknown_only_reconciliation_can_terminate", + "statement": "∀ {operation : Auths.Lifecycle.Operation} {gates : Auths.Lifecycle.Gates} {terminal : Auths.Lifecycle.State},\n terminal = Auths.Lifecycle.State.reconciledCommitted ∨ terminal = Auths.Lifecycle.State.reconciledReleased →\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.outcomeUnknown) operation gates =\n Auths.Lifecycle.Code.applied terminal →\n operation = Auths.Lifecycle.Operation.reconcileEffect ∨ operation = Auths.Lifecycle.Operation.reconcileNonEffect", + "statement_constants": [ + "Eq", + "Or", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.Operation", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.applied", + "Auths.Lifecycle.Operation.reconcileEffect", + "Auths.Lifecycle.Operation.reconcileNonEffect", + "Auths.Lifecycle.State.outcomeUnknown", + "Auths.Lifecycle.State.reconciledCommitted", + "Auths.Lifecycle.State.reconciledReleased" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.configuration_mismatch_stops_reservation", + "statement": "∀ (gates : Auths.Lifecycle.Gates),\n gates.configurationMatches = false →\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.decisionRecorded) Auths.Lifecycle.Operation.reserve\n gates =\n Auths.Lifecycle.Code.configurationMismatch", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.configurationMismatch", + "Auths.Lifecycle.Gates.configurationMatches", + "Auths.Lifecycle.Operation.reserve", + "Auths.Lifecycle.State.decisionRecorded" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.configuration_mismatch_stops_credential", + "statement": "∀ (gates : Auths.Lifecycle.Gates),\n gates.configurationMatches = false →\n Auths.Lifecycle.transitionCode (some Auths.Lifecycle.State.executionIntentRecorded)\n Auths.Lifecycle.Operation.authorizeCredential gates =\n Auths.Lifecycle.Code.configurationMismatch", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.configurationMismatch", + "Auths.Lifecycle.Gates.configurationMatches", + "Auths.Lifecycle.Operation.authorizeCredential", + "Auths.Lifecycle.State.executionIntentRecorded" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Theorems", + "name": "Auths.Lifecycle.terminal_states_never_transition", + "statement": "∀ (state : Auths.Lifecycle.State) (operation : Auths.Lifecycle.Operation) (gates : Auths.Lifecycle.Gates),\n state.isTerminal = true → Auths.Lifecycle.transitionCode (some state) operation gates = Auths.Lifecycle.Code.terminal", + "statement_constants": [ + "Bool", + "Eq", + "Bool.true", + "Option.some", + "Auths.Lifecycle.Code", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.Operation", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "Auths.Lifecycle.Code.terminal", + "Auths.Lifecycle.State.isTerminal" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Refinement", + "name": "Auths.Lifecycle.Refinement.translated_terminal_refines_rich", + "statement": "∀ (state : Auths.Lifecycle.State),\n (Auths.Lifecycle.Refinement.generatedState state).is_terminal = Aeneas.Std.Result.ok state.isTerminal", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Auths.Lifecycle.State", + "Aeneas.Std.Result.ok", + "Auths.Lifecycle.Refinement.generatedState", + "Auths.Lifecycle.State.isTerminal", + "auths_lifecycle.model.LifecycleState.is_terminal" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Refinement", + "name": "Auths.Lifecycle.Refinement.translated_transition_refines_rich", + "statement": "∀ (current : Option Auths.Lifecycle.State) (operation : Auths.Lifecycle.Operation) (gates : Auths.Lifecycle.Gates),\n auths_lifecycle.kernel.transition_code (Option.map Auths.Lifecycle.Refinement.generatedState current)\n (Auths.Lifecycle.Refinement.generatedOperation operation) (Auths.Lifecycle.Refinement.generatedGates gates) =\n Aeneas.Std.Result.ok\n (Auths.Lifecycle.Refinement.generatedCode (Auths.Lifecycle.transitionCode current operation gates))", + "statement_constants": [ + "Eq", + "Option", + "Option.map", + "Aeneas.Std.Result", + "Auths.Lifecycle.Gates", + "Auths.Lifecycle.Operation", + "Auths.Lifecycle.State", + "Auths.Lifecycle.transitionCode", + "auths_lifecycle.kernel.KernelCode", + "auths_lifecycle.kernel.transition_code", + "auths_lifecycle.model.LifecycleState", + "Aeneas.Std.Result.ok", + "Auths.Lifecycle.Refinement.generatedCode", + "Auths.Lifecycle.Refinement.generatedGates", + "Auths.Lifecycle.Refinement.generatedOperation", + "Auths.Lifecycle.Refinement.generatedState" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Lifecycle.Refinement", + "name": "Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich", + "statement": "∀ (hasLiveOwner ownerIsExactReplay : Bool),\n auths_lifecycle.kernel.exclusive_capacity_available hasLiveOwner ownerIsExactReplay =\n Aeneas.Std.Result.ok (Auths.Lifecycle.exclusiveCapacityAvailable hasLiveOwner ownerIsExactReplay)", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Auths.Lifecycle.exclusiveCapacityAvailable", + "auths_lifecycle.kernel.exclusive_capacity_available", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Lifecycle.Refinement", + "name": "Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich", + "statement": "∀ (ceiling committed active requested : Aeneas.Std.U64),\n auths_lifecycle.kernel.additive_capacity_available ceiling committed active requested =\n Aeneas.Std.Result.ok (Auths.Lifecycle.additiveCapacityAvailable ↑ceiling ↑committed ↑active ↑requested)", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "Auths.Lifecycle.additiveCapacityAvailable", + "auths_lifecycle.kernel.additive_capacity_available", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Lifecycle.Refinement", + "name": "Auths.Lifecycle.Refinement.translated_replay_refines_rich", + "statement": "∀ (recordExists commitmentsEqual : Bool),\n auths_lifecycle.kernel.replay_code recordExists commitmentsEqual =\n Aeneas.Std.Result.ok\n (Auths.Lifecycle.Refinement.generatedReplayCode (Auths.Lifecycle.replayCode recordExists commitmentsEqual))", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Auths.Lifecycle.replayCode", + "auths_lifecycle.kernel.ReplayCode", + "auths_lifecycle.kernel.replay_code", + "Aeneas.Std.Result.ok", + "Auths.Lifecycle.Refinement.generatedReplayCode" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.all_commutative", + "statement": "∀ (left right : Auths.Truth), Auths.all left right = Auths.all right left", + "statement_constants": [ + "Eq", + "Auths.Truth", + "Auths.all" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.all_associative", + "statement": "∀ (a b c : Auths.Truth), Auths.all (Auths.all a b) c = Auths.all a (Auths.all b c)", + "statement_constants": [ + "Eq", + "Auths.Truth", + "Auths.all" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.all_idempotent", + "statement": "∀ (value : Auths.Truth), Auths.all value value = value", + "statement_constants": [ + "Eq", + "Auths.Truth", + "Auths.all" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.any_commutative", + "statement": "∀ (left right : Auths.Truth), Auths.any left right = Auths.any right left", + "statement_constants": [ + "Eq", + "Auths.Truth", + "Auths.any" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.any_associative", + "statement": "∀ (a b c : Auths.Truth), Auths.any (Auths.any a b) c = Auths.any a (Auths.any b c)", + "statement_constants": [ + "Eq", + "Auths.Truth", + "Auths.any" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.any_idempotent", + "statement": "∀ (value : Auths.Truth), Auths.any value value = value", + "statement_constants": [ + "Eq", + "Auths.Truth", + "Auths.any" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.threshold_one_eq_any", + "statement": "∀ (left right : Auths.Truth), Auths.thresholdTwo 1 left right = Auths.any left right", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Auths.Truth", + "Auths.any", + "Auths.thresholdTwo", + "OfNat.ofNat" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.threshold_n_eq_all", + "statement": "∀ (left right : Auths.Truth), Auths.thresholdTwo 2 left right = Auths.all left right", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Auths.Truth", + "Auths.all", + "Auths.thresholdTwo", + "OfNat.ofNat" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.threshold_monotone_k", + "statement": "∀ (left right : Auths.Truth), (Auths.thresholdTwo 2 left right).le (Auths.thresholdTwo 1 left right)", + "statement_constants": [ + "Nat", + "instOfNatNat", + "Auths.Truth", + "Auths.thresholdTwo", + "OfNat.ofNat", + "Auths.Truth.le" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.threshold_zero_authorized", + "statement": "∀ (left right : Auths.Truth), Auths.thresholdTwo 0 left right = Auths.Generated.Truth.authorized", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "Auths.Truth", + "Auths.thresholdTwo", + "OfNat.ofNat", + "Auths.Generated.Truth.authorized" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.threshold_above_inputs_denied", + "statement": "∀ {k : ℕ}, 3 ≤ k → ∀ (left right : Auths.Truth), Auths.thresholdTwo k left right = Auths.Generated.Truth.denied", + "statement_constants": [ + "Eq", + "Nat", + "instLENat", + "instOfNatNat", + "Auths.Truth", + "Auths.thresholdTwo", + "LE.le", + "OfNat.ofNat", + "Auths.Generated.Truth.denied" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.threshold_antitone_k", + "statement": "∀ {k₁ k₂ : ℕ},\n k₁ ≤ k₂ → ∀ (left right : Auths.Truth), (Auths.thresholdTwo k₂ left right).le (Auths.thresholdTwo k₁ left right)", + "statement_constants": [ + "Nat", + "instLENat", + "Auths.Truth", + "Auths.thresholdTwo", + "LE.le", + "Auths.Truth.le" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.thresholdCounts_antitone_required", + "statement": "∀ {k₁ k₂ a i : ℕ}, k₁ ≤ k₂ → Auths.Truth.le (Auths.thresholdCounts k₂ a i) (Auths.thresholdCounts k₁ a i)", + "statement_constants": [ + "Nat", + "instLENat", + "Auths.thresholdCounts", + "LE.le", + "Auths.Truth.le" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.thresholdTwo_eq_thresholdCounts", + "statement": "∀ (k : ℕ) (left right : Auths.Truth),\n Auths.thresholdTwo k left right =\n Auths.thresholdCounts k (List.countP (fun x => x == Auths.Generated.Truth.authorized) [left, right])\n (List.countP (fun x => x == Auths.Generated.Truth.indeterminate) [left, right])", + "statement_constants": [ + "Eq", + "Nat", + "Auths.Truth", + "Auths.thresholdCounts", + "Auths.thresholdTwo", + "BEq.beq", + "List.cons", + "List.countP", + "List.nil", + "Auths.Generated.instBEqTruth", + "Auths.Generated.Truth.authorized", + "Auths.Generated.Truth.indeterminate" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.binary_composition_swap_invariant", + "statement": "∀ (left right : Auths.Truth), Auths.all left right = Auths.all right left ∧ Auths.any left right = Auths.any right left", + "statement_constants": [ + "And", + "Eq", + "Auths.Truth", + "Auths.all", + "Auths.any" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.canonical_diagnostic_permutation_invariant", + "statement": "∀ (left right : ℕ), Auths.canonicalCode left right = Auths.canonicalCode right left", + "statement_constants": [ + "Eq", + "Nat", + "Auths.canonicalCode" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.plan_visit_is_leaf_enumeration", + "statement": "∀ (plan : Auths.Plan), plan.visit = plan.leaves", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Auths.Plan", + "Auths.Plan.leaves", + "Auths.Plan.visit" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.plan_cost_is_node_count", + "statement": "∀ (plan : Auths.Plan), plan.cost = plan.nodes", + "statement_constants": [ + "Eq", + "Nat", + "Auths.Plan", + "Auths.Plan.cost", + "Auths.Plan.nodes" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.authorized_implies_threshold_met", + "statement": "∀ {k authorized indeterminate : ℕ},\n Auths.thresholdCounts k authorized indeterminate = Auths.Generated.Truth.authorized → k ≤ authorized", + "statement_constants": [ + "Eq", + "Nat", + "instLENat", + "Auths.thresholdCounts", + "LE.le", + "Auths.Generated.Truth", + "Auths.Generated.Truth.authorized" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.denied_implies_threshold_impossible", + "statement": "∀ {k authorized indeterminate : ℕ},\n Auths.thresholdCounts k authorized indeterminate = Auths.Generated.Truth.denied → authorized + indeterminate < k", + "statement_constants": [ + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instLTNat", + "Auths.thresholdCounts", + "HAdd.hAdd", + "LT.lt", + "Auths.Generated.Truth", + "Auths.Generated.Truth.denied" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Composition", + "name": "Auths.indeterminate_implies_threshold_reachable", + "statement": "∀ {k authorized indeterminate : ℕ},\n Auths.thresholdCounts k authorized indeterminate = Auths.Generated.Truth.indeterminate →\n authorized < k ∧ k ≤ authorized + indeterminate", + "statement_constants": [ + "And", + "Eq", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instLTNat", + "Auths.thresholdCounts", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "Auths.Generated.Truth", + "Auths.Generated.Truth.indeterminate" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.requirements_monotone", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {parent child : List Auths.Observation.Requirement},\n (∀ requirement ∈ parent, requirement ∈ child) →\n Auths.Observation.authorized env observations child = true →\n Auths.Observation.authorized env observations parent = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.authorized" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.conditions_monotone", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement} {conditions : List Auths.Observation.Condition},\n (∀ condition ∈ requirement.conditions, condition ∈ conditions) →\n Auths.Observation.satisfied env observations\n { observerAnchor := requirement.observerAnchor, schema := requirement.schema, subject := requirement.subject,\n maxAge := requirement.maxAge, conditions := conditions } =\n true →\n Auths.Observation.satisfied env observations requirement = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Observation.Condition", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.satisfied", + "Auths.Observation.Requirement.conditions", + "Auths.Observation.Requirement.maxAge", + "Auths.Observation.Requirement.mk", + "Auths.Observation.Requirement.observerAnchor", + "Auths.Observation.Requirement.schema", + "Auths.Observation.Requirement.subject" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.child_requirements_superset_attenuates", + "statement": "∀ {parentBase childBase : Auths.Observation.Environment → Bool} {parent child : List Auths.Observation.Requirement},\n (∀ (env : Auths.Observation.Environment), childBase env = true → parentBase env = true) →\n (∀ requirement ∈ parent, requirement ∈ child) →\n ∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord},\n Auths.Observation.chainAuthorized childBase child env observations = true →\n Auths.Observation.chainAuthorized parentBase parent env observations = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.chainAuthorized" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.satisfied_monotone_observations", + "statement": "∀ {env : Auths.Observation.Environment} {fewer more : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement},\n (∀ observation ∈ fewer, observation ∈ more) →\n Auths.Observation.satisfied env fewer requirement = true → Auths.Observation.satisfied env more requirement = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.satisfied" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.no_observation_satisfies_nothing", + "statement": "∀ (env : Auths.Observation.Environment) (requirement : Auths.Observation.Requirement),\n Auths.Observation.satisfied env [] requirement = false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "List.nil", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.satisfied" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.future_observation_never_fresh", + "statement": "∀ {now maxAge notBefore expiresAt observedAt : ℕ},\n now < observedAt → Auths.Observation.fresh now maxAge notBefore expiresAt observedAt = false", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instLTNat", + "Bool.false", + "LT.lt", + "Auths.Observation.fresh" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.stale_observation_never_fresh", + "statement": "∀ {now maxAge notBefore expiresAt observedAt : ℕ},\n maxAge < now - observedAt → Auths.Observation.fresh now maxAge notBefore expiresAt observedAt = false", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instHSub", + "instLTNat", + "instSubNat", + "Bool.false", + "HSub.hSub", + "LT.lt", + "Auths.Observation.fresh" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.satisfied_requires_action_facts", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement},\n Auths.Observation.satisfied env observations requirement = true →\n Auths.Observation.actionFactsAvailable env requirement = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.actionFactsAvailable", + "Auths.Observation.satisfied" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.decision_satisfied_iff", + "statement": "∀ (env : Auths.Observation.Environment) (observations : List Auths.Observation.ObservationRecord)\n (requirement : Auths.Observation.Requirement),\n Auths.Observation.requirementDecision env observations requirement = Auths.Observation.Decision.satisfied ↔\n Auths.Observation.satisfied env observations requirement = true", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Bool.true", + "Auths.Observation.Decision", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.requirementDecision", + "Auths.Observation.satisfied", + "Auths.Observation.Decision.satisfied" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.decision_denied_has_falsifying_observation", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement},\n Auths.Observation.requirementDecision env observations requirement = Auths.Observation.Decision.denied →\n (∃ observation ∈ observations, Auths.Observation.eligible env requirement observation = true) ∧\n ∀ observation ∈ observations,\n Auths.Observation.eligible env requirement observation = true →\n Auths.Observation.conditionsHold env observation requirement.conditions = false", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Bool.false", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Observation.Decision", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.conditionsHold", + "Auths.Observation.eligible", + "Auths.Observation.requirementDecision", + "Auths.Observation.Decision.denied", + "Auths.Observation.Requirement.conditions" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.fresh_monotone_max_age", + "statement": "∀ {now shorter longer notBefore expiresAt observedAt : ℕ},\n shorter ≤ longer →\n Auths.Observation.fresh now shorter notBefore expiresAt observedAt = true →\n Auths.Observation.fresh now longer notBefore expiresAt observedAt = true", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "instLENat", + "Bool.true", + "LE.le", + "Auths.Observation.fresh" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.narrows_monotone", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {child parent : Auths.Observation.Requirement},\n Auths.Observation.narrows child parent →\n Auths.Observation.satisfied env observations child = true →\n Auths.Observation.satisfied env observations parent = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.narrows", + "Auths.Observation.satisfied" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.covers_monotone", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {child parent : Auths.Observation.Requirement},\n Auths.Observation.covers child parent →\n Auths.Observation.satisfied env observations child = true →\n Auths.Observation.satisfied env observations parent = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.covers", + "Auths.Observation.satisfied" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.covers_trans", + "statement": "∀ {child middle parent : Auths.Observation.Requirement},\n Auths.Observation.covers child middle → Auths.Observation.covers middle parent → Auths.Observation.covers child parent", + "statement_constants": [ + "Auths.Observation.Requirement", + "Auths.Observation.covers" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.requirements_attenuate_refl", + "statement": "∀ (requirements : List Auths.Observation.Requirement), Auths.Observation.requirementsAttenuate requirements requirements", + "statement_constants": [ + "List", + "Auths.Observation.Requirement", + "Auths.Observation.requirementsAttenuate" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.requirements_attenuate_trans", + "statement": "∀ {child middle parent : List Auths.Observation.Requirement},\n Auths.Observation.requirementsAttenuate child middle →\n Auths.Observation.requirementsAttenuate middle parent → Auths.Observation.requirementsAttenuate child parent", + "statement_constants": [ + "List", + "Auths.Observation.Requirement", + "Auths.Observation.requirementsAttenuate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.requirements_attenuate_monotone", + "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {child parent : List Auths.Observation.Requirement},\n Auths.Observation.requirementsAttenuate child parent →\n Auths.Observation.authorized env observations child = true →\n Auths.Observation.authorized env observations parent = true", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.authorized", + "Auths.Observation.requirementsAttenuate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.observation_requirement_law_lawful", + "statement": "Auths.Observation.observationRequirementLaw.Lawful", + "statement_constants": [ + "List", + "Prod", + "Auths.NarrowingLaw.Lawful", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.observationRequirementLaw" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Observation", + "name": "Auths.Observation.observation_requirement_law_accepts_addition", + "statement": "∀ (requirements : List Auths.Observation.Requirement),\n Auths.Observation.observationRequirementLaw.attenuates (some requirements) none", + "statement_constants": [ + "List", + "Prod", + "Option.none", + "Option.some", + "Auths.NarrowingLaw.attenuates", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.observationRequirementLaw" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_decide_eq_threshold_counts", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n Auths.Approval.approvalDecision env identifier requirement approvals =\n Auths.thresholdCounts requirement.threshold\n (Auths.Approval.countedCount requirement.approvers (Auths.Approval.outcomes env identifier requirement approvals))\n (Auths.Approval.pendingCount requirement.approvers (Auths.Approval.outcomes env identifier requirement approvals))", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "Auths.Truth", + "Auths.thresholdCounts", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision", + "Auths.Approval.countedCount", + "Auths.Approval.outcomes", + "Auths.Approval.pendingCount", + "Auths.Approval.Requirement.approvers", + "Auths.Approval.Requirement.threshold" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_authorized_iff_distinct_quorum", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n requirement.approvers.Nodup →\n (Auths.Approval.approvalDecision env identifier requirement approvals = Auths.Generated.Truth.authorized ↔\n ∃ chosen,\n chosen.Nodup ∧\n chosen ⊆ requirement.approvers ∧\n requirement.threshold ≤ chosen.length ∧\n ∀ principal ∈ chosen,\n ∃ approval ∈ approvals,\n approval.approver = principal ∧\n Auths.Approval.verdict env identifier requirement approval = Auths.Approval.Verdict.counted)", + "statement_constants": [ + "And", + "DecidableEq", + "Eq", + "Exists", + "Iff", + "List", + "Nat", + "String", + "instLENat", + "Auths.Truth", + "HasSubset.Subset", + "LE.le", + "List.Nodup", + "List.instHasSubset", + "List.instMembership", + "List.length", + "Membership.mem", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.Verdict", + "Auths.Approval.approvalDecision", + "Auths.Approval.verdict", + "Auths.Approval.ApprovalRecord.approver", + "Auths.Approval.Requirement.approvers", + "Auths.Approval.Requirement.threshold", + "Auths.Approval.Verdict.counted", + "Auths.Generated.Truth.authorized" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_duplicate_irrelevant", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n ∀ approval ∈ approvals,\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "Auths.Truth", + "List.cons", + "List.instMembership", + "Membership.mem", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_outsider_irrelevant", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.approver ∉ requirement.approvers →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "Not", + "String", + "Auths.Truth", + "List.cons", + "List.instMembership", + "Membership.mem", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision", + "Auths.Approval.ApprovalRecord.approver", + "Auths.Approval.Requirement.approvers" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_other_action_irrelevant", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.action ≠ env.action →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "Ne", + "Auths.Truth", + "List.cons", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision", + "Auths.Approval.ApprovalRecord.action", + "Auths.Approval.Environment.action" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_other_requirement_irrelevant", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.requirement ≠ identifier →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "Ne", + "Auths.Truth", + "List.cons", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision", + "Auths.Approval.ApprovalRecord.requirement" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_self_approval_irrelevant", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.approver ∈ env.authority →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "String", + "Auths.Truth", + "List.cons", + "List.instMembership", + "Membership.mem", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision", + "Auths.Approval.ApprovalRecord.approver", + "Auths.Approval.Environment.authority" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_permutation_invariant", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) {left right : List (Auths.Approval.ApprovalRecord Action)},\n left.Perm right →\n Auths.Approval.approvalDecision env identifier requirement left =\n Auths.Approval.approvalDecision env identifier requirement right", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "Auths.Truth", + "List.Perm", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_monotone_in_approvals", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals extra : List (Auths.Approval.ApprovalRecord Action)),\n (Auths.Approval.approvalDecision env identifier requirement approvals).le\n (Auths.Approval.approvalDecision env identifier requirement (approvals ++ extra))", + "statement_constants": [ + "DecidableEq", + "List", + "Nat", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.approvalDecision", + "Auths.Truth.le" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_antitone_in_threshold", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (approvers : List String) (approvals : List (Auths.Approval.ApprovalRecord Action)) {lower higher : ℕ},\n lower ≤ higher →\n (Auths.Approval.approvalDecision env identifier { approvers := approvers, threshold := higher } approvals).le\n (Auths.Approval.approvalDecision env identifier { approvers := approvers, threshold := lower } approvals)", + "statement_constants": [ + "DecidableEq", + "List", + "Nat", + "String", + "instLENat", + "LE.le", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.approvalDecision", + "Auths.Truth.le", + "Auths.Approval.Requirement.mk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_antitone_in_approvers", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier threshold : ℕ)\n (approvals : List (Auths.Approval.ApprovalRecord Action)) {fewer more : List String},\n fewer ⊆ more →\n fewer.Nodup →\n (Auths.Approval.approvalDecision env identifier { approvers := fewer, threshold := threshold } approvals).le\n (Auths.Approval.approvalDecision env identifier { approvers := more, threshold := threshold } approvals)", + "statement_constants": [ + "DecidableEq", + "List", + "Nat", + "String", + "HasSubset.Subset", + "List.Nodup", + "List.instHasSubset", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.approvalDecision", + "Auths.Truth.le", + "Auths.Approval.Requirement.mk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_authorized_meets", + "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n requirement.approvers.Nodup →\n Auths.Approval.approvalDecision env identifier requirement approvals = Auths.Generated.Truth.authorized →\n Auths.Approval.meets\n (List.map Auths.Approval.ApprovalRecord.approver\n (List.filter\n (fun approval =>\n decide (Auths.Approval.verdict env identifier requirement approval = Auths.Approval.Verdict.counted))\n approvals))\n requirement", + "statement_constants": [ + "DecidableEq", + "Eq", + "List", + "Nat", + "String", + "Auths.Truth", + "Decidable.decide", + "List.Nodup", + "List.filter", + "List.map", + "Auths.Approval.ApprovalRecord", + "Auths.Approval.Environment", + "Auths.Approval.Requirement", + "Auths.Approval.Verdict", + "Auths.Approval.approvalDecision", + "Auths.Approval.instDecidableEqVerdict", + "Auths.Approval.meets", + "Auths.Approval.verdict", + "Auths.Approval.ApprovalRecord.approver", + "Auths.Approval.Requirement.approvers", + "Auths.Approval.Verdict.counted", + "Auths.Generated.Truth.authorized" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.covers_monotone", + "statement": "∀ {approving : List String} {child parent : Auths.Approval.Requirement},\n Auths.Approval.covers child parent → Auths.Approval.meets approving child → Auths.Approval.meets approving parent", + "statement_constants": [ + "List", + "String", + "Auths.Approval.Requirement", + "Auths.Approval.covers", + "Auths.Approval.meets" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.covers_trans", + "statement": "∀ {child middle parent : Auths.Approval.Requirement},\n Auths.Approval.covers child middle → Auths.Approval.covers middle parent → Auths.Approval.covers child parent", + "statement_constants": [ + "Auths.Approval.Requirement", + "Auths.Approval.covers" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_requirements_attenuate_refl", + "statement": "∀ (requirements : List Auths.Approval.Requirement), Auths.Approval.requirementsAttenuate requirements requirements", + "statement_constants": [ + "List", + "Auths.Approval.Requirement", + "Auths.Approval.requirementsAttenuate" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_requirements_attenuate_trans", + "statement": "∀ {child middle parent : List Auths.Approval.Requirement},\n Auths.Approval.requirementsAttenuate child middle →\n Auths.Approval.requirementsAttenuate middle parent → Auths.Approval.requirementsAttenuate child parent", + "statement_constants": [ + "List", + "Auths.Approval.Requirement", + "Auths.Approval.requirementsAttenuate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_requirements_attenuate_monotone", + "statement": "∀ {approving : List String} {child parent : List Auths.Approval.Requirement},\n Auths.Approval.requirementsAttenuate child parent →\n (∀ requirement ∈ child, Auths.Approval.meets approving requirement) →\n ∀ requirement ∈ parent, Auths.Approval.meets approving requirement", + "statement_constants": [ + "List", + "String", + "List.instMembership", + "Membership.mem", + "Auths.Approval.Requirement", + "Auths.Approval.meets", + "Auths.Approval.requirementsAttenuate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_requirement_law_lawful", + "statement": "Auths.Approval.approvalRequirementLaw.Lawful", + "statement_constants": [ + "List", + "String", + "Auths.Approval.Requirement", + "Auths.Approval.approvalRequirementLaw", + "Auths.NarrowingLaw.Lawful" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_requirement_law_accepts_addition", + "statement": "∀ (requirements : List Auths.Approval.Requirement),\n Auths.Approval.approvalRequirementLaw.attenuates (some requirements) none", + "statement_constants": [ + "List", + "String", + "Option.none", + "Option.some", + "Auths.Approval.Requirement", + "Auths.Approval.approvalRequirementLaw", + "Auths.NarrowingLaw.attenuates" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Approval", + "name": "Auths.Approval.approval_requirement_law_refuses_drop", + "statement": "∀ (requirements : List Auths.Approval.Requirement),\n ¬Auths.Approval.approvalRequirementLaw.attenuates none (some requirements)", + "statement_constants": [ + "List", + "Not", + "String", + "Option.none", + "Option.some", + "Auths.Approval.Requirement", + "Auths.Approval.approvalRequirementLaw", + "Auths.NarrowingLaw.attenuates" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.ExtensionLaw", + "name": "Auths.exact_marker_law_lawful", + "statement": "∀ (Body : Type u) (World : Type w), (Auths.exactMarkerLaw Body World).Lawful", + "statement_constants": [ + "Auths.exactMarkerLaw", + "Auths.NarrowingLaw.Lawful" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.ExtensionLaw", + "name": "Auths.exact_marker_law_refuses_addition", + "statement": "∀ (Body : Type u) (World : Type w) (body : Body), ¬(Auths.exactMarkerLaw Body World).attenuates (some body) none", + "statement_constants": [ + "Not", + "Auths.exactMarkerLaw", + "Option.none", + "Option.some", + "Auths.NarrowingLaw.attenuates" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Rich.Semantics", + "name": "Auths.Rich.ExtensionLawsNarrow.of_lawful", + "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n (∀ (id : v.ExtensionIdCarrier), (Auths.Rich.extensionLawAt v id).Lawful) → Auths.Rich.ExtensionLawsNarrow v", + "statement_constants": [ + "Auths.NarrowingLaw.Lawful", + "Auths.Rich.ExtensionLaws", + "Auths.Rich.ExtensionLawsNarrow", + "Auths.Rich.Vocabulary", + "Auths.Rich.extensionLawAt", + "Auths.Rich.ExtensionLaws.World", + "Auths.Rich.Vocabulary.ExtensionBodyCarrier", + "Auths.Rich.Vocabulary.ExtensionIdCarrier" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_fact_name_equal_refines_model", + "statement": "∀ (left right : String),\n Auths.Refinement.StringBounded left →\n Auths.Refinement.StringBounded right →\n auths_model.observation.fact_name_equal left right = Aeneas.Std.Result.ok (left == right)", + "statement_constants": [ + "Bool", + "Eq", + "String", + "instBEqOfDecidableEq", + "instDecidableEqString", + "BEq.beq", + "Aeneas.Std.Result", + "Auths.Refinement.StringBounded", + "auths_model.observation.fact_name_equal", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_fresh_refines_model", + "statement": "∀ (observedAt evaluationTime maxAge notBefore expiresAt : Aeneas.Std.U64),\n auths_model.observation.observation_fresh observedAt evaluationTime maxAge notBefore expiresAt =\n Aeneas.Std.Result.ok (Auths.Observation.fresh ↑evaluationTime ↑maxAge ↑notBefore ↑expiresAt ↑observedAt)", + "statement_constants": [ + "Bool", + "Eq", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "Auths.Observation.fresh", + "auths_model.observation.observation_fresh", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_subject_equal_refines_model", + "statement": "∀ (expected observed : auths_model.ResourceId),\n Auths.Refinement.StringBounded expected →\n Auths.Refinement.StringBounded observed →\n auths_model.observation.observation_subject_equal expected observed =\n Aeneas.Std.Result.ok (decide (expected = observed))", + "statement_constants": [ + "Bool", + "Eq", + "instDecidableEqString", + "Decidable.decide", + "auths_model.ResourceId", + "Aeneas.Std.Result", + "Auths.Refinement.StringBounded", + "auths_model.observation.observation_subject_equal", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_fact_value_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.FactValue),\n Auths.Refinement.Observation.FactValueValid left →\n Auths.Refinement.Observation.FactValueValid right →\n auths_model.observation.fact_value_equal left right =\n Aeneas.Std.Result.ok\n (decide (Auths.Refinement.Observation.factValue left = Auths.Refinement.Observation.factValue right))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.FactValue", + "Auths.Observation.instDecidableEqFactValue", + "auths_model.observation.FactValue", + "auths_model.observation.fact_value_equal", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.FactValueValid", + "Auths.Refinement.Observation.factValue" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_uint_range_contains_refines_model", + "statement": "∀ (lo hi value : Aeneas.Std.U64) (factName : String) (actionFact : String → Option Auths.Observation.FactValue),\n auths_model.observation.uint_range_contains lo hi value =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds actionFact (some (Auths.Observation.FactValue.uint ↑value))\n (Auths.Observation.Condition.uintRange factName ↑lo ↑hi))", + "statement_constants": [ + "Bool", + "Eq", + "Option", + "String", + "Option.some", + "Aeneas.Std.Result", + "Aeneas.Std.U64", + "Auths.Observation.FactValue", + "Auths.Observation.valueHolds", + "auths_model.observation.uint_range_contains", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Observation.Condition.uintRange", + "Auths.Observation.FactValue.uint" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_member_values_contain_refines_model", + "statement": "∀ (values : auths_model.observation.MemberValues) (value : auths_model.observation.FactValue),\n (∀ member ∈ ↑values, Auths.Refinement.Observation.FactValueValid member) →\n Auths.Refinement.Observation.FactValueValid value →\n ∀ (factName : String) (actionFact : String → Option Auths.Observation.FactValue),\n auths_model.observation.member_values_contain values value =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds actionFact (some (Auths.Refinement.Observation.factValue value))\n (Auths.Observation.Condition.member factName (List.map Auths.Refinement.Observation.factValue ↑values)))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "String", + "instLENat", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Option.some", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.Observation.FactValue", + "Auths.Observation.valueHolds", + "auths_model.observation.FactValue", + "auths_model.observation.MemberValues", + "auths_model.observation.member_values_contain", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Observation.Condition.member", + "Auths.Refinement.Observation.FactValueValid", + "Auths.Refinement.Observation.factValue" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_fact_refines_model", + "statement": "∀ (facts : auths_model.observation.ObservationFacts) (factName : String),\n Auths.Refinement.Observation.FactsValid facts →\n Auths.Refinement.StringBounded factName →\n ∃ result,\n auths_model.observation.observation_fact facts factName = Aeneas.Std.Result.ok result ∧\n Option.map Auths.Refinement.Observation.factValue result =\n Auths.Observation.lookupFact (Auths.Refinement.Observation.factsOf facts) factName", + "statement_constants": [ + "And", + "Eq", + "Exists", + "Option", + "String", + "Option.map", + "Aeneas.Std.Result", + "Auths.Observation.FactValue", + "Auths.Observation.lookupFact", + "Auths.Refinement.StringBounded", + "auths_model.observation.FactValue", + "auths_model.observation.ObservationFacts", + "auths_model.observation.observation_fact", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.FactsValid", + "Auths.Refinement.Observation.factValue", + "Auths.Refinement.Observation.factsOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_condition_value_holds_refines_model", + "statement": "∀ (test : auths_model.observation.ConditionTest) (observed actionValue : Option auths_model.observation.FactValue),\n Auths.Refinement.Observation.TestValid test →\n Auths.Refinement.Observation.OptionValid observed →\n Auths.Refinement.Observation.OptionValid actionValue →\n ∀ (factName : String),\n auths_model.observation.condition_value_holds test observed actionValue =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds (fun x => Option.map Auths.Refinement.Observation.factValue actionValue)\n (Option.map Auths.Refinement.Observation.factValue observed)\n (Auths.Refinement.Observation.conditionOf factName test))", + "statement_constants": [ + "Bool", + "Eq", + "Option", + "String", + "Option.map", + "Aeneas.Std.Result", + "Auths.Observation.FactValue", + "Auths.Observation.valueHolds", + "auths_model.observation.ConditionTest", + "auths_model.observation.FactValue", + "auths_model.observation.condition_value_holds", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.OptionValid", + "Auths.Refinement.Observation.TestValid", + "Auths.Refinement.Observation.conditionOf", + "Auths.Refinement.Observation.factValue" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_condition_holds_refines_model", + "statement": "∀ (value : auths_model.observation.ObservationCondition) (actionValue : Option auths_model.observation.FactValue)\n (facts : auths_model.observation.ObservationFacts),\n Auths.Refinement.Observation.ConditionValid value →\n Auths.Refinement.Observation.OptionValid actionValue →\n Auths.Refinement.Observation.FactsValid facts →\n auths_model.observation.observation_condition_holds value actionValue facts =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds (fun x => Option.map Auths.Refinement.Observation.factValue actionValue)\n (Auths.Observation.lookupFact (Auths.Refinement.Observation.factsOf facts) value.name)\n (Auths.Refinement.Observation.condition value))", + "statement_constants": [ + "Bool", + "Eq", + "Option", + "String", + "Option.map", + "Aeneas.Std.Result", + "Auths.Observation.FactValue", + "Auths.Observation.lookupFact", + "Auths.Observation.valueHolds", + "auths_model.observation.FactValue", + "auths_model.observation.ObservationCondition", + "auths_model.observation.ObservationFacts", + "auths_model.observation.observation_condition_holds", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.ConditionValid", + "Auths.Refinement.Observation.FactsValid", + "Auths.Refinement.Observation.OptionValid", + "Auths.Refinement.Observation.condition", + "Auths.Refinement.Observation.factValue", + "Auths.Refinement.Observation.factsOf", + "auths_model.observation.ObservationCondition.name" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_model", + "statement": "∀ (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (actionValues : Aeneas.Std.Slice (Option auths_model.observation.FactValue))\n (facts : auths_model.observation.ObservationFacts),\n (∀ value ∈ ↑conditions, Auths.Refinement.Observation.ConditionValid value) →\n (∀ value ∈ ↑actionValues, Auths.Refinement.Observation.OptionValid value) →\n Auths.Refinement.Observation.FactsValid facts →\n auths_model.observation.observation_conditions_hold conditions actionValues facts =\n Aeneas.Std.Result.ok\n (decide ((↑conditions).length = (↑actionValues).length) &&\n ((↑conditions).zip ↑actionValues).all fun pair =>\n Auths.Observation.valueHolds (fun x => Option.map Auths.Refinement.Observation.factValue pair.2)\n (Auths.Observation.lookupFact (Auths.Refinement.Observation.factsOf facts) pair.1.name)\n (Auths.Refinement.Observation.condition pair.1))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "String", + "instDecidableEqNat", + "instLENat", + "Bool.and", + "Decidable.decide", + "LE.le", + "List.all", + "List.instMembership", + "List.length", + "List.zip", + "Membership.mem", + "Option.map", + "Prod.fst", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Observation.FactValue", + "Auths.Observation.lookupFact", + "Auths.Observation.valueHolds", + "auths_model.observation.FactValue", + "auths_model.observation.ObservationCondition", + "auths_model.observation.ObservationFacts", + "auths_model.observation.observation_conditions_hold", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.ConditionValid", + "Auths.Refinement.Observation.FactsValid", + "Auths.Refinement.Observation.OptionValid", + "Auths.Refinement.Observation.condition", + "Auths.Refinement.Observation.factValue", + "Auths.Refinement.Observation.factsOf", + "auths_model.observation.ObservationCondition.name" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_conditions_length_mismatch_fails_closed", + "statement": "∀ (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (actionValues : Aeneas.Std.Slice (Option auths_model.observation.FactValue))\n (facts : auths_model.observation.ObservationFacts),\n (↑conditions).length ≠ (↑actionValues).length →\n auths_model.observation.observation_conditions_hold conditions actionValues facts = Aeneas.Std.Result.ok false", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Ne", + "Option", + "instLENat", + "Bool.false", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "auths_model.observation.FactValue", + "auths_model.observation.ObservationCondition", + "auths_model.observation.ObservationFacts", + "auths_model.observation.observation_conditions_hold", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_conditions_hold", + "statement": "∀ (env : Auths.Observation.Environment) (observation : Auths.Observation.ObservationRecord)\n (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (actionValues : Aeneas.Std.Slice (Option auths_model.observation.FactValue))\n (facts : auths_model.observation.ObservationFacts),\n (∀ value ∈ ↑conditions, Auths.Refinement.Observation.ConditionValid value) →\n (∀ value ∈ ↑actionValues, Auths.Refinement.Observation.OptionValid value) →\n Auths.Refinement.Observation.FactsValid facts →\n observation.facts = Auths.Refinement.Observation.factsOf facts →\n (↑conditions).length = (↑actionValues).length →\n Auths.Refinement.Observation.ActionValuesMatch env ↑conditions ↑actionValues →\n auths_model.observation.observation_conditions_hold conditions actionValues facts =\n Aeneas.Std.Result.ok\n (Auths.Observation.conditionsHold env observation\n (List.map Auths.Refinement.Observation.condition ↑conditions))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Observation.Condition", + "Auths.Observation.Environment", + "Auths.Observation.Facts", + "Auths.Observation.ObservationRecord", + "Auths.Observation.conditionsHold", + "auths_model.observation.FactValue", + "auths_model.observation.ObservationCondition", + "auths_model.observation.ObservationFacts", + "auths_model.observation.observation_conditions_hold", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Observation.ObservationRecord.facts", + "Auths.Refinement.Observation.ActionValuesMatch", + "Auths.Refinement.Observation.ConditionValid", + "Auths.Refinement.Observation.FactsValid", + "Auths.Refinement.Observation.OptionValid", + "Auths.Refinement.Observation.condition", + "Auths.Refinement.Observation.factsOf" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_requirement_verdict_refines_model", + "statement": "∀ (anyEligible anySatisfying : Bool),\n ∃ verdict,\n auths_model.observation.requirement_verdict anyEligible anySatisfying = Aeneas.Std.Result.ok verdict ∧\n Auths.Refinement.Observation.decisionOf verdict =\n if anySatisfying = true then Auths.Observation.Decision.satisfied\n else if anyEligible = true then Auths.Observation.Decision.denied else Auths.Observation.Decision.indeterminate", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "instDecidableEqBool", + "ite", + "Bool.true", + "Aeneas.Std.Result", + "Auths.Observation.Decision", + "auths_model.observation.RequirementVerdict", + "auths_model.observation.requirement_verdict", + "Aeneas.Std.Result.ok", + "Auths.Observation.Decision.denied", + "Auths.Observation.Decision.indeterminate", + "Auths.Observation.Decision.satisfied", + "Auths.Refinement.Observation.decisionOf" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_requirement_verdict_refines_requirement_decision", + "statement": "∀ (env : Auths.Observation.Environment) (observations : List Auths.Observation.ObservationRecord)\n (requirement : Auths.Observation.Requirement),\n Auths.Observation.actionFactsAvailable env requirement = true →\n ∃ verdict,\n auths_model.observation.requirement_verdict (observations.any (Auths.Observation.eligible env requirement))\n (Auths.Observation.satisfied env observations requirement) =\n Aeneas.Std.Result.ok verdict ∧\n Auths.Refinement.Observation.decisionOf verdict =\n Auths.Observation.requirementDecision env observations requirement", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Bool.true", + "List.any", + "Aeneas.Std.Result", + "Auths.Observation.Decision", + "Auths.Observation.Environment", + "Auths.Observation.ObservationRecord", + "Auths.Observation.Requirement", + "Auths.Observation.actionFactsAvailable", + "Auths.Observation.eligible", + "Auths.Observation.requirementDecision", + "Auths.Observation.satisfied", + "auths_model.observation.RequirementVerdict", + "auths_model.observation.requirement_verdict", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.decisionOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observer_anchor_id_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.ObserverAnchorId),\n Auths.Refinement.StringBounded left →\n Auths.Refinement.StringBounded right →\n auths_model.observation.observer_anchor_id_equal left right = Aeneas.Std.Result.ok (decide (left = right))", + "statement_constants": [ + "Bool", + "Eq", + "instDecidableEqString", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Refinement.StringBounded", + "auths_model.observation.ObserverAnchorId", + "auths_model.observation.observer_anchor_id_equal", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_schema_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.ObservationSchemaId),\n Auths.Refinement.StringBounded left →\n Auths.Refinement.StringBounded right →\n auths_model.observation.observation_schema_equal left right = Aeneas.Std.Result.ok (decide (left = right))", + "statement_constants": [ + "Bool", + "Eq", + "instDecidableEqString", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Refinement.StringBounded", + "auths_model.observation.ObservationSchemaId", + "auths_model.observation.observation_schema_equal", + "Aeneas.Std.Result.ok" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_requirement_subject_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.ObservationSubject),\n Auths.Refinement.Observation.SubjectValid left →\n Auths.Refinement.Observation.SubjectValid right →\n auths_model.observation.requirement_subject_equal left right =\n Aeneas.Std.Result.ok\n (decide (Auths.Refinement.Observation.subjectOf left = Auths.Refinement.Observation.subjectOf right))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.Subject", + "Auths.Observation.instDecidableEqSubject", + "auths_model.observation.ObservationSubject", + "auths_model.observation.requirement_subject_equal", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.SubjectValid", + "Auths.Refinement.Observation.subjectOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_member_values_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.MemberValues),\n (∀ value ∈ ↑left, Auths.Refinement.Observation.FactValueValid value) →\n (∀ value ∈ ↑right, Auths.Refinement.Observation.FactValueValid value) →\n auths_model.observation.member_values_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (List.map Auths.Refinement.Observation.factValue ↑left =\n List.map Auths.Refinement.Observation.factValue ↑right))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instDecidableEqList", + "instLENat", + "Decidable.decide", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.Observation.FactValue", + "Auths.Observation.instDecidableEqFactValue", + "auths_model.observation.FactValue", + "auths_model.observation.MemberValues", + "auths_model.observation.member_values_equal", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.FactValueValid", + "Auths.Refinement.Observation.factValue" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_condition_test_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.ConditionTest),\n Auths.Refinement.Observation.TestComparable left →\n Auths.Refinement.Observation.TestComparable right →\n ∀ (factName : String),\n auths_model.observation.condition_test_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Refinement.Observation.conditionOf factName left =\n Auths.Refinement.Observation.conditionOf factName right))", + "statement_constants": [ + "Bool", + "Eq", + "String", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.Condition", + "Auths.Observation.instDecidableEqCondition", + "auths_model.observation.ConditionTest", + "auths_model.observation.condition_test_equal", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.TestComparable", + "Auths.Refinement.Observation.conditionOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_condition_equal_refines_model", + "statement": "∀ (left right : auths_model.observation.ObservationCondition),\n Auths.Refinement.Observation.ConditionComparable left →\n Auths.Refinement.Observation.ConditionComparable right →\n auths_model.observation.observation_condition_equal left right =\n Aeneas.Std.Result.ok\n (decide (Auths.Refinement.Observation.condition left = Auths.Refinement.Observation.condition right))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.Condition", + "Auths.Observation.instDecidableEqCondition", + "auths_model.observation.ObservationCondition", + "auths_model.observation.observation_condition_equal", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.ConditionComparable", + "Auths.Refinement.Observation.condition" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_conditions_contain_refines_model", + "statement": "∀ (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (value : auths_model.observation.ObservationCondition),\n (∀ member ∈ ↑conditions, Auths.Refinement.Observation.ConditionComparable member) →\n Auths.Refinement.Observation.ConditionComparable value →\n auths_model.observation.observation_conditions_contain conditions value =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Refinement.Observation.condition value ∈\n List.map Auths.Refinement.Observation.condition ↑conditions))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instBEqOfDecidableEq", + "instLENat", + "instLawfulBEq", + "Decidable.decide", + "LE.le", + "List.instDecidableMemOfLawfulBEq", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Observation.Condition", + "Auths.Observation.instDecidableEqCondition", + "auths_model.observation.ObservationCondition", + "auths_model.observation.observation_conditions_contain", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.ConditionComparable", + "Auths.Refinement.Observation.condition" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_conditions_include_refines_model", + "statement": "∀ (narrower wider : Aeneas.Std.Slice auths_model.observation.ObservationCondition),\n (∀ member ∈ ↑narrower, Auths.Refinement.Observation.ConditionComparable member) →\n (∀ member ∈ ↑wider, Auths.Refinement.Observation.ConditionComparable member) →\n auths_model.observation.observation_conditions_include narrower wider =\n Aeneas.Std.Result.ok\n (decide\n (∀ value ∈ List.map Auths.Refinement.Observation.condition ↑wider,\n value ∈ List.map Auths.Refinement.Observation.condition ↑narrower))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instBEqOfDecidableEq", + "instLENat", + "instLawfulBEq", + "Decidable.decide", + "LE.le", + "List.decidableBAll", + "List.instDecidableMemOfLawfulBEq", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Observation.Condition", + "Auths.Observation.instDecidableEqCondition", + "auths_model.observation.ObservationCondition", + "auths_model.observation.observation_conditions_include", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.ConditionComparable", + "Auths.Refinement.Observation.condition" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_conditions_equal_refines_model", + "statement": "∀ (left right : Aeneas.Std.Slice auths_model.observation.ObservationCondition),\n (∀ member ∈ ↑left, Auths.Refinement.Observation.ConditionComparable member) →\n (∀ member ∈ ↑right, Auths.Refinement.Observation.ConditionComparable member) →\n auths_model.observation.observation_conditions_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (List.map Auths.Refinement.Observation.condition ↑left =\n List.map Auths.Refinement.Observation.condition ↑right))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instDecidableEqList", + "instLENat", + "Decidable.decide", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Observation.Condition", + "Auths.Observation.instDecidableEqCondition", + "auths_model.observation.ObservationCondition", + "auths_model.observation.observation_conditions_equal", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.ConditionComparable", + "Auths.Refinement.Observation.condition" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_requirement_same_target_refines_model", + "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_same_target child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.sameTarget (Auths.Refinement.Observation.requirementOf child)\n (Auths.Refinement.Observation.requirementOf parent)))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.sameTarget", + "auths_model.observation.ObservationRequirement", + "auths_model.observation.observation_requirement_same_target", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.RequirementValid", + "Auths.Refinement.Observation.instDecidableSameTarget", + "Auths.Refinement.Observation.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_requirement_equal_refines_model", + "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_equal child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Refinement.Observation.requirementOf child = Auths.Refinement.Observation.requirementOf parent))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.Requirement", + "Auths.Observation.instDecidableEqRequirement", + "auths_model.observation.ObservationRequirement", + "auths_model.observation.observation_requirement_equal", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.RequirementValid", + "Auths.Refinement.Observation.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_requirement_narrows_refines_model", + "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_narrows child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.narrows (Auths.Refinement.Observation.requirementOf child)\n (Auths.Refinement.Observation.requirementOf parent)))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.narrows", + "auths_model.observation.ObservationRequirement", + "auths_model.observation.observation_requirement_narrows", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.RequirementValid", + "Auths.Refinement.Observation.instDecidableNarrows", + "Auths.Refinement.Observation.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_requirement_covers_refines_model", + "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_covers child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.covers (Auths.Refinement.Observation.requirementOf child)\n (Auths.Refinement.Observation.requirementOf parent)))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Observation.covers", + "auths_model.observation.ObservationRequirement", + "auths_model.observation.observation_requirement_covers", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Observation.RequirementValid", + "Auths.Refinement.Observation.instDecidableCovers", + "Auths.Refinement.Observation.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_requirement_retained_refines_model", + "statement": "∀ (child : auths_model.observation.ObservationRequirements) (parent : auths_model.observation.ObservationRequirement),\n (∀ requirement ∈ ↑child, Auths.Refinement.Observation.RequirementValid requirement) →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_retained child parent =\n Aeneas.Std.Result.ok\n (decide\n (∃ candidate ∈ List.map Auths.Refinement.Observation.requirementOf ↑child,\n Auths.Observation.covers candidate (Auths.Refinement.Observation.requirementOf parent)))", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.decidableBEx", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.Observation.Requirement", + "Auths.Observation.covers", + "auths_model.observation.ObservationRequirement", + "auths_model.observation.ObservationRequirements", + "auths_model.observation.observation_requirement_retained", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.RequirementValid", + "Auths.Refinement.Observation.instDecidableCovers", + "Auths.Refinement.Observation.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Observation", + "name": "Auths.Refinement.Observation.translated_observation_requirements_attenuate_refines_model", + "statement": "∀ (child parent : auths_model.observation.ObservationRequirements),\n (∀ requirement ∈ ↑child, Auths.Refinement.Observation.RequirementValid requirement) →\n (∀ requirement ∈ ↑parent, Auths.Refinement.Observation.RequirementValid requirement) →\n auths_model.observation.observation_requirements_attenuate child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.requirementsAttenuate (List.map Auths.Refinement.Observation.requirementOf ↑child)\n (List.map Auths.Refinement.Observation.requirementOf ↑parent)))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.Observation.Requirement", + "Auths.Observation.requirementsAttenuate", + "auths_model.observation.ObservationRequirement", + "auths_model.observation.ObservationRequirements", + "auths_model.observation.observation_requirements_attenuate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Observation.RequirementValid", + "Auths.Refinement.Observation.instDecidableRequirementsAttenuate", + "Auths.Refinement.Observation.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_approver_verdict_refines_model", + "statement": "∀ (outcomes : Aeneas.Std.Slice auths_model.approval.ApprovalOutcome) (approver : auths_model.PrincipalId),\n Auths.Refinement.Approval.OutcomesValid ↑outcomes →\n Auths.Refinement.StringBounded approver →\n ∃ result,\n auths_model.approval.approver_verdict outcomes approver = Aeneas.Std.Result.ok result ∧\n Auths.Refinement.Approval.verdictOf result =\n Auths.Approval.approverVerdict (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes) approver", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Prod", + "String", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "auths_model.PrincipalId", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Approval.Verdict", + "Auths.Approval.approverVerdict", + "Auths.Refinement.StringBounded", + "auths_model.approval.ApprovalOutcome", + "auths_model.approval.ApprovalVerdict", + "auths_model.approval.approver_verdict", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Approval.OutcomesValid", + "Auths.Refinement.Approval.outcomeOf", + "Auths.Refinement.Approval.verdictOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_approval_counts_refines_model", + "statement": "∀ (approvers : Aeneas.Std.Slice auths_model.PrincipalId)\n (outcomes : Aeneas.Std.Slice auths_model.approval.ApprovalOutcome),\n Auths.Refinement.Approval.PrincipalsValid ↑approvers →\n Auths.Refinement.Approval.OutcomesValid ↑outcomes →\n ∀ (threshold : Aeneas.Std.U16),\n ∃ counts,\n auths_model.approval.approval_counts approvers outcomes = Aeneas.Std.Result.ok counts ∧\n ↑counts.counted =\n Auths.Approval.countedCount (↑approvers) (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes) ∧\n ↑counts.pending =\n Auths.Approval.pendingCount (↑approvers) (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes) ∧\n Auths.thresholdCounts ↑threshold ↑counts.counted ↑counts.pending =\n Auths.Approval.decideCounts (↑threshold) (↑approvers)\n (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes)", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Prod", + "String", + "instLENat", + "Auths.thresholdCounts", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "auths_model.PrincipalId", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U16", + "Auths.Approval.Verdict", + "Auths.Approval.countedCount", + "Auths.Approval.decideCounts", + "Auths.Approval.pendingCount", + "Auths.Generated.Truth", + "auths_model.approval.ApprovalCounts", + "auths_model.approval.ApprovalOutcome", + "auths_model.approval.approval_counts", + "Aeneas.Std.Result.ok", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Approval.OutcomesValid", + "Auths.Refinement.Approval.PrincipalsValid", + "Auths.Refinement.Approval.outcomeOf", + "auths_model.approval.ApprovalCounts.counted", + "auths_model.approval.ApprovalCounts.pending" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model", + "statement": "∀ (principals : Aeneas.Std.Slice auths_model.PrincipalId) (principal : auths_model.PrincipalId),\n Auths.Refinement.Approval.PrincipalsValid ↑principals →\n Auths.Refinement.StringBounded principal →\n auths_model.approval.principal_ids_contain principals principal =\n Aeneas.Std.Result.ok (decide (principal ∈ ↑principals))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instBEqOfDecidableEq", + "instDecidableEqString", + "instLENat", + "instLawfulBEqString", + "Decidable.decide", + "LE.le", + "List.instDecidableMemOfLawfulBEq", + "List.instMembership", + "List.length", + "Membership.mem", + "Subtype.val", + "auths_model.PrincipalId", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Auths.Refinement.StringBounded", + "auths_model.approval.principal_ids_contain", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Approval.PrincipalsValid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model", + "statement": "∀ (narrower wider : Aeneas.Std.Slice auths_model.PrincipalId),\n Auths.Refinement.Approval.PrincipalsValid ↑narrower →\n Auths.Refinement.Approval.PrincipalsValid ↑wider →\n auths_model.approval.principal_ids_subset narrower wider = Aeneas.Std.Result.ok (decide (↑narrower ⊆ ↑wider))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instDecidableEqString", + "instLENat", + "Decidable.decide", + "HasSubset.Subset", + "LE.le", + "List.instDecidableRelSubsetOfDecidableEq", + "List.instHasSubset", + "List.length", + "Subtype.val", + "auths_model.PrincipalId", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "auths_model.approval.principal_ids_subset", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Approval.PrincipalsValid" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model", + "statement": "∀ (child parent : auths_model.approval.ApprovalRequirement),\n Auths.Refinement.Approval.RequirementValid child →\n Auths.Refinement.Approval.RequirementValid parent →\n auths_model.approval.approval_requirement_covers child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Approval.covers (Auths.Refinement.Approval.requirementOf child)\n (Auths.Refinement.Approval.requirementOf parent)))", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.Result", + "Auths.Approval.covers", + "auths_model.approval.ApprovalRequirement", + "auths_model.approval.approval_requirement_covers", + "Aeneas.Std.Result.ok", + "Auths.Refinement.Approval.RequirementValid", + "Auths.Refinement.Approval.instDecidableCovers", + "Auths.Refinement.Approval.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model", + "statement": "∀ (child : auths_model.approval.ApprovalRequirements) (parent : auths_model.approval.ApprovalRequirement),\n (∀ requirement ∈ ↑child, Auths.Refinement.Approval.RequirementValid requirement) →\n Auths.Refinement.Approval.RequirementValid parent →\n auths_model.approval.approval_requirement_retained child parent =\n Aeneas.Std.Result.ok\n (decide\n (∃ candidate ∈ List.map Auths.Refinement.Approval.requirementOf ↑child,\n Auths.Approval.covers candidate (Auths.Refinement.Approval.requirementOf parent)))", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Exists", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.decidableBEx", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.Approval.Requirement", + "Auths.Approval.covers", + "auths_model.approval.ApprovalRequirement", + "auths_model.approval.ApprovalRequirements", + "auths_model.approval.approval_requirement_retained", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Approval.RequirementValid", + "Auths.Refinement.Approval.instDecidableCovers", + "Auths.Refinement.Approval.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Refinement.Approval", + "name": "Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model", + "statement": "∀ (child parent : auths_model.approval.ApprovalRequirements),\n (∀ requirement ∈ ↑child, Auths.Refinement.Approval.RequirementValid requirement) →\n (∀ requirement ∈ ↑parent, Auths.Refinement.Approval.RequirementValid requirement) →\n auths_model.approval.approval_requirements_attenuate child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Approval.requirementsAttenuate (List.map Auths.Refinement.Approval.requirementOf ↑child)\n (List.map Auths.Refinement.Approval.requirementOf ↑parent)))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.instMembership", + "List.length", + "List.map", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Result", + "Auths.Approval.Requirement", + "Auths.Approval.requirementsAttenuate", + "auths_model.approval.ApprovalRequirement", + "auths_model.approval.ApprovalRequirements", + "auths_model.approval.approval_requirements_attenuate", + "Aeneas.Std.Result.ok", + "Aeneas.Std.Usize.max", + "Auths.Refinement.Approval.RequirementValid", + "Auths.Refinement.Approval.instDecidableRequirementsAttenuate", + "Auths.Refinement.Approval.requirementOf" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.counter_equal_spec", + "statement": "∀ (left right : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.counter_equal left right) fun actual =>\n actual = decide (↑left = ↑right)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instDecidableEqList", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.U8", + "Aeneas.Std.instDecidableEqUScalar_1", + "auths_gateway_kernel.counter_aggregation.counter_equal", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.counter_position_spec", + "statement": "∀ (counters : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (key : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.counter_position counters key) fun actual =>\n Option.map Aeneas.Std.UScalar.val actual =\n Auths.Product.SchemaIndex.position (Auths.Product.CounterAggregation.Refinement.counterKeys counters)\n (List.map (fun x => ↑x) ↑key)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Option.map", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Usize", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.counter_position", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.Refinement.counterKeys" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.contribute_spec", + "statement": "∀ (counters : Aeneas.Std.alloc.vec.Vec auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (key : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (capacity : Aeneas.Std.U64),\n (↑counters).length < 4294967295 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.contribute counters key capacity) fun actual =>\n Auths.Product.CounterAggregation.Refinement.countersView actual =\n Auths.Product.CounterAggregation.contribute (Auths.Product.CounterAggregation.Refinement.countersView counters)\n (List.map (fun x => ↑x) ↑key) ↑capacity", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instLTNat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "LT.lt", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.contribute", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.contribute", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.countersView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.aggregate_spec", + "statement": "∀ (contributions : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity),\n (↑contributions).length ≤ 16 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.aggregate contributions) fun actual =>\n Auths.Product.CounterAggregation.Refinement.countersView actual =\n Auths.Product.CounterAggregation.aggregate []\n (List.map Auths.Product.CounterAggregation.Refinement.counterView ↑contributions)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "List.map", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.aggregate", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.counterView", + "Auths.Product.CounterAggregation.Refinement.countersView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.source_aggregate_unique", + "statement": "∀ (contributions : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity),\n (↑contributions).length ≤ 16 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.aggregate contributions) fun actual =>\n (List.map Auths.Product.CounterAggregation.Counter.key\n (Auths.Product.CounterAggregation.Refinement.countersView actual)).Nodup", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.Nodup", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Counter.key", + "Auths.Product.CounterAggregation.Refinement.countersView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities", + "statement": "∀ (contributions : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity),\n (↑contributions).length ≤ 16 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.aggregate contributions) fun actual =>\n ∀ (key : Auths.Product.CounterAggregation.Key),\n Auths.Product.CounterAggregation.lookup (Auths.Product.CounterAggregation.Refinement.countersView actual) key =\n Auths.Product.CounterAggregation.specification (fun x => none)\n (List.map Auths.Product.CounterAggregation.Refinement.counterView ↑contributions) key", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Option.none", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.specification", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.counterView", + "Auths.Product.CounterAggregation.Refinement.countersView" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.lookup_contribute", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key) (capacity : ℕ)\n (wanted : Auths.Product.CounterAggregation.Key),\n Auths.Product.CounterAggregation.lookup (Auths.Product.CounterAggregation.contribute counters key capacity) wanted =\n if wanted = key then\n Auths.Product.CounterAggregation.tighten (Auths.Product.CounterAggregation.lookup counters wanted) capacity\n else Auths.Product.CounterAggregation.lookup counters wanted", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instDecidableEqList", + "instDecidableEqNat", + "ite", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.tighten" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.contribute_keys", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key)\n (capacity : ℕ),\n List.map Auths.Product.CounterAggregation.Counter.key\n (Auths.Product.CounterAggregation.contribute counters key capacity) =\n if key ∈ List.map Auths.Product.CounterAggregation.Counter.key counters then\n List.map Auths.Product.CounterAggregation.Counter.key counters\n else List.map Auths.Product.CounterAggregation.Counter.key counters ++ [key]", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instBEqOfDecidableEq", + "instDecidableEqNat", + "instHAppendOfAppend", + "ite", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.instBEq", + "List.instDecidableMemOfLawfulBEq", + "List.instLawfulBEq", + "List.instMembership", + "List.map", + "List.nil", + "Membership.mem", + "Nat.instLawfulBEq", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.CounterAggregation.Counter.key" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.contribute_unique", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key)\n (capacity : ℕ),\n (List.map Auths.Product.CounterAggregation.Counter.key counters).Nodup →\n (List.map Auths.Product.CounterAggregation.Counter.key\n (Auths.Product.CounterAggregation.contribute counters key capacity)).Nodup", + "statement_constants": [ + "List", + "Nat", + "List.Nodup", + "List.map", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.CounterAggregation.Counter.key" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.contribute_at", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key)\n (capacity index : ℕ) (old : Auths.Product.CounterAggregation.Counter),\n Auths.Product.SchemaIndex.position (List.map Auths.Product.CounterAggregation.Counter.key counters) key = some index →\n counters[index]? = some old →\n Auths.Product.CounterAggregation.contribute counters key capacity =\n counters.set index { key := old.key, capacity := min old.capacity capacity }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLTNat", + "instMinNat", + "GetElem?.getElem?", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "List.map", + "List.set", + "Min.min", + "Option.some", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.Counter.capacity", + "Auths.Product.CounterAggregation.Counter.key", + "Auths.Product.CounterAggregation.Counter.mk" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.contribute_absent", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key)\n (capacity : ℕ),\n Auths.Product.SchemaIndex.position (List.map Auths.Product.CounterAggregation.Counter.key counters) key = none →\n Auths.Product.CounterAggregation.contribute counters key capacity =\n counters ++ [{ key := key, capacity := capacity }]", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.map", + "List.nil", + "Option.none", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.Counter.key", + "Auths.Product.CounterAggregation.Counter.mk" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.aggregate_exact", + "statement": "∀ (state contributions : List Auths.Product.CounterAggregation.Counter) (wanted : Auths.Product.CounterAggregation.Key),\n Auths.Product.CounterAggregation.lookup (Auths.Product.CounterAggregation.aggregate state contributions) wanted =\n Auths.Product.CounterAggregation.specification (Auths.Product.CounterAggregation.lookup state) contributions wanted", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.aggregate", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.specification" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.aggregate_unique", + "statement": "∀ (state contributions : List Auths.Product.CounterAggregation.Counter),\n (List.map Auths.Product.CounterAggregation.Counter.key state).Nodup →\n (List.map Auths.Product.CounterAggregation.Counter.key\n (Auths.Product.CounterAggregation.aggregate state contributions)).Nodup", + "statement_constants": [ + "List", + "List.Nodup", + "List.map", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.aggregate", + "Auths.Product.CounterAggregation.Counter.key" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.contribute_length_le", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key)\n (capacity : ℕ), (Auths.Product.CounterAggregation.contribute counters key capacity).length ≤ counters.length + 1", + "statement_constants": [ + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.contribute" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.aggregate_append", + "statement": "∀ (state first rest : List Auths.Product.CounterAggregation.Counter),\n Auths.Product.CounterAggregation.aggregate state (first ++ rest) =\n Auths.Product.CounterAggregation.aggregate (Auths.Product.CounterAggregation.aggregate state first) rest", + "statement_constants": [ + "Eq", + "List", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.aggregate" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.aggregate_snoc", + "statement": "∀ (state first : List Auths.Product.CounterAggregation.Counter) (next : Auths.Product.CounterAggregation.Counter),\n Auths.Product.CounterAggregation.aggregate state (first ++ [next]) =\n Auths.Product.CounterAggregation.contribute (Auths.Product.CounterAggregation.aggregate state first) next.key\n next.capacity", + "statement_constants": [ + "Eq", + "List", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.nil", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.aggregate", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.CounterAggregation.Counter.capacity", + "Auths.Product.CounterAggregation.Counter.key" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.aggregate_length_le", + "statement": "∀ (state incoming : List Auths.Product.CounterAggregation.Counter),\n (Auths.Product.CounterAggregation.aggregate state incoming).length ≤ state.length + incoming.length", + "statement_constants": [ + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "HAdd.hAdd", + "LE.le", + "List.length", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.aggregate" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.sum_position_spec", + "statement": "∀ (counters : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity)\n (key : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.sum_position counters key) fun actual =>\n Option.map Aeneas.Std.UScalar.val actual =\n Auths.Product.SchemaIndex.position (Auths.Product.CounterAggregation.Refinement.sumKeys counters)\n (List.map (fun x => ↑x) ↑key)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Option.map", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "Aeneas.Std.Usize", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.sum_position", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.Refinement.sumKeys" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.contribute_sum_spec", + "statement": "∀ (counters : Aeneas.Std.alloc.vec.Vec auths_gateway_kernel.counter_aggregation.SumCapacity)\n (key : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (capacity slots : Aeneas.Std.U64),\n (↑counters).length < 4294967295 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.contribute_sum counters key capacity slots)\n fun actual =>\n Auths.Product.CounterAggregation.Refinement.sumCountersView actual =\n Auths.Product.CounterAggregation.contributeSum\n (Auths.Product.CounterAggregation.Refinement.sumCountersView counters) (List.map (fun x => ↑x) ↑key) ↑capacity\n ↑slots", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instLTNat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "LT.lt", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.contribute_sum", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.contributeSum", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.sumCountersView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec", + "statement": "∀ (contributions : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity),\n (↑contributions).length ≤ 16 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.aggregate_sum contributions) fun actual =>\n Auths.Product.CounterAggregation.Refinement.sumCountersView actual =\n Auths.Product.CounterAggregation.aggregateSum []\n (List.map Auths.Product.CounterAggregation.Refinement.sumView ↑contributions)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "List.map", + "List.nil", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate_sum", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.aggregateSum", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.sumCountersView", + "Auths.Product.CounterAggregation.Refinement.sumView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique", + "statement": "∀ (contributions : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity),\n (↑contributions).length ≤ 16 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.aggregate_sum contributions) fun actual =>\n (List.map Auths.Product.CounterAggregation.SumCounter.key\n (Auths.Product.CounterAggregation.Refinement.sumCountersView actual)).Nodup", + "statement_constants": [ + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.Nodup", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate_sum", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.sumCountersView", + "Auths.Product.CounterAggregation.SumCounter.key" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities", + "statement": "∀ (contributions : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity),\n (↑contributions).length ≤ 16 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.aggregate_sum contributions) fun actual =>\n ∀ (key : Auths.Product.CounterAggregation.Key),\n Auths.Product.CounterAggregation.lookup\n (List.map Auths.Product.CounterAggregation.SumCounter.counter\n (Auths.Product.CounterAggregation.Refinement.sumCountersView actual))\n key =\n Auths.Product.CounterAggregation.specification (fun x => none)\n (List.map Auths.Product.CounterAggregation.SumCounter.counter\n (List.map Auths.Product.CounterAggregation.Refinement.sumView ↑contributions))\n key", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "List.map", + "OfNat.ofNat", + "Option.none", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate_sum", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.specification", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.sumCountersView", + "Auths.Product.CounterAggregation.Refinement.sumView", + "Auths.Product.CounterAggregation.SumCounter.counter" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_contribution_projection", + "statement": "∀ (state : List Auths.Product.CounterAggregation.SumCounter) (key : Auths.Product.CounterAggregation.Key)\n (capacity slots : ℕ),\n List.map Auths.Product.CounterAggregation.SumCounter.counter\n (Auths.Product.CounterAggregation.contributeSum state key capacity slots) =\n Auths.Product.CounterAggregation.contribute (List.map Auths.Product.CounterAggregation.SumCounter.counter state) key\n capacity", + "statement_constants": [ + "Eq", + "List", + "Nat", + "List.map", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.contribute", + "Auths.Product.CounterAggregation.contributeSum", + "Auths.Product.CounterAggregation.SumCounter.counter" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_aggregate_projection", + "statement": "∀ (state incoming : List Auths.Product.CounterAggregation.SumCounter),\n List.map Auths.Product.CounterAggregation.SumCounter.counter\n (Auths.Product.CounterAggregation.aggregateSum state incoming) =\n Auths.Product.CounterAggregation.aggregate (List.map Auths.Product.CounterAggregation.SumCounter.counter state)\n (List.map Auths.Product.CounterAggregation.SumCounter.counter incoming)", + "statement_constants": [ + "Eq", + "List", + "List.map", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.aggregate", + "Auths.Product.CounterAggregation.aggregateSum", + "Auths.Product.CounterAggregation.SumCounter.counter" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_aggregate_unique", + "statement": "∀ (incoming : List Auths.Product.CounterAggregation.SumCounter),\n (List.map Auths.Product.CounterAggregation.Counter.key\n (List.map Auths.Product.CounterAggregation.SumCounter.counter\n (Auths.Product.CounterAggregation.aggregateSum [] incoming))).Nodup", + "statement_constants": [ + "List", + "List.Nodup", + "List.map", + "List.nil", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.aggregateSum", + "Auths.Product.CounterAggregation.Counter.key", + "Auths.Product.CounterAggregation.SumCounter.counter" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_aggregate_capacities", + "statement": "∀ (incoming : List Auths.Product.CounterAggregation.SumCounter) (key : Auths.Product.CounterAggregation.Key),\n Auths.Product.CounterAggregation.lookup\n (List.map Auths.Product.CounterAggregation.SumCounter.counter\n (Auths.Product.CounterAggregation.aggregateSum [] incoming))\n key =\n Auths.Product.CounterAggregation.specification (fun x => none)\n (List.map Auths.Product.CounterAggregation.SumCounter.counter incoming) key", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "List.map", + "List.nil", + "Option.none", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.aggregateSum", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.specification", + "Auths.Product.CounterAggregation.SumCounter.counter" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_contribute_length_le", + "statement": "∀ (state : List Auths.Product.CounterAggregation.SumCounter) (key : Auths.Product.CounterAggregation.Key)\n (capacity slots : ℕ),\n (Auths.Product.CounterAggregation.contributeSum state key capacity slots).length ≤ state.length + 1", + "statement_constants": [ + "List", + "Nat", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.contributeSum" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_aggregate_append", + "statement": "∀ (state first rest : List Auths.Product.CounterAggregation.SumCounter),\n Auths.Product.CounterAggregation.aggregateSum state (first ++ rest) =\n Auths.Product.CounterAggregation.aggregateSum (Auths.Product.CounterAggregation.aggregateSum state first) rest", + "statement_constants": [ + "Eq", + "List", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.aggregateSum" + ] + }, + { + "axioms": [], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_aggregate_snoc", + "statement": "∀ (state first : List Auths.Product.CounterAggregation.SumCounter) (next : Auths.Product.CounterAggregation.SumCounter),\n Auths.Product.CounterAggregation.aggregateSum state (first ++ [next]) =\n Auths.Product.CounterAggregation.contributeSum (Auths.Product.CounterAggregation.aggregateSum state first) next.key\n next.capacity next.slots", + "statement_constants": [ + "Eq", + "List", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.nil", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.aggregateSum", + "Auths.Product.CounterAggregation.contributeSum", + "Auths.Product.CounterAggregation.SumCounter.capacity", + "Auths.Product.CounterAggregation.SumCounter.key", + "Auths.Product.CounterAggregation.SumCounter.slots" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.first_slots_preserved", + "statement": "∀ (first : Auths.Product.CounterAggregation.SumCounter) (rest : List Auths.Product.CounterAggregation.SumCounter)\n (capacity slots : ℕ),\n Auths.Product.CounterAggregation.contributeSum (first :: rest) first.key capacity slots =\n { key := first.key, capacity := min first.capacity capacity, slots := first.slots } :: rest", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instMinNat", + "List.cons", + "Min.min", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.contributeSum", + "Auths.Product.CounterAggregation.SumCounter.capacity", + "Auths.Product.CounterAggregation.SumCounter.key", + "Auths.Product.CounterAggregation.SumCounter.mk", + "Auths.Product.CounterAggregation.SumCounter.slots" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_contribute_at", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.SumCounter) (key : Auths.Product.CounterAggregation.Key)\n (capacity slots index : ℕ) (old : Auths.Product.CounterAggregation.SumCounter),\n Auths.Product.SchemaIndex.position (List.map Auths.Product.CounterAggregation.SumCounter.key counters) key =\n some index →\n counters[index]? = some old →\n Auths.Product.CounterAggregation.contributeSum counters key capacity slots =\n counters.set index { key := old.key, capacity := min old.capacity capacity, slots := old.slots }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLTNat", + "instMinNat", + "GetElem?.getElem?", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "List.map", + "List.set", + "Min.min", + "Option.some", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.contributeSum", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.SumCounter.capacity", + "Auths.Product.CounterAggregation.SumCounter.key", + "Auths.Product.CounterAggregation.SumCounter.mk", + "Auths.Product.CounterAggregation.SumCounter.slots" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregation", + "name": "Auths.Product.CounterAggregation.sum_contribute_absent", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.SumCounter) (key : Auths.Product.CounterAggregation.Key)\n (capacity slots : ℕ),\n Auths.Product.SchemaIndex.position (List.map Auths.Product.CounterAggregation.SumCounter.key counters) key = none →\n Auths.Product.CounterAggregation.contributeSum counters key capacity slots =\n counters ++ [{ key := key, capacity := capacity, slots := slots }]", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.cons", + "List.instAppend", + "List.map", + "List.nil", + "Option.none", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.contributeSum", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.SumCounter.key", + "Auths.Product.CounterAggregation.SumCounter.mk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetryRefinement", + "name": "Auths.Product.ReservationRetry.Refinement.retry_target_exact", + "statement": "∀ (index : Aeneas.Std.Usize) (counts sums : Aeneas.Std.Slice Aeneas.Std.U64) (totalSize counterSize : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.reservation_retry.retry_target index counts sums totalSize counterSize)\n fun actual =>\n Auths.Product.ReservationRetry.Refinement.meaning actual =\n Auths.Product.ReservationRetry.target (↑index) (List.map (fun value => ↑value) ↑counts)\n (List.map (fun value => ↑value) ↑sums) ↑totalSize ↑counterSize", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "List.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.Usize", + "auths_gateway_kernel.reservation_retry.RetryTarget", + "auths_gateway_kernel.reservation_retry.retry_target", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.target", + "Auths.Product.ReservationRetry.Refinement.meaning" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetryRefinement", + "name": "Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay", + "statement": "∀ (counts sums : Aeneas.Std.Slice Aeneas.Std.U64) (totalSize counterSize : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.reservation_retry.retry_target 0#usize counts sums totalSize counterSize)\n fun actual => actual = auths_gateway_kernel.reservation_retry.RetryTarget.Replay", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.Usize", + "auths_gateway_kernel.reservation_retry.RetryTarget", + "auths_gateway_kernel.reservation_retry.retry_target", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.reservation_retry.RetryTarget.Replay" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetryRefinement", + "name": "Auths.Product.ReservationRetry.Refinement.source_count_progress_safe", + "statement": "∀ (index : Aeneas.Std.Usize) (counts sums : Aeneas.Std.Slice Aeneas.Std.U64) (totalSize counterSize : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.reservation_retry.retry_target index counts sums totalSize counterSize)\n fun actual =>\n ∀ (position next : ℕ),\n Auths.Product.ReservationRetry.Refinement.meaning actual =\n Auths.Product.ReservationRetry.Target.count position next →\n ↑index = position + 1 ∧\n position < (↑counts).length ∧\n next = (List.map (fun value => ↑value) ↑counts)[position]! + 1 ∧\n next ≤ Auths.Product.ReservationRetry.wordMax", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLENat", + "instLTNat", + "instOfNatNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.Usize", + "auths_gateway_kernel.reservation_retry.RetryTarget", + "auths_gateway_kernel.reservation_retry.retry_target", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.wordMax", + "Auths.Product.ReservationRetry.Refinement.meaning", + "Auths.Product.ReservationRetry.Target.count" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetryRefinement", + "name": "Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe", + "statement": "∀ (index : Aeneas.Std.Usize) (counts sums : Aeneas.Std.Slice Aeneas.Std.U64) (totalSize counterSize : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.reservation_retry.retry_target index counts sums totalSize counterSize)\n fun actual =>\n ∀ (position readSlot next : ℕ),\n Auths.Product.ReservationRetry.Refinement.meaning actual =\n Auths.Product.ReservationRetry.Target.sum position readSlot next →\n ↑index = (↑counts).length + position + 1 ∧\n position < (↑sums).length ∧\n position < ↑totalSize ∧\n position < ↑counterSize ∧\n readSlot = (List.map (fun value => ↑value) ↑sums)[position]! ∧\n next = readSlot + 1 ∧ next ≤ Auths.Product.ReservationRetry.wordMax", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLENat", + "instLTNat", + "instOfNatNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "List.map", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.Usize", + "auths_gateway_kernel.reservation_retry.RetryTarget", + "auths_gateway_kernel.reservation_retry.retry_target", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.wordMax", + "Auths.Product.ReservationRetry.Refinement.meaning", + "Auths.Product.ReservationRetry.Target.sum" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.any_associative", - "statement": "∀ (a b c : Auths.Truth), Auths.any (Auths.any a b) c = Auths.any a (Auths.any b c)" + "module": "Auths.Product.ReservationRetry", + "name": "Auths.Product.ReservationRetry.existing_claim_is_replay", + "statement": "∀ (counts sums : List ℕ) (totalSize counterSize : ℕ),\n Auths.Product.ReservationRetry.target 0 counts sums totalSize counterSize =\n Auths.Product.ReservationRetry.Target.replay", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.target", + "Auths.Product.ReservationRetry.Target.replay" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetry", + "name": "Auths.Product.ReservationRetry.count_progress_exact", + "statement": "∀ (index : ℕ) (counts sums : List ℕ) (totalSize counterSize position next : ℕ),\n Auths.Product.ReservationRetry.target index counts sums totalSize counterSize =\n Auths.Product.ReservationRetry.Target.count position next →\n index = position + 1 ∧\n position < counts.length ∧ next = counts[position]! + 1 ∧ next ≤ Auths.Product.ReservationRetry.wordMax", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLENat", + "instLTNat", + "instOfNatNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "OfNat.ofNat", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.target", + "Auths.Product.ReservationRetry.wordMax", + "Auths.Product.ReservationRetry.Target.count" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetry", + "name": "Auths.Product.ReservationRetry.sum_progress_exact", + "statement": "∀ (index : ℕ) (counts sums : List ℕ) (totalSize counterSize position readSlot next : ℕ),\n Auths.Product.ReservationRetry.target index counts sums totalSize counterSize =\n Auths.Product.ReservationRetry.Target.sum position readSlot next →\n index = counts.length + position + 1 ∧\n position < sums.length ∧\n position < totalSize ∧\n position < counterSize ∧\n readSlot = sums[position]! ∧ next = readSlot + 1 ∧ next ≤ Auths.Product.ReservationRetry.wordMax", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLENat", + "instLTNat", + "instOfNatNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "OfNat.ofNat", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.target", + "Auths.Product.ReservationRetry.wordMax", + "Auths.Product.ReservationRetry.Target.sum" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetry", + "name": "Auths.Product.ReservationRetry.count_available", + "statement": "∀ (counts sums : List ℕ) (totalSize counterSize position : ℕ),\n position < counts.length →\n counts[position]! < Auths.Product.ReservationRetry.wordMax →\n Auths.Product.ReservationRetry.target (position + 1) counts sums totalSize counterSize =\n Auths.Product.ReservationRetry.Target.count position (counts[position]! + 1)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLTNat", + "instOfNatNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "OfNat.ofNat", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.target", + "Auths.Product.ReservationRetry.wordMax", + "Auths.Product.ReservationRetry.Target.count" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationRetry", + "name": "Auths.Product.ReservationRetry.sum_available", + "statement": "∀ (counts sums : List ℕ) (totalSize counterSize position : ℕ),\n position < sums.length →\n position < totalSize →\n position < counterSize →\n sums[position]! < Auths.Product.ReservationRetry.wordMax →\n Auths.Product.ReservationRetry.target (counts.length + position + 1) counts sums totalSize counterSize =\n Auths.Product.ReservationRetry.Target.sum position sums[position]! (sums[position]! + 1)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLTNat", + "instOfNatNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "OfNat.ofNat", + "Auths.Product.ReservationRetry.Target", + "Auths.Product.ReservationRetry.target", + "Auths.Product.ReservationRetry.wordMax", + "Auths.Product.ReservationRetry.Target.sum" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.count_loop_exact", + "statement": "∀ (counts : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (slots : Aeneas.Std.Slice Aeneas.Std.U64)\n (initial : Aeneas.Std.alloc.vec.Vec auths_gateway_kernel.reservation_batch.SlotEntry),\n (↑counts).length ≤ 16 →\n (↑counts).length = (↑slots).length →\n (↑initial).length ≤ 1 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.reservation_batch.build_batch_loop0 counts slots initial 0#usize)\n fun actual =>\n Auths.Product.SlotBatch.Refinement.entriesView actual =\n Auths.Product.SlotBatch.Refinement.entriesView initial ++\n Auths.Product.SlotBatch.Refinement.nativeCounts counts slots", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instHAppendOfAppend", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAppend.hAppend", + "LE.le", + "List.instAppend", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.reservation_batch.SlotEntry", + "auths_gateway_kernel.reservation_batch.build_batch_loop0", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotBatch.Entry", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SlotBatch.Refinement.entriesView", + "Auths.Product.SlotBatch.Refinement.nativeCounts" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.sum_loop_exact", + "statement": "∀ (sums : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity)\n (slots totals : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64)\n (initial : Aeneas.Std.alloc.vec.Vec auths_gateway_kernel.reservation_batch.SlotEntry),\n (↑sums).length ≤ 16 →\n (↑sums).length = (↑slots).length →\n (↑sums).length = (↑totals).length →\n (↑initial).length ≤ 17 →\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.reservation_batch.build_batch_loop1 sums slots totals amount initial 0#usize)\n fun actual =>\n Option.map Auths.Product.SlotBatch.Refinement.entriesView actual =\n Auths.Product.SlotBatch.Refinement.nativeSums (Auths.Product.SlotBatch.Refinement.entriesView initial)\n (↑sums) (↑slots) (↑totals) amount", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Option.map", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.reservation_batch.SlotEntry", + "auths_gateway_kernel.reservation_batch.build_batch_loop1", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotBatch.Entry", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SlotBatch.Refinement.entriesView", + "Auths.Product.SlotBatch.Refinement.nativeSums" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.build_exact", + "statement": "∀ (claim : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (counts : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (countSlots : Aeneas.Std.Slice Aeneas.Std.U64)\n (sums : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity)\n (sumSlots totals : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount)\n fun actual =>\n Option.map Auths.Product.SlotBatch.Refinement.entriesView actual =\n Auths.Product.SlotBatch.build (Auths.Product.SlotBatch.Refinement.keyBytes claim)\n (Auths.Product.SlotBatch.Refinement.countKeys counts) (Auths.Product.SlotBatch.Refinement.wordValues countSlots)\n (Auths.Product.SlotBatch.Refinement.sumKeys sums) (Auths.Product.SlotBatch.Refinement.wordValues sumSlots)\n (Auths.Product.SlotBatch.Refinement.wordValues totals) ↑amount", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Option.map", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.reservation_batch.SlotEntry", + "auths_gateway_kernel.reservation_batch.build_batch", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotBatch.Entry", + "Auths.Product.SlotBatch.build", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SlotBatch.Refinement.countKeys", + "Auths.Product.SlotBatch.Refinement.entriesView", + "Auths.Product.SlotBatch.Refinement.keyBytes", + "Auths.Product.SlotBatch.Refinement.sumKeys", + "Auths.Product.SlotBatch.Refinement.wordValues" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.source_claim_first", + "statement": "∀ (claim : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (counts : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (countSlots : Aeneas.Std.Slice Aeneas.Std.U64)\n (sums : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity)\n (sumSlots totals : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount)\n fun actual =>\n match actual with\n | none => True\n | some entries =>\n (Auths.Product.SlotBatch.Refinement.entriesView entries).head? =\n some (Auths.Product.SlotBatch.Entry.claim (Auths.Product.SlotBatch.Refinement.keyBytes claim))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Option", + "True", + "Unit", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.head?", + "Nat.decLe", + "OfNat.ofNat", + "Option.some", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.reservation_batch.SlotEntry", + "auths_gateway_kernel.reservation_batch.build_batch", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotBatch.Entry", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SlotBatch.Entry.claim", + "Auths.Product.SlotBatch.Refinement.entriesView", + "Auths.Product.SlotBatch.Refinement.keyBytes", + "Auths.Product.SlotBatch.Refinement.source_claim_first.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.source_complete_entry_count", + "statement": "∀ (claim : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (counts : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (countSlots : Aeneas.Std.Slice Aeneas.Std.U64)\n (sums : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity)\n (sumSlots totals : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount)\n fun actual =>\n match actual with\n | none => True\n | some entries => (↑entries).length = 1 + (↑counts).length + (↑sums).length ∧ (↑entries).length ≤ 33", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Option", + "True", + "Unit", + "id", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "HAdd.hAdd", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.reservation_batch.SlotEntry", + "auths_gateway_kernel.reservation_batch.build_batch", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SlotBatch.Refinement.source_claim_first.match_1" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused", + "statement": "∀ (claim : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (counts : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (countSlots : Aeneas.Std.Slice Aeneas.Std.U64)\n (sums : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.SumCapacity)\n (sumSlots totals : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n ¬Auths.Product.SlotBatch.shape (Auths.Product.SlotBatch.Refinement.countKeys counts)\n (Auths.Product.SlotBatch.Refinement.wordValues countSlots) (Auths.Product.SlotBatch.Refinement.sumKeys sums)\n (Auths.Product.SlotBatch.Refinement.wordValues sumSlots)\n (Auths.Product.SlotBatch.Refinement.wordValues totals) →\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.reservation_batch.build_batch claim counts countSlots sums sumSlots totals amount)\n fun actual => actual = none", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Not", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Option.none", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.reservation_batch.SlotEntry", + "auths_gateway_kernel.reservation_batch.build_batch", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotBatch.shape", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.SlotBatch.Refinement.countKeys", + "Auths.Product.SlotBatch.Refinement.sumKeys", + "Auths.Product.SlotBatch.Refinement.wordValues" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.any_idempotent", - "statement": "∀ (value : Auths.Truth), Auths.any value value = value" + "module": "Auths.Product.SlotBatch", + "name": "Auths.Product.SlotBatch.sum_entries_length", + "statement": "∀ (counters : List Auths.Product.SlotBatch.Key) (slots totals : List ℕ) (amount : ℕ)\n (entries : List Auths.Product.SlotBatch.Entry),\n Auths.Product.SlotBatch.sumEntries counters slots totals amount = some entries →\n entries.length = counters.length ∧ counters.length = slots.length ∧ counters.length = totals.length", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "List.length", + "Option.some", + "Auths.Product.SlotBatch.Entry", + "Auths.Product.SlotBatch.Key", + "Auths.Product.SlotBatch.sumEntries" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.threshold_one_eq_any", - "statement": "∀ (left right : Auths.Truth), Auths.thresholdTwo 1 left right = Auths.any left right" + "module": "Auths.Product.SlotBatch", + "name": "Auths.Product.SlotBatch.first_is_claim", + "statement": "∀ (claim : Auths.Product.SlotBatch.Key) (counts : List Auths.Product.SlotBatch.Key) (countSlots : List ℕ)\n (sums : List Auths.Product.SlotBatch.Key) (sumSlots totals : List ℕ) (amount : ℕ)\n (entries : List Auths.Product.SlotBatch.Entry),\n Auths.Product.SlotBatch.build claim counts countSlots sums sumSlots totals amount = some entries →\n entries.head? = some (Auths.Product.SlotBatch.Entry.claim claim)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "List.head?", + "Option.some", + "Auths.Product.SlotBatch.Entry", + "Auths.Product.SlotBatch.Key", + "Auths.Product.SlotBatch.build", + "Auths.Product.SlotBatch.Entry.claim" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotBatch", + "name": "Auths.Product.SlotBatch.exact_entry_count", + "statement": "∀ (claim : Auths.Product.SlotBatch.Key) (counts : List Auths.Product.SlotBatch.Key) (countSlots : List ℕ)\n (sums : List Auths.Product.SlotBatch.Key) (sumSlots totals : List ℕ) (amount : ℕ)\n (entries : List Auths.Product.SlotBatch.Entry),\n Auths.Product.SlotBatch.build claim counts countSlots sums sumSlots totals amount = some entries →\n entries.length = 1 + counts.length + sums.length ∧ entries.length ≤ 33", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "instAddNat", + "instHAdd", + "instLENat", + "instOfNatNat", + "HAdd.hAdd", + "LE.le", + "List.length", + "OfNat.ofNat", + "Option.some", + "Auths.Product.SlotBatch.Entry", + "Auths.Product.SlotBatch.Key", + "Auths.Product.SlotBatch.build" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.threshold_n_eq_all", - "statement": "∀ (left right : Auths.Truth), Auths.thresholdTwo 2 left right = Auths.all left right" + "module": "Auths.Product.SlotBatch", + "name": "Auths.Product.SlotBatch.invalid_shape_refused", + "statement": "∀ (claim : Auths.Product.SlotBatch.Key) (counts : List Auths.Product.SlotBatch.Key) (countSlots : List ℕ)\n (sums : List Auths.Product.SlotBatch.Key) (sumSlots totals : List ℕ) (amount : ℕ),\n ¬Auths.Product.SlotBatch.shape counts countSlots sums sumSlots totals →\n Auths.Product.SlotBatch.build claim counts countSlots sums sumSlots totals amount = none", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Not", + "Option", + "Option.none", + "Auths.Product.SlotBatch.Entry", + "Auths.Product.SlotBatch.Key", + "Auths.Product.SlotBatch.build", + "Auths.Product.SlotBatch.shape" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.threshold_monotone_k", - "statement": "∀ (left right : Auths.Truth), (Auths.thresholdTwo 2 left right).le (Auths.thresholdTwo 1 left right)" + "module": "Auths.Product.SlotBatchRefinement", + "name": "Auths.Product.SlotBatch.Refinement.native_sums_refines", + "statement": "∀ (built : List Auths.Product.SlotBatch.Entry) (counters : List auths_gateway_kernel.counter_aggregation.SumCapacity)\n (slots totals : List Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Auths.Product.SlotBatch.Refinement.nativeSums built counters slots totals amount =\n Option.map (fun x => built ++ x)\n (Auths.Product.SlotBatch.sumEntries\n (List.map (fun counter => Auths.Product.SlotBatch.Refinement.keyBytes counter.key) counters)\n (List.map (fun slot => ↑slot) slots) (List.map (fun total => ↑total) totals) ↑amount)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instHAppendOfAppend", + "HAppend.hAppend", + "List.instAppend", + "List.map", + "Option.map", + "Aeneas.Std.U64", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Auths.Product.SlotBatch.Entry", + "Auths.Product.SlotBatch.Key", + "Auths.Product.SlotBatch.sumEntries", + "auths_gateway_kernel.counter_aggregation.SumCapacity.key", + "Auths.Product.SlotBatch.Refinement.keyBytes", + "Auths.Product.SlotBatch.Refinement.nativeSums" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotRecordRefinement", + "name": "Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec", + "statement": "∀ (stored : Aeneas.Std.Slice Aeneas.Std.U8) (counter : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.slot_record.counter_hex_matches stored counter) fun actual =>\n actual =\n decide\n (Auths.Product.SlotRecord.hexMatches (Auths.Product.SlotRecord.Refinement.bytes ↑stored)\n (Auths.Product.SlotRecord.Refinement.bytes ↑counter))", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.slot_record.counter_hex_matches", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotRecord.hexMatches", + "Auths.Product.SlotRecord.instDecidableHexMatches", + "Auths.Product.SlotRecord.Refinement.bytes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotRecordRefinement", + "name": "Auths.Product.SlotRecord.Refinement.validate_cumulative_exact", + "statement": "∀ (schema expectedSchema stored : Aeneas.Std.Slice Aeneas.Std.U8) (counter : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (expectedSlot : Aeneas.Std.U64) (values : auths_gateway_kernel.slot_record.SumValues),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.slot_record.validate_cumulative schema expectedSchema stored counter expectedSlot values)\n fun actual =>\n Option.map Aeneas.Std.UScalar.val actual =\n Auths.Product.SlotRecord.validate (Auths.Product.SlotRecord.Refinement.bytes ↑schema)\n (Auths.Product.SlotRecord.Refinement.bytes ↑expectedSchema) (Auths.Product.SlotRecord.Refinement.bytes ↑stored)\n (Auths.Product.SlotRecord.Refinement.bytes ↑counter) (↑expectedSlot)\n (Auths.Product.SlotRecord.Refinement.valuesView values)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Option.map", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.UScalar", + "auths_gateway_kernel.slot_record.SumValues", + "auths_gateway_kernel.slot_record.validate_cumulative", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotRecord.validate", + "Auths.Product.SlotRecord.Refinement.bytes", + "Auths.Product.SlotRecord.Refinement.valuesView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotRecordRefinement", + "name": "Auths.Product.SlotRecord.Refinement.source_accepted_binds_record", + "statement": "∀ (schema expectedSchema stored : Aeneas.Std.Slice Aeneas.Std.U8) (counter : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (expectedSlot : Aeneas.Std.U64) (values : auths_gateway_kernel.slot_record.SumValues),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.slot_record.validate_cumulative schema expectedSchema stored counter expectedSlot values)\n fun actual =>\n ∀ (value : Aeneas.Std.U64),\n actual = some value →\n ↑schema = ↑expectedSchema ∧\n Auths.Product.SlotRecord.hexMatches (Auths.Product.SlotRecord.Refinement.bytes ↑stored)\n (Auths.Product.SlotRecord.Refinement.bytes ↑counter) ∧\n ↑values.slot = ↑expectedSlot ∧ ↑values.amount ≤ ↑value ∧ ↑value = ↑values.cumulative", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Option.some", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.slot_record.SumValues", + "auths_gateway_kernel.slot_record.validate_cumulative", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotRecord.hexMatches", + "auths_gateway_kernel.slot_record.SumValues.amount", + "auths_gateway_kernel.slot_record.SumValues.cumulative", + "auths_gateway_kernel.slot_record.SumValues.slot", + "Auths.Product.SlotRecord.Refinement.bytes" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotRecordRefinement", + "name": "Auths.Product.SlotRecord.Refinement.source_invalid_record_refused", + "statement": "∀ (schema expectedSchema stored : Aeneas.Std.Slice Aeneas.Std.U8) (counter : Aeneas.Std.Array Aeneas.Std.U8 32#usize)\n (expectedSlot : Aeneas.Std.U64) (values : auths_gateway_kernel.slot_record.SumValues),\n ¬Auths.Product.SlotRecord.valid (Auths.Product.SlotRecord.Refinement.bytes ↑schema)\n (Auths.Product.SlotRecord.Refinement.bytes ↑expectedSchema) (Auths.Product.SlotRecord.Refinement.bytes ↑stored)\n (Auths.Product.SlotRecord.Refinement.bytes ↑counter) (↑expectedSlot)\n (Auths.Product.SlotRecord.Refinement.valuesView values) →\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.slot_record.validate_cumulative schema expectedSchema stored counter expectedSlot values)\n fun actual => actual = none", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Not", + "Option", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Option.none", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.slot_record.SumValues", + "auths_gateway_kernel.slot_record.validate_cumulative", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.SlotRecord.valid", + "Auths.Product.SlotRecord.Refinement.bytes", + "Auths.Product.SlotRecord.Refinement.valuesView" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.threshold_zero_authorized", - "statement": "∀ (left right : Auths.Truth), Auths.thresholdTwo 0 left right = Auths.Generated.Truth.authorized" + "module": "Auths.Product.SlotRecord", + "name": "Auths.Product.SlotRecord.accepted_iff", + "statement": "∀ (schema expectedSchema stored counter : Auths.Product.SlotRecord.Bytes) (expectedSlot : ℕ)\n (values : Auths.Product.SlotRecord.Values),\n Auths.Product.SlotRecord.validate schema expectedSchema stored counter expectedSlot values = some values.cumulative ↔\n Auths.Product.SlotRecord.valid schema expectedSchema stored counter expectedSlot values", + "statement_constants": [ + "Eq", + "Iff", + "Nat", + "Option", + "Option.some", + "Auths.Product.SlotRecord.Bytes", + "Auths.Product.SlotRecord.Values", + "Auths.Product.SlotRecord.valid", + "Auths.Product.SlotRecord.validate", + "Auths.Product.SlotRecord.Values.cumulative" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.threshold_above_inputs_denied", - "statement": "∀ {k : ℕ}, 3 ≤ k → ∀ (left right : Auths.Truth), Auths.thresholdTwo k left right = Auths.Generated.Truth.denied" + "module": "Auths.Product.SlotRecord", + "name": "Auths.Product.SlotRecord.accepted_binds_slot", + "statement": "∀ (schema expectedSchema stored counter : Auths.Product.SlotRecord.Bytes) (expectedSlot value : ℕ)\n (values : Auths.Product.SlotRecord.Values),\n Auths.Product.SlotRecord.validate schema expectedSchema stored counter expectedSlot values = some value →\n schema = expectedSchema ∧\n Auths.Product.SlotRecord.hexMatches stored counter ∧\n values.slot = expectedSlot ∧ values.amount ≤ value ∧ value = values.cumulative", + "statement_constants": [ + "And", + "Eq", + "Nat", + "Option", + "instLENat", + "LE.le", + "Option.some", + "Auths.Product.SlotRecord.Bytes", + "Auths.Product.SlotRecord.Values", + "Auths.Product.SlotRecord.hexMatches", + "Auths.Product.SlotRecord.validate", + "Auths.Product.SlotRecord.Values.amount", + "Auths.Product.SlotRecord.Values.cumulative", + "Auths.Product.SlotRecord.Values.slot" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SlotRecord", + "name": "Auths.Product.SlotRecord.hex_matches_injective", + "statement": "∀ (stored left right : Auths.Product.SlotRecord.Bytes),\n (∀ value ∈ left, value < 256) →\n (∀ value ∈ right, value < 256) →\n Auths.Product.SlotRecord.hexMatches stored left → Auths.Product.SlotRecord.hexMatches stored right → left = right", + "statement_constants": [ + "Eq", + "Nat", + "instLTNat", + "instOfNatNat", + "LT.lt", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.SlotRecord.Bytes", + "Auths.Product.SlotRecord.hexMatches" + ] }, { "axioms": [ @@ -2343,47 +24048,660 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.threshold_antitone_k", - "statement": "∀ {k₁ k₂ : ℕ},\n k₁ ≤ k₂ → ∀ (left right : Auths.Truth), (Auths.thresholdTwo k₂ left right).le (Auths.thresholdTwo k₁ left right)" + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.lookup_at", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key) (index : ℕ)\n (entry : Auths.Product.CounterAggregation.Counter),\n Auths.Product.SchemaIndex.position (List.map Auths.Product.CounterAggregation.Counter.key counters) key = some index →\n counters[index]? = some entry → Auths.Product.CounterAggregation.lookup counters key = some entry.capacity", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "instLTNat", + "GetElem?.getElem?", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "List.map", + "Option.some", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.Counter.capacity", + "Auths.Product.CounterAggregation.Counter.key" + ] + }, + { + "axioms": [ + "propext" + ], + "kind": "theorem", + "module": "Auths.Product.CounterAggregation", + "name": "Auths.Product.CounterAggregation.lookup_absent", + "statement": "∀ (counters : List Auths.Product.CounterAggregation.Counter) (key : Auths.Product.CounterAggregation.Key),\n Auths.Product.SchemaIndex.position (List.map Auths.Product.CounterAggregation.Counter.key counters) key = none →\n Auths.Product.CounterAggregation.lookup counters key = none", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "List.map", + "Option.none", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.SchemaIndex.Name", + "Auths.Product.SchemaIndex.position", + "Auths.Product.CounterAggregation.Counter.key" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.thresholdCounts_antitone_required", - "statement": "∀ {k₁ k₂ a i : ℕ}, k₁ ≤ k₂ → Auths.Truth.le (Auths.thresholdCounts k₂ a i) (Auths.thresholdCounts k₁ a i)" + "module": "Auths.Product.CounterAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.count_capacity_spec", + "statement": "∀ (counters : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (key : Aeneas.Std.Array Aeneas.Std.U8 32#usize),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.count_capacity counters key) fun actual =>\n ↑actual =\n (Auths.Product.CounterAggregation.lookup\n (List.map Auths.Product.CounterAggregation.Refinement.counterView ↑counters)\n (List.map (fun x => ↑x) ↑key)).getD\n 0", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Option.getD", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.count_capacity", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.Refinement.counterView" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.thresholdTwo_eq_thresholdCounts", - "statement": "∀ (k : ℕ) (left right : Auths.Truth),\n Auths.thresholdTwo k left right =\n Auths.thresholdCounts k (List.countP (fun x => x == Auths.Generated.Truth.authorized) [left, right])\n (List.countP (fun x => x == Auths.Generated.Truth.indeterminate) [left, right])" + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact", + "statement": "∀ (counts : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (countKey sumKey : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (capacity : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_gateway_kernel.counter_aggregation.linked_sum_contribution counts countKey sumKey capacity)\n fun actual =>\n Auths.Product.CounterAggregation.Refinement.sumView actual =\n { key := List.map (fun x => ↑x) ↑sumKey, capacity := ↑capacity,\n slots :=\n (Auths.Product.CounterAggregation.lookup\n (List.map Auths.Product.CounterAggregation.Refinement.counterView ↑counts)\n (List.map (fun x => ↑x) ↑countKey)).getD\n 0 }", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Option.getD", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.linked_sum_contribution", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.lookup", + "Auths.Product.CounterAggregation.Refinement.counterView", + "Auths.Product.CounterAggregation.Refinement.sumView", + "Auths.Product.CounterAggregation.SumCounter.mk" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.SumAggregationRefinement", + "name": "Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum", + "statement": "∀ (incoming : Aeneas.Std.Slice auths_gateway_kernel.counter_aggregation.CounterCapacity)\n (countKey sumKey : Aeneas.Std.Array Aeneas.Std.U8 32#usize) (capacity : Aeneas.Std.U64),\n (↑incoming).length ≤ 16 →\n Aeneas.Std.WP.spec\n (do\n let counts ← auths_gateway_kernel.counter_aggregation.aggregate incoming\n auths_gateway_kernel.counter_aggregation.linked_sum_contribution counts.deref countKey sumKey capacity)\n fun actual =>\n Auths.Product.CounterAggregation.Refinement.sumView actual =\n { key := List.map (fun x => ↑x) ↑sumKey, capacity := ↑capacity,\n slots :=\n (Auths.Product.CounterAggregation.specification (fun x => none)\n (List.map Auths.Product.CounterAggregation.Refinement.counterView ↑incoming)\n (List.map (fun x => ↑x) ↑countKey)).getD\n 0 }", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bind.bind", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "List.map", + "Nat.decLe", + "OfNat.ofNat", + "Option.getD", + "Option.none", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Result", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "Aeneas.Std.instBindResult", + "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "auths_gateway_kernel.counter_aggregation.SumCapacity", + "auths_gateway_kernel.counter_aggregation.aggregate", + "auths_gateway_kernel.counter_aggregation.linked_sum_contribution", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Product.CounterAggregation.Counter", + "Auths.Product.CounterAggregation.Key", + "Auths.Product.CounterAggregation.SumCounter", + "Auths.Product.CounterAggregation.specification", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.CounterAggregation.Refinement.counterView", + "Auths.Product.CounterAggregation.Refinement.sumView", + "Auths.Product.CounterAggregation.SumCounter.mk", + "Aeneas.Std.alloc.vec.Vec.deref" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmissionRefinement", + "name": "Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_bounded_policy.kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount)\n fun actual =>\n Auths.Product.ReservationAdmission.Refinement.codeView actual =\n Auths.Product.ReservationAdmission.decideReservation (Auths.Product.Refinement.natList ↑counts)\n (Auths.Product.Refinement.natList ↑countCaps) (Auths.Product.Refinement.natList ↑slots)\n (Auths.Product.Refinement.natList ↑slotCaps) (Auths.Product.Refinement.natList ↑totals)\n (Auths.Product.Refinement.natList ↑sumCaps) ↑amount", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.ReservationCode", + "auths_bounded_policy.kernel.reservation_admission", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.Refinement.natList", + "Auths.Product.ReservationAdmission.Code", + "Auths.Product.ReservationAdmission.decideReservation", + "Auths.Product.ReservationAdmission.Refinement.codeView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmissionRefinement", + "name": "Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_bounded_policy.kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount)\n fun actual =>\n actual = auths_bounded_policy.kernel.ReservationCode.Admit →\n Auths.Product.ReservationAdmission.CountRoom (Auths.Product.Refinement.natList ↑counts)\n (Auths.Product.Refinement.natList ↑countCaps) ∧\n Auths.Product.ReservationAdmission.CountRoom (Auths.Product.Refinement.natList ↑slots)\n (Auths.Product.Refinement.natList ↑slotCaps) ∧\n Auths.Product.ReservationAdmission.SumRoom (Auths.Product.Refinement.natList ↑totals) (↑amount)\n (Auths.Product.Refinement.natList ↑sumCaps)", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.ReservationCode", + "auths_bounded_policy.kernel.reservation_admission", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.Refinement.natList", + "Auths.Product.ReservationAdmission.CountRoom", + "Auths.Product.ReservationAdmission.SumRoom", + "auths_bounded_policy.kernel.ReservationCode.Admit" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmissionRefinement", + "name": "Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n ¬Auths.Product.ReservationAdmission.CountRoom (Auths.Product.Refinement.natList ↑counts)\n (Auths.Product.Refinement.natList ↑countCaps) ∨\n ¬Auths.Product.ReservationAdmission.CountRoom (Auths.Product.Refinement.natList ↑slots)\n (Auths.Product.Refinement.natList ↑slotCaps) →\n Aeneas.Std.WP.spec\n (auths_bounded_policy.kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount)\n fun actual => actual = auths_bounded_policy.kernel.ReservationCode.WindowExhausted", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Not", + "Or", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.ReservationCode", + "auths_bounded_policy.kernel.reservation_admission", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.Refinement.natList", + "Auths.Product.ReservationAdmission.CountRoom", + "auths_bounded_policy.kernel.ReservationCode.WindowExhausted" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmissionRefinement", + "name": "Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_bounded_policy.kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount)\n fun actual =>\n actual = auths_bounded_policy.kernel.ReservationCode.Admit →\n (↑counts).length = (↑countCaps).length ∧\n (↑slots).length = (↑slotCaps).length ∧ (↑totals).length = (↑sumCaps).length", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.ReservationCode", + "auths_bounded_policy.kernel.reservation_admission", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "auths_bounded_policy.kernel.ReservationCode.Admit" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmissionRefinement", + "name": "Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : Aeneas.Std.Slice Aeneas.Std.U64) (amount : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_bounded_policy.kernel.reservation_admission counts countCaps slots slotCaps totals sumCaps amount)\n fun actual =>\n actual = auths_bounded_policy.kernel.ReservationCode.Admit →\n ∀ index < (↑totals).length, (Auths.Product.Refinement.natList ↑totals)[index]! + ↑amount ≤ Aeneas.Std.U64.max", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLENat", + "instLTNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_bounded_policy.kernel.ReservationCode", + "auths_bounded_policy.kernel.reservation_admission", + "Aeneas.Std.U64.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.Refinement.natList", + "auths_bounded_policy.kernel.ReservationCode.Admit" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmission", + "name": "Auths.Product.ReservationAdmission.counts_admit_iff", + "statement": "∀ (values capacities : List ℕ),\n Auths.Product.CeilingCount.countsAdmit values capacities = true ↔\n Auths.Product.ReservationAdmission.CountRoom values capacities", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Bool.true", + "Auths.Product.CeilingCount.countsAdmit", + "Auths.Product.ReservationAdmission.CountRoom" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmission", + "name": "Auths.Product.ReservationAdmission.sums_admit_iff", + "statement": "∀ (values capacities : List ℕ) (amount : ℕ),\n Auths.Product.CeilingCount.sumsAdmit values amount capacities = true ↔\n Auths.Product.ReservationAdmission.SumRoom values amount capacities", + "statement_constants": [ + "Bool", + "Eq", + "Iff", + "List", + "Nat", + "Bool.true", + "Auths.Product.CeilingCount.sumsAdmit", + "Auths.Product.ReservationAdmission.SumRoom" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmission", + "name": "Auths.Product.ReservationAdmission.admitted_iff", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : List ℕ) (amount : ℕ),\n Auths.Product.ReservationAdmission.decideReservation counts countCaps slots slotCaps totals sumCaps amount =\n Auths.Product.ReservationAdmission.Code.admit ↔\n Auths.Product.ReservationAdmission.CountRoom counts countCaps ∧\n Auths.Product.ReservationAdmission.CountRoom slots slotCaps ∧\n Auths.Product.ReservationAdmission.SumRoom totals amount sumCaps", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Nat", + "Auths.Product.ReservationAdmission.Code", + "Auths.Product.ReservationAdmission.CountRoom", + "Auths.Product.ReservationAdmission.SumRoom", + "Auths.Product.ReservationAdmission.decideReservation", + "Auths.Product.ReservationAdmission.Code.admit" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmission", + "name": "Auths.Product.ReservationAdmission.admitted_shapes", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : List ℕ) (amount : ℕ),\n Auths.Product.ReservationAdmission.decideReservation counts countCaps slots slotCaps totals sumCaps amount =\n Auths.Product.ReservationAdmission.Code.admit →\n counts.length = countCaps.length ∧ slots.length = slotCaps.length ∧ totals.length = sumCaps.length", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "List.length", + "Auths.Product.ReservationAdmission.Code", + "Auths.Product.ReservationAdmission.decideReservation", + "Auths.Product.ReservationAdmission.Code.admit" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmission", + "name": "Auths.Product.ReservationAdmission.window_refusal_precedes_sum", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : List ℕ) (amount : ℕ),\n ¬Auths.Product.ReservationAdmission.CountRoom counts countCaps ∨\n ¬Auths.Product.ReservationAdmission.CountRoom slots slotCaps →\n Auths.Product.ReservationAdmission.decideReservation counts countCaps slots slotCaps totals sumCaps amount =\n Auths.Product.ReservationAdmission.Code.windowExhausted", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Not", + "Or", + "Auths.Product.ReservationAdmission.Code", + "Auths.Product.ReservationAdmission.CountRoom", + "Auths.Product.ReservationAdmission.decideReservation", + "Auths.Product.ReservationAdmission.Code.windowExhausted" + ] + }, + { + "axioms": [ + "propext", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ReservationAdmission", + "name": "Auths.Product.ReservationAdmission.admitted_sum_at", + "statement": "∀ (counts countCaps slots slotCaps totals sumCaps : List ℕ) (amount index : ℕ),\n Auths.Product.ReservationAdmission.decideReservation counts countCaps slots slotCaps totals sumCaps amount =\n Auths.Product.ReservationAdmission.Code.admit →\n index < totals.length → totals[index]! + amount ≤ sumCaps[index]!", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instAddNat", + "instHAdd", + "instInhabitedNat", + "instLENat", + "instLTNat", + "GetElem?.getElem!", + "HAdd.hAdd", + "LE.le", + "LT.lt", + "List.instGetElem?NatLtLength", + "List.length", + "Auths.Product.ReservationAdmission.Code", + "Auths.Product.ReservationAdmission.decideReservation", + "Auths.Product.ReservationAdmission.Code.admit" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionEntryRefinement", + "name": "Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact", + "statement": "∀ (profiles : Aeneas.Std.Slice auths_gateway_kernel.entry_authorization.EntryProfile)\n (requested : auths_gateway_kernel.entry_authorization.EntryProfile),\n Aeneas.Std.WP.spec (auths_gateway_kernel.entry_authorization.profile_allowed profiles requested) fun actual =>\n actual =\n decide\n (Auths.Product.ConnectionEntry.Refinement.profileView requested ∈\n Auths.Product.ConnectionEntry.Refinement.profilesView profiles)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "instBEqOfDecidableEq", + "instLawfulBEq", + "Decidable.decide", + "List.instDecidableMemOfLawfulBEq", + "List.instMembership", + "Membership.mem", + "Aeneas.Std.Slice", + "auths_gateway_kernel.entry_authorization.EntryProfile", + "auths_gateway_kernel.entry_authorization.profile_allowed", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionEntry.Profile", + "Auths.Product.ConnectionEntry.instDecidableEqProfile", + "Auths.Product.ConnectionEntry.Refinement.profileView", + "Auths.Product.ConnectionEntry.Refinement.profilesView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionEntryRefinement", + "name": "Auths.Product.ConnectionEntry.Refinement.entry_allows_exact", + "statement": "∀ (state : auths_gateway_kernel.entry_authorization.EntryState)\n (workloads : Aeneas.Std.Slice (Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8))\n (profiles : Aeneas.Std.Slice auths_gateway_kernel.entry_authorization.EntryProfile)\n (workload : Aeneas.Std.Slice Aeneas.Std.U8) (profile : auths_gateway_kernel.entry_authorization.EntryProfile),\n Aeneas.Std.WP.spec (auths_gateway_kernel.entry_authorization.entry_allows state workloads profiles workload profile)\n fun actual =>\n actual =\n Auths.Product.ConnectionEntry.allows (Auths.Product.ConnectionEntry.Refinement.stateView state)\n (Auths.Product.SchemaIndex.Refinement.namesView workloads)\n (Auths.Product.ConnectionEntry.Refinement.profilesView profiles)\n (Auths.Product.ConnectionEntry.Refinement.bytes ↑workload)\n (Auths.Product.ConnectionEntry.Refinement.profileView profile)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.entry_authorization.EntryProfile", + "auths_gateway_kernel.entry_authorization.EntryState", + "auths_gateway_kernel.entry_authorization.entry_allows", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionEntry.allows", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.ConnectionEntry.Refinement.bytes", + "Auths.Product.ConnectionEntry.Refinement.profileView", + "Auths.Product.ConnectionEntry.Refinement.profilesView", + "Auths.Product.ConnectionEntry.Refinement.stateView", + "Auths.Product.SchemaIndex.Refinement.namesView" + ] + }, + { + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], + "kind": "theorem", + "module": "Auths.Product.ConnectionEntryRefinement", + "name": "Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile", + "statement": "∀ (state : auths_gateway_kernel.entry_authorization.EntryState)\n (workloads : Aeneas.Std.Slice (Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8))\n (profiles : Aeneas.Std.Slice auths_gateway_kernel.entry_authorization.EntryProfile)\n (workload : Aeneas.Std.Slice Aeneas.Std.U8) (profile : auths_gateway_kernel.entry_authorization.EntryProfile),\n Aeneas.Std.WP.spec (auths_gateway_kernel.entry_authorization.entry_allows state workloads profiles workload profile)\n fun actual =>\n actual = true →\n Auths.Product.ConnectionEntry.Refinement.stateView state = Auths.Product.ConnectionEntry.State.active ∧\n Auths.Product.ConnectionEntry.Refinement.bytes ↑workload ∈\n Auths.Product.SchemaIndex.Refinement.namesView workloads ∧\n Auths.Product.ConnectionEntry.Refinement.profileView profile ∈\n Auths.Product.ConnectionEntry.Refinement.profilesView profiles", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Bool.true", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.entry_authorization.EntryProfile", + "auths_gateway_kernel.entry_authorization.EntryState", + "auths_gateway_kernel.entry_authorization.entry_allows", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionEntry.Profile", + "Auths.Product.ConnectionEntry.State", + "Auths.Product.SchemaIndex.Name", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.ConnectionEntry.Refinement.bytes", + "Auths.Product.ConnectionEntry.Refinement.profileView", + "Auths.Product.ConnectionEntry.Refinement.profilesView", + "Auths.Product.ConnectionEntry.Refinement.stateView", + "Auths.Product.ConnectionEntry.State.active", + "Auths.Product.SchemaIndex.Refinement.namesView" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.binary_composition_swap_invariant", - "statement": "∀ (left right : Auths.Truth), Auths.all left right = Auths.all right left ∧ Auths.any left right = Auths.any right left" + "module": "Auths.Product.ConnectionEntryRefinement", + "name": "Auths.Product.ConnectionEntry.Refinement.source_disabled_refused", + "statement": "∀ (workloads : Aeneas.Std.Slice (Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8))\n (profiles : Aeneas.Std.Slice auths_gateway_kernel.entry_authorization.EntryProfile)\n (workload : Aeneas.Std.Slice Aeneas.Std.U8) (profile : auths_gateway_kernel.entry_authorization.EntryProfile),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.entry_authorization.entry_allows auths_gateway_kernel.entry_authorization.EntryState.Disabled\n workloads profiles workload profile)\n fun actual => actual = false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.entry_authorization.EntryProfile", + "auths_gateway_kernel.entry_authorization.entry_allows", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.entry_authorization.EntryState.Disabled", + "Aeneas.Std.alloc.vec.Vec" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.canonical_diagnostic_permutation_invariant", - "statement": "∀ (left right : ℕ), Auths.canonicalCode left right = Auths.canonicalCode right left" + "module": "Auths.Product.ConnectionEntryRefinement", + "name": "Auths.Product.ConnectionEntry.Refinement.source_revoked_refused", + "statement": "∀ (workloads : Aeneas.Std.Slice (Aeneas.Std.alloc.vec.Vec Aeneas.Std.U8))\n (profiles : Aeneas.Std.Slice auths_gateway_kernel.entry_authorization.EntryProfile)\n (workload : Aeneas.Std.Slice Aeneas.Std.U8) (profile : auths_gateway_kernel.entry_authorization.EntryProfile),\n Aeneas.Std.WP.spec\n (auths_gateway_kernel.entry_authorization.entry_allows auths_gateway_kernel.entry_authorization.EntryState.Revoked\n workloads profiles workload profile)\n fun actual => actual = false", + "statement_constants": [ + "Bool", + "Eq", + "Bool.false", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.entry_authorization.EntryProfile", + "auths_gateway_kernel.entry_authorization.entry_allows", + "Aeneas.Std.WP.spec", + "auths_gateway_kernel.entry_authorization.EntryState.Revoked", + "Aeneas.Std.alloc.vec.Vec" + ] }, { "axioms": [ @@ -2391,36 +24709,112 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.plan_visit_is_leaf_enumeration", - "statement": "∀ (plan : Auths.Plan), plan.visit = plan.leaves" + "module": "Auths.Product.ConnectionEntry", + "name": "Auths.Product.ConnectionEntry.admitted_binds_all", + "statement": "∀ (state : Auths.Product.ConnectionEntry.State) (workloads : List (List ℕ))\n (profiles : List Auths.Product.ConnectionEntry.Profile) (workload : List ℕ)\n (profile : Auths.Product.ConnectionEntry.Profile),\n Auths.Product.ConnectionEntry.allows state workloads profiles workload profile = true →\n state = Auths.Product.ConnectionEntry.State.active ∧ workload ∈ workloads ∧ profile ∈ profiles", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Bool.true", + "List.instMembership", + "Membership.mem", + "Auths.Product.ConnectionEntry.Profile", + "Auths.Product.ConnectionEntry.State", + "Auths.Product.ConnectionEntry.allows", + "Auths.Product.ConnectionEntry.State.active" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.plan_cost_is_node_count", - "statement": "∀ (plan : Auths.Plan), plan.cost = plan.nodes" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.lower_tail_exact", + "statement": "∀ (byte : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_connections.kernel.lower_tail_valid byte) fun actual =>\n actual = decide (Auths.Product.ConnectionBytes.lowerTail ↑byte)", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.U8", + "auths_connections.kernel.lower_tail_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.instDecidableLowerTail", + "Auths.Product.ConnectionBytes.lowerTail" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Classical.choice", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.authorized_implies_threshold_met", - "statement": "∀ {k authorized indeterminate : ℕ},\n Auths.thresholdCounts k authorized indeterminate = Auths.Generated.Truth.authorized → k ≤ authorized" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.ascii_graphic_valid value maximum) fun actual =>\n actual =\n decide\n (Auths.Product.ConnectionBytes.graphicValid (Auths.Product.ConnectionBytes.Refinement.bytes ↑value) ↑maximum)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.ascii_graphic_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.graphicValid", + "Auths.Product.ConnectionBytes.instDecidableGraphicValid", + "Auths.Product.ConnectionBytes.Refinement.bytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.denied_implies_threshold_impossible", - "statement": "∀ {k authorized indeterminate : ℕ},\n Auths.thresholdCounts k authorized indeterminate = Auths.Generated.Truth.denied → authorized + indeterminate < k" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.lower_valid_exact", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.lower_token_valid value maximum) fun actual =>\n actual =\n decide (Auths.Product.ConnectionBytes.lowerValid (Auths.Product.ConnectionBytes.Refinement.bytes ↑value) ↑maximum)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.lower_token_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.instDecidableLowerValid", + "Auths.Product.ConnectionBytes.lowerValid", + "Auths.Product.ConnectionBytes.Refinement.bytes" + ] }, { "axioms": [ @@ -2429,58 +24823,170 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Composition", - "name": "Auths.indeterminate_implies_threshold_reachable", - "statement": "∀ {k authorized indeterminate : ℕ},\n Auths.thresholdCounts k authorized indeterminate = Auths.Generated.Truth.indeterminate →\n authorized < k ∧ k ≤ authorized + indeterminate" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.lower_token_valid value maximum) fun actual =>\n actual = true → 0 ∉ Auths.Product.ConnectionBytes.Refinement.bytes ↑value", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Not", + "instLENat", + "instOfNatNat", + "Bool.true", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.lower_token_valid", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.Refinement.bytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.requirements_monotone", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {parent child : List Auths.Observation.Requirement},\n (∀ requirement ∈ parent, requirement ∈ child) →\n Auths.Observation.authorized env observations child = true →\n Auths.Observation.authorized env observations parent = true" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.ascii_graphic_valid value maximum) fun actual =>\n actual = true → 0 ∉ Auths.Product.ConnectionBytes.Refinement.bytes ↑value", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Not", + "instLENat", + "instOfNatNat", + "Bool.true", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.ascii_graphic_valid", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.Refinement.bytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.conditions_monotone", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement} {conditions : List Auths.Observation.Condition},\n (∀ condition ∈ requirement.conditions, condition ∈ conditions) →\n Auths.Observation.satisfied env observations\n { observerAnchor := requirement.observerAnchor, schema := requirement.schema, subject := requirement.subject,\n maxAge := requirement.maxAge, conditions := conditions } =\n true →\n Auths.Observation.satisfied env observations requirement = true" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.lower_token_valid value maximum) fun actual =>\n actual = true → ↑value ≠ [] ∧ (↑value).length ≤ ↑maximum", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Ne", + "instLENat", + "Bool.true", + "LE.le", + "List.length", + "List.nil", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.lower_token_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.child_requirements_superset_attenuates", - "statement": "∀ {parentBase childBase : Auths.Observation.Environment → Bool} {parent child : List Auths.Observation.Requirement},\n (∀ (env : Auths.Observation.Environment), childBase env = true → parentBase env = true) →\n (∀ requirement ∈ parent, requirement ∈ child) →\n ∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord},\n Auths.Observation.chainAuthorized childBase child env observations = true →\n Auths.Observation.chainAuthorized parentBase parent env observations = true" + "module": "Auths.Product.ConnectionBytesRefinement", + "name": "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.ascii_graphic_valid value maximum) fun actual =>\n actual = true → ↑value ≠ [] ∧ (↑value).length ≤ ↑maximum", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Ne", + "instLENat", + "Bool.true", + "LE.le", + "List.length", + "List.nil", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.ascii_graphic_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.satisfied_monotone_observations", - "statement": "∀ {env : Auths.Observation.Environment} {fewer more : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement},\n (∀ observation ∈ fewer, observation ∈ more) →\n Auths.Observation.satisfied env fewer requirement = true → Auths.Observation.satisfied env more requirement = true" + "module": "Auths.Product.ConnectionBytes", + "name": "Auths.Product.ConnectionBytes.lower_has_no_nul", + "statement": "∀ (value : Auths.Product.ConnectionBytes.Bytes) (maximum : ℕ),\n Auths.Product.ConnectionBytes.lowerValid value maximum → 0 ∉ value", + "statement_constants": [ + "Nat", + "Not", + "instOfNatNat", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.ConnectionBytes.Bytes", + "Auths.Product.ConnectionBytes.lowerValid" + ] }, { "axioms": [ "propext" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.no_observation_satisfies_nothing", - "statement": "∀ (env : Auths.Observation.Environment) (requirement : Auths.Observation.Requirement),\n Auths.Observation.satisfied env [] requirement = false" + "module": "Auths.Product.ConnectionBytes", + "name": "Auths.Product.ConnectionBytes.graphic_has_no_nul", + "statement": "∀ (value : Auths.Product.ConnectionBytes.Bytes) (maximum : ℕ),\n Auths.Product.ConnectionBytes.graphicValid value maximum → 0 ∉ value", + "statement_constants": [ + "Nat", + "Not", + "instOfNatNat", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.ConnectionBytes.Bytes", + "Auths.Product.ConnectionBytes.graphicValid" + ] }, { "axioms": [ @@ -2489,9 +24995,30 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.future_observation_never_fresh", - "statement": "∀ {now maxAge notBefore expiresAt observedAt : ℕ},\n now < observedAt → Auths.Observation.fresh now maxAge notBefore expiresAt observedAt = false" + "module": "Auths.Product.ProfileConstructorRefinement", + "name": "Auths.Product.ProfileConstructor.Refinement.constructor_exact", + "statement": "∀ (id : auths_profile_construction.auths_connections.model.SemanticId) (version : Aeneas.Std.U16),\n Aeneas.Std.WP.spec (auths_profile_construction.auths_connections.model.ConnectionProfile.new id version) fun actual =>\n actual =\n if ↑version = 0 then\n Aeneas.Std.core.result.Result.Err\n auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidProfile\n else Aeneas.Std.core.result.Result.Ok { id := id, version := version }", + "statement_constants": [ + "Eq", + "Nat", + "instDecidableEqNat", + "instOfNatNat", + "ite", + "OfNat.ofNat", + "Aeneas.Std.U16", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.WP.spec", + "auths_profile_construction.auths_connections.model.ConnectionProfile", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.SemanticId", + "Aeneas.Std.core.result.Result", + "auths_profile_construction.auths_connections.model.ConnectionProfile.mk", + "auths_profile_construction.auths_connections.model.ConnectionProfile.new", + "auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidProfile", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2500,39 +25027,113 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.stale_observation_never_fresh", - "statement": "∀ {now maxAge notBefore expiresAt observedAt : ℕ},\n maxAge < now - observedAt → Auths.Observation.fresh now maxAge notBefore expiresAt observedAt = false" + "module": "Auths.Product.ProfileConstructorRefinement", + "name": "Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields", + "statement": "∀ (id : auths_profile_construction.auths_connections.model.SemanticId) (version : Aeneas.Std.U16),\n Aeneas.Std.WP.spec (auths_profile_construction.auths_connections.model.ConnectionProfile.new id version) fun actual =>\n ∀ (profile : auths_profile_construction.auths_connections.model.ConnectionProfile),\n actual = Aeneas.Std.core.result.Result.Ok profile →\n profile.id = id ∧ profile.version = version ∧ 0 < ↑profile.version", + "statement_constants": [ + "And", + "Eq", + "Nat", + "instLTNat", + "instOfNatNat", + "LT.lt", + "OfNat.ofNat", + "Aeneas.Std.U16", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.WP.spec", + "auths_profile_construction.auths_connections.model.ConnectionProfile", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.SemanticId", + "Aeneas.Std.core.result.Result", + "auths_profile_construction.auths_connections.model.ConnectionProfile.id", + "auths_profile_construction.auths_connections.model.ConnectionProfile.new", + "auths_profile_construction.auths_connections.model.ConnectionProfile.version", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.satisfied_requires_action_facts", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement},\n Auths.Observation.satisfied env observations requirement = true →\n Auths.Observation.actionFactsAvailable env requirement = true" + "module": "Auths.Product.ProfileConstructorRefinement", + "name": "Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused", + "statement": "∀ (id : auths_profile_construction.auths_connections.model.SemanticId),\n Aeneas.Std.WP.spec (auths_profile_construction.auths_connections.model.ConnectionProfile.new id 0#u16) fun actual =>\n actual =\n Aeneas.Std.core.result.Result.Err\n auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidProfile", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "Nat.decLe", + "OfNat.ofNat", + "Aeneas.Std.U16.ofNat", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.WP.spec", + "auths_profile_construction.auths_connections.model.ConnectionProfile", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.SemanticId", + "Aeneas.Std.core.result.Result", + "auths_profile_construction.auths_connections.model.ConnectionProfile.new", + "auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidProfile", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.decision_satisfied_iff", - "statement": "∀ (env : Auths.Observation.Environment) (observations : List Auths.Observation.ObservationRecord)\n (requirement : Auths.Observation.Requirement),\n Auths.Observation.requirementDecision env observations requirement = Auths.Observation.Decision.satisfied ↔\n Auths.Observation.satisfied env observations requirement = true" + "module": "Auths.Product.SemanticIdRefinement", + "name": "Auths.Product.SemanticId.Refinement.semantic_head_exact", + "statement": "∀ (byte : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_connections.kernel.semantic_head_valid byte) fun actual =>\n actual = decide (Auths.Product.SemanticId.head ↑byte)", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.U8", + "auths_connections.kernel.semantic_head_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.head", + "Auths.Product.SemanticId.instDecidableHead" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.decision_denied_has_falsifying_observation", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {requirement : Auths.Observation.Requirement},\n Auths.Observation.requirementDecision env observations requirement = Auths.Observation.Decision.denied →\n (∃ observation ∈ observations, Auths.Observation.eligible env requirement observation = true) ∧\n ∀ observation ∈ observations,\n Auths.Observation.eligible env requirement observation = true →\n Auths.Observation.conditionsHold env observation requirement.conditions = false" + "module": "Auths.Product.SemanticIdRefinement", + "name": "Auths.Product.SemanticId.Refinement.semantic_tail_exact", + "statement": "∀ (byte : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_connections.kernel.semantic_tail_valid byte) fun actual =>\n actual = decide (Auths.Product.SemanticId.tail ↑byte)", + "statement_constants": [ + "Bool", + "Eq", + "Decidable.decide", + "Aeneas.Std.U8", + "auths_connections.kernel.semantic_tail_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.instDecidableTail", + "Auths.Product.SemanticId.tail" + ] }, { "axioms": [ @@ -2541,9 +25142,31 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.fresh_monotone_max_age", - "statement": "∀ {now shorter longer notBefore expiresAt observedAt : ℕ},\n shorter ≤ longer →\n Auths.Observation.fresh now shorter notBefore expiresAt observedAt = true →\n Auths.Observation.fresh now longer notBefore expiresAt observedAt = true" + "module": "Auths.Product.SemanticIdRefinement", + "name": "Auths.Product.SemanticId.Refinement.semantic_valid_exact", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.semantic_id_valid value maximum) fun actual =>\n actual = decide (Auths.Product.SemanticId.valid (Auths.Product.SemanticId.Refinement.bytes ↑value) ↑maximum)", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Decidable.decide", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.semantic_id_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.instDecidableValid", + "Auths.Product.SemanticId.valid", + "Auths.Product.SemanticId.Refinement.bytes" + ] }, { "axioms": [ @@ -2552,9 +25175,32 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.narrows_monotone", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {child parent : Auths.Observation.Requirement},\n Auths.Observation.narrows child parent →\n Auths.Observation.satisfied env observations child = true →\n Auths.Observation.satisfied env observations parent = true" + "module": "Auths.Product.SemanticIdRefinement", + "name": "Auths.Product.SemanticId.Refinement.source_earns_no_nul", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.semantic_id_valid value maximum) fun actual =>\n actual = true → 0 ∉ Auths.Product.SemanticId.Refinement.bytes ↑value", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "Not", + "instLENat", + "instOfNatNat", + "Bool.true", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.semantic_id_valid", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.Refinement.bytes" + ] }, { "axioms": [ @@ -2563,26 +25209,85 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.covers_monotone", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {child parent : Auths.Observation.Requirement},\n Auths.Observation.covers child parent →\n Auths.Observation.satisfied env observations child = true →\n Auths.Observation.satisfied env observations parent = true" + "module": "Auths.Product.SemanticIdRefinement", + "name": "Auths.Product.SemanticId.Refinement.source_earns_ascii", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.semantic_id_valid value maximum) fun actual =>\n actual = true → ∀ byte ∈ Auths.Product.SemanticId.Refinement.bytes ↑value, byte < 128", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "instLTNat", + "instOfNatNat", + "Bool.true", + "LE.le", + "LT.lt", + "List.instMembership", + "List.length", + "Membership.mem", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.semantic_id_valid", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.Refinement.bytes" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.covers_trans", - "statement": "∀ {child middle parent : Auths.Observation.Requirement},\n Auths.Observation.covers child middle → Auths.Observation.covers middle parent → Auths.Observation.covers child parent" + "module": "Auths.Product.SemanticIdRefinement", + "name": "Auths.Product.SemanticId.Refinement.source_earns_bounds", + "statement": "∀ (value : Aeneas.Std.Slice Aeneas.Std.U8) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_connections.kernel.semantic_id_valid value maximum) fun actual =>\n actual = true → ↑value ≠ [] ∧ (↑value).length ≤ ↑maximum", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Ne", + "instLENat", + "Bool.true", + "LE.le", + "List.length", + "List.nil", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_connections.kernel.semantic_id_valid", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec" + ] }, { - "axioms": [], + "axioms": [ + "propext" + ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.requirements_attenuate_refl", - "statement": "∀ (requirements : List Auths.Observation.Requirement), Auths.Observation.requirementsAttenuate requirements requirements" + "module": "Auths.Product.SemanticId", + "name": "Auths.Product.SemanticId.valid_has_no_nul", + "statement": "∀ (value : Auths.Product.SemanticId.Bytes) (maximum : ℕ), Auths.Product.SemanticId.valid value maximum → 0 ∉ value", + "statement_constants": [ + "Nat", + "Not", + "instOfNatNat", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.SemanticId.Bytes", + "Auths.Product.SemanticId.valid" + ] }, { "axioms": [ @@ -2590,99 +25295,285 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.requirements_attenuate_trans", - "statement": "∀ {child middle parent : List Auths.Observation.Requirement},\n Auths.Observation.requirementsAttenuate child middle →\n Auths.Observation.requirementsAttenuate middle parent → Auths.Observation.requirementsAttenuate child parent" + "module": "Auths.Product.SemanticId", + "name": "Auths.Product.SemanticId.valid_is_ascii", + "statement": "∀ (value : Auths.Product.SemanticId.Bytes) (maximum : ℕ),\n Auths.Product.SemanticId.valid value maximum → ∀ byte ∈ value, byte < 128", + "statement_constants": [ + "Nat", + "instLTNat", + "instOfNatNat", + "LT.lt", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.SemanticId.Bytes", + "Auths.Product.SemanticId.valid" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.requirements_attenuate_monotone", - "statement": "∀ {env : Auths.Observation.Environment} {observations : List Auths.Observation.ObservationRecord}\n {child parent : List Auths.Observation.Requirement},\n Auths.Observation.requirementsAttenuate child parent →\n Auths.Observation.authorized env observations child = true →\n Auths.Observation.authorized env observations parent = true" + "module": "Auths.Product.ConnectionFrame", + "name": "Auths.Product.ConnectionFrame.preimage_injective", + "statement": "∀ (left right : Auths.Product.ConnectionFrame.Key),\n 0 ∉ left.provider →\n 0 ∉ right.provider →\n Auths.Product.ConnectionFrame.preimage left = Auths.Product.ConnectionFrame.preimage right → left = right", + "statement_constants": [ + "Eq", + "Nat", + "Not", + "instOfNatNat", + "List.instMembership", + "Membership.mem", + "OfNat.ofNat", + "Auths.Product.ConnectionFrame.Bytes", + "Auths.Product.ConnectionFrame.Key", + "Auths.Product.ConnectionFrame.preimage", + "Auths.Product.ConnectionFrame.Key.provider" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.observation_requirement_law_lawful", - "statement": "Auths.Observation.observationRequirementLaw.Lawful" + "module": "Auths.Product.ConnectionFrame", + "name": "Auths.Product.ConnectionFrame.validated_names_bind_both_fields", + "statement": "∀ (left right : Auths.Product.ConnectionFrame.Key),\n Auths.Product.ConnectionBytes.lowerValid left.provider 64 →\n Auths.Product.ConnectionBytes.lowerValid right.provider 64 →\n Auths.Product.ConnectionFrame.preimage left = Auths.Product.ConnectionFrame.preimage right → left = right", + "statement_constants": [ + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Auths.Product.ConnectionBytes.lowerValid", + "Auths.Product.ConnectionFrame.Bytes", + "Auths.Product.ConnectionFrame.Key", + "Auths.Product.ConnectionFrame.preimage", + "Auths.Product.ConnectionFrame.Key.provider" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Observation", - "name": "Auths.Observation.observation_requirement_law_accepts_addition", - "statement": "∀ (requirements : List Auths.Observation.Requirement),\n Auths.Observation.observationRequirementLaw.attenuates (some requirements) none" + "module": "Auths.Product.ConnectionFrameRefinement", + "name": "Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact", + "statement": "∀ (provider aliasBytes : Aeneas.Std.Slice Aeneas.Std.U8),\n (↑provider).length ≤ 64 →\n (↑aliasBytes).length ≤ 64 →\n Aeneas.Std.WP.spec (auths_gateway_kernel.identity.connection_record_preimage provider aliasBytes) fun output =>\n Auths.Product.Refinement.Gateway.vecBytes output =\n Auths.Product.ConnectionFrame.preimage\n { provider := Auths.Product.Refinement.Gateway.sliceBytes provider,\n aliasBytes := Auths.Product.Refinement.Gateway.sliceBytes aliasBytes }", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_gateway_kernel.identity.connection_record_preimage", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionFrame.preimage", + "Aeneas.Std.alloc.vec.Vec", + "Auths.Product.ConnectionFrame.Key.mk", + "Auths.Product.Refinement.Gateway.sliceBytes", + "Auths.Product.Refinement.Gateway.vecBytes" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_decide_eq_threshold_counts", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n Auths.Approval.approvalDecision env identifier requirement approvals =\n Auths.thresholdCounts requirement.threshold\n (Auths.Approval.countedCount requirement.approvers (Auths.Approval.outcomes env identifier requirement approvals))\n (Auths.Approval.pendingCount requirement.approvers (Auths.Approval.outcomes env identifier requirement approvals))" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.recovery_exact", + "statement": "∀ (state : auths_connections.model.ConnectionState) (current requested : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.recovery_lease state current requested) fun actual =>\n actual =\n if state = auths_connections.model.ConnectionState.Revoked then\n Aeneas.Std.core.result.Result.Err auths_connections.model.ConnectionRecordError.Revoked\n else\n if ↑current = 0 ∨ ↑requested = 0 ∨ ↑current < ↑requested then\n Aeneas.Std.core.result.Result.Err auths_connections.model.ConnectionRecordError.InvalidGeneration\n else Aeneas.Std.core.result.Result.Ok ()", + "statement_constants": [ + "Eq", + "Nat", + "Or", + "Unit", + "instDecidableEqNat", + "instDecidableOr", + "instLTNat", + "instOfNatNat", + "ite", + "LT.lt", + "Nat.decLt", + "OfNat.ofNat", + "Unit.unit", + "Aeneas.Std.U64", + "auths_connections.kernel.recovery_lease", + "auths_connections.model.ConnectionRecordError", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionRecordError.InvalidGeneration", + "auths_connections.model.ConnectionRecordError.Revoked", + "auths_connections.model.ConnectionState.Revoked", + "Aeneas.Std.core.result.Result", + "Auths.Product.RecoveryGate.Refinement.instDecidableEqConnectionState_auths", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_authorized_iff_distinct_quorum", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n requirement.approvers.Nodup →\n (Auths.Approval.approvalDecision env identifier requirement approvals = Auths.Generated.Truth.authorized ↔\n ∃ chosen,\n chosen.Nodup ∧\n chosen ⊆ requirement.approvers ∧\n requirement.threshold ≤ chosen.length ∧\n ∀ principal ∈ chosen,\n ∃ approval ∈ approvals,\n approval.approver = principal ∧\n Auths.Approval.verdict env identifier requirement approval = Auths.Approval.Verdict.counted)" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation", + "statement": "∀ (current requested : Aeneas.Std.U64),\n Aeneas.Std.WP.spec\n (auths_connections.kernel.recovery_lease auths_connections.model.ConnectionState.Revoked current requested)\n fun actual => actual = Aeneas.Std.core.result.Result.Err auths_connections.model.ConnectionRecordError.Revoked", + "statement_constants": [ + "Eq", + "Unit", + "Aeneas.Std.U64", + "auths_connections.kernel.recovery_lease", + "auths_connections.model.ConnectionRecordError", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionRecordError.Revoked", + "auths_connections.model.ConnectionState.Revoked", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_duplicate_irrelevant", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n ∀ approval ∈ approvals,\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state", + "statement": "∀ (state : auths_connections.model.ConnectionState) (current requested : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.recovery_lease state current requested) fun actual =>\n actual = Aeneas.Std.core.result.Result.Ok () →\n state ≠ auths_connections.model.ConnectionState.Revoked ∧ 0 < ↑requested ∧ ↑requested ≤ ↑current", + "statement_constants": [ + "And", + "Eq", + "Nat", + "Ne", + "Unit", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "OfNat.ofNat", + "Unit.unit", + "Aeneas.Std.U64", + "auths_connections.kernel.recovery_lease", + "auths_connections.model.ConnectionRecordError", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionState.Revoked", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_outsider_irrelevant", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.approver ∉ requirement.approvers →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.binding_requirement_exact", + "statement": "∀ (current operation credential : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.recovery_binding_requirement current operation credential) fun actual =>\n actual =\n if ↑current = 0 ∨ ↑operation = 0 ∨ ↑credential = 0 ∨ ↑operation < ↑credential then\n auths_connections.kernel.RecoveryBindingRequirement.Refuse\n else\n if ↑operation < ↑current then auths_connections.kernel.RecoveryBindingRequirement.RecordedCommitment\n else\n if ↑credential = ↑current then auths_connections.kernel.RecoveryBindingRequirement.CurrentCommitment\n else auths_connections.kernel.RecoveryBindingRequirement.Refuse", + "statement_constants": [ + "Eq", + "Nat", + "Or", + "instDecidableEqNat", + "instDecidableOr", + "instLTNat", + "instOfNatNat", + "ite", + "LT.lt", + "Nat.decLt", + "OfNat.ofNat", + "Aeneas.Std.U64", + "auths_connections.kernel.RecoveryBindingRequirement", + "auths_connections.kernel.recovery_binding_requirement", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.kernel.RecoveryBindingRequirement.CurrentCommitment", + "auths_connections.kernel.RecoveryBindingRequirement.RecordedCommitment", + "auths_connections.kernel.RecoveryBindingRequirement.Refuse" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_other_action_irrelevant", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.action ≠ env.action →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation", + "statement": "∀ (current operation credential : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.recovery_binding_requirement current operation credential) fun actual =>\n actual = auths_connections.kernel.RecoveryBindingRequirement.CurrentCommitment →\n credential = current ∧ 0 < ↑current ∧ ↑current ≤ ↑operation", + "statement_constants": [ + "And", + "Eq", + "Nat", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "OfNat.ofNat", + "Aeneas.Std.U64", + "auths_connections.kernel.RecoveryBindingRequirement", + "auths_connections.kernel.recovery_binding_requirement", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.kernel.RecoveryBindingRequirement.CurrentCommitment" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_other_requirement_irrelevant", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.requirement ≠ identifier →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation", + "statement": "∀ (current operation credential : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.recovery_binding_requirement current operation credential) fun actual =>\n actual = auths_connections.kernel.RecoveryBindingRequirement.RecordedCommitment →\n 0 < ↑credential ∧ ↑credential ≤ ↑operation ∧ ↑operation < ↑current", + "statement_constants": [ + "And", + "Eq", + "Nat", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "OfNat.ofNat", + "Aeneas.Std.U64", + "auths_connections.kernel.RecoveryBindingRequirement", + "auths_connections.kernel.recovery_binding_requirement", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.kernel.RecoveryBindingRequirement.RecordedCommitment" + ] }, { "axioms": [ @@ -2690,40 +25581,117 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_self_approval_irrelevant", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action))\n (approval : Auths.Approval.ApprovalRecord Action),\n approval.approver ∈ env.authority →\n Auths.Approval.approvalDecision env identifier requirement (approval :: approvals) =\n Auths.Approval.approvalDecision env identifier requirement approvals" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.state_transition_exact", + "statement": "∀ (current next : auths_connections.model.ConnectionState) (previous proposed : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.state_transition_allows current next previous proposed) fun actual =>\n actual = decide (current ≠ auths_connections.model.ConnectionState.Revoked ∧ current ≠ next ∧ ↑previous ≤ ↑proposed)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Nat", + "Ne", + "instDecidableAnd", + "instDecidableNot", + "instLENat", + "Decidable.decide", + "LE.le", + "Nat.decLe", + "Aeneas.Std.U64", + "auths_connections.kernel.state_transition_allows", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionState.Revoked", + "Auths.Product.RecoveryGate.Refinement.instDecidableEqConnectionState_auths" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_permutation_invariant", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) {left right : List (Auths.Approval.ApprovalRecord Action)},\n left.Perm right →\n Auths.Approval.approvalDecision env identifier requirement left =\n Auths.Approval.approvalDecision env identifier requirement right" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time", + "statement": "∀ (current next : auths_connections.model.ConnectionState) (previous proposed : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.state_transition_allows current next previous proposed) fun actual =>\n actual = true → current ≠ auths_connections.model.ConnectionState.Revoked ∧ current ≠ next ∧ ↑previous ≤ ↑proposed", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Nat", + "Ne", + "instLENat", + "Bool.true", + "LE.le", + "Aeneas.Std.U64", + "auths_connections.kernel.state_transition_allows", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionState.Revoked" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_monotone_in_approvals", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals extra : List (Auths.Approval.ApprovalRecord Action)),\n (Auths.Approval.approvalDecision env identifier requirement approvals).le\n (Auths.Approval.approvalDecision env identifier requirement (approvals ++ extra))" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.record_change_exact", + "statement": "∀ (state : auths_connections.model.ConnectionState) (previous proposed : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.record_change_allows state previous proposed) fun actual =>\n actual = decide (state ≠ auths_connections.model.ConnectionState.Revoked ∧ ↑previous ≤ ↑proposed)", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Nat", + "Ne", + "instDecidableAnd", + "instDecidableNot", + "instLENat", + "Decidable.decide", + "LE.le", + "Nat.decLe", + "Aeneas.Std.U64", + "auths_connections.kernel.record_change_allows", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionState.Revoked", + "Auths.Product.RecoveryGate.Refinement.instDecidableEqConnectionState_auths" + ] }, { "axioms": [ "propext", + "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_antitone_in_threshold", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (approvers : List String) (approvals : List (Auths.Approval.ApprovalRecord Action)) {lower higher : ℕ},\n lower ≤ higher →\n (Auths.Approval.approvalDecision env identifier { approvers := approvers, threshold := higher } approvals).le\n (Auths.Approval.approvalDecision env identifier { approvers := approvers, threshold := lower } approvals)" + "module": "Auths.Product.RecoveryGateRefinement", + "name": "Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time", + "statement": "∀ (state : auths_connections.model.ConnectionState) (previous proposed : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.record_change_allows state previous proposed) fun actual =>\n actual = true → state ≠ auths_connections.model.ConnectionState.Revoked ∧ ↑previous ≤ ↑proposed", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Nat", + "Ne", + "instLENat", + "Bool.true", + "LE.le", + "Aeneas.Std.U64", + "auths_connections.kernel.record_change_allows", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionState.Revoked" + ] }, { "axioms": [ @@ -2732,9 +25700,35 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_antitone_in_approvers", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier threshold : ℕ)\n (approvals : List (Auths.Approval.ApprovalRecord Action)) {fewer more : List String},\n fewer ⊆ more →\n fewer.Nodup →\n (Auths.Approval.approvalDecision env identifier { approvers := fewer, threshold := threshold } approvals).le\n (Auths.Approval.approvalDecision env identifier { approvers := more, threshold := threshold } approvals)" + "module": "Auths.Product.StringConstructorsRefinement", + "name": "Auths.Product.StringConstructors.Refinement.actual_provider_exact", + "statement": "∀ (value : String),\n value.toByteArray.size ≤ Aeneas.Std.U32.max →\n Aeneas.Std.WP.spec\n (auths_profile_construction.auths_connections.model.ProviderKind.parse\n (Aeneas.Std.core.convert.IntoFrom (Aeneas.Std.core.convert.FromSame String)) value)\n fun actual =>\n actual =\n if\n Auths.Product.ConnectionBytes.lowerValid (Auths.Product.StringConstructors.Refinement.utf8Bytes value)\n 64 then\n Aeneas.Std.core.result.Result.Ok value\n else\n Aeneas.Std.core.result.Result.Err\n auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidProviderKind", + "statement_constants": [ + "Eq", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "ite", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.U32.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.instDecidableLowerValid", + "Auths.Product.ConnectionBytes.lowerValid", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.ProviderKind", + "Aeneas.Std.core.convert.FromSame", + "Aeneas.Std.core.convert.IntoFrom", + "Aeneas.Std.core.result.Result", + "Auths.Product.StringConstructors.Refinement.utf8Bytes", + "auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidProviderKind", + "auths_profile_construction.auths_connections.model.ProviderKind.parse", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2743,9 +25737,35 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_authorized_meets", - "statement": "∀ {Action : Type} [inst : DecidableEq Action] (env : Auths.Approval.Environment Action) (identifier : ℕ)\n (requirement : Auths.Approval.Requirement) (approvals : List (Auths.Approval.ApprovalRecord Action)),\n requirement.approvers.Nodup →\n Auths.Approval.approvalDecision env identifier requirement approvals = Auths.Generated.Truth.authorized →\n Auths.Approval.meets\n (List.map Auths.Approval.ApprovalRecord.approver\n (List.filter\n (fun approval =>\n decide (Auths.Approval.verdict env identifier requirement approval = Auths.Approval.Verdict.counted))\n approvals))\n requirement" + "module": "Auths.Product.StringConstructorsRefinement", + "name": "Auths.Product.StringConstructors.Refinement.actual_alias_exact", + "statement": "∀ (value : String),\n value.toByteArray.size ≤ Aeneas.Std.U32.max →\n Aeneas.Std.WP.spec\n (auths_profile_construction.auths_connections.model.ConnectionAlias.parse\n (Aeneas.Std.core.convert.IntoFrom (Aeneas.Std.core.convert.FromSame String)) value)\n fun actual =>\n actual =\n if\n Auths.Product.ConnectionBytes.lowerValid (Auths.Product.StringConstructors.Refinement.utf8Bytes value)\n 64 then\n Aeneas.Std.core.result.Result.Ok value\n else\n Aeneas.Std.core.result.Result.Err\n auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidAlias", + "statement_constants": [ + "Eq", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "ite", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.U32.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.instDecidableLowerValid", + "Auths.Product.ConnectionBytes.lowerValid", + "auths_profile_construction.auths_connections.model.ConnectionAlias", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "Aeneas.Std.core.convert.FromSame", + "Aeneas.Std.core.convert.IntoFrom", + "Aeneas.Std.core.result.Result", + "Auths.Product.StringConstructors.Refinement.utf8Bytes", + "auths_profile_construction.auths_connections.model.ConnectionAlias.parse", + "auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidAlias", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2754,30 +25774,35 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.covers_monotone", - "statement": "∀ {approving : List String} {child parent : Auths.Approval.Requirement},\n Auths.Approval.covers child parent → Auths.Approval.meets approving child → Auths.Approval.meets approving parent" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.covers_trans", - "statement": "∀ {child middle parent : Auths.Approval.Requirement},\n Auths.Approval.covers child middle → Auths.Approval.covers middle parent → Auths.Approval.covers child parent" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_requirements_attenuate_refl", - "statement": "∀ (requirements : List Auths.Approval.Requirement), Auths.Approval.requirementsAttenuate requirements requirements" - }, - { - "axioms": [], - "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_requirements_attenuate_trans", - "statement": "∀ {child middle parent : List Auths.Approval.Requirement},\n Auths.Approval.requirementsAttenuate child middle →\n Auths.Approval.requirementsAttenuate middle parent → Auths.Approval.requirementsAttenuate child parent" + "module": "Auths.Product.StringConstructorsRefinement", + "name": "Auths.Product.StringConstructors.Refinement.actual_semantic_exact", + "statement": "∀ (value : String),\n value.toByteArray.size ≤ Aeneas.Std.U32.max →\n Aeneas.Std.WP.spec\n (auths_profile_construction.auths_connections.model.SemanticId.parse\n (Aeneas.Std.core.convert.IntoFrom (Aeneas.Std.core.convert.FromSame String)) value)\n fun actual =>\n actual =\n if Auths.Product.SemanticId.valid (Auths.Product.StringConstructors.Refinement.utf8Bytes value) 128 then\n Aeneas.Std.core.result.Result.Ok value\n else\n Aeneas.Std.core.result.Result.Err\n auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidSemanticId", + "statement_constants": [ + "Eq", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "ite", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.U32.max", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.instDecidableValid", + "Auths.Product.SemanticId.valid", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.SemanticId", + "Aeneas.Std.core.convert.FromSame", + "Aeneas.Std.core.convert.IntoFrom", + "Aeneas.Std.core.result.Result", + "Auths.Product.StringConstructors.Refinement.utf8Bytes", + "auths_profile_construction.auths_connections.model.ConnectionRecordError.InvalidSemanticId", + "auths_profile_construction.auths_connections.model.SemanticId.parse", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2786,9 +25811,32 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_requirements_attenuate_monotone", - "statement": "∀ {approving : List String} {child parent : List Auths.Approval.Requirement},\n Auths.Approval.requirementsAttenuate child parent →\n (∀ requirement ∈ child, Auths.Approval.meets approving requirement) →\n ∀ requirement ∈ parent, Auths.Approval.meets approving requirement" + "module": "Auths.Product.StringConstructorsRefinement", + "name": "Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload", + "statement": "∀ (value : String),\n value.toByteArray.size ≤ Aeneas.Std.U32.max →\n Aeneas.Std.WP.spec\n (auths_profile_construction.auths_connections.model.ProviderKind.parse\n (Aeneas.Std.core.convert.IntoFrom (Aeneas.Std.core.convert.FromSame String)) value)\n fun actual =>\n ∀ (parsed : auths_profile_construction.auths_connections.model.ProviderKind),\n actual = Aeneas.Std.core.result.Result.Ok parsed →\n parsed = value ∧\n Auths.Product.ConnectionBytes.lowerValid (Auths.Product.StringConstructors.Refinement.utf8Bytes parsed) 64", + "statement_constants": [ + "And", + "Eq", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.U32.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.lowerValid", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.ProviderKind", + "Aeneas.Std.core.convert.FromSame", + "Aeneas.Std.core.convert.IntoFrom", + "Aeneas.Std.core.result.Result", + "Auths.Product.StringConstructors.Refinement.utf8Bytes", + "auths_profile_construction.auths_connections.model.ProviderKind.parse", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2797,63 +25845,197 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_requirement_law_lawful", - "statement": "Auths.Approval.approvalRequirementLaw.Lawful" + "module": "Auths.Product.StringConstructorsRefinement", + "name": "Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload", + "statement": "∀ (value : String),\n value.toByteArray.size ≤ Aeneas.Std.U32.max →\n Aeneas.Std.WP.spec\n (auths_profile_construction.auths_connections.model.ConnectionAlias.parse\n (Aeneas.Std.core.convert.IntoFrom (Aeneas.Std.core.convert.FromSame String)) value)\n fun actual =>\n ∀ (parsed : auths_profile_construction.auths_connections.model.ConnectionAlias),\n actual = Aeneas.Std.core.result.Result.Ok parsed →\n parsed = value ∧\n Auths.Product.ConnectionBytes.lowerValid (Auths.Product.StringConstructors.Refinement.utf8Bytes parsed) 64", + "statement_constants": [ + "And", + "Eq", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.U32.max", + "Aeneas.Std.WP.spec", + "Auths.Product.ConnectionBytes.lowerValid", + "auths_profile_construction.auths_connections.model.ConnectionAlias", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "Aeneas.Std.core.convert.FromSame", + "Aeneas.Std.core.convert.IntoFrom", + "Aeneas.Std.core.result.Result", + "Auths.Product.StringConstructors.Refinement.utf8Bytes", + "auths_profile_construction.auths_connections.model.ConnectionAlias.parse", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_requirement_law_accepts_addition", - "statement": "∀ (requirements : List Auths.Approval.Requirement),\n Auths.Approval.approvalRequirementLaw.attenuates (some requirements) none" + "module": "Auths.Product.StringConstructorsRefinement", + "name": "Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload", + "statement": "∀ (value : String),\n value.toByteArray.size ≤ Aeneas.Std.U32.max →\n Aeneas.Std.WP.spec\n (auths_profile_construction.auths_connections.model.SemanticId.parse\n (Aeneas.Std.core.convert.IntoFrom (Aeneas.Std.core.convert.FromSame String)) value)\n fun actual =>\n ∀ (parsed : auths_profile_construction.auths_connections.model.SemanticId),\n actual = Aeneas.Std.core.result.Result.Ok parsed →\n parsed = value ∧\n Auths.Product.SemanticId.valid (Auths.Product.StringConstructors.Refinement.utf8Bytes parsed) 128", + "statement_constants": [ + "And", + "Eq", + "Nat", + "String", + "instLENat", + "instOfNatNat", + "ByteArray.size", + "LE.le", + "OfNat.ofNat", + "String.toByteArray", + "Aeneas.Std.U32.max", + "Aeneas.Std.WP.spec", + "Auths.Product.SemanticId.valid", + "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "auths_profile_construction.auths_connections.model.SemanticId", + "Aeneas.Std.core.convert.FromSame", + "Aeneas.Std.core.convert.IntoFrom", + "Aeneas.Std.core.result.Result", + "Auths.Product.StringConstructors.Refinement.utf8Bytes", + "auths_profile_construction.auths_connections.model.SemanticId.parse", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ - "propext" + "propext", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.Approval", - "name": "Auths.Approval.approval_requirement_law_refuses_drop", - "statement": "∀ (requirements : List Auths.Approval.Requirement),\n ¬Auths.Approval.approvalRequirementLaw.attenuates none (some requirements)" + "module": "Auths.Product.RecordTimesRefinement", + "name": "Auths.Product.RecordTimes.Refinement.record_times_exact", + "statement": "∀ (state : auths_connections.model.ConnectionState) (created updated : Aeneas.Std.U64)\n (revoked : Option Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.record_times_valid state created updated revoked) fun actual =>\n actual =\n decide (Auths.Product.RecordTimes.Refinement.valid state (↑created) (↑updated) (Option.map (fun x => ↑x) revoked))", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Option", + "Decidable.decide", + "Option.map", + "Aeneas.Std.U64", + "auths_connections.kernel.record_times_valid", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "Auths.Product.RecordTimes.Refinement.instDecidableValid", + "Auths.Product.RecordTimes.Refinement.valid" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.ExtensionLaw", - "name": "Auths.exact_marker_law_lawful", - "statement": "∀ (Body : Type u) (World : Type w), (Auths.exactMarkerLaw Body World).Lawful" + "module": "Auths.Product.RecordTimesRefinement", + "name": "Auths.Product.RecordTimes.Refinement.success_earns_order", + "statement": "∀ (state : auths_connections.model.ConnectionState) (created updated : Aeneas.Std.U64)\n (revoked : Option Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.record_times_valid state created updated revoked) fun actual =>\n actual = true → ↑created ≤ ↑updated", + "statement_constants": [ + "Bool", + "Eq", + "Nat", + "Option", + "instLENat", + "Bool.true", + "LE.le", + "Aeneas.Std.U64", + "auths_connections.kernel.record_times_valid", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec" + ] }, { "axioms": [ - "propext" + "propext", + "Classical.choice", + "Quot.sound" ], "kind": "theorem", - "module": "Auths.ExtensionLaw", - "name": "Auths.exact_marker_law_refuses_addition", - "statement": "∀ (Body : Type u) (World : Type w) (body : Body), ¬(Auths.exactMarkerLaw Body World).attenuates (some body) none" + "module": "Auths.Product.RecordTimesRefinement", + "name": "Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape", + "statement": "∀ (state : auths_connections.model.ConnectionState) (created updated : Aeneas.Std.U64)\n (revoked : Option Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_connections.kernel.record_times_valid state created updated revoked) fun actual =>\n actual = true →\n (state = auths_connections.model.ConnectionState.Revoked ↔ revoked.isSome = true) ∧\n ∀ (atTime : Aeneas.Std.U64), revoked = some atTime → ↑created ≤ ↑atTime ∧ ↑atTime ≤ ↑updated", + "statement_constants": [ + "And", + "Bool", + "Eq", + "Iff", + "Nat", + "Option", + "instLENat", + "Bool.true", + "LE.le", + "Option.isSome", + "Option.some", + "Aeneas.Std.U64", + "auths_connections.kernel.record_times_valid", + "auths_connections.model.ConnectionState", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.WP.spec", + "auths_connections.model.ConnectionState.Revoked" + ] }, { - "axioms": [], + "axioms": [ + "propext", + "Quot.sound" + ], "kind": "theorem", - "module": "Auths.Rich.Semantics", - "name": "Auths.Rich.ExtensionLawsNarrow.of_lawful", - "statement": "∀ {v : Auths.Rich.Vocabulary} [inst : Auths.Rich.ExtensionLaws v],\n (∀ (id : v.ExtensionIdCarrier), (Auths.Rich.extensionLawAt v id).Lawful) → Auths.Rich.ExtensionLawsNarrow v" + "module": "Auths.Product.RecordTimesRefinement", + "name": "Auths.Product.RecordTimes.Refinement.state_change_preserves_valid_time", + "statement": "∀ (current next : auths_connections.model.ConnectionState) (created previous proposed : ℕ) (revoked : Option ℕ),\n Auths.Product.RecordTimes.Refinement.valid current created previous revoked →\n current ≠ auths_connections.model.ConnectionState.Revoked ∧ current ≠ next ∧ previous ≤ proposed →\n Auths.Product.RecordTimes.Refinement.valid next created proposed\n (if next = auths_connections.model.ConnectionState.Revoked then some proposed else none)", + "statement_constants": [ + "And", + "Eq", + "Nat", + "Ne", + "Option", + "instLENat", + "ite", + "LE.le", + "Option.none", + "Option.some", + "auths_connections.model.ConnectionState", + "auths_connections.model.ConnectionState.Revoked", + "Auths.Product.RecordTimes.Refinement.valid", + "Auths.Product.RecoveryGate.Refinement.instDecidableEqConnectionState_auths" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_fact_name_equal_refines_model", - "statement": "∀ (left right : String),\n Auths.Refinement.StringBounded left →\n Auths.Refinement.StringBounded right →\n auths_model.observation.fact_name_equal left right = Aeneas.Std.Result.ok (left == right)" + "module": "Auths.Product.RecordTimesRefinement", + "name": "Auths.Product.RecordTimes.Refinement.data_change_preserves_valid_time", + "statement": "∀ (state : auths_connections.model.ConnectionState) (created previous proposed : ℕ) (revoked : Option ℕ),\n Auths.Product.RecordTimes.Refinement.valid state created previous revoked →\n state ≠ auths_connections.model.ConnectionState.Revoked ∧ previous ≤ proposed →\n Auths.Product.RecordTimes.Refinement.valid state created proposed none", + "statement_constants": [ + "And", + "Nat", + "Ne", + "Option", + "instLENat", + "LE.le", + "Option.none", + "auths_connections.model.ConnectionState", + "auths_connections.model.ConnectionState.Revoked", + "Auths.Product.RecordTimes.Refinement.valid" + ] }, { "axioms": [ @@ -2862,9 +26044,27 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_fresh_refines_model", - "statement": "∀ (observedAt evaluationTime maxAge notBefore expiresAt : Aeneas.Std.U64),\n auths_model.observation.observation_fresh observedAt evaluationTime maxAge notBefore expiresAt =\n Aeneas.Std.Result.ok (Auths.Observation.fresh ↑evaluationTime ↑maxAge ↑notBefore ↑expiresAt ↑observedAt)" + "module": "Auths.Product.StrictOrderRefinement", + "name": "Auths.Product.StrictOrder.Refinement.strict_order_exact", + "statement": "∀ {T : Type} (order : Aeneas.Std.core.cmp.Ord T) (less : T → T → Bool),\n (∀ (a b : T), Aeneas.Std.WP.spec (order.partialOrdInst.lt a b) fun actual => actual = less a b) →\n ∀ (values : Aeneas.Std.Slice T),\n Aeneas.Std.WP.spec (auths_connections.kernel.strictly_sorted_unique order values) fun actual =>\n actual = Auths.Product.StrictOrder.Refinement.ordered less ↑values", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_connections.kernel.strictly_sorted_unique", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.cmp.Ord", + "Auths.Product.StrictOrder.Refinement.ordered", + "Aeneas.Std.core.cmp.Ord.partialOrdInst", + "Aeneas.Std.core.cmp.PartialOrd.lt" + ] }, { "axioms": [ @@ -2873,20 +26073,47 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_subject_equal_refines_model", - "statement": "∀ (expected observed : auths_model.ResourceId),\n Auths.Refinement.StringBounded expected →\n Auths.Refinement.StringBounded observed →\n auths_model.observation.observation_subject_equal expected observed =\n Aeneas.Std.Result.ok (decide (expected = observed))" + "module": "Auths.Product.StrictOrderRefinement", + "name": "Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates", + "statement": "∀ {T : Type} (order : Aeneas.Std.core.cmp.Ord T) (less : T → T → Bool),\n (∀ (a b : T), Aeneas.Std.WP.spec (order.partialOrdInst.lt a b) fun actual => actual = less a b) →\n (∀ (a b c : T), less a b = true → less b c = true → less a c = true) →\n (∀ (value : T), less value value = false) →\n ∀ (values : Aeneas.Std.Slice T),\n Aeneas.Std.WP.spec (auths_connections.kernel.strictly_sorted_unique order values) fun actual =>\n actual = true → (↑values).Nodup", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "Bool.false", + "Bool.true", + "LE.le", + "List.Nodup", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_connections.kernel.strictly_sorted_unique", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.cmp.Ord", + "Aeneas.Std.core.cmp.Ord.partialOrdInst", + "Aeneas.Std.core.cmp.PartialOrd.lt" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_fact_value_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.FactValue),\n Auths.Refinement.Observation.FactValueValid left →\n Auths.Refinement.Observation.FactValueValid right →\n auths_model.observation.fact_value_equal left right =\n Aeneas.Std.Result.ok\n (decide (Auths.Refinement.Observation.factValue left = Auths.Refinement.Observation.factValue right))" + "module": "Auths.Product.StrictOrderRefinement", + "name": "Auths.Product.StrictOrder.Refinement.ordered_implies_pairwise", + "statement": "∀ {T : Type} (less : T → T → Bool),\n (∀ (a b c : T), less a b = true → less b c = true → less a c = true) →\n ∀ (values : List T),\n Auths.Product.StrictOrder.Refinement.ordered less values = true →\n List.Pairwise (fun a b => less a b = true) values", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.true", + "List.Pairwise", + "Auths.Product.StrictOrder.Refinement.ordered" + ] }, { "axioms": [ @@ -2894,9 +26121,18 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_uint_range_contains_refines_model", - "statement": "∀ (lo hi value : Aeneas.Std.U64) (factName : String) (actionFact : String → Option Auths.Observation.FactValue),\n auths_model.observation.uint_range_contains lo hi value =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds actionFact (some (Auths.Observation.FactValue.uint ↑value))\n (Auths.Observation.Condition.uintRange factName ↑lo ↑hi))" + "module": "Auths.Product.StrictOrderRefinement", + "name": "Auths.Product.StrictOrder.Refinement.ordered_implies_no_duplicates", + "statement": "∀ {T : Type} (less : T → T → Bool),\n (∀ (a b c : T), less a b = true → less b c = true → less a c = true) →\n (∀ (value : T), less value value = false) →\n ∀ (values : List T), Auths.Product.StrictOrder.Refinement.ordered less values = true → values.Nodup", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Bool.false", + "Bool.true", + "List.Nodup", + "Auths.Product.StrictOrder.Refinement.ordered" + ] }, { "axioms": [ @@ -2905,9 +26141,27 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_member_values_contain_refines_model", - "statement": "∀ (values : auths_model.observation.MemberValues) (value : auths_model.observation.FactValue),\n (∀ member ∈ ↑values, Auths.Refinement.Observation.FactValueValid member) →\n Auths.Refinement.Observation.FactValueValid value →\n ∀ (factName : String) (actionFact : String → Option Auths.Observation.FactValue),\n auths_model.observation.member_values_contain values value =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds actionFact (some (Auths.Refinement.Observation.factValue value))\n (Auths.Observation.Condition.member factName (List.map Auths.Refinement.Observation.factValue ↑values)))" + "module": "Auths.Product.RecordShapeRefinement", + "name": "Auths.Product.RecordShape.Refinement.text_order_exact", + "statement": "∀ (values : Aeneas.Std.Slice String),\n Aeneas.Std.WP.spec\n (auths_connections.kernel.strictly_sorted_unique auths_connections.alloc.string.String.Insts.CoreCmpOrd values)\n fun actual =>\n actual = Auths.Product.StrictOrder.Refinement.ordered Auths.Product.RecordShape.Refinement.textLess ↑values", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "String", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_connections.kernel.strictly_sorted_unique", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.RecordShape.Refinement.textLess", + "Auths.Product.StrictOrder.Refinement.ordered", + "auths_connections.alloc.string.String.Insts.CoreCmpOrd" + ] }, { "axioms": [ @@ -2916,9 +26170,28 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_fact_refines_model", - "statement": "∀ (facts : auths_model.observation.ObservationFacts) (factName : String),\n Auths.Refinement.Observation.FactsValid facts →\n Auths.Refinement.StringBounded factName →\n ∃ result,\n auths_model.observation.observation_fact facts factName = Aeneas.Std.Result.ok result ∧\n Option.map Auths.Refinement.Observation.factValue result =\n Auths.Observation.lookupFact (Auths.Refinement.Observation.factsOf facts) factName" + "module": "Auths.Product.RecordShapeRefinement", + "name": "Auths.Product.RecordShape.Refinement.profile_order_exact", + "statement": "∀ (values : Aeneas.Std.Slice Auths.Product.RecordShape.Refinement.Profile),\n Aeneas.Std.WP.spec\n (auths_connections.kernel.strictly_sorted_unique auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd values)\n fun actual =>\n actual = Auths.Product.StrictOrder.Refinement.ordered Auths.Product.RecordShape.Refinement.profileLess ↑values", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_connections.kernel.strictly_sorted_unique", + "auths_connections.model.ConnectionProfile", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.RecordShape.Refinement.Profile", + "Auths.Product.RecordShape.Refinement.profileLess", + "Auths.Product.StrictOrder.Refinement.ordered", + "auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd" + ] }, { "axioms": [ @@ -2927,9 +26200,30 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_condition_value_holds_refines_model", - "statement": "∀ (test : auths_model.observation.ConditionTest) (observed actionValue : Option auths_model.observation.FactValue),\n Auths.Refinement.Observation.TestValid test →\n Auths.Refinement.Observation.OptionValid observed →\n Auths.Refinement.Observation.OptionValid actionValue →\n ∀ (factName : String),\n auths_model.observation.condition_value_holds test observed actionValue =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds (fun x => Option.map Auths.Refinement.Observation.factValue actionValue)\n (Option.map Auths.Refinement.Observation.factValue observed)\n (Auths.Refinement.Observation.conditionOf factName test))" + "module": "Auths.Product.RecordShapeRefinement", + "name": "Auths.Product.RecordShape.Refinement.workloads_exact", + "statement": "∀ (values : Aeneas.Std.Slice String),\n (∀ value ∈ ↑values, value.toByteArray.size ≤ Aeneas.Std.U32.max) →\n Aeneas.Std.WP.spec (auths_connections.kernel.workloads_valid values) fun actual =>\n actual = Auths.Product.RecordShape.Refinement.workloadsValid ↑values", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "String", + "instLENat", + "ByteArray.size", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "String.toByteArray", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_connections.kernel.workloads_valid", + "Aeneas.Std.U32.max", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.RecordShape.Refinement.workloadsValid" + ] }, { "axioms": [ @@ -2938,9 +26232,25 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_condition_holds_refines_model", - "statement": "∀ (value : auths_model.observation.ObservationCondition) (actionValue : Option auths_model.observation.FactValue)\n (facts : auths_model.observation.ObservationFacts),\n Auths.Refinement.Observation.ConditionValid value →\n Auths.Refinement.Observation.OptionValid actionValue →\n Auths.Refinement.Observation.FactsValid facts →\n auths_model.observation.observation_condition_holds value actionValue facts =\n Aeneas.Std.Result.ok\n (Auths.Observation.valueHolds (fun x => Option.map Auths.Refinement.Observation.factValue actionValue)\n (Auths.Observation.lookupFact (Auths.Refinement.Observation.factsOf facts) value.name)\n (Auths.Refinement.Observation.condition value))" + "module": "Auths.Product.RecordShapeRefinement", + "name": "Auths.Product.RecordShape.Refinement.profiles_exact", + "statement": "∀ (values : Aeneas.Std.Slice Auths.Product.RecordShape.Refinement.Profile),\n Aeneas.Std.WP.spec (auths_connections.kernel.profiles_valid values) fun actual =>\n actual = Auths.Product.RecordShape.Refinement.profilesValid ↑values", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.Slice", + "auths_connections.kernel.profiles_valid", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Product.RecordShape.Refinement.Profile", + "Auths.Product.RecordShape.Refinement.profilesValid" + ] }, { "axioms": [ @@ -2949,9 +26259,39 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_model", - "statement": "∀ (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (actionValues : Aeneas.Std.Slice (Option auths_model.observation.FactValue))\n (facts : auths_model.observation.ObservationFacts),\n (∀ value ∈ ↑conditions, Auths.Refinement.Observation.ConditionValid value) →\n (∀ value ∈ ↑actionValues, Auths.Refinement.Observation.OptionValid value) →\n Auths.Refinement.Observation.FactsValid facts →\n auths_model.observation.observation_conditions_hold conditions actionValues facts =\n Aeneas.Std.Result.ok\n (decide ((↑conditions).length = (↑actionValues).length) &&\n ((↑conditions).zip ↑actionValues).all fun pair =>\n Auths.Observation.valueHolds (fun x => Option.map Auths.Refinement.Observation.factValue pair.2)\n (Auths.Observation.lookupFact (Auths.Refinement.Observation.factsOf facts) pair.1.name)\n (Auths.Refinement.Observation.condition pair.1))" + "module": "Auths.Product.RecordShapeRefinement", + "name": "Auths.Product.RecordShape.Refinement.record_shape_exact", + "statement": "∀ (workloads : Aeneas.Std.Slice String) (profiles : Aeneas.Std.Slice Auths.Product.RecordShape.Refinement.Profile)\n (state : Auths.Product.RecordShape.Refinement.State) (created updated : Aeneas.Std.U64)\n (revoked : Option Aeneas.Std.U64),\n (∀ value ∈ ↑workloads, value.toByteArray.size ≤ Aeneas.Std.U32.max) →\n Aeneas.Std.WP.spec (auths_connections.kernel.validate_record_shape workloads profiles state created updated revoked)\n fun actual =>\n actual =\n Auths.Product.RecordShape.Refinement.verdict (↑workloads) (↑profiles) state (↑created) (↑updated)\n (Option.map (fun x => ↑x) revoked)", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Option", + "String", + "Unit", + "instLENat", + "ByteArray.size", + "LE.le", + "List.instMembership", + "List.length", + "Membership.mem", + "Option.map", + "String.toByteArray", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_connections.kernel.validate_record_shape", + "auths_connections.model.ConnectionRecordError", + "Aeneas.Std.U32.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.result.Result", + "Auths.Product.RecordShape.Refinement.Profile", + "Auths.Product.RecordShape.Refinement.State", + "Auths.Product.RecordShape.Refinement.verdict" + ] }, { "axioms": [ @@ -2960,9 +26300,51 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_conditions_length_mismatch_fails_closed", - "statement": "∀ (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (actionValues : Aeneas.Std.Slice (Option auths_model.observation.FactValue))\n (facts : auths_model.observation.ObservationFacts),\n (↑conditions).length ≠ (↑actionValues).length →\n auths_model.observation.observation_conditions_hold conditions actionValues facts = Aeneas.Std.Result.ok false" + "module": "Auths.Product.RecordShapeRefinement", + "name": "Auths.Product.RecordShape.Refinement.success_earns_all_invariants", + "statement": "∀ (workloads : Aeneas.Std.Slice String) (profiles : Aeneas.Std.Slice Auths.Product.RecordShape.Refinement.Profile)\n (state : Auths.Product.RecordShape.Refinement.State) (created updated : Aeneas.Std.U64)\n (revoked : Option Aeneas.Std.U64),\n (∀ value ∈ ↑workloads, value.toByteArray.size ≤ Aeneas.Std.U32.max) →\n Aeneas.Std.WP.spec (auths_connections.kernel.validate_record_shape workloads profiles state created updated revoked)\n fun actual =>\n (actual = Aeneas.Std.core.result.Result.Ok () ↔\n Auths.Product.RecordShape.Refinement.requirements (↑workloads) (↑profiles) state (↑created) (↑updated)\n (Option.map (fun x => ↑x) revoked)) ∧\n (actual = Aeneas.Std.core.result.Result.Ok () →\n ↑workloads ≠ [] ∧\n (↑workloads).length ≤ 256 ∧\n (↑workloads).Nodup ∧\n (∀ value ∈ ↑workloads, Auths.Product.RecordShape.Refinement.textValid value) ∧\n ↑profiles ≠ [] ∧\n (↑profiles).length ≤ 32 ∧\n (↑profiles).Nodup ∧\n Auths.Product.RecordTimes.Refinement.valid\n (Auths.Product.RecordShape.Refinement.stateView state) (↑created) (↑updated)\n (Option.map (fun x => ↑x) revoked))", + "statement_constants": [ + "And", + "Eq", + "Iff", + "List", + "Nat", + "Ne", + "Option", + "String", + "Unit", + "instLENat", + "instOfNatNat", + "ByteArray.size", + "LE.le", + "List.Nodup", + "List.instMembership", + "List.length", + "List.nil", + "Membership.mem", + "OfNat.ofNat", + "Option.map", + "String.toByteArray", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "auths_connections.kernel.validate_record_shape", + "auths_connections.model.ConnectionRecordError", + "Aeneas.Std.U32.max", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Aeneas.Std.core.result.Result", + "Auths.Product.RecordShape.Refinement.Profile", + "Auths.Product.RecordShape.Refinement.State", + "Auths.Product.RecordShape.Refinement.requirements", + "Auths.Product.RecordShape.Refinement.stateView", + "Auths.Product.RecordShape.Refinement.textValid", + "Auths.Product.RecordTimes.Refinement.valid", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -2971,9 +26353,25 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_conditions_hold_refines_conditions_hold", - "statement": "∀ (env : Auths.Observation.Environment) (observation : Auths.Observation.ObservationRecord)\n (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (actionValues : Aeneas.Std.Slice (Option auths_model.observation.FactValue))\n (facts : auths_model.observation.ObservationFacts),\n (∀ value ∈ ↑conditions, Auths.Refinement.Observation.ConditionValid value) →\n (∀ value ∈ ↑actionValues, Auths.Refinement.Observation.OptionValid value) →\n Auths.Refinement.Observation.FactsValid facts →\n observation.facts = Auths.Refinement.Observation.factsOf facts →\n (↑conditions).length = (↑actionValues).length →\n Auths.Refinement.Observation.ActionValuesMatch env ↑conditions ↑actionValues →\n auths_model.observation.observation_conditions_hold conditions actionValues facts =\n Aeneas.Std.Result.ok\n (Auths.Observation.conditionsHold env observation\n (List.map Auths.Refinement.Observation.condition ↑conditions))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.new_exact", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_codec.cbor.Decoder.new input) fun actual => actual.input = input ∧ ↑actual.position = 0", + "statement_constants": [ + "And", + "Eq", + "Nat", + "instOfNatNat", + "OfNat.ofNat", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.WP.spec", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.new", + "auths_codec.cbor.Decoder.position" + ] }, { "axioms": [ @@ -2981,19 +26379,52 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_requirement_verdict_refines_model", - "statement": "∀ (anyEligible anySatisfying : Bool),\n ∃ verdict,\n auths_model.observation.requirement_verdict anyEligible anySatisfying = Aeneas.Std.Result.ok verdict ∧\n Auths.Refinement.Observation.decisionOf verdict =\n if anySatisfying = true then Auths.Observation.Decision.satisfied\n else if anyEligible = true then Auths.Observation.Decision.denied else Auths.Observation.Decision.indeterminate" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.at_exact", + "statement": "∀ (input : Aeneas.Std.Slice Aeneas.Std.U8) (position : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_codec.cbor.Decoder.at input position) fun actual =>\n actual =\n if ↑position ≤ (↑input).length then Aeneas.Std.core.result.Result.Ok { input := input, position := position }\n else Aeneas.Std.core.result.Result.Err ()", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "ite", + "LE.le", + "List.length", + "Nat.decLe", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "auths_codec.cbor.Decoder.at", + "auths_codec.cbor.Decoder.mk", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ - "propext", - "Quot.sound" + "propext" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_requirement_verdict_refines_requirement_decision", - "statement": "∀ (env : Auths.Observation.Environment) (observations : List Auths.Observation.ObservationRecord)\n (requirement : Auths.Observation.Requirement),\n Auths.Observation.actionFactsAvailable env requirement = true →\n ∃ verdict,\n auths_model.observation.requirement_verdict (observations.any (Auths.Observation.eligible env requirement))\n (Auths.Observation.satisfied env observations requirement) =\n Aeneas.Std.Result.ok verdict ∧\n Auths.Refinement.Observation.decisionOf verdict =\n Auths.Observation.requirementDecision env observations requirement" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.position_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec (auths_codec.cbor.Decoder.impl.position self) fun actual => actual = self.position", + "statement_constants": [ + "Eq", + "Aeneas.Std.Usize", + "auths_codec.cbor.Decoder", + "Aeneas.Std.WP.spec", + "auths_codec.cbor.Decoder.position", + "auths_codec.cbor.Decoder.impl.position" + ] }, { "axioms": [ @@ -3002,9 +26433,42 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observer_anchor_id_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.ObserverAnchorId),\n Auths.Refinement.StringBounded left →\n Auths.Refinement.StringBounded right →\n auths_model.observation.observer_anchor_id_equal left right = Aeneas.Std.Result.ok (decide (left = right))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.head_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (major : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (self.head major) fun actual =>\n (Auths.Codec.Cursor.wordView actual.1, ↑actual.2.position) =\n Auths.Codec.Cursor.typedHead (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑major ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.typedHead", + "Auths.Codec.Cursor.wordView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.head", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3013,9 +26477,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_schema_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.ObservationSchemaId),\n Auths.Refinement.StringBounded left →\n Auths.Refinement.StringBounded right →\n auths_model.observation.observation_schema_equal left right = Aeneas.Std.Result.ok (decide (left = right))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.u64_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.u64 fun actual =>\n (Auths.Codec.Cursor.wordView actual.1, ↑actual.2.position) =\n Auths.Codec.Cursor.typedHead (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) 0 ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.typedHead", + "Auths.Codec.Cursor.wordView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "auths_codec.cbor.Decoder.u64", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3024,9 +26522,42 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_requirement_subject_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.ObservationSubject),\n Auths.Refinement.Observation.SubjectValid left →\n Auths.Refinement.Observation.SubjectValid right →\n auths_model.observation.requirement_subject_equal left right =\n Aeneas.Std.Result.ok\n (decide (Auths.Refinement.Observation.subjectOf left = Auths.Refinement.Observation.subjectOf right))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.u8_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.u8 fun actual =>\n (Auths.Codec.Cursor.wordView actual.1, ↑actual.2.position) =\n Auths.Codec.Cursor.narrowHead (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) 255 ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.narrowHead", + "Auths.Codec.Cursor.wordView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "auths_codec.cbor.Decoder.u8", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3035,9 +26566,43 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_member_values_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.MemberValues),\n (∀ value ∈ ↑left, Auths.Refinement.Observation.FactValueValid value) →\n (∀ value ∈ ↑right, Auths.Refinement.Observation.FactValueValid value) →\n auths_model.observation.member_values_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (List.map Auths.Refinement.Observation.factValue ↑left =\n List.map Auths.Refinement.Observation.factValue ↑right))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.u16_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.u16 fun actual =>\n (Auths.Codec.Cursor.wordView actual.1, ↑actual.2.position) =\n Auths.Codec.Cursor.narrowHead (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) 65535 ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U16", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U16", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.narrowHead", + "Auths.Codec.Cursor.wordView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "auths_codec.cbor.Decoder.u16", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3046,9 +26611,40 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_condition_test_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.ConditionTest),\n Auths.Refinement.Observation.TestComparable left →\n Auths.Refinement.Observation.TestComparable right →\n ∀ (factName : String),\n auths_model.observation.condition_test_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Refinement.Observation.conditionOf factName left =\n Auths.Refinement.Observation.conditionOf factName right))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.null_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.null fun actual =>\n (Auths.Codec.Cursor.unitView actual.1, ↑actual.2.position) =\n Auths.Codec.Cursor.nullAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "Unit", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.nullAt", + "Auths.Codec.Cursor.unitView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.null", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3057,20 +26653,69 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_condition_equal_refines_model", - "statement": "∀ (left right : auths_model.observation.ObservationCondition),\n Auths.Refinement.Observation.ConditionComparable left →\n Auths.Refinement.Observation.ConditionComparable right →\n auths_model.observation.observation_condition_equal left right =\n Aeneas.Std.Result.ok\n (decide (Auths.Refinement.Observation.condition left = Auths.Refinement.Observation.condition right))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.datatype_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.datatype fun actual =>\n actual = Auths.Codec.Cursor.typeAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position", + "statement_constants": [ + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "auths_codec.cbor.Type", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.typeAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.datatype", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ "propext", - "Classical.choice", "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_conditions_contain_refines_model", - "statement": "∀ (conditions : Aeneas.Std.Slice auths_model.observation.ObservationCondition)\n (value : auths_model.observation.ObservationCondition),\n (∀ member ∈ ↑conditions, Auths.Refinement.Observation.ConditionComparable member) →\n Auths.Refinement.Observation.ConditionComparable value →\n auths_model.observation.observation_conditions_contain conditions value =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Refinement.Observation.condition value ∈\n List.map Auths.Refinement.Observation.condition ↑conditions))" + "module": "Auths.Codec.Cursor", + "name": "Auths.Codec.Cursor.ensure_complete_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (input : Aeneas.Std.Slice Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_codec.decode.ensure_complete self input) fun actual =>\n actual =\n if ↑self.position = (↑input).length then Aeneas.Std.core.result.Result.Ok ()\n else Aeneas.Std.core.result.Result.Err auths_codec.error.CodecError.Malformed", + "statement_constants": [ + "Eq", + "List", + "Nat", + "Unit", + "instDecidableEqNat", + "instLENat", + "ite", + "LE.le", + "List.length", + "Subtype.val", + "Unit.unit", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.ensure_complete", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "auths_codec.cbor.Decoder.position", + "auths_codec.error.CodecError.Malformed", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Err", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -3079,9 +26724,40 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_conditions_include_refines_model", - "statement": "∀ (narrower wider : Aeneas.Std.Slice auths_model.observation.ObservationCondition),\n (∀ member ∈ ↑narrower, Auths.Refinement.Observation.ConditionComparable member) →\n (∀ member ∈ ↑wider, Auths.Refinement.Observation.ConditionComparable member) →\n auths_model.observation.observation_conditions_include narrower wider =\n Aeneas.Std.Result.ok\n (decide\n (∀ value ∈ List.map Auths.Refinement.Observation.condition ↑wider,\n value ∈ List.map Auths.Refinement.Observation.condition ↑narrower))" + "module": "Auths.Codec.Payload", + "name": "Auths.Codec.Payload.payload_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (major : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (self.payload major) fun actual =>\n (Auths.Codec.Payload.bytesView actual.1, ↑actual.2.position) =\n Auths.Codec.Payload.payloadAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑major ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Payload.bytesView", + "Auths.Codec.Payload.payloadAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.payload", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3090,9 +26766,41 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_conditions_equal_refines_model", - "statement": "∀ (left right : Aeneas.Std.Slice auths_model.observation.ObservationCondition),\n (∀ member ∈ ↑left, Auths.Refinement.Observation.ConditionComparable member) →\n (∀ member ∈ ↑right, Auths.Refinement.Observation.ConditionComparable member) →\n auths_model.observation.observation_conditions_equal left right =\n Aeneas.Std.Result.ok\n (decide\n (List.map Auths.Refinement.Observation.condition ↑left =\n List.map Auths.Refinement.Observation.condition ↑right))" + "module": "Auths.Codec.Payload", + "name": "Auths.Codec.Payload.bytes_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.bytes fun actual =>\n (Auths.Codec.Payload.bytesView actual.1, ↑actual.2.position) =\n Auths.Codec.Payload.payloadAt (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) 2 ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Payload.bytesView", + "Auths.Codec.Payload.payloadAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.bytes", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3101,9 +26809,40 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_requirement_same_target_refines_model", - "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_same_target child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.sameTarget (Auths.Refinement.Observation.requirementOf child)\n (Auths.Refinement.Observation.requirementOf parent)))" + "module": "Auths.Codec.Payload", + "name": "Auths.Codec.Payload.str_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.str fun actual =>\n (Auths.Codec.Payload.bytesView actual.1, ↑actual.2.position) =\n Auths.Codec.Payload.textAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Payload.bytesView", + "Auths.Codec.Payload.textAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "auths_codec.cbor.Decoder.str", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3112,9 +26851,47 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_requirement_equal_refines_model", - "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_equal child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Refinement.Observation.requirementOf child = Auths.Refinement.Observation.requirementOf parent))" + "module": "Auths.Codec.Payload", + "name": "Auths.Codec.Payload.success_earns_span", + "statement": "∀ (self : auths_codec.cbor.Decoder) (major : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (self.payload major) fun actual =>\n actual.2.input = self.input ∧\n ∀ (bytes : Aeneas.Std.Slice Aeneas.Std.U8),\n actual.1 = Aeneas.Std.core.result.Result.Ok bytes →\n ∃ start length,\n Auths.Codec.Cursor.typedHead (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑major =\n (some length, start) ∧\n Auths.Codec.Refinement.byteList ↑bytes =\n List.take length (List.drop start (Auths.Codec.Refinement.byteList ↑self.input)) ∧\n ↑actual.2.position = start + length ∧\n ↑actual.2.position ≤ (↑self.input).length ∧ (↑bytes).length = length", + "statement_constants": [ + "And", + "Eq", + "Exists", + "List", + "Nat", + "Option", + "Prod", + "instAddNat", + "instHAdd", + "instLENat", + "HAdd.hAdd", + "LE.le", + "List.drop", + "List.length", + "List.take", + "Option.some", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Cursor.typedHead", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.payload", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result", + "Aeneas.Std.core.result.Result.Ok" + ] }, { "axioms": [ @@ -3123,9 +26900,45 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_requirement_narrows_refines_model", - "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_narrows child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.narrows (Auths.Refinement.Observation.requirementOf child)\n (Auths.Refinement.Observation.requirementOf parent)))" + "module": "Auths.Codec.Collection", + "name": "Auths.Codec.Collection.collection_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (major : Aeneas.Std.U8),\n ↑major < 8 →\n Aeneas.Std.WP.spec (self.collection major) fun actual =>\n (Auths.Codec.Collection.collectionView actual.1, ↑actual.2.position) =\n Auths.Codec.Collection.collectionAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑major ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instLTNat", + "instOfNatNat", + "LE.le", + "LT.lt", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Collection.collectionAt", + "Auths.Codec.Collection.collectionView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.collection", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3134,9 +26947,42 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_requirement_covers_refines_model", - "statement": "∀ (child parent : auths_model.observation.ObservationRequirement),\n Auths.Refinement.Observation.RequirementValid child →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_covers child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.covers (Auths.Refinement.Observation.requirementOf child)\n (Auths.Refinement.Observation.requirementOf parent)))" + "module": "Auths.Codec.Collection", + "name": "Auths.Codec.Collection.map_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.map fun actual =>\n (Auths.Codec.Collection.collectionView actual.1, ↑actual.2.position) =\n Auths.Codec.Collection.collectionAt (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) 5 ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Collection.collectionAt", + "Auths.Codec.Collection.collectionView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.map", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3145,9 +26991,42 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_requirement_retained_refines_model", - "statement": "∀ (child : auths_model.observation.ObservationRequirements) (parent : auths_model.observation.ObservationRequirement),\n (∀ requirement ∈ ↑child, Auths.Refinement.Observation.RequirementValid requirement) →\n Auths.Refinement.Observation.RequirementValid parent →\n auths_model.observation.observation_requirement_retained child parent =\n Aeneas.Std.Result.ok\n (decide\n (∃ candidate ∈ List.map Auths.Refinement.Observation.requirementOf ↑child,\n Auths.Observation.covers candidate (Auths.Refinement.Observation.requirementOf parent)))" + "module": "Auths.Codec.Collection", + "name": "Auths.Codec.Collection.array_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec self.array fun actual =>\n (Auths.Codec.Collection.collectionView actual.1, ↑actual.2.position) =\n Auths.Codec.Collection.collectionAt (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) 4 ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Option", + "Prod", + "instLENat", + "instOfNatNat", + "LE.le", + "List.length", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.cbor.Error", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Collection.collectionAt", + "Auths.Codec.Collection.collectionView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.array", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3156,9 +27035,39 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Observation", - "name": "Auths.Refinement.Observation.translated_observation_requirements_attenuate_refines_model", - "statement": "∀ (child parent : auths_model.observation.ObservationRequirements),\n (∀ requirement ∈ ↑child, Auths.Refinement.Observation.RequirementValid requirement) →\n (∀ requirement ∈ ↑parent, Auths.Refinement.Observation.RequirementValid requirement) →\n auths_model.observation.observation_requirements_attenuate child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Observation.requirementsAttenuate (List.map Auths.Refinement.Observation.requirementOf ↑child)\n (List.map Auths.Refinement.Observation.requirementOf ↑parent)))" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.key_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (expected : Aeneas.Std.U8),\n Aeneas.Std.WP.spec (auths_codec.decode.key self expected) fun actual =>\n (actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.keyAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑expected ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Prod", + "Unit", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.key", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U8", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.keyAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3167,9 +27076,40 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_approver_verdict_refines_model", - "statement": "∀ (outcomes : Aeneas.Std.Slice auths_model.approval.ApprovalOutcome) (approver : auths_model.PrincipalId),\n Auths.Refinement.Approval.OutcomesValid ↑outcomes →\n Auths.Refinement.StringBounded approver →\n ∃ result,\n auths_model.approval.approver_verdict outcomes approver = Aeneas.Std.Result.ok result ∧\n Auths.Refinement.Approval.verdictOf result =\n Auths.Approval.approverVerdict (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes) approver" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.map_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (expected : Aeneas.Std.U64),\n Aeneas.Std.WP.spec (auths_codec.decode.map self expected) fun actual =>\n (actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.mapAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑expected ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Prod", + "Unit", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U64", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.map", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.U64", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.mapAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3178,9 +27118,39 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_approval_counts_refines_model", - "statement": "∀ (approvers : Aeneas.Std.Slice auths_model.PrincipalId)\n (outcomes : Aeneas.Std.Slice auths_model.approval.ApprovalOutcome),\n Auths.Refinement.Approval.PrincipalsValid ↑approvers →\n Auths.Refinement.Approval.OutcomesValid ↑outcomes →\n ∀ (threshold : Aeneas.Std.U16),\n ∃ counts,\n auths_model.approval.approval_counts approvers outcomes = Aeneas.Std.Result.ok counts ∧\n ↑counts.counted =\n Auths.Approval.countedCount (↑approvers) (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes) ∧\n ↑counts.pending =\n Auths.Approval.pendingCount (↑approvers) (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes) ∧\n Auths.thresholdCounts ↑threshold ↑counts.counted ↑counts.pending =\n Auths.Approval.decideCounts (↑threshold) (↑approvers)\n (List.map Auths.Refinement.Approval.outcomeOf ↑outcomes)" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.text_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec (auths_codec.decode.text self) fun actual =>\n (Auths.Codec.Fields.codecBytesView actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.textAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.Str", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.text", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.codecBytesView", + "Auths.Codec.Fields.textAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3189,9 +27159,38 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model", - "statement": "∀ (principals : Aeneas.Std.Slice auths_model.PrincipalId) (principal : auths_model.PrincipalId),\n Auths.Refinement.Approval.PrincipalsValid ↑principals →\n Auths.Refinement.StringBounded principal →\n auths_model.approval.principal_ids_contain principals principal =\n Aeneas.Std.Result.ok (decide (principal ∈ ↑principals))" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.null_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec (auths_codec.decode.null self) fun actual =>\n (actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.nullAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Prod", + "Unit", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.null", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.nullAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3200,9 +27199,32 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model", - "statement": "∀ (narrower wider : Aeneas.Std.Slice auths_model.PrincipalId),\n Auths.Refinement.Approval.PrincipalsValid ↑narrower →\n Auths.Refinement.Approval.PrincipalsValid ↑wider →\n auths_model.approval.principal_ids_subset narrower wider = Aeneas.Std.Result.ok (decide (↑narrower ⊆ ↑wider))" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.is_null_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec (auths_codec.decode.is_null self) fun actual =>\n actual = Auths.Codec.Fields.isNullAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position", + "statement_constants": [ + "Bool", + "Eq", + "List", + "Nat", + "instLENat", + "LE.le", + "List.length", + "Subtype.val", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.is_null", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.isNullAt", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3211,9 +27233,39 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model", - "statement": "∀ (child parent : auths_model.approval.ApprovalRequirement),\n Auths.Refinement.Approval.RequirementValid child →\n Auths.Refinement.Approval.RequirementValid parent →\n auths_model.approval.approval_requirement_covers child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Approval.covers (Auths.Refinement.Approval.requirementOf child)\n (Auths.Refinement.Approval.requirementOf parent)))" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.array_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (maximum : Aeneas.Std.Usize),\n Aeneas.Std.WP.spec (auths_codec.decode.array self maximum) fun actual =>\n (Auths.Codec.Fields.sizeView actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.arrayAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ↑maximum ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Eq", + "List", + "Nat", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.cbor.Decoder", + "auths_codec.decode.array", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.arrayAt", + "Auths.Codec.Fields.sizeView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3222,9 +27274,41 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model", - "statement": "∀ (child : auths_model.approval.ApprovalRequirements) (parent : auths_model.approval.ApprovalRequirement),\n (∀ requirement ∈ ↑child, Auths.Refinement.Approval.RequirementValid requirement) →\n Auths.Refinement.Approval.RequirementValid parent →\n auths_model.approval.approval_requirement_retained child parent =\n Aeneas.Std.Result.ok\n (decide\n (∃ candidate ∈ List.map Auths.Refinement.Approval.requirementOf ↑child,\n Auths.Approval.covers candidate (Auths.Refinement.Approval.requirementOf parent)))" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.bounded_bytes_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder) (maximum : Aeneas.Std.Usize) (nonempty : Bool),\n Aeneas.Std.WP.spec (auths_codec.decode.bounded_bytes self maximum nonempty) fun actual =>\n (Auths.Codec.Fields.vecView actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.boundedBytesAt (Auths.Codec.Refinement.byteList ↑self.input) (↑self.position) (↑maximum)\n nonempty ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "instLENat", + "LE.le", + "List.length", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "Aeneas.Std.Usize", + "auths_codec.cbor.Decoder", + "auths_codec.decode.bounded_bytes", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.boundedBytesAt", + "Auths.Codec.Fields.vecView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.alloc.vec.Vec", + "Aeneas.Std.core.result.Result" + ] }, { "axioms": [ @@ -3233,9 +27317,50 @@ "Quot.sound" ], "kind": "theorem", - "module": "Auths.Refinement.Approval", - "name": "Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model", - "statement": "∀ (child parent : auths_model.approval.ApprovalRequirements),\n (∀ requirement ∈ ↑child, Auths.Refinement.Approval.RequirementValid requirement) →\n (∀ requirement ∈ ↑parent, Auths.Refinement.Approval.RequirementValid requirement) →\n auths_model.approval.approval_requirements_attenuate child parent =\n Aeneas.Std.Result.ok\n (decide\n (Auths.Approval.requirementsAttenuate (List.map Auths.Refinement.Approval.requirementOf ↑child)\n (List.map Auths.Refinement.Approval.requirementOf ↑parent)))" + "module": "Auths.Codec.Fields", + "name": "Auths.Codec.Fields.digest_bytes_exact", + "statement": "∀ (self : auths_codec.cbor.Decoder),\n Aeneas.Std.WP.spec (auths_codec.decode.digest_bytes self) fun actual =>\n (Auths.Codec.Fields.digestView actual.1, ↑actual.2.position) =\n Auths.Codec.Fields.digestAt (Auths.Codec.Refinement.byteList ↑self.input) ↑self.position ∧\n actual.2.input = self.input", + "statement_constants": [ + "And", + "Bool", + "Eq", + "List", + "Nat", + "Prod", + "id", + "instLENat", + "instOfNatNat", + "of_decide_eq_true", + "Bool.true", + "Decidable.decide", + "Eq.refl", + "LE.le", + "List.length", + "Nat.decLe", + "OfNat.ofNat", + "Prod.fst", + "Prod.mk", + "Prod.snd", + "Subtype.val", + "Aeneas.Std.Array", + "Aeneas.Std.Slice", + "Aeneas.Std.U8", + "auths_codec.cbor.Decoder", + "auths_codec.decode.digest_bytes", + "auths_codec.error.CodecError", + "Aeneas.Std.UScalar.cMax", + "Aeneas.Std.UScalar.val", + "Aeneas.Std.UScalarTy.Usize", + "Aeneas.Std.Usize.max", + "Aeneas.Std.Usize.ofNat", + "Aeneas.Std.WP.spec", + "Auths.Codec.Fields.digestAt", + "Auths.Codec.Fields.digestView", + "Auths.Codec.Refinement.byteList", + "auths_codec.cbor.Decoder.input", + "auths_codec.cbor.Decoder.position", + "Aeneas.Std.core.result.Result" + ] } ], "schema": "auths-proof-lean-assurance-audit/v1" diff --git a/formal/proof-coverage-functions-v1.tsv b/formal/proof-coverage-functions-v1.tsv index 9e3656230..78cc7fa6c 100644 --- a/formal/proof-coverage-functions-v1.tsv +++ b/formal/proof-coverage-functions-v1.tsv @@ -67,87 +67,128 @@ core/crates/auths-codec/src/bounded_policy.rs 70 87 18 encode_bounded_policy_com core/crates/auths-codec/src/bounded_policy.rs 94 96 3 bounded_policy_digest core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/bounded_policy.rs 103 105 3 bounded_policy_link core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/bounded_policy.rs 117 149 33 decode_bounded_policy_commitment core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 40 46 7 map core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 48 56 9 array core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 58 64 7 array_exact core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 66 72 7 key core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 74 76 3 text core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 78 88 11 bounded_bytes core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 90 96 7 digest_bytes core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 98 100 3 is_null core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 102 104 3 null core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 118 125 8 profile_ref core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 127 134 8 permission core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 136 146 11 permissions core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 148 158 11 audiences core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 160 177 18 status_policy core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 179 186 8 budget core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 188 197 10 optional_budget core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 199 227 29 constraint core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 229 248 20 extensions core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 250 265 16 signature_descriptor core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 267 280 14 signature core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 282 343 62 grant_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 345 355 11 signed_grant core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 357 431 75 action_envelope core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 433 443 11 signed_action core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 445 489 45 authorization_plan core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 491 509 19 evidence core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 511 529 19 statement_ref core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 531 545 15 binding core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 547 586 40 principal_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 588 598 11 signed_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 600 639 40 grant_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 641 651 11 signed_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 653 690 38 attachment core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 692 800 97 bundle_from core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 802 810 9 role core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 812 886 75 assurance_policy core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/cbor.rs 14 16 3 malformed core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 40 62 23 read_tail core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 68 92 25 read_head core/crates/auths-codec decoding 0 0 1 1 1 3 +core/crates/auths-codec/src/cbor.rs 98 104 7 append_tail core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 111 134 24 encode_head core/crates/auths-codec decoding 0 0 1 1 1 3 +core/crates/auths-codec/src/cbor.rs 143 145 3 Decoder::new core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 147 152 6 Decoder::at core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 154 156 3 Decoder::position core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 158 165 8 Decoder::head core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 167 173 7 Decoder::collection core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 175 177 3 Decoder::map core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 179 181 3 Decoder::array core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 183 185 3 Decoder::u64 core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 187 189 3 Decoder::u32 core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/cbor.rs 191 193 3 Decoder::u16 core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 195 197 3 Decoder::u8 core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 199 205 7 Decoder::payload core/crates/auths-codec decoding 0 0 1 1 1 2 +core/crates/auths-codec/src/cbor.rs 207 209 3 Decoder::bytes core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 211 216 6 Decoder::str core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 218 226 9 Decoder::bool core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/cbor.rs 228 234 7 Decoder::null core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 236 248 13 Decoder::datatype core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/cbor.rs 257 259 3 Encoder::new core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 261 263 3 Encoder::into_writer core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 265 269 5 Encoder::head core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 271 273 3 Encoder::map core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 275 277 3 Encoder::array core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 279 281 3 Encoder::u64 core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 283 285 3 Encoder::u32 core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/cbor.rs 287 289 3 Encoder::u16 core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 291 293 3 Encoder::u8 core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 295 299 5 Encoder::payload core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 301 303 3 Encoder::bytes core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 305 307 3 Encoder::str core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/cbor.rs 309 311 3 Encoder::bool core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/cbor.rs 313 315 3 Encoder::null core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 40 42 3 decode_error core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 44 50 7 map core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 52 60 9 array core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 62 68 7 array_exact core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 70 76 7 key core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 78 83 6 text core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 85 97 13 bounded_bytes core/crates/auths-codec decoding 0 0 1 1 1 2 +core/crates/auths-codec/src/decode.rs 99 104 6 digest_bytes core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 106 108 3 is_null core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 110 112 3 null core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 126 133 8 profile_ref core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 135 142 8 permission core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 144 154 11 permissions core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 156 166 11 audiences core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 168 185 18 status_policy core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 187 194 8 budget core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 196 205 10 optional_budget core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 207 235 29 constraint core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 237 256 20 extensions core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 258 273 16 signature_descriptor core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 275 288 14 signature core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 290 348 59 grant_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 350 360 11 signed_grant core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 362 433 72 action_envelope core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 435 445 11 signed_action core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 447 491 45 authorization_plan core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 493 511 19 evidence core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 513 531 19 statement_ref core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 533 547 15 binding core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 549 588 40 principal_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 590 600 11 signed_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 602 641 40 grant_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 643 653 11 signed_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 655 692 38 attachment core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 694 802 97 bundle_from core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 804 812 9 role core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 814 886 73 assurance_policy core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/decode.rs 888 898 11 profile_refs core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/decode.rs 900 911 12 parsed_texts core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/decode.rs 913 965 53 anchor core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/decode.rs 967 1018 52 registries core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/decode.rs 1020 1030 11 checkpoints core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1032 1051 20 status_trust core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1056 1083 28 status_scope core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1085 1115 31 principal_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1117 1140 24 grant_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1171 1202 32 verifier_limits core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1204 1282 79 context_from core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1284 1290 7 ensure_complete core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1298 1310 13 decode_bundle core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1318 1333 16 decode_grant_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1341 1356 16 decode_signed_grant core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1364 1379 16 decode_signed_action core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1387 1402 16 decode_action_envelope core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1410 1425 16 decode_principal_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1433 1448 16 decode_signed_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1456 1471 16 decode_grant_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1479 1494 16 decode_signed_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1502 1517 16 decode_principal_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1525 1540 16 decode_grant_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1548 1597 50 decode_canonical_action core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1599 1625 27 assurance_claim core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1627 1637 11 evidence_ids core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1639 1666 28 assurance_report core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1668 1686 19 assurance_satisfaction core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1688 1703 16 verification_resources core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1712 1845 134 decode_verification_result core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/decode.rs 1853 1867 15 decode_verifier_context core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 27 29 3 encode_error core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 31 33 3 length core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1032 1051 20 status_trust core/crates/auths-codec decoding 0 0 1 1 1 3 +core/crates/auths-codec/src/decode.rs 1053 1067 15 status_trust_rule core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 1072 1108 37 status_scope core/crates/auths-codec decoding 0 0 1 1 1 12 +core/crates/auths-codec/src/decode.rs 1110 1112 3 status_scope_anchor core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 1114 1144 31 principal_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1146 1169 24 grant_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1200 1231 32 verifier_limits core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1233 1311 79 context_from core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1313 1319 7 ensure_complete core/crates/auths-codec decoding 0 0 1 1 1 1 +core/crates/auths-codec/src/decode.rs 1327 1339 13 decode_bundle core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1347 1362 16 decode_grant_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1370 1385 16 decode_signed_grant core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1393 1408 16 decode_signed_action core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1416 1431 16 decode_action_envelope core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1439 1454 16 decode_principal_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1462 1477 16 decode_signed_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1485 1500 16 decode_grant_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1508 1523 16 decode_signed_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1531 1546 16 decode_principal_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1554 1569 16 decode_grant_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1577 1604 27 attachment_batch_step core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 1606 1622 17 attachment_batch core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/decode.rs 1630 1668 39 decode_canonical_action core/crates/auths-codec decoding 0 0 1 1 1 12 +core/crates/auths-codec/src/decode.rs 1670 1694 25 assurance_claim core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1696 1706 11 evidence_ids core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1708 1735 28 assurance_report core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1737 1755 19 assurance_satisfaction core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1757 1772 16 verification_resources core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1781 1912 132 decode_verification_result core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/decode.rs 1920 1934 15 decode_verifier_context core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 27 29 3 encode_error core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 31 33 3 length core/crates/auths-codec decoding 0 0 1 0 1 0 core/crates/auths-codec/src/encode.rs 35 41 7 finish core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 43 46 4 map core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 48 51 4 array core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 53 56 4 key core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 58 61 4 text core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 63 66 4 bytes core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 68 75 8 encode_profile_ref core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 77 84 8 encode_permission core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 43 46 4 map core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 48 51 4 array core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 53 56 4 key core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 58 61 4 text core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 63 66 4 bytes core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 68 75 8 encode_profile_ref core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 77 84 8 encode_permission core/crates/auths-codec decoding 0 0 1 0 1 0 core/crates/auths-codec/src/encode.rs 86 95 10 encode_permission_set core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/encode.rs 97 118 22 encode_status_policy core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 120 127 8 encode_budget core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 129 139 11 encode_optional_budget core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 120 127 8 encode_budget core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 129 139 11 encode_optional_budget core/crates/auths-codec decoding 0 0 1 0 1 0 core/crates/auths-codec/src/encode.rs 141 170 30 encode_constraint core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/encode.rs 172 182 11 encode_extension core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/encode.rs 184 193 10 encode_extensions core/crates/auths-codec decoding 0 0 0 0 0 0 @@ -159,84 +200,89 @@ core/crates/auths-codec/src/encode.rs 287 294 8 encode_signed_grant_to core/crat core/crates/auths-codec/src/encode.rs 301 303 3 encode_signed_grant core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/encode.rs 305 364 60 encode_action_envelope_to core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/encode.rs 371 373 3 encode_action_envelope core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 380 404 25 encode_canonical_action core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 406 429 24 encode_assurance_claim core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 431 441 11 encode_role core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 443 469 27 encode_assurance_report core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 471 490 20 encode_assurance_satisfaction core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 492 516 25 encode_verification_resources core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 518 610 93 encode_verification_result_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 617 621 5 encode_verification_result core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 628 632 5 encode_verification_result_digest_input core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 634 644 11 encode_signed_action_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 651 653 3 encode_signed_action core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 655 701 47 encode_authorization_plan_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 708 710 3 encode_authorization_plan core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 712 726 15 encode_evidence core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 728 740 13 encode_evidence_content_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 742 744 3 encode_evidence_content core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 746 775 30 encode_statement_ref core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 777 787 11 encode_binding core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 789 824 36 encode_principal_status_statement_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 831 835 5 encode_principal_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 837 847 11 encode_signed_principal_status_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 855 859 5 encode_signed_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 861 896 36 encode_grant_status_statement_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 903 907 5 encode_grant_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 909 919 11 encode_signed_grant_status_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 927 929 3 encode_signed_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 931 968 38 encode_attachment core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 970 977 8 sorted_grants core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 979 988 10 sorted_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 990 999 10 sorted_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1001 1081 71 encode_bundle_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1088 1090 3 encode_bundle core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1092 1103 12 encode_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1110 1118 9 encode_grant_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1125 1133 9 encode_action_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1140 1148 9 encode_principal_status_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1155 1163 9 encode_grant_status_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1165 1226 62 encode_assurance_policy core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1228 1275 48 encode_anchor core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1277 1287 11 encode_registry_ids core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1289 1333 45 encode_registries core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1335 1352 18 encode_status_trust core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1354 1378 25 encode_status_scope core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1380 1409 30 encode_principal_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1411 1440 30 encode_grant_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1447 1451 5 encode_principal_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1458 1460 3 encode_grant_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1462 1520 59 encode_limits core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1522 1546 25 encode_composition_requirement core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1548 1593 46 encode_verifier_context_to core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/encode.rs 1600 1602 3 encode_verifier_context core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/error.rs 24 26 3 CodecError::from core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/error.rs 30 39 10 CodecError::fmt core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 51 55 5 raw_sha256 core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 67 82 16 domain_commitment core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 90 92 3 transaction_binding core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 94 103 10 domain_hash core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 105 130 26 signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 137 142 6 grant_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 149 154 6 action_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 161 166 6 plan_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 173 178 6 evidence_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 185 192 8 principal_status_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 199 204 6 grant_status_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 208 210 3 body_digest core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 214 216 3 attachment_digest core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 223 225 3 proof_digest core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 232 237 6 context_digest core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 245 251 7 verification_result_digest core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 258 268 11 grant_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 275 285 11 action_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 292 302 11 principal_status_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 309 319 11 grant_status_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 329 339 11 observation_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 346 353 8 observation_requirement_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 360 367 8 approval_requirement_id core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 377 388 12 approval_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-codec/src/hash.rs 395 399 5 approval_digest core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 380 400 21 encode_canonical_action core/crates/auths-codec decoding 0 0 1 1 1 2 +core/crates/auths-codec/src/encode.rs 402 413 12 encode_canonical_attachment core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/encode.rs 415 438 24 encode_assurance_claim core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 440 450 11 encode_role core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 452 478 27 encode_assurance_report core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 480 499 20 encode_assurance_satisfaction core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 501 525 25 encode_verification_resources core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 527 619 93 encode_verification_result_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 626 630 5 encode_verification_result core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 637 641 5 encode_verification_result_digest_input core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 643 653 11 encode_signed_action_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 660 662 3 encode_signed_action core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 664 710 47 encode_authorization_plan_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 717 719 3 encode_authorization_plan core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 721 735 15 encode_evidence core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 737 749 13 encode_evidence_content_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 751 753 3 encode_evidence_content core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 755 784 30 encode_statement_ref core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 786 796 11 encode_binding core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 798 833 36 encode_principal_status_statement_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 840 844 5 encode_principal_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 846 856 11 encode_signed_principal_status_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 864 868 5 encode_signed_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 870 905 36 encode_grant_status_statement_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 912 916 5 encode_grant_status_statement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 918 928 11 encode_signed_grant_status_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 936 938 3 encode_signed_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 940 971 32 encode_attachment core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 973 980 8 sorted_grants core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 982 991 10 sorted_principal_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 993 1002 10 sorted_grant_status core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1004 1084 71 encode_bundle_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1091 1093 3 encode_bundle core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1095 1106 12 encode_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1113 1121 9 encode_grant_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1128 1136 9 encode_action_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1143 1151 9 encode_principal_status_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1158 1166 9 encode_grant_status_signing_input core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1168 1229 62 encode_assurance_policy core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1231 1278 48 encode_anchor core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1280 1290 11 encode_registry_ids core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1292 1336 45 encode_registries core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1338 1355 18 encode_status_trust core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1357 1381 25 encode_status_scope core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1383 1412 30 encode_principal_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1414 1443 30 encode_grant_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1450 1454 5 encode_principal_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1461 1463 3 encode_grant_status_snapshot core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1465 1523 59 encode_limits core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1525 1549 25 encode_composition_requirement core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1551 1596 46 encode_verifier_context_to core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/encode.rs 1603 1605 3 encode_verifier_context core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/error.rs 23 25 3 limit_error core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/error.rs 28 30 3 CodecError::from core/crates/auths-codec decoding 0 0 1 0 1 0 +core/crates/auths-codec/src/error.rs 34 43 10 CodecError::fmt core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 51 53 3 raw_sha256 core/crates/auths-codec decoding 0 0 1 1 1 3 +core/crates/auths-codec/src/hash.rs 65 67 3 domain_commitment core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 69 75 4 preimage_buffer core/crates/auths-codec decoding 0 0 1 1 1 3 +core/crates/auths-codec/src/hash.rs 77 98 22 commitment_preimage core/crates/auths-codec decoding 0 0 1 1 1 10 +core/crates/auths-codec/src/hash.rs 106 108 3 transaction_binding core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 110 115 6 domain_hash core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 117 134 18 identifier_preimage core/crates/auths-codec decoding 0 0 1 1 1 8 +core/crates/auths-codec/src/hash.rs 136 165 30 signing_preimage core/crates/auths-codec decoding 0 0 1 1 1 11 +core/crates/auths-codec/src/hash.rs 172 177 6 grant_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 184 189 6 action_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 196 201 6 plan_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 208 213 6 evidence_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 220 227 8 principal_status_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 234 239 6 grant_status_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 243 245 3 body_digest core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 249 251 3 attachment_digest core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 258 260 3 proof_digest core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 267 272 6 context_digest core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 280 286 7 verification_result_digest core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 293 303 11 grant_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 310 320 11 action_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 327 337 11 principal_status_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 344 354 11 grant_status_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 364 374 11 observation_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 381 388 8 observation_requirement_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 395 402 8 approval_requirement_id core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 412 423 12 approval_signing_preimage core/crates/auths-codec decoding 0 0 0 0 0 0 +core/crates/auths-codec/src/hash.rs 430 434 5 approval_digest core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/observation.rs 32 41 10 encode_fact_value core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/observation.rs 43 62 20 fact_value core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/observation.rs 64 66 3 fact_name core/crates/auths-codec decoding 0 0 0 0 0 0 @@ -259,14 +305,16 @@ core/crates/auths-codec/src/observation.rs 419 455 37 encode_observer_anchors co core/crates/auths-codec/src/observation.rs 457 501 45 observer_anchors core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/observation.rs 503 516 14 encode_observation_satisfactions core/crates/auths-codec decoding 0 0 0 0 0 0 core/crates/auths-codec/src/observation.rs 518 532 15 observation_satisfactions core/crates/auths-codec decoding 0 0 0 0 0 0 -core/crates/auths-composition/src/lib.rs 48 52 5 EvaluationEvent::outcome core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 59 65 7 evaluate_threshold_counts core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 73 79 7 evaluate core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 93 102 10 evaluate_observed core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 104 208 105 evaluate_node core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 210 226 17 observe_aggregate core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 228 230 3 canonical_denial core/crates/auths-composition decision 1 0 1 0 0 0 0 -core/crates/auths-composition/src/lib.rs 232 237 6 canonical_requirement core/crates/auths-composition decision 1 0 1 0 0 0 0 +core/crates/auths-composition/src/lib.rs 54 58 5 EvaluationEvent::outcome core/crates/auths-composition decision 1 0 1 1 1 1 1 +core/crates/auths-composition/src/lib.rs 65 71 7 evaluate_threshold_counts core/crates/auths-composition decision 1 0 1 1 0 1 0 +core/crates/auths-composition/src/lib.rs 79 85 7 evaluate core/crates/auths-composition decision 1 0 1 1 1 1 5 +core/crates/auths-composition/src/lib.rs 99 110 12 evaluate_observed core/crates/auths-composition decision 1 0 1 1 1 1 10 +core/crates/auths-composition/src/lib.rs 112 124 13 evaluate_members core/crates/auths-composition decision 1 0 1 1 0 1 0 +core/crates/auths-composition/src/lib.rs 126 171 46 evaluate_node core/crates/auths-composition decision 1 0 1 1 1 1 9 +core/crates/auths-composition/src/lib.rs 173 189 17 observe_aggregate core/crates/auths-composition decision 1 0 1 1 0 1 0 +core/crates/auths-composition/src/summary.rs 13 38 26 push core/crates/auths-composition decision 1 0 1 1 1 1 1 +core/crates/auths-composition/src/summary.rs 40 48 9 all core/crates/auths-composition decision 1 0 1 1 1 1 1 +core/crates/auths-composition/src/summary.rs 50 62 13 threshold core/crates/auths-composition decision 1 0 1 1 1 1 2 core/crates/auths-model/src/approval.rs 53 67 15 ApprovalRequirement::new core/crates/auths-model decision 1 0 1 0 0 0 0 core/crates/auths-model/src/approval.rs 71 73 3 ApprovalRequirement::approvers core/crates/auths-model decision 1 0 1 0 0 0 0 core/crates/auths-model/src/approval.rs 77 79 3 ApprovalRequirement::threshold core/crates/auths-model decision 1 0 1 0 0 0 0 @@ -333,407 +381,415 @@ core/crates/auths-model/src/bounded_policy.rs 162 164 3 BoundedPolicyCommitment: core/crates/auths-model/src/bounded_policy.rs 169 171 3 BoundedPolicyCommitment::parent core/crates/auths-model decision 1 0 1 0 0 0 0 core/crates/auths-model/src/bounded_policy.rs 177 179 3 digest_equal core/crates/auths-model decision 1 0 1 1 1 1 1 core/crates/auths-model/src/bounded_policy.rs 188 199 12 bounded_policy_link_accepts core/crates/auths-model decision 1 0 1 1 1 1 1 -core/crates/auths-model/src/lib.rs 98 104 7 ProtocolVersion::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 107 109 3 ProtocolVersion::get core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 112 122 11 parse_bounded core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 124 126 3 byte_slices_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 142 144 3 name::parse core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 147 149 3 name::as_str core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 153 155 3 name::fmt core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 172 189 18 PrincipalId::parse core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 193 195 3 PrincipalId::as_str core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 201 203 3 principal_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 206 208 3 PrincipalId::fmt core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 254 256 3 Digest::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 259 261 3 Digest::as_bytes core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 271 273 3 name::new core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 276 278 3 name::from_digest core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 281 283 3 name::digest core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 286 288 3 name::as_bytes core/crates/auths-model decision 1 1 0 1 0 1 0 -core/crates/auths-model/src/lib.rs 292 294 3 name::from core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 298 300 3 Digest::from core/crates/auths-model decision 1 1 0 0 0 0 0 -core/crates/auths-model/src/lib.rs 331 333 3 Challenge::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 337 339 3 Challenge::as_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 343 345 3 Challenge::eq core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 351 353 3 Challenge::hash core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 361 363 3 Timestamp::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 366 368 3 Timestamp::get core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 384 392 9 ValidityWindow::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 395 397 3 ValidityWindow::not_before core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 400 402 3 ValidityWindow::expires_at core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 405 407 3 ValidityWindow::contains core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 410 417 8 ValidityWindow::contains_window core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 423 430 8 inclusive_window_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 435 442 8 validity_window_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 457 462 6 ProfileRef::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 465 467 3 ProfileRef::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 470 472 3 ProfileRef::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 478 480 3 profile_ref_equal core/crates/auths-model decision 1 0 1 1 1 1 1 -core/crates/auths-model/src/lib.rs 485 494 10 profile_slice_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 499 501 3 assurance_policy_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 506 508 3 grant_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 513 519 7 optional_grant_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 529 534 6 Permission::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 537 539 3 Permission::capability core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 542 544 3 Permission::resource core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 547 550 4 permissions_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 562 569 8 PermissionSet::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 572 574 3 PermissionSet::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 577 579 3 PermissionSet::contains core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 582 584 3 PermissionSet::is_subset_of core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 590 599 10 permission_set_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 604 613 10 permission_set_is_subset core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 618 620 3 audiences_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 629 636 8 AudienceSet::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 639 641 3 AudienceSet::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 644 646 3 AudienceSet::contains core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 649 651 3 AudienceSet::is_subset_of core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 657 666 10 audience_set_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 671 680 10 audience_set_is_subset core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 686 688 3 digests_equal core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 697 704 8 BodyDigestSet::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 708 710 3 BodyDigestSet::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 714 716 3 BodyDigestSet::contains core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 720 722 3 BodyDigestSet::is_subset_of core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 728 737 10 body_digest_set_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 742 751 10 body_digest_set_is_subset core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 760 769 10 body_digest_set_only_contains core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 789 791 3 ActionConstraint::allowed_body_digests core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 794 796 3 ActionConstraint::allows core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 799 801 3 ActionConstraint::attenuates core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 804 810 7 ActionConstraint::allowed_digests core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 816 822 7 action_constraint_allows core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 827 847 21 action_constraint_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 857 859 3 BudgetCeiling::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 862 864 3 BudgetCeiling::algebra core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 867 869 3 BudgetCeiling::value core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 872 874 3 BudgetCeiling::attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 878 880 3 BudgetCeiling::covers core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 886 889 4 budget_ceiling_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 896 905 10 optional_budget_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 917 926 10 optional_budget_covers core/crates/auths-model decision 1 0 1 1 1 1 1 -core/crates/auths-model/src/lib.rs 964 974 10 budget_ceiling_covers_action core/crates/auths-model decision 1 0 1 1 1 1 3 -core/crates/auths-model/src/lib.rs 986 992 7 FreshnessLimit::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 996 998 3 FreshnessLimit::get core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1018 1020 3 StatusPolicy::attenuates core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1026 1044 19 status_policy_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 1059 1064 6 CriticalExtension::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1067 1069 3 CriticalExtension::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1072 1074 3 CriticalExtension::bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1088 1100 13 CriticalExtensions::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1103 1105 3 CriticalExtensions::empty core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1108 1110 3 CriticalExtensions::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1129 1141 13 critical_extension_find core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 1146 1148 3 critical_extension_entries core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 1153 1155 3 critical_extension_id core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 1160 1162 3 critical_extension_payload core/crates/auths-model decision 1 0 1 1 0 1 0 -core/crates/auths-model/src/lib.rs 1173 1183 11 SignatureDescriptor::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1186 1188 3 SignatureDescriptor::principal_method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1191 1193 3 SignatureDescriptor::verification_method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1196 1198 3 SignatureDescriptor::suite core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1211 1216 6 SignatureBytes::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1219 1221 3 SignatureBytes::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1232 1237 6 SignatureEnvelope::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1240 1242 3 SignatureEnvelope::descriptor core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1245 1247 3 SignatureEnvelope::signature core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1271 1302 32 GrantStatement::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1305 1307 3 GrantStatement::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1309 1311 3 GrantStatement::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1313 1315 3 GrantStatement::subject core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1317 1319 3 GrantStatement::profile core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1321 1323 3 GrantStatement::permissions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1325 1327 3 GrantStatement::validity core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1329 1331 3 GrantStatement::audiences core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1333 1335 3 GrantStatement::action_constraint core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1337 1339 3 GrantStatement::budget_ceiling core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1341 1343 3 GrantStatement::remaining_depth core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1345 1347 3 GrantStatement::parent core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1349 1351 3 GrantStatement::status_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1353 1355 3 GrantStatement::assurance_floor core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1357 1359 3 GrantStatement::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1405 1418 14 scope_authority_view core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1423 1439 17 grant_authority_view core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1449 1454 6 SignedGrant::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1457 1459 3 SignedGrant::statement core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1462 1464 3 SignedGrant::signature core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1490 1525 36 ActionEnvelope::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1528 1530 3 ActionEnvelope::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1532 1534 3 ActionEnvelope::profile core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1536 1538 3 ActionEnvelope::body_media_type core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1540 1542 3 ActionEnvelope::canonical_body_digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1544 1546 3 ActionEnvelope::permission core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1548 1550 3 ActionEnvelope::requested_budget core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1552 1554 3 ActionEnvelope::audience core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1556 1558 3 ActionEnvelope::challenge core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1560 1562 3 ActionEnvelope::validity core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1564 1566 3 ActionEnvelope::actor core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1568 1570 3 ActionEnvelope::terminal_grant core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1572 1574 3 ActionEnvelope::authorization_plan core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1576 1578 3 ActionEnvelope::channel_binding core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1580 1582 3 ActionEnvelope::proof_ref core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1585 1587 3 ActionEnvelope::attachments core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1589 1591 3 ActionEnvelope::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1611 1622 12 action_authority_view core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1647 1665 19 CanonicalAction::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1674 1694 21 CanonicalAction::with_detached_attachments core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1698 1700 3 CanonicalAction::profile core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1704 1706 3 CanonicalAction::media_type core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1710 1712 3 CanonicalAction::body core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1716 1718 3 CanonicalAction::permission core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1722 1724 3 CanonicalAction::requested_budget core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1728 1730 3 CanonicalAction::detached_attachments core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1741 1746 6 SignedAction::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1749 1751 3 SignedAction::envelope core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1754 1756 3 SignedAction::signature core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1796 1798 3 AuthorizationPlan::proof core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1807 1809 3 AuthorizationPlan::all_of core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1818 1820 3 AuthorizationPlan::any_of core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1830 1832 3 AuthorizationPlan::k_of_n core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1834 1844 11 AuthorizationPlan::compound core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1848 1857 10 AuthorizationPlan::as_ref core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1866 1917 51 AuthorizationPlan::validate core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1867 1908 42 AuthorizationPlan::walk core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1928 1930 3 PlanShape::leaves core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1934 1936 3 PlanShape::maximum_depth core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1954 1969 16 EvidenceObject::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1972 1974 3 EvidenceObject::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1976 1978 3 EvidenceObject::evidence_type core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1980 1982 3 EvidenceObject::media_type core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 1984 1986 3 EvidenceObject::bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2010 2022 13 ControlBinding::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2025 2027 3 ControlBinding::statement core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2029 2031 3 ControlBinding::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2077 2101 25 PrincipalStatusStatement::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2104 2106 3 PrincipalStatusStatement::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2109 2111 3 PrincipalStatusStatement::method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2113 2115 3 PrincipalStatusStatement::principal core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2117 2119 3 PrincipalStatusStatement::state core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2121 2123 3 PrincipalStatusStatement::sequence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2125 2127 3 PrincipalStatusStatement::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2129 2131 3 PrincipalStatusStatement::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2133 2135 3 PrincipalStatusStatement::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2137 2139 3 PrincipalStatusStatement::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2150 2155 6 SignedPrincipalStatus::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2157 2159 3 SignedPrincipalStatus::statement core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2161 2163 3 SignedPrincipalStatus::signature core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2192 2216 25 GrantStatusStatement::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2219 2221 3 GrantStatusStatement::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2224 2226 3 GrantStatusStatement::method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2228 2230 3 GrantStatusStatement::grant_id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2232 2234 3 GrantStatusStatement::state core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2236 2238 3 GrantStatusStatement::sequence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2240 2242 3 GrantStatusStatement::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2244 2246 3 GrantStatusStatement::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2248 2250 3 GrantStatusStatement::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2252 2254 3 GrantStatusStatement::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2265 2270 6 SignedGrantStatus::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2272 2274 3 SignedGrantStatus::statement core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2276 2278 3 SignedGrantStatus::signature core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2292 2301 10 StatusScopeAnchors::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2305 2307 3 StatusScopeAnchors::ids core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2311 2313 3 StatusScopeAnchors::contains core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2335 2341 7 StatusScope::covers core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2353 2362 10 status_issuer_in_scope core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2379 2391 13 status_issuer_visible core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2406 2418 13 StatusTrustRule::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2422 2424 3 StatusTrustRule::scope core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2428 2430 3 StatusTrustRule::method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2434 2436 3 StatusTrustRule::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2440 2442 3 StatusTrustRule::sequence_floor core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2465 2480 16 PrincipalStatusSnapshot::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2491 2544 54 PrincipalStatusSnapshot::with_trust core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2548 2550 3 PrincipalStatusSnapshot::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2554 2556 3 PrincipalStatusSnapshot::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2560 2562 3 PrincipalStatusSnapshot::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2566 2568 3 PrincipalStatusSnapshot::statements core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2572 2574 3 PrincipalStatusSnapshot::checkpoints core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2578 2580 3 PrincipalStatusSnapshot::trust core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2603 2618 16 GrantStatusSnapshot::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2626 2679 54 GrantStatusSnapshot::with_trust core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2683 2685 3 GrantStatusSnapshot::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2689 2691 3 GrantStatusSnapshot::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2695 2697 3 GrantStatusSnapshot::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2701 2703 3 GrantStatusSnapshot::statements core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2707 2709 3 GrantStatusSnapshot::checkpoints core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2713 2715 3 GrantStatusSnapshot::trust core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2752 2770 19 AttachmentDescriptor::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2772 2774 3 AttachmentDescriptor::digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2776 2778 3 AttachmentDescriptor::media_type core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2780 2782 3 AttachmentDescriptor::byte_length core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2784 2786 3 AttachmentDescriptor::disposition core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2788 2790 3 AttachmentDescriptor::confidentiality core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2793 2795 3 AttachmentDescriptor::presence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2798 2800 3 AttachmentDescriptor::opacity core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2817 2822 6 DetachedAttachment::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2826 2828 3 DetachedAttachment::digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2832 2834 3 DetachedAttachment::bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2851 2856 6 BundleHeader::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2860 2865 6 BundleHeader::v1 core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2869 2871 3 BundleHeader::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2875 2877 3 BundleHeader::flags core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2898 2919 22 CompositionRequirement::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2923 2930 8 CompositionRequirement::exact core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2934 2936 3 CompositionRequirement::expected_plan core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2940 2942 3 CompositionRequirement::minimum_authorized_branches core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2946 2948 3 CompositionRequirement::minimum_distinct_actors core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2952 2954 3 CompositionRequirement::minimum_distinct_roots core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 2982 3033 52 ProofBundle::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3045 3051 7 ProofBundle::with_approvals core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3054 3056 3 ProofBundle::version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3058 3060 3 ProofBundle::header core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3062 3064 3 ProofBundle::grants core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3066 3068 3 ProofBundle::actions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3070 3072 3 ProofBundle::plan core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3074 3076 3 ProofBundle::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3078 3080 3 ProofBundle::bindings core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3082 3084 3 ProofBundle::principal_status core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3086 3088 3 ProofBundle::grant_status core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3090 3092 3 ProofBundle::attachments core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3094 3096 3 ProofBundle::canonical_body core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3099 3101 3 ProofBundle::approvals core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3138 3160 23 AssuranceClaim::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3163 3165 3 AssuranceClaim::kind core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3167 3169 3 AssuranceClaim::parameters core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3171 3173 3 AssuranceClaim::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3175 3177 3 AssuranceClaim::source core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3197 3220 24 ParticipantAssurance::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3223 3225 3 ParticipantAssurance::principal core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3227 3229 3 ParticipantAssurance::role core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3231 3233 3 ParticipantAssurance::claims core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3235 3237 3 ParticipantAssurance::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3239 3241 3 ParticipantAssurance::adapter core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3243 3245 3 ParticipantAssurance::adapter_version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3262 3278 17 AssuranceRequirement::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3288 3318 31 AssuranceRequirement::constrained core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3320 3322 3 AssuranceRequirement::role core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3325 3327 3 AssuranceRequirement::quantifier core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3329 3331 3 AssuranceRequirement::claim_kind core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3334 3336 3 AssuranceRequirement::parameters core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3339 3341 3 AssuranceRequirement::source core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3344 3346 3 AssuranceRequirement::adapter core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3349 3351 3 AssuranceRequirement::adapter_version core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3353 3355 3 AssuranceRequirement::maximum_age core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3371 3381 11 AssurancePolicy::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3383 3385 3 AssurancePolicy::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3387 3389 3 AssurancePolicy::requirements core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3404 3416 13 AssuranceSatisfaction::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3420 3422 3 AssuranceSatisfaction::requirement_index core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3426 3428 3 AssuranceSatisfaction::principal core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3432 3434 3 AssuranceSatisfaction::claim core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3438 3440 3 AssuranceSatisfaction::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3467 3509 43 TrustAnchor::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3512 3514 3 TrustAnchor::id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3516 3518 3 TrustAnchor::principal core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3520 3522 3 TrustAnchor::accepted_methods core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3524 3526 3 TrustAnchor::profiles core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3528 3530 3 TrustAnchor::permissions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3532 3534 3 TrustAnchor::resource_namespaces core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3536 3538 3 TrustAnchor::audiences core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3540 3542 3 TrustAnchor::validity core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3545 3547 3 TrustAnchor::budget_ceiling core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3549 3551 3 TrustAnchor::max_delegation_depth core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3553 3555 3 TrustAnchor::assurance_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3557 3559 3 TrustAnchor::status_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3632 3665 34 VerifierLimits::default_deployment core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3668 3701 34 VerifierLimits::hard core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3709 3743 35 VerifierLimits::with_limit core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3751 3755 5 VerifierLimits::with_work_units core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3759 3791 33 VerifierLimits::get core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3795 3797 3 VerifierLimits::max_work_units core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3806 3842 37 VerifierLimits::validate core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3846 3848 3 VerifierLimits::default core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3851 3861 11 canonical_registry_ids core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3891 3935 42 AcceptedRegistries::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3950 3967 18 AcceptedRegistries::with_budget_free_profiles core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3971 3973 3 AcceptedRegistries::manifest_id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3977 3979 3 AcceptedRegistries::principal_methods core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3983 3985 3 AcceptedRegistries::signature_suites core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3989 3991 3 AcceptedRegistries::evidence_types core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 3995 3997 3 AcceptedRegistries::principal_status_methods core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4001 4003 3 AcceptedRegistries::grant_status_methods core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4007 4009 3 AcceptedRegistries::assurance_claims core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4013 4015 3 AcceptedRegistries::assurance_implications core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4019 4021 3 AcceptedRegistries::resource_matchers core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4025 4027 3 AcceptedRegistries::budget_algebras core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4031 4033 3 AcceptedRegistries::critical_extensions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4037 4039 3 AcceptedRegistries::profiles core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4043 4045 3 AcceptedRegistries::profile_policies core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4049 4051 3 AcceptedRegistries::accepts_principal_method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4055 4057 3 AcceptedRegistries::accepts_signature_suite core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4061 4063 3 AcceptedRegistries::accepts_evidence_type core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4067 4071 5 AcceptedRegistries::accepts_principal_status_method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4075 4077 3 AcceptedRegistries::accepts_grant_status_method core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4081 4083 3 AcceptedRegistries::accepts_assurance_claim core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4087 4091 5 AcceptedRegistries::accepts_assurance_implication core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4095 4097 3 AcceptedRegistries::accepts_resource_matcher core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4101 4103 3 AcceptedRegistries::accepts_budget_algebra core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4107 4109 3 AcceptedRegistries::accepts_critical_extension core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4113 4115 3 AcceptedRegistries::accepts_profile core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4119 4121 3 AcceptedRegistries::accepts_profile_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4125 4127 3 AcceptedRegistries::budget_free_profiles core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4136 4142 7 AcceptedRegistries::profile_budget_expression core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4146 4165 20 AcceptedRegistries::maximum_entry_count core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4171 4183 13 status_scopes_apply core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4214 4294 81 TrustedContext::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4307 4327 21 TrustedContext::with_observer_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4344 4385 42 TrustedContext::with_approvals core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4394 4421 28 TrustedContext::for_request core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4429 4454 26 TrustedContext::with_composition core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4461 4486 26 TrustedContext::with_configuration core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4494 4516 23 TrustedContext::with_limits core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4520 4522 3 TrustedContext::configuration core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4525 4527 3 TrustedContext::composition core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4529 4531 3 TrustedContext::trust_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4533 4535 3 TrustedContext::accepted_registries core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4537 4539 3 TrustedContext::expected_audience core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4541 4543 3 TrustedContext::expected_challenge core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4545 4547 3 TrustedContext::evaluation_time core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4549 4551 3 TrustedContext::assurance_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4553 4555 3 TrustedContext::principal_status_snapshot core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4557 4559 3 TrustedContext::grant_status_snapshot core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4561 4563 3 TrustedContext::resource_matcher core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4565 4567 3 TrustedContext::profile_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4569 4571 3 TrustedContext::channel_policy core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4573 4575 3 TrustedContext::limits core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4578 4580 3 TrustedContext::observer_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4583 4585 3 TrustedContext::approver_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4588 4593 6 TrustedContext::approver_anchor core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4596 4598 3 TrustedContext::approval_requirements core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4630 4636 7 VerificationCode::code core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4655 4673 19 VerificationResources::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4676 4678 3 VerificationResources::proof_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4680 4682 3 VerificationResources::action_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4684 4686 3 VerificationResources::context_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4688 4690 3 VerificationResources::object_count core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4692 4694 3 VerificationResources::plan_leaves core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4696 4698 3 VerificationResources::plan_depth core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4700 4702 3 VerificationResources::work_units core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4732 4767 36 PortableVerificationResult::new core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4772 4780 9 PortableVerificationResult::with_observation_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4785 4793 9 PortableVerificationResult::with_approval_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4797 4800 4 PortableVerificationResult::with_result_digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4803 4805 3 PortableVerificationResult::decision core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4807 4809 3 PortableVerificationResult::stage core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4811 4813 3 PortableVerificationResult::code core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4815 4817 3 PortableVerificationResult::proof_digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4819 4821 3 PortableVerificationResult::action_digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4823 4825 3 PortableVerificationResult::context_digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4827 4829 3 PortableVerificationResult::plan_id core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4831 4833 3 PortableVerificationResult::result_digest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4835 4837 3 PortableVerificationResult::authorized_branches core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4839 4841 3 PortableVerificationResult::assurance core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4843 4845 3 PortableVerificationResult::assurance_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4847 4849 3 PortableVerificationResult::resources core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4851 4853 3 PortableVerificationResult::registry_manifest core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4858 4860 3 PortableVerificationResult::required_configuration core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4863 4865 3 PortableVerificationResult::local_configuration core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4868 4870 3 PortableVerificationResult::observation_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4873 4875 3 PortableVerificationResult::approval_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4931 4980 50 DenialReason::code core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 4984 5035 52 DenialReason::from_code core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 5066 5090 25 Requirement::code core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 5094 5120 27 Requirement::from_code core/crates/auths-model decision 1 0 1 0 0 0 0 -core/crates/auths-model/src/lib.rs 5170 5215 46 ModelError::fmt core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/identifier.rs 9 21 13 forbidden_three_byte_prefix core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/identifier.rs 23 42 20 forbidden_identifier_at core/crates/auths-model decision 1 0 1 1 1 1 1 +core/crates/auths-model/src/identifier.rs 44 53 10 contains_forbidden_identifier core/crates/auths-model decision 1 0 1 1 1 1 1 +core/crates/auths-model/src/identifier.rs 55 57 3 bounded_identifier_valid core/crates/auths-model decision 1 0 1 1 1 1 3 +core/crates/auths-model/src/identifier.rs 63 69 7 principal_scheme_byte_valid core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/identifier.rs 73 91 19 principal_scheme_valid core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 99 105 7 ProtocolVersion::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 108 110 3 ProtocolVersion::get core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 113 115 3 byte_slices_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 131 136 6 name::parse core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 139 141 3 name::as_str core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 145 147 3 name::fmt core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 164 171 8 PrincipalId::parse core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 175 177 3 PrincipalId::as_str core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 183 185 3 principal_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 188 190 3 PrincipalId::fmt core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 236 238 3 Digest::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 241 243 3 Digest::as_bytes core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 253 255 3 name::new core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 258 260 3 name::from_digest core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 263 265 3 name::digest core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 268 270 3 name::as_bytes core/crates/auths-model decision 1 1 0 1 0 1 0 +core/crates/auths-model/src/lib.rs 274 276 3 name::from core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 280 282 3 Digest::from core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 313 315 3 Challenge::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 319 321 3 Challenge::as_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 325 327 3 Challenge::eq core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 333 335 3 Challenge::hash core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 343 345 3 Timestamp::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 348 350 3 Timestamp::get core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 366 374 9 ValidityWindow::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 377 379 3 ValidityWindow::not_before core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 382 384 3 ValidityWindow::expires_at core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 387 389 3 ValidityWindow::contains core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 392 399 8 ValidityWindow::contains_window core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 405 412 8 inclusive_window_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 417 424 8 validity_window_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 439 444 6 ProfileRef::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 447 449 3 ProfileRef::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 452 454 3 ProfileRef::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 460 462 3 profile_ref_equal core/crates/auths-model decision 1 0 1 1 1 1 1 +core/crates/auths-model/src/lib.rs 467 476 10 profile_slice_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 481 483 3 assurance_policy_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 488 490 3 grant_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 495 501 7 optional_grant_id_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 511 516 6 Permission::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 519 521 3 Permission::capability core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 524 526 3 Permission::resource core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 529 532 4 permissions_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 544 551 8 PermissionSet::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 554 556 3 PermissionSet::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 559 561 3 PermissionSet::contains core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 564 566 3 PermissionSet::is_subset_of core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 572 581 10 permission_set_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 586 595 10 permission_set_is_subset core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 600 602 3 audiences_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 611 618 8 AudienceSet::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 621 623 3 AudienceSet::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 626 628 3 AudienceSet::contains core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 631 633 3 AudienceSet::is_subset_of core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 639 648 10 audience_set_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 653 662 10 audience_set_is_subset core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 668 670 3 digests_equal core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 679 686 8 BodyDigestSet::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 690 692 3 BodyDigestSet::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 696 698 3 BodyDigestSet::contains core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 702 704 3 BodyDigestSet::is_subset_of core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 710 719 10 body_digest_set_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 724 733 10 body_digest_set_is_subset core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 742 751 10 body_digest_set_only_contains core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 771 773 3 ActionConstraint::allowed_body_digests core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 776 778 3 ActionConstraint::allows core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 781 783 3 ActionConstraint::attenuates core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 786 792 7 ActionConstraint::allowed_digests core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 798 804 7 action_constraint_allows core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 809 829 21 action_constraint_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 839 841 3 BudgetCeiling::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 844 846 3 BudgetCeiling::algebra core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 849 851 3 BudgetCeiling::value core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 854 856 3 BudgetCeiling::attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 860 862 3 BudgetCeiling::covers core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 868 871 4 budget_ceiling_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 878 887 10 optional_budget_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 899 908 10 optional_budget_covers core/crates/auths-model decision 1 0 1 1 1 1 1 +core/crates/auths-model/src/lib.rs 946 956 10 budget_ceiling_covers_action core/crates/auths-model decision 1 0 1 1 1 1 3 +core/crates/auths-model/src/lib.rs 968 974 7 FreshnessLimit::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 978 980 3 FreshnessLimit::get core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1000 1002 3 StatusPolicy::attenuates core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1008 1026 19 status_policy_attenuates core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 1041 1046 6 CriticalExtension::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1049 1051 3 CriticalExtension::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1054 1056 3 CriticalExtension::bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1070 1082 13 CriticalExtensions::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1085 1087 3 CriticalExtensions::empty core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1090 1092 3 CriticalExtensions::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1111 1123 13 critical_extension_find core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 1128 1130 3 critical_extension_entries core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 1135 1137 3 critical_extension_id core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 1142 1144 3 critical_extension_payload core/crates/auths-model decision 1 0 1 1 0 1 0 +core/crates/auths-model/src/lib.rs 1155 1165 11 SignatureDescriptor::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1168 1170 3 SignatureDescriptor::principal_method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1173 1175 3 SignatureDescriptor::verification_method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1178 1180 3 SignatureDescriptor::suite core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1193 1198 6 SignatureBytes::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1201 1203 3 SignatureBytes::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1214 1219 6 SignatureEnvelope::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1222 1224 3 SignatureEnvelope::descriptor core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1227 1229 3 SignatureEnvelope::signature core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1253 1284 32 GrantStatement::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1287 1289 3 GrantStatement::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1291 1293 3 GrantStatement::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1295 1297 3 GrantStatement::subject core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1299 1301 3 GrantStatement::profile core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1303 1305 3 GrantStatement::permissions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1307 1309 3 GrantStatement::validity core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1311 1313 3 GrantStatement::audiences core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1315 1317 3 GrantStatement::action_constraint core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1319 1321 3 GrantStatement::budget_ceiling core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1323 1325 3 GrantStatement::remaining_depth core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1327 1329 3 GrantStatement::parent core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1331 1333 3 GrantStatement::status_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1335 1337 3 GrantStatement::assurance_floor core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1339 1341 3 GrantStatement::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1387 1400 14 scope_authority_view core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1405 1421 17 grant_authority_view core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1431 1436 6 SignedGrant::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1439 1441 3 SignedGrant::statement core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1444 1446 3 SignedGrant::signature core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1472 1507 36 ActionEnvelope::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1510 1512 3 ActionEnvelope::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1514 1516 3 ActionEnvelope::profile core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1518 1520 3 ActionEnvelope::body_media_type core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1522 1524 3 ActionEnvelope::canonical_body_digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1526 1528 3 ActionEnvelope::permission core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1530 1532 3 ActionEnvelope::requested_budget core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1534 1536 3 ActionEnvelope::audience core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1538 1540 3 ActionEnvelope::challenge core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1542 1544 3 ActionEnvelope::validity core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1546 1548 3 ActionEnvelope::actor core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1550 1552 3 ActionEnvelope::terminal_grant core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1554 1556 3 ActionEnvelope::authorization_plan core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1558 1560 3 ActionEnvelope::channel_binding core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1562 1564 3 ActionEnvelope::proof_ref core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1567 1569 3 ActionEnvelope::attachments core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1571 1573 3 ActionEnvelope::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1593 1604 12 action_authority_view core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1622 1639 18 canonical_attachments_valid core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1648 1666 19 CanonicalAction::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1675 1692 17 CanonicalAction::with_detached_attachments core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1696 1698 3 CanonicalAction::profile core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1702 1704 3 CanonicalAction::media_type core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1708 1710 3 CanonicalAction::body core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1714 1716 3 CanonicalAction::permission core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1720 1722 3 CanonicalAction::requested_budget core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1726 1728 3 CanonicalAction::detached_attachments core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1739 1744 6 SignedAction::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1747 1749 3 SignedAction::envelope core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1752 1754 3 SignedAction::signature core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1794 1796 3 AuthorizationPlan::proof core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1805 1807 3 AuthorizationPlan::all_of core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1816 1818 3 AuthorizationPlan::any_of core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1828 1830 3 AuthorizationPlan::k_of_n core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1832 1857 26 AuthorizationPlan::compound core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1861 1870 10 AuthorizationPlan::as_ref core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1879 1945 63 AuthorizationPlan::validate core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1880 1891 12 AuthorizationPlan::walk_members core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1893 1930 38 AuthorizationPlan::walk core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1956 1958 3 PlanShape::leaves core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1962 1964 3 PlanShape::maximum_depth core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 1982 1997 16 EvidenceObject::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2000 2002 3 EvidenceObject::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2004 2006 3 EvidenceObject::evidence_type core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2008 2010 3 EvidenceObject::media_type core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2012 2014 3 EvidenceObject::bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2038 2050 13 ControlBinding::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2053 2055 3 ControlBinding::statement core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2057 2059 3 ControlBinding::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2105 2129 25 PrincipalStatusStatement::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2132 2134 3 PrincipalStatusStatement::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2137 2139 3 PrincipalStatusStatement::method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2141 2143 3 PrincipalStatusStatement::principal core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2145 2147 3 PrincipalStatusStatement::state core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2149 2151 3 PrincipalStatusStatement::sequence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2153 2155 3 PrincipalStatusStatement::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2157 2159 3 PrincipalStatusStatement::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2161 2163 3 PrincipalStatusStatement::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2165 2167 3 PrincipalStatusStatement::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2178 2183 6 SignedPrincipalStatus::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2185 2187 3 SignedPrincipalStatus::statement core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2189 2191 3 SignedPrincipalStatus::signature core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2220 2244 25 GrantStatusStatement::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2247 2249 3 GrantStatusStatement::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2252 2254 3 GrantStatusStatement::method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2256 2258 3 GrantStatusStatement::grant_id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2260 2262 3 GrantStatusStatement::state core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2264 2266 3 GrantStatusStatement::sequence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2268 2270 3 GrantStatusStatement::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2272 2274 3 GrantStatusStatement::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2276 2278 3 GrantStatusStatement::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2280 2282 3 GrantStatusStatement::extensions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2293 2298 6 SignedGrantStatus::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2300 2302 3 SignedGrantStatus::statement core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2304 2306 3 SignedGrantStatus::signature core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2320 2336 17 StatusScopeAnchors::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2340 2342 3 StatusScopeAnchors::ids core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2346 2348 3 StatusScopeAnchors::contains core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2370 2376 7 StatusScope::covers core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2388 2403 16 status_issuer_in_scope core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2420 2440 21 status_issuer_visible core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2455 2467 13 StatusTrustRule::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2471 2473 3 StatusTrustRule::scope core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2477 2479 3 StatusTrustRule::method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2483 2485 3 StatusTrustRule::issuer core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2489 2491 3 StatusTrustRule::sequence_floor core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2514 2529 16 PrincipalStatusSnapshot::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2540 2593 54 PrincipalStatusSnapshot::with_trust core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2597 2599 3 PrincipalStatusSnapshot::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2603 2605 3 PrincipalStatusSnapshot::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2609 2611 3 PrincipalStatusSnapshot::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2615 2617 3 PrincipalStatusSnapshot::statements core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2621 2623 3 PrincipalStatusSnapshot::checkpoints core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2627 2629 3 PrincipalStatusSnapshot::trust core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2652 2667 16 GrantStatusSnapshot::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2675 2728 54 GrantStatusSnapshot::with_trust core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2732 2734 3 GrantStatusSnapshot::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2738 2740 3 GrantStatusSnapshot::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2744 2746 3 GrantStatusSnapshot::valid_until core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2750 2752 3 GrantStatusSnapshot::statements core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2756 2758 3 GrantStatusSnapshot::checkpoints core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2762 2764 3 GrantStatusSnapshot::trust core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2801 2819 19 AttachmentDescriptor::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2821 2823 3 AttachmentDescriptor::digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2825 2827 3 AttachmentDescriptor::media_type core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2829 2831 3 AttachmentDescriptor::byte_length core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2833 2835 3 AttachmentDescriptor::disposition core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2837 2839 3 AttachmentDescriptor::confidentiality core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2842 2844 3 AttachmentDescriptor::presence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2847 2849 3 AttachmentDescriptor::opacity core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2866 2871 6 DetachedAttachment::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2875 2877 3 DetachedAttachment::digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2881 2883 3 DetachedAttachment::bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2900 2905 6 BundleHeader::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2909 2914 6 BundleHeader::v1 core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2918 2920 3 BundleHeader::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2924 2926 3 BundleHeader::flags core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2947 2968 22 CompositionRequirement::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2972 2979 8 CompositionRequirement::exact core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2983 2985 3 CompositionRequirement::expected_plan core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2989 2991 3 CompositionRequirement::minimum_authorized_branches core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 2995 2997 3 CompositionRequirement::minimum_distinct_actors core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3001 3003 3 CompositionRequirement::minimum_distinct_roots core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3031 3082 52 ProofBundle::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3094 3100 7 ProofBundle::with_approvals core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3103 3105 3 ProofBundle::version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3107 3109 3 ProofBundle::header core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3111 3113 3 ProofBundle::grants core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3115 3117 3 ProofBundle::actions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3119 3121 3 ProofBundle::plan core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3123 3125 3 ProofBundle::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3127 3129 3 ProofBundle::bindings core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3131 3133 3 ProofBundle::principal_status core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3135 3137 3 ProofBundle::grant_status core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3139 3141 3 ProofBundle::attachments core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3143 3145 3 ProofBundle::canonical_body core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3148 3150 3 ProofBundle::approvals core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3187 3209 23 AssuranceClaim::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3212 3214 3 AssuranceClaim::kind core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3216 3218 3 AssuranceClaim::parameters core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3220 3222 3 AssuranceClaim::observed_at core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3224 3226 3 AssuranceClaim::source core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3246 3269 24 ParticipantAssurance::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3272 3274 3 ParticipantAssurance::principal core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3276 3278 3 ParticipantAssurance::role core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3280 3282 3 ParticipantAssurance::claims core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3284 3286 3 ParticipantAssurance::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3288 3290 3 ParticipantAssurance::adapter core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3292 3294 3 ParticipantAssurance::adapter_version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3311 3327 17 AssuranceRequirement::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3337 3367 31 AssuranceRequirement::constrained core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3369 3371 3 AssuranceRequirement::role core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3374 3376 3 AssuranceRequirement::quantifier core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3378 3380 3 AssuranceRequirement::claim_kind core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3383 3385 3 AssuranceRequirement::parameters core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3388 3390 3 AssuranceRequirement::source core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3393 3395 3 AssuranceRequirement::adapter core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3398 3400 3 AssuranceRequirement::adapter_version core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3402 3404 3 AssuranceRequirement::maximum_age core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3420 3430 11 AssurancePolicy::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3432 3434 3 AssurancePolicy::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3436 3438 3 AssurancePolicy::requirements core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3453 3465 13 AssuranceSatisfaction::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3469 3471 3 AssuranceSatisfaction::requirement_index core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3475 3477 3 AssuranceSatisfaction::principal core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3481 3483 3 AssuranceSatisfaction::claim core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3487 3489 3 AssuranceSatisfaction::evidence core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3516 3558 43 TrustAnchor::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3561 3563 3 TrustAnchor::id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3565 3567 3 TrustAnchor::principal core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3569 3571 3 TrustAnchor::accepted_methods core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3573 3575 3 TrustAnchor::profiles core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3577 3579 3 TrustAnchor::permissions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3581 3583 3 TrustAnchor::resource_namespaces core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3585 3587 3 TrustAnchor::audiences core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3589 3591 3 TrustAnchor::validity core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3594 3596 3 TrustAnchor::budget_ceiling core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3598 3600 3 TrustAnchor::max_delegation_depth core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3602 3604 3 TrustAnchor::assurance_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3606 3608 3 TrustAnchor::status_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3681 3714 34 VerifierLimits::default_deployment core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3717 3750 34 VerifierLimits::hard core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3758 3792 35 VerifierLimits::with_limit core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3800 3804 5 VerifierLimits::with_work_units core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3808 3840 33 VerifierLimits::get core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3844 3846 3 VerifierLimits::max_work_units core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3855 3891 37 VerifierLimits::validate core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3895 3897 3 VerifierLimits::default core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3900 3910 11 canonical_registry_ids core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3940 3984 42 AcceptedRegistries::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 3999 4016 18 AcceptedRegistries::with_budget_free_profiles core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4020 4022 3 AcceptedRegistries::manifest_id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4026 4028 3 AcceptedRegistries::principal_methods core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4032 4034 3 AcceptedRegistries::signature_suites core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4038 4040 3 AcceptedRegistries::evidence_types core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4044 4046 3 AcceptedRegistries::principal_status_methods core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4050 4052 3 AcceptedRegistries::grant_status_methods core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4056 4058 3 AcceptedRegistries::assurance_claims core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4062 4064 3 AcceptedRegistries::assurance_implications core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4068 4070 3 AcceptedRegistries::resource_matchers core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4074 4076 3 AcceptedRegistries::budget_algebras core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4080 4082 3 AcceptedRegistries::critical_extensions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4086 4088 3 AcceptedRegistries::profiles core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4092 4094 3 AcceptedRegistries::profile_policies core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4098 4100 3 AcceptedRegistries::accepts_principal_method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4104 4106 3 AcceptedRegistries::accepts_signature_suite core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4110 4112 3 AcceptedRegistries::accepts_evidence_type core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4116 4120 5 AcceptedRegistries::accepts_principal_status_method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4124 4126 3 AcceptedRegistries::accepts_grant_status_method core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4130 4132 3 AcceptedRegistries::accepts_assurance_claim core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4136 4140 5 AcceptedRegistries::accepts_assurance_implication core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4144 4146 3 AcceptedRegistries::accepts_resource_matcher core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4150 4152 3 AcceptedRegistries::accepts_budget_algebra core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4156 4158 3 AcceptedRegistries::accepts_critical_extension core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4162 4164 3 AcceptedRegistries::accepts_profile core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4168 4170 3 AcceptedRegistries::accepts_profile_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4174 4176 3 AcceptedRegistries::budget_free_profiles core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4185 4191 7 AcceptedRegistries::profile_budget_expression core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4195 4214 20 AcceptedRegistries::maximum_entry_count core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4220 4232 13 status_scopes_apply core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4263 4343 81 TrustedContext::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4356 4376 21 TrustedContext::with_observer_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4393 4434 42 TrustedContext::with_approvals core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4443 4470 28 TrustedContext::for_request core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4478 4503 26 TrustedContext::with_composition core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4510 4535 26 TrustedContext::with_configuration core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4543 4565 23 TrustedContext::with_limits core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4569 4571 3 TrustedContext::configuration core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4574 4576 3 TrustedContext::composition core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4578 4580 3 TrustedContext::trust_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4582 4584 3 TrustedContext::accepted_registries core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4586 4588 3 TrustedContext::expected_audience core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4590 4592 3 TrustedContext::expected_challenge core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4594 4596 3 TrustedContext::evaluation_time core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4598 4600 3 TrustedContext::assurance_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4602 4604 3 TrustedContext::principal_status_snapshot core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4606 4608 3 TrustedContext::grant_status_snapshot core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4610 4612 3 TrustedContext::resource_matcher core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4614 4616 3 TrustedContext::profile_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4618 4620 3 TrustedContext::channel_policy core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4622 4624 3 TrustedContext::limits core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4627 4629 3 TrustedContext::observer_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4632 4634 3 TrustedContext::approver_anchors core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4637 4642 6 TrustedContext::approver_anchor core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4645 4647 3 TrustedContext::approval_requirements core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4679 4685 7 VerificationCode::code core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4704 4722 19 VerificationResources::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4725 4727 3 VerificationResources::proof_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4729 4731 3 VerificationResources::action_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4733 4735 3 VerificationResources::context_bytes core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4737 4739 3 VerificationResources::object_count core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4741 4743 3 VerificationResources::plan_leaves core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4745 4747 3 VerificationResources::plan_depth core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4749 4751 3 VerificationResources::work_units core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4781 4816 36 PortableVerificationResult::new core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4821 4829 9 PortableVerificationResult::with_observation_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4834 4842 9 PortableVerificationResult::with_approval_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4846 4849 4 PortableVerificationResult::with_result_digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4852 4854 3 PortableVerificationResult::decision core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4856 4858 3 PortableVerificationResult::stage core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4860 4862 3 PortableVerificationResult::code core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4864 4866 3 PortableVerificationResult::proof_digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4868 4870 3 PortableVerificationResult::action_digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4872 4874 3 PortableVerificationResult::context_digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4876 4878 3 PortableVerificationResult::plan_id core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4880 4882 3 PortableVerificationResult::result_digest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4884 4886 3 PortableVerificationResult::authorized_branches core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4888 4890 3 PortableVerificationResult::assurance core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4892 4894 3 PortableVerificationResult::assurance_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4896 4898 3 PortableVerificationResult::resources core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4900 4902 3 PortableVerificationResult::registry_manifest core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4907 4909 3 PortableVerificationResult::required_configuration core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4912 4914 3 PortableVerificationResult::local_configuration core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4917 4919 3 PortableVerificationResult::observation_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4922 4924 3 PortableVerificationResult::approval_satisfactions core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 4983 4985 3 code core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 4993 4995 3 code_precedes core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 4997 4999 3 code_order core/crates/auths-model decision 1 1 0 0 0 0 0 +core/crates/auths-model/src/lib.rs 5058 5109 52 DenialReason::from_code core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 5164 5190 27 Requirement::from_code core/crates/auths-model decision 1 0 1 0 0 0 0 +core/crates/auths-model/src/lib.rs 5240 5285 46 ModelError::fmt core/crates/auths-model decision 1 0 1 0 0 0 0 core/crates/auths-model/src/observation.rs 57 59 3 fact_name_equal core/crates/auths-model decision 1 0 1 1 1 1 1 core/crates/auths-model/src/observation.rs 71 76 6 FactBytes::new core/crates/auths-model decision 1 0 1 0 0 0 0 core/crates/auths-model/src/observation.rs 79 81 3 FactBytes::as_slice core/crates/auths-model decision 1 0 1 0 0 0 0 @@ -842,8 +898,11 @@ core/crates/auths-ports/src/lib.rs 161 163 3 ControlEvidence::work_units core/cr core/crates/auths-ports/src/lib.rs 168 170 3 ControlEvidence::signature_message core/crates/auths-ports interface 0 0 0 0 0 0 core/crates/auths-ports/src/lib.rs 231 243 13 PrincipalMethod::evaluate_control core/crates/auths-ports interface 0 0 0 0 0 0 core/crates/auths-ports/src/lib.rs 356 363 8 ProfilePolicy::action_fact core/crates/auths-ports interface 0 0 0 0 0 0 -core/crates/auths-ports/src/lib.rs 552 564 13 PrincipalControlError::fmt core/crates/auths-ports interface 0 0 0 0 0 0 -core/crates/auths-ports/src/lib.rs 579 585 7 SignatureError::fmt core/crates/auths-ports interface 0 0 0 0 0 0 +core/crates/auths-ports/src/lib.rs 464 469 6 StatusEvaluation::new core/crates/auths-ports interface 0 0 0 0 0 0 +core/crates/auths-ports/src/lib.rs 473 475 3 StatusEvaluation::decision core/crates/auths-ports interface 0 0 0 0 0 0 +core/crates/auths-ports/src/lib.rs 479 481 3 StatusEvaluation::valid_through core/crates/auths-ports interface 0 0 0 0 0 0 +core/crates/auths-ports/src/lib.rs 586 598 13 PrincipalControlError::fmt core/crates/auths-ports interface 0 0 0 0 0 0 +core/crates/auths-ports/src/lib.rs 613 619 7 SignatureError::fmt core/crates/auths-ports interface 0 0 0 0 0 0 core/crates/auths-ports/src/path.rs 34 44 11 CertificateDer::new core/crates/auths-ports interface 0 0 0 0 0 0 core/crates/auths-ports/src/path.rs 48 50 3 CertificateDer::as_bytes core/crates/auths-ports interface 0 0 0 0 0 0 core/crates/auths-ports/src/path.rs 67 77 11 ExtendedKeyUsage::from_der_content core/crates/auths-ports interface 0 0 0 0 0 0 @@ -904,37 +963,38 @@ core/crates/auths-registries/src/lib.rs 427 429 3 ExactClaimRule::id core/crates core/crates/auths-registries/src/lib.rs 431 433 3 ExactClaimRule::configuration_id core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/lib.rs 435 437 3 ExactClaimRule::maximum_work_units core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/lib.rs 439 445 7 ExactClaimRule::validate core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 453 470 18 ExactStatusMethod::freshness core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 453 470 18 ExactStatusMethod::freshness core/crates/auths-registries decision 1 0 1 1 1 1 1 core/crates/auths-registries/src/lib.rs 474 476 3 ExactStatusMethod::id core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/lib.rs 478 480 3 ExactStatusMethod::configuration_id core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/lib.rs 482 484 3 ExactStatusMethod::maximum_work_units core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 486 513 28 ExactStatusMethod::principal core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 515 542 28 ExactStatusMethod::grant core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 545 613 69 select_principal core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 615 683 69 select_grant core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 704 714 11 PureRegistrySet::empty core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 730 777 48 CoreSemantics::new core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 783 914 132 verifier_configuration_id core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 932 941 10 ImmutableRegistries::new core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 949 1010 62 ImmutableRegistries::with_pure core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1014 1016 3 ImmutableRegistries::manifest_id core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1021 1023 3 ImmutableRegistries::configuration_id core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1027 1038 12 ImmutableRegistries::principal_method core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1042 1053 12 ImmutableRegistries::signature_suite core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1057 1073 17 ImmutableRegistries::resource_matcher core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1077 1093 17 ImmutableRegistries::profile_policy core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1097 1113 17 ImmutableRegistries::budget_algebra core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1117 1142 26 ImmutableRegistries::extension_handler core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1147 1155 9 ImmutableRegistries::extension_laws core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1159 1185 27 ImmutableRegistries::status_method core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1189 1209 21 ImmutableRegistries::assurance_claim core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1213 1226 14 ImmutableRegistries::assurance_implications core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1240 1255 16 AcceptedExtensionLaws::maximum_work_units core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1259 1263 5 AcceptedExtensionLaws::attenuates core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1283 1291 9 CoreExtensionLaws::target_v1 core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1295 1308 14 CoreExtensionLaws::attenuates core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1311 1319 9 reject_duplicates core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-registries/src/lib.rs 1331 1336 6 RegistryError::fmt core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 486 502 17 ExactStatusMethod::principal core/crates/auths-registries decision 1 0 1 1 1 1 16 +core/crates/auths-registries/src/lib.rs 504 520 17 ExactStatusMethod::grant core/crates/auths-registries decision 1 0 1 1 1 1 5 +core/crates/auths-registries/src/lib.rs 524 539 16 status_sequence_floor core/crates/auths-registries decision 1 0 1 1 1 1 1 +core/crates/auths-registries/src/lib.rs 541 640 98 select_principal_from_snapshot core/crates/auths-registries decision 1 0 1 1 1 1 2 +core/crates/auths-registries/src/lib.rs 642 739 96 select_grant_from_snapshot core/crates/auths-registries decision 1 0 1 1 1 1 2 +core/crates/auths-registries/src/lib.rs 760 770 11 PureRegistrySet::empty core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 786 833 48 CoreSemantics::new core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 839 970 132 verifier_configuration_id core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 988 997 10 ImmutableRegistries::new core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1005 1066 62 ImmutableRegistries::with_pure core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1070 1072 3 ImmutableRegistries::manifest_id core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1077 1079 3 ImmutableRegistries::configuration_id core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1083 1094 12 ImmutableRegistries::principal_method core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1098 1109 12 ImmutableRegistries::signature_suite core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1113 1129 17 ImmutableRegistries::resource_matcher core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1133 1149 17 ImmutableRegistries::profile_policy core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1153 1169 17 ImmutableRegistries::budget_algebra core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1173 1198 26 ImmutableRegistries::extension_handler core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1203 1211 9 ImmutableRegistries::extension_laws core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1215 1241 27 ImmutableRegistries::status_method core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1245 1265 21 ImmutableRegistries::assurance_claim core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1269 1282 14 ImmutableRegistries::assurance_implications core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1296 1311 16 AcceptedExtensionLaws::maximum_work_units core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1315 1319 5 AcceptedExtensionLaws::attenuates core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1339 1347 9 CoreExtensionLaws::target_v1 core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1351 1364 14 CoreExtensionLaws::attenuates core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1367 1375 9 reject_duplicates core/crates/auths-registries decision 1 0 1 0 0 0 0 +core/crates/auths-registries/src/lib.rs 1387 1392 6 RegistryError::fmt core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/template.rs 60 100 41 TrustedContextTemplate::new core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/template.rs 113 128 16 TrustedContextTemplate::with_approvals core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/template.rs 132 135 4 TrustedContextTemplate::with_principal_status core/crates/auths-registries decision 1 0 1 0 0 0 0 @@ -946,18 +1006,58 @@ core/crates/auths-registries/src/template.rs 167 170 4 TrustedContextTemplate::a core/crates/auths-registries/src/template.rs 181 184 4 TrustedContextTemplate::declare_budget_free_profile core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/template.rs 192 271 80 TrustedContextTemplate::compile core/crates/auths-registries decision 1 0 1 0 0 0 0 core/crates/auths-registries/src/template.rs 278 282 5 sorted_unique core/crates/auths-registries decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 71 77 7 limit_or_malformed core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 81 106 26 chain_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 109 119 11 context_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 125 139 15 binds_exact core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 144 150 7 classify core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 156 181 26 Approvals::new core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 185 213 29 Approvals::evaluate_list core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 216 221 6 Approvals::get core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 224 241 18 Approvals::satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 243 318 76 Approvals::evaluate core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 324 362 39 signature_verdict core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/approval.rs 367 423 57 status_verdict core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-signature-core/src/lib.rs 17 39 21 ed25519_point_encoding_is_canonical core/crates/auths-signature-core crypto 0 0 1 1 1 7 +core/crates/auths-signature-core/src/lib.rs 42 47 6 p256_key_encoding_is_canonical core/crates/auths-signature-core crypto 0 0 1 1 1 5 +core/crates/auths-signature-core/src/lib.rs 55 69 15 p256_signature_is_low_s core/crates/auths-signature-core crypto 0 0 1 1 1 10 +core/crates/auths-signature-core/src/lib.rs 71 83 13 ed25519_same_coordinate core/crates/auths-signature-core crypto 0 0 1 1 1 2 +core/crates/auths-signature-core/src/lib.rs 110 116 7 ed25519_has_small_order_coordinate core/crates/auths-signature-core crypto 0 0 1 1 1 3 +core/crates/auths-signature-core/src/lib.rs 118 124 7 ed25519_signature_r_is_allowed core/crates/auths-signature-core crypto 0 0 1 1 1 3 +core/crates/auths-signature-core/src/lib.rs 138 144 7 Ed25519Error::fmt core/crates/auths-signature-core crypto 0 0 0 0 0 0 +core/crates/auths-signature-core/src/lib.rs 162 168 7 P256Error::fmt core/crates/auths-signature-core crypto 0 0 0 0 0 0 +core/crates/auths-signature-core/src/lib.rs 178 180 3 validate_ed25519_key core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 182 190 9 ed25519_key_encoding core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 192 201 10 decode_ed25519_key_with core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 203 205 3 decode_ed25519_point core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 211 213 3 decode_ed25519_key core/crates/auths-signature-core crypto 0 0 1 0 1 0 +core/crates/auths-signature-core/src/lib.rs 215 242 28 verify_ed25519_with core/crates/auths-signature-core crypto 0 0 1 1 1 2 +core/crates/auths-signature-core/src/lib.rs 244 247 4 verify_ed25519_equation core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 261 273 13 verify_ed25519 core/crates/auths-signature-core crypto 0 0 1 1 1 6 +core/crates/auths-signature-core/src/lib.rs 286 291 6 validate_p256_key core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 306 308 3 NativeP256::decode core/crates/auths-signature-core crypto 0 0 1 0 1 0 +core/crates/auths-signature-core/src/lib.rs 309 311 3 NativeP256::parse core/crates/auths-signature-core crypto 0 0 1 0 1 0 +core/crates/auths-signature-core/src/lib.rs 312 314 3 NativeP256::verify core/crates/auths-signature-core crypto 0 0 1 0 1 0 +core/crates/auths-signature-core/src/lib.rs 320 328 9 decode_p256_key_with core/crates/auths-signature-core crypto 0 0 1 1 1 2 +core/crates/auths-signature-core/src/lib.rs 330 332 3 decode_p256_point core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 334 336 3 decode_p256_key core/crates/auths-signature-core crypto 0 0 1 0 1 0 +core/crates/auths-signature-core/src/lib.rs 338 340 3 parse_p256_signature core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 342 344 3 verify_p256_equation core/crates/auths-signature-core crypto 0 0 1 1 1 1 +core/crates/auths-signature-core/src/lib.rs 346 369 22 verify_p256_sha256_with core/crates/auths-signature-core crypto 0 0 1 1 1 2 +core/crates/auths-signature-core/src/lib.rs 381 387 7 verify_p256_sha256 core/crates/auths-signature-core crypto 0 0 1 1 1 8 +core/crates/auths-signature/src/lib.rs 26 30 5 Ed25519Suite::new core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 34 36 3 Ed25519Suite::id core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 38 40 3 Ed25519Suite::configuration_id core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 42 44 3 Ed25519Suite::validate_key core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 46 57 12 Ed25519Suite::verify core/crates/auths-signature crypto 0 0 1 1 1 4 +core/crates/auths-signature/src/lib.rs 59 61 3 Ed25519Suite::work_units core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 76 80 5 P256Sha256Suite::new core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 84 86 3 P256Sha256Suite::id core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 88 90 3 P256Sha256Suite::configuration_id core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 92 94 3 P256Sha256Suite::validate_key core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-signature/src/lib.rs 96 107 12 P256Sha256Suite::verify core/crates/auths-signature crypto 0 0 1 1 1 4 +core/crates/auths-signature/src/lib.rs 109 111 3 P256Sha256Suite::work_units core/crates/auths-signature crypto 0 0 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 72 78 7 limit_or_malformed core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 82 107 26 chain_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 110 120 11 context_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 126 140 15 binds_exact core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 145 151 7 classify core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 157 182 26 Approvals::new core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 186 214 29 Approvals::evaluate_list core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 217 222 6 Approvals::get core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 225 242 18 Approvals::satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 247 255 9 Approvals::valid_through core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 257 338 82 Approvals::evaluate core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 344 382 39 signature_verdict core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/approval.rs 387 454 68 status_verdict core/crates/auths-verifier decision 1 0 1 0 0 0 0 core/crates/auths-verifier/src/causal.rs 33 100 65 causal_slice core/crates/auths-verifier explanation 0 0 0 0 0 0 core/crates/auths-verifier/src/causal.rs 102 135 34 classify core/crates/auths-verifier explanation 0 0 0 0 0 0 core/crates/auths-verifier/src/causal.rs 137 171 35 plan_child_contribution core/crates/auths-verifier explanation 0 0 0 0 0 0 @@ -979,92 +1079,95 @@ core/crates/auths-verifier/src/lib.rs 245 247 3 ResolvedProof::decoded core/crat core/crates/auths-verifier/src/lib.rs 251 253 3 ResolvedProof::plan_id core/crates/auths-verifier decision 1 0 1 0 0 0 0 core/crates/auths-verifier/src/lib.rs 274 276 3 ControlVerifiedProof::resolved core/crates/auths-verifier decision 1 0 1 0 0 0 0 core/crates/auths-verifier/src/lib.rs 280 282 3 ControlVerifiedProof::work_units core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 333 335 3 SealedVerificationResult::portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 339 341 3 SealedVerificationResult::cbor core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 345 347 3 SealedVerificationResult::action core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 351 359 9 SealedVerificationResult::into_parts core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 365 367 3 VerifiedAction::canonical_action core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 371 373 3 VerifiedAction::proof_digest core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 377 379 3 VerifiedAction::context_digest core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 383 385 3 VerifiedAction::plan_id core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 390 392 3 VerifiedAction::action_ids core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 397 399 3 VerifiedAction::authorized_branches core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 403 405 3 VerifiedAction::assurance core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 409 411 3 VerifiedAction::assurance_satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 416 418 3 VerifiedAction::observation_satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 424 426 3 VerifiedAction::approval_satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 430 432 3 VerifiedAction::work_units core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 437 450 14 verify core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 460 478 19 verify_explained core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 480 487 8 failure_code core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 489 569 81 failure_fact_kind core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 571 607 37 record_configuration_facts core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 609 629 21 record_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 632 790 156 verify_internal core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 792 800 9 branch_fact_result core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 802 810 9 branch_verification_code core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 812 866 55 record_plan_events core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 868 954 87 record_composition_decision core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 966 979 14 verify_v1 core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 987 1043 57 verify_v1_sealed core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1049 1056 8 verify_portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1059 1246 187 verify_portable_sealed core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1250 1255 3 infallible_encoding core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1257 1267 11 seal_portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1270 1308 39 portable_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1310 1313 4 finalize_portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1321 1331 11 decode_proof core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1339 1441 98 resolve_proof core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1443 1458 16 require_expected_plan core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1467 1571 104 verify_principal_control core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1573 1619 47 verify_status_controls core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1628 1753 124 verify_authority_measured core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1758 1776 19 evaluate_context_approvals core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1780 1794 15 bind_verified_action core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1796 1811 16 codec_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1813 1825 13 principal_status_records core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1827 1839 13 grant_status_records core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1841 1856 16 statement_exists core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1858 1878 21 resolve_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1880 1892 13 reject_duplicate_attachments core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1902 1952 51 validate_carried_status core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 1955 1992 38 verify_signed core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2000 2065 66 evaluate_signature core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2067 2089 23 bound_evidence core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2091 2118 28 control_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2120 2122 3 signature_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2124 2204 81 validate_action_binding core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2206 2296 91 validate_attachments core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2298 2314 17 same_shared_action core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2326 2375 49 verify_branch core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2389 2487 96 verify_branch_from_anchor core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2491 2532 42 delegate_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2534 2558 25 evaluate_branch_assurance core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2560 2568 9 action_or_first_method core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2570 2588 19 branch_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2590 2606 17 control_for core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2608 2622 15 participant_report core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2624 2650 27 evaluate_extensions core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2661 2680 20 check_status_extensions core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2698 2744 47 check_principal_status core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2747 2786 40 check_grant_status core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2788 2812 25 status_decision core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2814 2847 34 validate_resource_constraints core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2849 2915 61 validate_budget_constraints core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2917 2933 17 validate_assurance_claims core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/lib.rs 2935 2944 10 registry_operation_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 48 54 7 limit_or_malformed core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 58 76 19 validate_observation_attachments core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 80 104 25 chain_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 111 132 22 require_parent_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 137 179 43 Stage::evaluate core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 181 188 8 Stage::in_authority_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 190 214 25 Stage::candidates core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 218 277 60 Stage::requirement core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 285 318 34 Stage::action_facts core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 320 357 38 Stage::eligible core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 359 384 26 Stage::subject_in_namespaces core/crates/auths-verifier decision 1 0 1 0 0 0 0 -core/crates/auths-verifier/src/observation.rs 389 458 70 Stage::authentic core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 335 337 3 SealedVerificationResult::portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 341 343 3 SealedVerificationResult::cbor core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 347 349 3 SealedVerificationResult::action core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 353 361 9 SealedVerificationResult::into_parts core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 372 374 3 VerifiedAction::authority_not_after core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 378 380 3 VerifiedAction::canonical_action core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 384 386 3 VerifiedAction::proof_digest core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 390 392 3 VerifiedAction::context_digest core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 396 398 3 VerifiedAction::plan_id core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 403 405 3 VerifiedAction::action_ids core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 410 412 3 VerifiedAction::authorized_branches core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 416 418 3 VerifiedAction::assurance core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 422 424 3 VerifiedAction::assurance_satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 429 431 3 VerifiedAction::observation_satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 437 439 3 VerifiedAction::approval_satisfactions core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 443 445 3 VerifiedAction::work_units core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 450 463 14 verify core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 473 491 19 verify_explained core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 493 500 8 failure_code core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 502 582 81 failure_fact_kind core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 584 620 37 record_configuration_facts core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 622 642 21 record_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 645 803 156 verify_internal core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 805 813 9 branch_fact_result core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 815 823 9 branch_verification_code core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 825 879 55 record_plan_events core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 881 967 87 record_composition_decision core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 979 992 14 verify_v1 core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1000 1056 57 verify_v1_sealed core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1062 1069 8 verify_portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1072 1259 187 verify_portable_sealed core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1263 1268 3 infallible_encoding core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1270 1280 11 seal_portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1283 1321 39 portable_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1323 1326 4 finalize_portable core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1334 1344 11 decode_proof core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1352 1454 98 resolve_proof core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1456 1471 16 require_expected_plan core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1480 1584 104 verify_principal_control core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1586 1632 47 verify_status_controls core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1641 1770 128 verify_authority_measured core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1775 1793 19 evaluate_context_approvals core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1797 1812 16 bind_verified_action core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1814 1829 16 codec_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1831 1843 13 principal_status_records core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1845 1857 13 grant_status_records core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1859 1874 16 statement_exists core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1876 1896 21 resolve_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1898 1910 13 reject_duplicate_attachments core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1920 1970 51 validate_carried_status core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 1973 2010 38 verify_signed core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2018 2083 66 evaluate_signature core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2085 2107 23 bound_evidence core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2109 2136 28 control_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2138 2140 3 signature_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2142 2222 81 validate_action_binding core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2224 2314 91 validate_attachments core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2316 2332 17 same_shared_action core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2345 2394 49 verify_branch core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2408 2515 105 verify_branch_from_anchor core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2519 2560 42 delegate_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2562 2586 25 evaluate_branch_assurance core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2589 2615 27 assurance_horizon core/crates/auths-verifier decision 1 0 1 1 1 1 4 +core/crates/auths-verifier/src/lib.rs 2617 2625 9 action_or_first_method core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2627 2645 19 branch_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2647 2663 17 control_for core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2665 2679 15 participant_report core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2681 2707 27 evaluate_extensions core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2718 2737 20 check_status_extensions core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2755 2802 48 check_principal_status core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2805 2845 41 check_grant_status core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2848 2857 10 status_horizon core/crates/auths-verifier decision 1 0 1 1 1 1 5 +core/crates/auths-verifier/src/lib.rs 2859 2883 25 status_decision core/crates/auths-verifier decision 1 0 1 1 1 1 4 +core/crates/auths-verifier/src/lib.rs 2885 2918 34 validate_resource_constraints core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2920 2986 61 validate_budget_constraints core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 2988 3004 17 validate_assurance_claims core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/lib.rs 3006 3015 10 registry_operation_failure core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 54 60 7 limit_or_malformed core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 64 82 19 validate_observation_attachments core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 86 110 25 chain_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 117 138 22 require_parent_requirements core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 143 189 47 Stage::evaluate core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 191 198 8 Stage::in_authority_chain core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 200 224 25 Stage::candidates core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 228 297 70 Stage::requirement core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 305 338 34 Stage::action_facts core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 340 377 38 Stage::eligible core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 379 404 26 Stage::subject_in_namespaces core/crates/auths-verifier decision 1 0 1 0 0 0 0 +core/crates/auths-verifier/src/observation.rs 409 478 70 Stage::authentic core/crates/auths-verifier decision 1 0 1 0 0 0 0 core/crates/auths-verifier/src/trace.rs 58 102 45 FactKind::code core/crates/auths-verifier explanation 0 0 0 0 0 0 core/crates/auths-verifier/src/trace.rs 149 151 3 FactEvaluation::sequence core/crates/auths-verifier explanation 0 0 0 0 0 0 core/crates/auths-verifier/src/trace.rs 154 156 3 FactEvaluation::stage core/crates/auths-verifier explanation 0 0 0 0 0 0 @@ -1082,6 +1185,10 @@ core/crates/auths-verifier/src/trace.rs 245 255 11 TraceCollector::record core/c core/crates/auths-verifier/src/trace.rs 258 290 33 TraceCollector::record_with_parents core/crates/auths-verifier explanation 0 0 0 0 0 0 core/crates/auths-verifier/src/trace.rs 292 296 5 TraceCollector::set_final_node core/crates/auths-verifier explanation 0 0 0 0 0 0 core/crates/auths-verifier/src/trace.rs 298 305 8 TraceCollector::finish core/crates/auths-verifier explanation 0 0 0 0 0 0 +formal/qualification/aeneas/entrypoints/profile_construction.rs 5 10 6 construct extraction-selector:auths_profile_construction interface 0 0 1 0 0 0 +formal/qualification/aeneas/entrypoints/profile_construction.rs 13 17 5 parse_provider extraction-selector:auths_profile_construction interface 0 0 1 0 0 0 +formal/qualification/aeneas/entrypoints/profile_construction.rs 20 24 5 parse_alias extraction-selector:auths_profile_construction interface 0 0 1 0 0 0 +formal/qualification/aeneas/entrypoints/profile_construction.rs 27 31 5 parse_semantic extraction-selector:auths_profile_construction interface 0 0 1 0 0 0 product/policy/auths-bounded-policy/src/arithmetic.rs 16 18 3 UnitQuantity::new product/policy/auths-bounded-policy decision 1 0 1 0 0 0 0 product/policy/auths-bounded-policy/src/arithmetic.rs 22 24 3 UnitQuantity::unit product/policy/auths-bounded-policy decision 1 0 1 0 0 0 0 product/policy/auths-bounded-policy/src/arithmetic.rs 28 30 3 UnitQuantity::amount product/policy/auths-bounded-policy decision 1 0 1 0 0 0 0 @@ -1162,14 +1269,15 @@ product/policy/auths-bounded-policy/src/kernel.rs 108 123 16 ceiling_count_tight product/policy/auths-bounded-policy/src/kernel.rs 128 130 3 window_index product/policy/auths-bounded-policy decision 1 0 1 1 1 1 1 product/policy/auths-bounded-policy/src/kernel.rs 137 149 13 chain_counts_admit product/policy/auths-bounded-policy decision 1 0 1 1 1 1 1 product/policy/auths-bounded-policy/src/kernel.rs 157 174 18 chain_sums_admit product/policy/auths-bounded-policy decision 1 0 1 1 1 1 1 -product/policy/auths-bounded-policy/src/kernel.rs 214 226 13 bytes_equal product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 230 239 10 values_contain product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 243 252 10 values_subset product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 256 258 3 values_narrow product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 267 278 12 partition_narrows product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 284 295 12 sum_tightens product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 300 308 9 scope_tightens product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 -product/policy/auths-bounded-policy/src/kernel.rs 314 332 19 argument_policy_tightens product/policy/auths-bounded-policy decision 1 0 1 1 1 1 1 +product/policy/auths-bounded-policy/src/kernel.rs 192 210 19 reservation_admission product/policy/auths-bounded-policy decision 1 0 1 1 1 1 5 +product/policy/auths-bounded-policy/src/kernel.rs 250 262 13 bytes_equal product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 266 275 10 values_contain product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 279 288 10 values_subset product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 292 294 3 values_narrow product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 303 314 12 partition_narrows product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 320 331 12 sum_tightens product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 336 344 9 scope_tightens product/policy/auths-bounded-policy decision 1 0 1 1 0 1 0 +product/policy/auths-bounded-policy/src/kernel.rs 350 368 19 argument_policy_tightens product/policy/auths-bounded-policy decision 1 0 1 1 1 1 1 product/policy/auths-bounded-policy/src/lib.rs 75 77 3 CommitmentDigest::new product/policy/auths-bounded-policy decision 1 0 1 0 0 0 0 product/policy/auths-bounded-policy/src/lib.rs 81 83 3 CommitmentDigest::as_bytes product/policy/auths-bounded-policy decision 1 0 1 0 0 0 0 product/policy/auths-bounded-policy/src/lib.rs 93 95 3 VerifierTime::from_unix_seconds product/policy/auths-bounded-policy decision 1 0 1 0 0 0 0 @@ -1248,11 +1356,26 @@ product/runtime/auths-connections/src/credential.rs 1176 1198 23 write_persisten product/runtime/auths-connections/src/credential.rs 1206 1209 4 EncodedLength::write_all product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/credential.rs 1212 1306 95 decode_persistent_entries product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/credential.rs 1337 1348 12 credential_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/kernel.rs 29 31 3 next_generation product/runtime/auths-connections decision 0 0 1 1 1 1 -product/runtime/auths-connections/src/kernel.rs 36 44 9 state_change product/runtime/auths-connections decision 0 0 1 1 1 1 -product/runtime/auths-connections/src/kernel.rs 49 57 9 rotation product/runtime/auths-connections decision 0 0 1 1 1 1 -product/runtime/auths-connections/src/kernel.rs 62 75 14 retained_generation product/runtime/auths-connections decision 0 0 1 1 1 1 -product/runtime/auths-connections/src/kernel.rs 86 101 16 lease_generation product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 28 30 3 next_generation product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 35 43 9 state_change product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 48 56 9 rotation product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 61 74 14 retained_generation product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 85 100 16 lease_generation product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 106 108 3 lower_tail_valid product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 116 133 18 lower_token_valid product/runtime/auths-connections decision 0 0 1 1 1 3 +product/runtime/auths-connections/src/kernel.rs 141 154 14 ascii_graphic_valid product/runtime/auths-connections decision 0 0 1 1 1 3 +product/runtime/auths-connections/src/kernel.rs 160 164 5 semantic_head_valid product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 165 172 8 semantic_tail_valid product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 176 191 16 semantic_id_valid product/runtime/auths-connections decision 0 0 1 1 1 4 +product/runtime/auths-connections/src/kernel.rs 202 220 19 recovery_lease product/runtime/auths-connections decision 0 0 1 1 1 3 +product/runtime/auths-connections/src/kernel.rs 237 258 22 recovery_binding_requirement product/runtime/auths-connections decision 0 0 1 1 1 3 +product/runtime/auths-connections/src/kernel.rs 263 282 20 state_transition_allows product/runtime/auths-connections decision 0 0 1 1 1 2 +product/runtime/auths-connections/src/kernel.rs 287 296 10 record_change_allows product/runtime/auths-connections decision 0 0 1 1 1 2 +product/runtime/auths-connections/src/kernel.rs 302 317 16 record_times_valid product/runtime/auths-connections decision 0 0 1 1 1 3 +product/runtime/auths-connections/src/kernel.rs 323 336 14 strictly_sorted_unique product/runtime/auths-connections decision 0 0 1 1 1 4 +product/runtime/auths-connections/src/kernel.rs 342 354 13 workloads_valid product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 359 361 3 profiles_valid product/runtime/auths-connections decision 0 0 1 1 1 1 +product/runtime/auths-connections/src/kernel.rs 370 388 19 validate_record_shape product/runtime/auths-connections decision 0 0 1 1 1 2 product/runtime/auths-connections/src/lib.rs 69 80 12 ValidatedConnectionDescriptor::from_adapter product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/lib.rs 84 86 3 ValidatedConnectionDescriptor::bytes product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/lib.rs 90 92 3 ValidatedConnectionDescriptor::account_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 @@ -1260,77 +1383,75 @@ product/runtime/auths-connections/src/lib.rs 108 117 10 ProviderCredentialLease: product/runtime/auths-connections/src/lib.rs 124 129 6 ProviderCredentialLease::expose product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/lib.rs 133 135 3 ProviderCredentialLease::fmt product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/lib.rs 139 141 3 ProviderCredentialLease::drop product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 28 34 7 ProviderKind::parse product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 28 34 7 ProviderKind::parse product/runtime/auths-connections decision 0 0 1 1 1 2 product/runtime/auths-connections/src/model.rs 38 40 3 ProviderKind::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 53 59 7 ConnectionAlias::parse product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 53 59 7 ConnectionAlias::parse product/runtime/auths-connections decision 0 0 1 1 1 2 product/runtime/auths-connections/src/model.rs 63 65 3 ConnectionAlias::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 78 90 13 SemanticId::parse product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 94 96 3 SemanticId::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 110 117 8 ConnectionId::generate product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 124 136 13 ConnectionId::parse product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 140 142 3 ConnectionId::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 146 151 6 ConnectionId::fmt product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 167 172 6 ConnectionProfile::new product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 176 178 3 ConnectionProfile::id product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 182 184 3 ConnectionProfile::version product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 201 207 7 ConnectionState::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 209 216 8 ConnectionState::parse product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 256 293 38 ConnectionRecord::new product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 296 346 51 ConnectionRecord::assemble product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 348 353 6 ConnectionRecord::generations product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 360 431 72 ConnectionRecord::to_canonical_cbor product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 441 526 86 ConnectionRecord::from_canonical_cbor product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 528 556 29 ConnectionRecord::validate product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 560 562 3 ConnectionRecord::provider_kind product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 565 567 3 ConnectionRecord::alias product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 570 572 3 ConnectionRecord::connection_id product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 575 577 3 ConnectionRecord::contract product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 580 582 3 ConnectionRecord::descriptor_schema product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 585 587 3 ConnectionRecord::descriptor product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 590 592 3 ConnectionRecord::descriptor_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 595 597 3 ConnectionRecord::account_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 600 602 3 ConnectionRecord::credential_reference_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 605 607 3 ConnectionRecord::generation product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 612 614 3 ConnectionRecord::credential_generation product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 617 619 3 ConnectionRecord::state product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 622 624 3 ConnectionRecord::allowed_workloads product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 627 629 3 ConnectionRecord::allowed_profiles product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 632 634 3 ConnectionRecord::created_at_unix_seconds product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 637 639 3 ConnectionRecord::updated_at_unix_seconds product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 642 644 3 ConnectionRecord::revoked_at_unix_seconds product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 653 660 8 ConnectionRecord::credential_binding product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 680 691 12 ConnectionRecord::authorize_recovery_lease product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 711 740 30 ConnectionRecord::binding_for_recovery product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 754 784 31 ConnectionRecord::transition_state product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 794 825 32 ConnectionRecord::rotated product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 835 865 31 ConnectionRecord::with_authorization product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 896 898 3 ConnectionBinding::provider_kind product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 901 903 3 ConnectionBinding::alias product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 906 908 3 ConnectionBinding::connection_id product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 911 913 3 ConnectionBinding::contract product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 916 918 3 ConnectionBinding::descriptor_schema product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 922 924 3 ConnectionBinding::descriptor product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 927 929 3 ConnectionBinding::generation product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 933 935 3 ConnectionBinding::credential_generation product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 938 940 3 ConnectionBinding::descriptor_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 943 945 3 ConnectionBinding::account_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 951 953 3 ConnectionBinding::credential_reference_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 957 964 8 ConnectionBinding::credential product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 985 987 3 CredentialBinding::connection_id product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 990 992 3 CredentialBinding::generation product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 996 998 3 CredentialBinding::credential_generation product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1001 1003 3 CredentialBinding::reference_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1007 1013 7 CredentialBinding::fmt product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1086 1092 7 is_lower_token product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1094 1096 3 is_ascii_graphic product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1098 1100 3 strictly_sorted_unique product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1102 1112 11 encode_text product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1114 1119 6 expect_key product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1121 1127 7 decode_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1129 1141 13 decode_workloads product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1143 1165 23 decode_profiles product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1167 1169 3 encoding product/runtime/auths-connections decision 0 0 0 0 0 0 -product/runtime/auths-connections/src/model.rs 1171 1173 3 decoding product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 78 85 8 SemanticId::parse product/runtime/auths-connections decision 0 0 1 1 1 2 +product/runtime/auths-connections/src/model.rs 89 91 3 SemanticId::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 105 112 8 ConnectionId::generate product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 119 131 13 ConnectionId::parse product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 135 137 3 ConnectionId::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 141 146 6 ConnectionId::fmt product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 162 167 6 ConnectionProfile::new product/runtime/auths-connections decision 0 0 1 1 1 3 +product/runtime/auths-connections/src/model.rs 171 173 3 ConnectionProfile::id product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 177 179 3 ConnectionProfile::version product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 196 202 7 ConnectionState::as_str product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 204 211 8 ConnectionState::parse product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 251 288 38 ConnectionRecord::new product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 291 341 51 ConnectionRecord::assemble product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 343 348 6 ConnectionRecord::generations product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 355 426 72 ConnectionRecord::to_canonical_cbor product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 436 521 86 ConnectionRecord::from_canonical_cbor product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 523 532 10 ConnectionRecord::validate product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 536 538 3 ConnectionRecord::provider_kind product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 541 543 3 ConnectionRecord::alias product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 546 548 3 ConnectionRecord::connection_id product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 551 553 3 ConnectionRecord::contract product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 556 558 3 ConnectionRecord::descriptor_schema product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 561 563 3 ConnectionRecord::descriptor product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 566 568 3 ConnectionRecord::descriptor_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 571 573 3 ConnectionRecord::account_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 576 578 3 ConnectionRecord::credential_reference_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 581 583 3 ConnectionRecord::generation product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 588 590 3 ConnectionRecord::credential_generation product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 593 595 3 ConnectionRecord::state product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 598 600 3 ConnectionRecord::allowed_workloads product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 603 605 3 ConnectionRecord::allowed_profiles product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 608 610 3 ConnectionRecord::created_at_unix_seconds product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 613 615 3 ConnectionRecord::updated_at_unix_seconds product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 618 620 3 ConnectionRecord::revoked_at_unix_seconds product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 629 636 8 ConnectionRecord::credential_binding product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 656 661 6 ConnectionRecord::authorize_recovery_lease product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 681 716 36 ConnectionRecord::binding_for_recovery product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 730 762 33 ConnectionRecord::transition_state product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 772 805 34 ConnectionRecord::rotated product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 815 847 33 ConnectionRecord::with_authorization product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 878 880 3 ConnectionBinding::provider_kind product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 883 885 3 ConnectionBinding::alias product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 888 890 3 ConnectionBinding::connection_id product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 893 895 3 ConnectionBinding::contract product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 898 900 3 ConnectionBinding::descriptor_schema product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 904 906 3 ConnectionBinding::descriptor product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 909 911 3 ConnectionBinding::generation product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 915 917 3 ConnectionBinding::credential_generation product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 920 922 3 ConnectionBinding::descriptor_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 925 927 3 ConnectionBinding::account_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 933 935 3 ConnectionBinding::credential_reference_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 939 946 8 ConnectionBinding::credential product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 967 969 3 CredentialBinding::connection_id product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 972 974 3 CredentialBinding::generation product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 978 980 3 CredentialBinding::credential_generation product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 983 985 3 CredentialBinding::reference_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 989 995 7 CredentialBinding::fmt product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1068 1070 3 is_lower_token product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1072 1082 11 encode_text product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1084 1089 6 expect_key product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1091 1097 7 decode_commitment product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1099 1111 13 decode_workloads product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1113 1135 23 decode_profiles product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1137 1139 3 encoding product/runtime/auths-connections decision 0 0 0 0 0 0 +product/runtime/auths-connections/src/model.rs 1141 1143 3 decoding product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/registry.rs 22 27 6 RegistryLimits::default product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/registry.rs 48 57 10 ConnectionRegistry::new product/runtime/auths-connections decision 0 0 0 0 0 0 product/runtime/auths-connections/src/registry.rs 64 88 25 ConnectionRegistry::insert product/runtime/auths-connections decision 0 0 0 0 0 0 @@ -1385,6 +1506,36 @@ product/runtime/auths-gateway-kernel/src/construct.rs 780 804 25 build_body prod product/runtime/auths-gateway-kernel/src/construct.rs 812 833 22 construct_write product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 product/runtime/auths-gateway-kernel/src/construct.rs 840 852 13 construct_action_read product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 product/runtime/auths-gateway-kernel/src/construct.rs 858 865 8 construct_credential_read product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/construct.rs 1054 1065 12 field_name_equal product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/construct.rs 1070 1080 11 field_index product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 17 26 10 counter_equal product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 30 39 10 counter_position product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 44 49 6 count_capacity product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 54 65 12 linked_sum_contribution product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 70 84 15 contribute product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 90 99 10 aggregate product/runtime/auths-gateway-kernel decision 0 0 1 1 1 4 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 234 243 10 sum_position product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 248 267 20 contribute_sum product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_aggregation.rs 272 286 15 aggregate_sum product/runtime/auths-gateway-kernel decision 0 0 1 1 1 3 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 6 8 3 append_word product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 10 14 5 append_component product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 16 19 4 append_coordinates product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 26 38 13 count_counter_preimage product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 43 57 15 sum_counter_preimage product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 59 62 4 slot_preimage product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 67 69 3 count_slot_preimage product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/counter_preimages.rs 74 76 3 sum_slot_preimage product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/deadline.rs 15 24 10 intersect_entry_bounds product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/deadline.rs 29 31 3 entry_time_allows product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/entry_authorization.rs 30 40 11 profile_allowed product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/entry_authorization.rs 45 60 16 entry_allows product/runtime/auths-gateway-kernel decision 0 0 1 1 1 4 +product/runtime/auths-gateway-kernel/src/frontier.rs 16 21 6 FrontierSearch::new product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/frontier.rs 26 32 7 FrontierSearch::probe product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/frontier.rs 37 54 18 FrontierSearch::observe product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/frontier.rs 59 61 3 FrontierSearch::candidate product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/identity.rs 11 24 14 valid_token product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/identity.rs 30 35 6 logical_operation_preimage product/runtime/auths-gateway-kernel decision 0 0 1 1 1 2 +product/runtime/auths-gateway-kernel/src/identity.rs 41 46 6 connection_record_preimage product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 product/runtime/auths-gateway-kernel/src/order.rs 387 393 7 start product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 product/runtime/auths-gateway-kernel/src/order.rs 397 406 10 go product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 product/runtime/auths-gateway-kernel/src/order.rs 410 412 3 stop product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 @@ -1419,6 +1570,10 @@ product/runtime/auths-gateway-kernel/src/recovery.rs 98 104 7 provider_link prod product/runtime/auths-gateway-kernel/src/recovery.rs 108 122 15 recovery_class product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 product/runtime/auths-gateway-kernel/src/recovery.rs 126 133 8 unknown_resolution product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 product/runtime/auths-gateway-kernel/src/recovery.rs 139 151 13 recovery_capability product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/reservation_batch.rs 33 75 43 build_batch product/runtime/auths-gateway-kernel decision 0 0 1 1 1 6 +product/runtime/auths-gateway-kernel/src/reservation_retry.rs 24 54 31 retry_target product/runtime/auths-gateway-kernel decision 0 0 1 1 1 4 +product/runtime/auths-gateway-kernel/src/slot_record.rs 18 33 16 counter_hex_matches product/runtime/auths-gateway-kernel decision 0 0 1 1 1 1 +product/runtime/auths-gateway-kernel/src/slot_record.rs 40 56 17 validate_cumulative product/runtime/auths-gateway-kernel decision 0 0 1 1 1 3 product/runtime/auths-gateway-kernel/src/transition.rs 89 91 3 absent product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 product/runtime/auths-gateway-kernel/src/transition.rs 95 104 10 same_bytes_from product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 product/runtime/auths-gateway-kernel/src/transition.rs 108 114 7 same_bytes product/runtime/auths-gateway-kernel decision 0 0 1 0 1 0 @@ -1501,7 +1656,7 @@ product/runtime/auths-lifecycle/src/kernel.rs 276 284 9 reconciliation_code prod product/runtime/auths-lifecycle/src/kernel.rs 288 304 17 additive_capacity_available product/runtime/auths-lifecycle decision 1 0 1 1 1 1 1 product/runtime/auths-lifecycle/src/kernel.rs 308 313 6 exclusive_capacity_available product/runtime/auths-lifecycle decision 1 0 1 1 1 1 1 product/runtime/auths-lifecycle/src/kernel.rs 328 336 9 replay_code product/runtime/auths-lifecycle decision 1 0 1 1 1 1 1 -product/runtime/auths-lifecycle/src/model.rs 45 50 6 LifecycleState::is_terminal product/runtime/auths-lifecycle decision 1 0 1 1 0 1 0 +product/runtime/auths-lifecycle/src/model.rs 45 50 6 LifecycleState::is_terminal product/runtime/auths-lifecycle decision 1 0 1 1 1 1 1 product/runtime/auths-lifecycle/src/model.rs 99 163 65 ReservationRequestV1::derive product/runtime/auths-lifecycle decision 1 0 1 0 0 0 0 product/runtime/auths-lifecycle/src/model.rs 167 169 3 ReservationRequestV1::reservation_id product/runtime/auths-lifecycle decision 1 0 1 0 0 0 0 product/runtime/auths-lifecycle/src/model.rs 173 175 3 ReservationRequestV1::algebra_id product/runtime/auths-lifecycle decision 1 0 1 0 0 0 0 @@ -1644,3 +1799,109 @@ product/runtime/auths-lifecycle/src/transition.rs 826 838 13 state_code product/ product/runtime/auths-lifecycle/src/transition.rs 840 866 27 event_kind_for product/runtime/auths-lifecycle decision 1 0 1 0 0 0 0 product/runtime/auths-lifecycle/src/transition.rs 868 889 22 map_kernel_failure product/runtime/auths-lifecycle decision 1 0 1 0 0 0 0 product/runtime/auths-lifecycle/src/transition.rs 891 893 3 failure product/runtime/auths-lifecycle decision 1 0 1 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 38 46 9 GatewayRecordKind::as_str product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 50 59 10 GatewayRecordKind::parse product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 63 65 3 GatewayRecordKind::expires product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 90 99 10 GatewayRecordEntry::validate product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 109 123 15 validate_gateway_batch product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 143 162 20 collection_cutoff product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 175 231 55 PostgresLifecycleStore::insert_gateway_records product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 239 266 28 PostgresLifecycleStore::load_gateway_record product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 276 298 23 PostgresLifecycleStore::list_gateway_record_keys product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 308 342 35 PostgresLifecycleStore::replace_gateway_record product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 353 390 36 PostgresLifecycleStore::sweep_expired_gateway_records product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_attempt.rs 393 399 7 bounded product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/gateway_fence.rs 7 12 6 gateway_window_open product/stores/auths-stores decision 0 0 1 1 1 2 +product/stores/auths-stores/src/gateway_fence.rs 18 23 6 advance_gateway_collection product/stores/auths-stores decision 0 0 1 1 1 1 +product/stores/auths-stores/src/lib.rs 52 58 7 unmetered_claim product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 67 80 14 InMemoryBudgetLedger::new product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 84 88 5 InMemoryBudgetLedger::is_claimed product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 92 121 25 InMemoryBudgetLedger::claim product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 134 136 3 InMemoryReceiptStore::decision product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 140 142 3 InMemoryReceiptStore::execution product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 145 150 6 InMemoryReceiptStore::counts product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 154 157 4 InMemoryReceiptStore::store_decision product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 159 162 4 InMemoryReceiptStore::store_execution product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 165 179 15 idempotent_insert product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 189 191 3 FileReceiptStore::new product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 193 205 13 FileReceiptStore::store product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 209 213 5 FileReceiptStore::path product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 217 220 4 FileReceiptStore::store_decision product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 222 225 4 FileReceiptStore::store_execution product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 241 246 6 LocalSpoolReceiptSink::new product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 250 252 3 LocalSpoolReceiptSink::spool_path product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 256 262 7 LocalSpoolReceiptSink::store_decision product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 264 270 7 LocalSpoolReceiptSink::store_execution product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 273 297 25 persist_noclobber product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lib.rs 304 306 3 StoreConfigurationError::fmt product/stores/auths-stores interface 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 99 103 5 LifecycleDatabase::empty product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 120 130 11 InMemoryLifecycleStore::new product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 137 142 6 InMemoryLifecycleStore::load product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 146 155 10 InMemoryLifecycleStore::transact product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 159 164 6 InMemoryLifecycleStore::load_lifecycle product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 188 209 22 PersistentLifecycleStore::open product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 216 221 6 PersistentLifecycleStore::load product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 230 245 16 PersistentLifecycleStore::transact product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 249 254 6 PersistentLifecycleStore::load_lifecycle product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 283 288 6 SecretConnectionString::new product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 290 293 4 SecretConnectionString::expose product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 297 299 3 SecretConnectionString::drop product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 313 318 6 PostgresServerName::parse product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 322 324 3 PostgresServerName::as_str product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 337 342 6 PostgresTlsConfig::new product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 346 348 3 PostgresTlsConfig::root_certificate product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 352 354 3 PostgresTlsConfig::expected_server_name product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 375 393 19 PostgresPoolConfig::new product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 395 412 18 PostgresPoolConfig::validate product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 416 418 3 PostgresPoolConfig::minimum_connections product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 422 424 3 PostgresPoolConfig::maximum_connections product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 428 437 10 PostgresPoolConfig::default product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 456 472 17 PostgresStoreConfig::new product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 479 499 21 PostgresStoreConfig::from_env product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 503 509 7 PostgresStoreConfig::summary product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 523 525 3 PostgresStoreSummary::family product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 529 531 3 PostgresStoreSummary::tls_required product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 535 537 3 PostgresStoreSummary::schema_id product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 541 543 3 PostgresStoreSummary::contract_id product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 547 549 3 PostgresStoreSummary::minimum_connections product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 553 555 3 PostgresStoreSummary::maximum_connections product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 559 561 3 PostgresStoreSummary::maximum_records product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 575 577 3 PostgresStoreHealth::schema_version product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 581 583 3 PostgresStoreHealth::pool_connections product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 587 589 3 PostgresStoreHealth::pool_idle_connections product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 600 607 8 SessionCustomizer::on_acquire product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 619 663 45 PostgresLifecycleStore::connect product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 671 682 12 PostgresLifecycleStore::load product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 691 712 22 PostgresLifecycleStore::probe product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 716 751 36 PostgresLifecycleStore::transact product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 755 760 6 PostgresLifecycleStore::load_lifecycle product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 764 804 41 PostgresLifecycleStore::bind_recovery_reference product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 806 828 23 PostgresLifecycleStore::resolve_recovery_reference product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 832 881 50 PostgresLifecycleStore::list_recoverable product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 883 962 80 PostgresLifecycleStore::claim_reconciliation product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 965 994 28 make_tls_connector product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 996 1009 14 validate_server_identity product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1011 1108 97 initialize_or_verify_schema product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1110 1145 36 verify_store_contract product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1147 1161 15 configuration_store_error product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1163 1196 34 load_postgres_database product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1198 1221 24 decode_postgres_row product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1223 1234 12 decode_postgres_recovery_row product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1236 1247 12 decode_postgres_lease_row product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1249 1273 25 decode_postgres_values product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1275 1282 8 recovery_configuration_store_error product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1284 1338 55 persist_postgres_record product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1340 1352 13 lifecycle_state_code product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1354 1364 11 map_postgres_error product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1366 1395 30 transact_database product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1397 1480 84 capacity_snapshot product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1482 1490 9 is_capacity_holding product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1492 1524 33 validate_configuration product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1526 1548 23 encode_database product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1550 1582 33 decode_database product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1592 1625 34 persist_database product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1632 1634 3 Cursor::new product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1636 1643 8 Cursor::take product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1645 1648 4 Cursor::u16 product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1650 1653 4 Cursor::u32 product/stores/auths-stores storage 0 0 0 0 0 0 +product/stores/auths-stores/src/lifecycle.rs 1655 1657 3 Cursor::remaining product/stores/auths-stores storage 0 0 0 0 0 0 diff --git a/formal/proof-coverage-v1.json b/formal/proof-coverage-v1.json index 49af70735..3a85f1829 100644 --- a/formal/proof-coverage-v1.json +++ b/formal/proof-coverage-v1.json @@ -2,7 +2,7 @@ "schema": "auths-proof-proof-coverage/v1", "tool": { "command": "cargo xtask formal coverage", - "version": "1" + "version": "4" }, "revision": "the commit that contains this file", "reference_reproduction": { @@ -15,10 +15,10 @@ "lean_toolchain": "leanprover/lean4:v4.31.0", "translation_toolchain_lock_sha256": "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" }, - "scope_definition_sha256": "053f0be216b0003768d422d9ccc92a692726488874284fa80615657b30a495b5", - "inputs_sha256": "56f5f8df74c31a2554725ec967451d36bfa6e7c4a49004b3c83bb5cd32c35f52", + "scope_definition_sha256": "ed030ce60262669dce62637a8f8016799e07f45e468055c2087b0e6a9ebab885", + "inputs_sha256": "a0ea986d5dc60e711d5f43033c2b45a0c5715e880576aa36001273fdf2785857", "inputs": { - "Cargo.toml": "sha256:6e0240aa432bcdb5b4f855618994582d2e428afe5ee4e4f6a3f8d21a518f8d24", + "Cargo.toml": "sha256:2cc6fc79bfa459cedad6237ed79064dfd13683232940d63d5778a2e994fbb30d", "core/crates/auths-algebra-kernel/Cargo.toml": "sha256:0cb078915287b8c47d20fb97b6fa14135ed1c61c4985c4de2753855563c27bba", "core/crates/auths-algebra-kernel/src/generated.rs": "sha256:ae4bcbef42a408c7ffa0c6a74a42f7de177a6f14479e51d205acf830bda05960", "core/crates/auths-algebra-kernel/src/lib.rs": "sha256:6654667eeb9b353d6648954c9fd2e8838462a82ce6b2803eb49e1366892c68c6", @@ -26,75 +26,122 @@ "core/crates/auths-assurance/src/lib.rs": "sha256:0fb2ec844d674b25a9e20b1601452c89c2454901fa506adfa9bb38ef9a7fa213", "core/crates/auths-authority/Cargo.toml": "sha256:4f68212938029f79ebd857b4f3038494eb85d0163d49f07e51376715cf959815", "core/crates/auths-authority/src/lib.rs": "sha256:da88d5194de4e17449e69972c0fb042afa3c39798a8f570f30771e77c384f1eb", - "core/crates/auths-codec/Cargo.toml": "sha256:e20e51826e17814effd9d8925d18d5fbdd6c0d37bf50231e743ec2611314722c", - "core/crates/auths-codec/src/approval.rs": "sha256:fbff43bf4d57f69f8b7738a8647751cde75c5a932dee65d924a1fe9c7202f91f", - "core/crates/auths-codec/src/bounded_policy.rs": "sha256:d21f6728be2d8a04b6d94921f2b683f7e61cbb42e0ac6866f1c88a49caa534c3", - "core/crates/auths-codec/src/decode.rs": "sha256:ba2999584cdf53b1b517ecb9c7ea50d39efee17c666a9a38e2ad1ac94379f778", - "core/crates/auths-codec/src/encode.rs": "sha256:8491192053e2e15d62b4d2a491de22405b7487ead69ab6f6bca40669ce7ca5f7", - "core/crates/auths-codec/src/error.rs": "sha256:fecb0737c16deb42d859f1dc7727c698438d9ac12064fd99e0024629642c390c", - "core/crates/auths-codec/src/hash.rs": "sha256:f88e111f1dbb2cef6b7b5e9c948cb45ff92e366710c8a5f5c636138aa748479e", - "core/crates/auths-codec/src/lib.rs": "sha256:3b0e5c94c6f34f750b88a9333e1d5c8145746d845d3a23e0d2f61807cf592ea7", - "core/crates/auths-codec/src/observation.rs": "sha256:38328b0c71ff97a4196eeade8b4faa889527ff1f80bb168468bcd49082a3987e", + "core/crates/auths-codec/Cargo.toml": "sha256:b164e44179704bcb76d32f7e25281ed17f738e434290997e979739ebe49b4f77", + "core/crates/auths-codec/src/approval.rs": "sha256:eb0a867ab26c151f9f947090dd81b5802541e818104ac2b363634e2c8f568005", + "core/crates/auths-codec/src/bounded_policy.rs": "sha256:5c84447f057e2bf356323c6d83cab4daf64fcce221051a0863350f414ad0fb85", + "core/crates/auths-codec/src/cbor.rs": "sha256:03f43d462fe39a45c7ad5ef487376ce109ae359b7874ec2b0200601ad0563361", + "core/crates/auths-codec/src/decode.rs": "sha256:41b1e08a76ba4fc841c80f81994e78a23f4692eab9262604080c36bb8d1be3bd", + "core/crates/auths-codec/src/encode.rs": "sha256:163dcb12f640eb63fbdb872e75bab1ee9e01571797cdf3a10b77cfd0b02a0c0b", + "core/crates/auths-codec/src/error.rs": "sha256:80c1e7fdd190a0d050c69fbcde9836a4702d9b98e8effd76bc659c3d75ea8175", + "core/crates/auths-codec/src/hash.rs": "sha256:db5e7773c8c1f6193c2494c95e3575d712c573e737ceb16b547f0f105efe1236", + "core/crates/auths-codec/src/lib.rs": "sha256:09688b7ffb9527cd89e3182ca556b2cbb0fb0c924d7e1e9889686b81b2bdf601", + "core/crates/auths-codec/src/observation.rs": "sha256:fb2d1151558b144a9d10dbc9a028c48f19c96344e396d0c292ff59be473b2149", + "core/crates/auths-codec/src/scope_decode_tests.rs": "sha256:61720a13ba4e2fefabcc492778348aaca5b3052e2570302de5ebc92efce12ab5", "core/crates/auths-composition/Cargo.toml": "sha256:331e13025eb82588b5269ed3975929eb41c823d588c49e4c296273d85c6fe80e", - "core/crates/auths-composition/src/lib.rs": "sha256:e42e3b0b6a9985b73c533aeb23799c638979aa27a9ce7d0f10a8d60340570fb1", + "core/crates/auths-composition/src/lib.rs": "sha256:e8a0f96ae904d831042f2284c5b8a7a8c9ccb030b4d6ac4b9912229039d4f535", + "core/crates/auths-composition/src/oracle.rs": "sha256:423c08f866797759fce7daeeb6316f15da870052a915504cbbd8954498cf942a", + "core/crates/auths-composition/src/summary.rs": "sha256:57ddc0376ae1182f73105147aa068d5b1e411444658f8da4ade56a5d0d4b4c6d", "core/crates/auths-model/Cargo.toml": "sha256:565c15302b0cc9270db1e28efa3862804846850ba933cc17aea8abcec4a65987", "core/crates/auths-model/src/approval.rs": "sha256:54cf44a9ef747ec21546a4086aecfb130bc7803b0d646430e6082df51e6e305f", "core/crates/auths-model/src/bounded.rs": "sha256:f90496abc0a06c028b4d850af6ddab7d850bfafeaa3d042f1b1246a41d8bbbc9", "core/crates/auths-model/src/bounded_policy.rs": "sha256:306a8f049cc7cfc7635fe0e4de47eb7813eed63d3c14c3be2b51586aa4eea450", - "core/crates/auths-model/src/lib.rs": "sha256:e7cfe6bb9574c6b016aa63e70658c31e0b90903ec6479a49f4a2ceb64f5bad97", - "core/crates/auths-model/src/observation.rs": "sha256:b3ed3e3cc090afca2896a7d3de7988afccc1ee1ea0ebd91b51a8bc0f20ad8dbb", + "core/crates/auths-model/src/identifier.rs": "sha256:fcfb49e42682de6358980e4d86ca7763bba6a9a04967a4a6022b9ca8157103de", + "core/crates/auths-model/src/lib.rs": "sha256:238d198437a9f4cc1ad180181d4409809071e8e92e1cc056c3b4431738ed4168", + "core/crates/auths-model/src/observation.rs": "sha256:0f0a8a4bd942867f168c0e411a8bca5d7f57e94065beaebe919b26b08ddd2108", + "core/crates/auths-model/src/principal_scheme_tests.rs": "sha256:d64588a32503cd70b954c21f8582e46a20292ec918ea8e3f7278c0b99c1528c9", + "core/crates/auths-model/src/scope_constructor_tests.rs": "sha256:a107fce37f38b5db2d9ae5c5585b49f011f88a5120c6a72c5a141da49f698c82", "core/crates/auths-ports/Cargo.toml": "sha256:596a9b0f5af3717c16a6d13f7054d8a106bcd9f01f5f72c2235dd2afcf0ab16c", "core/crates/auths-ports/src/binding.rs": "sha256:a16c012d40aa4249e3ec54372b9611006d0bfe8c7dc3c741911c2194ad17736d", "core/crates/auths-ports/src/diagnostics.rs": "sha256:aa596572503b5a65a918bb2ff38281c144ff53821ee914e9325c852828d852df", - "core/crates/auths-ports/src/lib.rs": "sha256:8da1debf86f9532df0660155d04298beb1ba3a1204508f8586e2e67cd2fb3449", + "core/crates/auths-ports/src/lib.rs": "sha256:e7f7fdcb480de4d69d488af5234915542627eb2fbc987232c4b5c47363a491dc", "core/crates/auths-ports/src/path.rs": "sha256:b68fc547b4e4d97a60cbbc1cc1939fc6b34a8233b81f840bd396914a707e3ea1", "core/crates/auths-registries/Cargo.toml": "sha256:590e49e58b0622d9d6274fea46796dcdb07dec9550eff295cce6a6427ffa51e2", - "core/crates/auths-registries/src/lib.rs": "sha256:450d3886d85ee333b7e046317fb5b47cde62483d5f3e41d46265e2caf4c373ec", + "core/crates/auths-registries/src/lib.rs": "sha256:0e94b31ddb24d57c2d0d82f479fcc138a677b606b89c8f16a8e9dc5497afc5c5", + "core/crates/auths-registries/src/status_selection_tests.rs": "sha256:456d830b1c65db272f337e0dacc12aaaeefa99071ff3251d19b2f0417bf0a284", "core/crates/auths-registries/src/template.rs": "sha256:1224039dd2b3ce6fa8357613d8cafbae40400493da7176da202b9ade62fa05e4", + "core/crates/auths-signature-core/src/lib.rs": "sha256:d8f9465b337deabf3dedc4337223913aa637a10192d6b504281f28475a13ea11", + "core/crates/auths-signature/src/lib.rs": "sha256:b3d9ac4cc3ba0797b9e1c09f2d6ac05089b25dac4e285a5af28c0165b33d925b", "core/crates/auths-verifier/Cargo.toml": "sha256:c43358e06a33324b41a8b93e5cc7279c55f7d21f1f6cfaa539a3fc7b4c27a38f", - "core/crates/auths-verifier/src/approval.rs": "sha256:c3cae6a49e169051eb555bb092b1069a4d422516d6a2114623a89e5f31ff923f", + "core/crates/auths-verifier/src/approval.rs": "sha256:2826a5227945a3e0ea000584f1e1c794bec3b313b13843f4284e0e716f830d33", "core/crates/auths-verifier/src/causal.rs": "sha256:9635230f33b13a263573d319ac8a1976addbcc07677514a43e3c7bf28dc04587", - "core/crates/auths-verifier/src/lib.rs": "sha256:f22dec38dfa47ced8da4f605390da8453273bee1da010f57fd1fdfcb10e0b389", - "core/crates/auths-verifier/src/observation.rs": "sha256:0bb07f06a0f9524c88427df1c972b1de8ba038a9eeeb15d3134c25125ae84b1e", + "core/crates/auths-verifier/src/lib.rs": "sha256:7d3ae3a95680018ae7d709b5fd64f1fa48ef838e3d389ee727b8087fbc4d9d50", + "core/crates/auths-verifier/src/observation.rs": "sha256:2b43ee60e1f105d33b325914ae723f91fe191675f27a9a9c04ea812c2fe27785", + "core/crates/auths-verifier/src/temporal_tests.rs": "sha256:c242d8bed72936ea7437e45ab88b98b28f0d82f9f92a6f750ef8b27fa71e8fef", "core/crates/auths-verifier/src/trace.rs": "sha256:2213d72023a1d9e0413a2cf2c51c3dad9e04775d86033a0caaa9d29a8f0036f8", - "formal/check-site-functions-v1.toml": "sha256:a4eebcb806f2be41aa39fb18700c70170cfe5792162feca0501d6e3fb69325ea", - "formal/coverage-scope-v1.toml": "sha256:053f0be216b0003768d422d9ccc92a692726488874284fa80615657b30a495b5", - "formal/lean-assurance-audit-v1.json": "sha256:adbc3882efd275e821ae5fb5da68107d44915cb9205dbdc57681d4493e8b85ee", + "formal/check-site-functions-v1.toml": "sha256:fed8e34c73ffde17881c8c8fc36bf943e7db699f042c7a0f0f3ce54afe74143c", + "formal/coverage-scope-v1.toml": "sha256:ed030ce60262669dce62637a8f8016799e07f45e468055c2087b0e6a9ebab885", + "formal/lean-assurance-audit-v1.json": "sha256:42d728e048e5aba4a829d177327ac2fe464c46b9448697fd5fd77000681192a7", + "formal/qualification/aeneas/entrypoints/profile_construction.rs": "sha256:4e6c4a3bfbd147a5ceab64e24a80fe10f08b0715210343b6be63fecaffdbd5ee", "formal/qualification/aeneas/generated/algebra/Funs.lean": "sha256:f78659289b73410828dceb4557cd4fbf2fa801b06ca083e8268be33074f68960", "formal/qualification/aeneas/generated/algebra/translation.json": "sha256:7b486aa626850f509f6c1038dbc5c74c753d53707d0085260e30321e570fab9d", "formal/qualification/aeneas/generated/authority/Funs.lean": "sha256:2bb401ffca0136622cd79bb14a5a38852061649a06cc46100503870c22d300c7", - "formal/qualification/aeneas/generated/authority/translation.json": "sha256:104f4b5fc036d3bfe533be7567dc2308f87fb34e8719363e71c77358eb129ba5", - "formal/qualification/aeneas/generated/bounded_policy/Funs.lean": "sha256:ba7aea214063b8a698fbd2c9c8cd95a717bf0ec0eaef70a92844444bf7e9f22e", - "formal/qualification/aeneas/generated/bounded_policy/translation.json": "sha256:3be48bd557146aef4d7452b17af0793fd61ed1e390c2274d7c75908a80fd79f5", - "formal/qualification/aeneas/generated/connections/Funs.lean": "sha256:dfa1998e3506f06dce142222dc383116d0952155517edc399f5d94e688e22912", - "formal/qualification/aeneas/generated/connections/translation.json": "sha256:c43f8a044ad0c19c676d43e3a6f7e24a492864c94f50b8fa4afbd08dd01f82ba", - "formal/qualification/aeneas/generated/gateway/Funs.lean": "sha256:c8c86db058f313ab46ee86370d79ee70130c1ead3860dd7dabd49f2a89af1636", - "formal/qualification/aeneas/generated/gateway/translation.json": "sha256:4b9e3e1158b6751a458ae6581e7e2230a1b242913d9a4842710d3bea3e08ee45", + "formal/qualification/aeneas/generated/authority/translation.json": "sha256:5a0b908ba7f82a95ba290f21a51725d40f8f08c342949c9cc234b1acae5a684a", + "formal/qualification/aeneas/generated/bounded_policy/Funs.lean": "sha256:373e056025e2c2a206a34505425b0015df5665ed92c83475b7e8d1c84aa1ab41", + "formal/qualification/aeneas/generated/bounded_policy/translation.json": "sha256:78b64e8a0ea05231c1620c4c597bb16443fe3a21900f81d215e8458c2d6fe4c8", + "formal/qualification/aeneas/generated/codec/Funs.lean": "sha256:29964fc8295ee8dae8775b4807d25619043908d759d468c3e47f3024a4e12953", + "formal/qualification/aeneas/generated/codec/translation.json": "sha256:6fd8a876a79974627ef75f2bcf183f2e1d46cd4f7f9c6bdc6267d65024e0959b", + "formal/qualification/aeneas/generated/composition/Funs.lean": "sha256:85d068a17e9d5b07f1907f6f48b0868205257b410c080e582fcfc797bfcf4a9d", + "formal/qualification/aeneas/generated/composition/translation.json": "sha256:deb6125b39bd66978479466eb44f2e38e3c1458f48e5c606ceee3f3283000e5e", + "formal/qualification/aeneas/generated/connections/Funs.lean": "sha256:9c9c0272f8e5d4e76bde8b27d8cbef5042f2fc19109717723e44070317e93e8e", + "formal/qualification/aeneas/generated/connections/translation.json": "sha256:15df69d0b9b900df6d4caaef5a2f0c3263616c28d914387f279566787c353b7b", + "formal/qualification/aeneas/generated/gateway/Funs.lean": "sha256:f75ffa59bd706a8156798baafef37aa4763ac82627d11bdbad0ba3851c5a0789", + "formal/qualification/aeneas/generated/gateway/translation.json": "sha256:0691e5433497a5dfe7bfa80994cb43c40ad99ae4e886c9267c2a8d8e4f76ba6e", "formal/qualification/aeneas/generated/lifecycle/Funs.lean": "sha256:817dcbb854a599fb14c89854d8023809a390f7a00e1cc70dbc7151d7b254649f", "formal/qualification/aeneas/generated/lifecycle/translation.json": "sha256:b729089853215acf4d019aae5f04da6d902b75ac4910feeeb8d801e9991cdb4a", - "formal/qualification/aeneas/generated/model/Funs.lean": "sha256:d4d36b72718a4076b7c0561abfa2edc006a1f9a4491762979f86c3dd99a71fdc", - "formal/qualification/aeneas/generated/model/translation.json": "sha256:66e62345ea87b3150722b2d8b37473269c1cbfdaa09c875a3546ae381b7f5cd0", - "formal/qualification/aeneas/qualification.toml": "sha256:38aa0babb5be3ac958c7e91f0640ad0ae3b6e4f265257642976dfe8bd3330850", - "formal/theorem-kinds-v1.toml": "sha256:9714b276af0a45cadb7582e39beaa57dcb3494d6af23ca1b6a8702cc78e59728", + "formal/qualification/aeneas/generated/model/Funs.lean": "sha256:d44ad15b213893c401d5bb215d77ac2ab8949e4fc6eb0c4af4f1fbe9cbc96650", + "formal/qualification/aeneas/generated/model/translation.json": "sha256:4252f051b873e98cd1c7cbd198017bcbf23d7e7a87389616731f2271c84670b8", + "formal/qualification/aeneas/generated/p256/Funs.lean": "sha256:d2d7d4ecaec037e905f86b66ac902103562ff38124469b1c1dbc8c099cccf29f", + "formal/qualification/aeneas/generated/p256/translation.json": "sha256:e2887ab5a96302d086e224c568a6c0d25eff8206f680217d80a669e6b8c7756c", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean": "sha256:ad4afc30b7bb19c05b494eeea0563c1dfebb7fd3960e246e5d9b4be0407d2f61", + "formal/qualification/aeneas/generated/profile_construction/translation.json": "sha256:bd6362f68206adcfad930cac0a4105b597956dc3dc8e2562ee000f6bedb68c52", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean": "sha256:7ce527b9e194e8470f9355dba67b31ce9efbbea8bec7d9c1e6a9b58fe037abed", + "formal/qualification/aeneas/generated/scope_codec/translation.json": "sha256:d19dddc8ecf98120d9035f514bc8310c90fb8c197bffa8958ef34097c4411beb", + "formal/qualification/aeneas/generated/sha256/Funs.lean": "sha256:ac717d96e3eb922e16e6fe25f5d64076a9c3adc0a0b9be20e0966e136b81100a", + "formal/qualification/aeneas/generated/sha256/translation.json": "sha256:a62a2775d58fd19bb8095b8de6f7cbbae2b34bcfd94c1635bd99c9fa5c5d8a29", + "formal/qualification/aeneas/generated/signature/Funs.lean": "sha256:dfe3b399556573de8a3720f036bea1d3afda03680543657c77ab3994a81afa84", + "formal/qualification/aeneas/generated/signature/translation.json": "sha256:969e89692b680973f81aba927de2cc463137a84f2d0afbf30a169cf2b71dac7e", + "formal/qualification/aeneas/generated/status_selection/Funs.lean": "sha256:4d8bdc1fd56f6fb40c65fe1dafb925b2a13b2fd7b6069a029325b3dde732baeb", + "formal/qualification/aeneas/generated/status_selection/translation.json": "sha256:3e027963629d6cadc5e72c12a7e15dc9c33e743397572e5d8bbb05cf6a2c40a5", + "formal/qualification/aeneas/generated/stores/Funs.lean": "sha256:93659adb731e4ebd0bfd7dde510d582657fc8e89427ebdee9ee2cdf8324bcf64", + "formal/qualification/aeneas/generated/stores/translation.json": "sha256:22c9f88c31e9b7fb88b45dd9e7a8b072a016c386ee3f7e916bfd96a32555b56c", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean": "sha256:431e4424062a07c09648a506a84829e55e01a2299c11d6048510e6a9f58c0777", + "formal/qualification/aeneas/generated/suite_adapter/translation.json": "sha256:58efad7d457adcb1808658075f5e4ef504f54398563a42a3f824e864d47557b6", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean": "sha256:05aad591f331d9e6c6c0f33e75f062a048d390a99b5cee4c43ce52343dc030de", + "formal/qualification/aeneas/generated/temporal_witness/translation.json": "sha256:068ff2fe97c4abe40ab641ca6ce6f150320da3a52513d63f025807f5ee57cd0f", + "formal/qualification/aeneas/qualification.toml": "sha256:0bc0b2d28f762aae45bf5045c97750e1d2990fce0133cc97de2678bed752f2ca", + "formal/theorem-kinds-v1.toml": "sha256:0648a6e025422ab69ef0e19697dfeeebc607c3517cc186bcb6bf42ae51c53272", "product/policy/auths-bounded-policy/src/arithmetic.rs": "sha256:75e43c5d4eab8d1f71c1daf53839f5f9fe45a400afc1f63a30c6f55ce3632627", "product/policy/auths-bounded-policy/src/commitment.rs": "sha256:c5706f2d583454e1a7f570f7ada138d4d864bef0205dfae7c1296774f396bb3f", "product/policy/auths-bounded-policy/src/eligibility.rs": "sha256:c9acdfb793074e687fc36efad506be27dbd99ffbf40387bc66c8de39ef238432", "product/policy/auths-bounded-policy/src/identifier.rs": "sha256:0006a32bae9eb16c4178cf797df418d2b0a781f2bc6474b741dc1a908141831c", - "product/policy/auths-bounded-policy/src/kernel.rs": "sha256:99187c28b161ac70bee1afed60711f7f645adb4d1671a01863f9849b369811d5", + "product/policy/auths-bounded-policy/src/kernel.rs": "sha256:00f66e91381dc53fbb5753dcb22276f41667529f584fe00770fe388b979a73f7", "product/policy/auths-bounded-policy/src/lib.rs": "sha256:76a18638b810e62e594d6e951504679305ce21841388e0c282ad51cd7841b91c", "product/policy/auths-bounded-policy/src/receipt.rs": "sha256:3b9eae82f349956d3e7f29b57b254bff5ce67cc703e6cf43445ce2827676d1ad", "product/policy/auths-bounded-policy/src/registry.rs": "sha256:4e251ea5833559841f8ee0bd9b66c0c01c39fa5e3a21720a19c4e8adbfcb99d0", "product/runtime/auths-connections/src/credential.rs": "sha256:82921413bb053f0f6c7931fbd4e6a86c8cc1d8c6b51debd9c2cef33a8d5b1c51", - "product/runtime/auths-connections/src/kernel.rs": "sha256:a456af19526ef7b19278551fd8d97606b6e7aa5a195e70bdd85d1e0786090ce8", + "product/runtime/auths-connections/src/kernel.rs": "sha256:d53bf8df4e1343e8e798f0ab2d9d092059db7b266b0d1bad3ae4e6d463abce74", "product/runtime/auths-connections/src/lib.rs": "sha256:79209249a0acba0e854d9937255ea0e30a9a6f8e1c2baad77ab83646d392de22", - "product/runtime/auths-connections/src/model.rs": "sha256:de34a089cac9702acb889b7602b3e4732306c9e61029ec892582b7e02b73fc77", + "product/runtime/auths-connections/src/model.rs": "sha256:f6af1c15fc10a904eb598d30827d24ca202f52853a5a8d2af2164a5dc025959c", + "product/runtime/auths-connections/src/record_time_tests.rs": "sha256:201c61940d95f84ea4e125d672c6244f4cd1fefb414e9e583db509d2db5d175b", + "product/runtime/auths-connections/src/recovery_guard_tests.rs": "sha256:ce918bca22cd4f1d2d430951ba191e76ee5dc2b0fa145acf13da08ba52274a62", "product/runtime/auths-connections/src/registry.rs": "sha256:e57640e003e72ad3235c567c2bb944a262bd64e673f023b62ea091094cc7e946", - "product/runtime/auths-gateway-kernel/src/construct.rs": "sha256:e9d65744bae273d65face4285e5d2da75c06a92ab48f7b8333d496604e31c63c", - "product/runtime/auths-gateway-kernel/src/lib.rs": "sha256:cfda6f8453426564c085475f183b6f790b438768a19668f1b65d33ba59dc8632", + "product/runtime/auths-connections/src/strict_order_tests.rs": "sha256:2aa297d2955cdaedc0abbc118ba1027c363803d4bc825091b2e1db1121dc865c", + "product/runtime/auths-connections/src/string_constructor_tests.rs": "sha256:7af0e6b75baef268c9b11ea8aa551e8e7793d26378b11455ead7dcb7f2493008", + "product/runtime/auths-gateway-kernel/src/construct.rs": "sha256:ba592901a463c2cd81dc434ae62f33efeccc5e13f441a0dff65d60162a588b61", + "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs": "sha256:4bc970895b118f71c074a091ede8d0c558ed43d912ae5d0aebdc03aa64a8f78c", + "product/runtime/auths-gateway-kernel/src/counter_preimages.rs": "sha256:d364f9c9955dbbda5e18dba547169a3ec61f5147153308b14eb85456bd04c175", + "product/runtime/auths-gateway-kernel/src/deadline.rs": "sha256:25c96a7ef2427f54930e90cf739e6149dc21de9454f5d6d20984f0d5735cca19", + "product/runtime/auths-gateway-kernel/src/entry_authorization.rs": "sha256:4ee6c6a014bfc246f34fbcbc65c020b3329377ac2cd262481060c480efede129", + "product/runtime/auths-gateway-kernel/src/frontier.rs": "sha256:09650383952c76180295ab471b4f9344e0714071c0f72ecd7d0e8081b447519d", + "product/runtime/auths-gateway-kernel/src/identity.rs": "sha256:38b6226778fee35abe163a20be35fe7099de7ebc1a24f94f8ee2c27132ed2c36", + "product/runtime/auths-gateway-kernel/src/lib.rs": "sha256:2707427b76ae35c7c44921433506dab1bad1306e2c59360756bf18e9c8d85aae", "product/runtime/auths-gateway-kernel/src/order.rs": "sha256:e0045f877c4b7fe3860c291039853885064ddcdebba7c9b345ab65e81e646dda", "product/runtime/auths-gateway-kernel/src/outcome.rs": "sha256:e9785b1afe70788c89b51b18655bcd5acff7b0c8e3d12fb79c6f05a202e67e6b", "product/runtime/auths-gateway-kernel/src/ratio.rs": "sha256:7ace22264812e6fc1ef3a62afee402cf43494bb71ae0d3de219ad1b39d690bcb", "product/runtime/auths-gateway-kernel/src/recovery.rs": "sha256:9f46dcd1685ab6e4d1ba04a3fc286a9f3afee8fb47829be1fbc670a7926a2dc6", + "product/runtime/auths-gateway-kernel/src/reservation_batch.rs": "sha256:25770ea6be3dddf1d771ed4650c9678323795b82479d761ff6bfbf57b875c67e", + "product/runtime/auths-gateway-kernel/src/reservation_retry.rs": "sha256:0feb8731a31b55bfcb4dececc6b79b76b2966e1bc8b4cb84ca4bca71eb75a319", + "product/runtime/auths-gateway-kernel/src/slot_record.rs": "sha256:da9b30cec8d728282e7eefb6f5dee1606b27902fd19d204792c2d5ebb5c8b33a", "product/runtime/auths-gateway-kernel/src/transition.rs": "sha256:cefb8f01d915880f6921f2501ff881ad94b9de61072c34d9cd19220992f97374", "product/runtime/auths-lifecycle/src/codec.rs": "sha256:51c4b746749150e8bfcd8ff972b3f6c1ef40bec15583448ec1b471d9ad737dc0", "product/runtime/auths-lifecycle/src/digest.rs": "sha256:55282cd7d8aba37713c2dcb5357c9877819edb72a30eadefb860d28d7d3a3eb7", @@ -106,21 +153,23 @@ "product/runtime/auths-lifecycle/src/registry.rs": "sha256:53495fe6f7a77422593a41623e28716f1c140dcc1e00f87f6b0ffbfb93a5ef90", "product/runtime/auths-lifecycle/src/sealed.rs": "sha256:2e0c03b5813c926c159598bb7890d1523825edbe57cd687d42a5dfb3374a0c19", "product/runtime/auths-lifecycle/src/test_support.rs": "sha256:221d9a5c5ef8e1f9f8fd66927484eaf813571d0568470278ecd8fa08a5eec8cd", - "product/runtime/auths-lifecycle/src/transition.rs": "sha256:011805a28efdd541f44ccea54dd0e34a1e58f4004447ee58013703b4fb6b2822" + "product/runtime/auths-lifecycle/src/transition.rs": "sha256:011805a28efdd541f44ccea54dd0e34a1e58f4004447ee58013703b4fb6b2822", + "product/stores/auths-stores/src/gateway_attempt.rs": "sha256:81c5ed9dad20ef8d544299b111b496d4a2af3d234364482bc5f892de358fa0ad", + "product/stores/auths-stores/src/gateway_fence.rs": "sha256:b3286828c65b8d0d9203c1ce2381eef709b8cd1ae89b9b3f5ddcf87707f2a906", + "product/stores/auths-stores/src/lib.rs": "sha256:6cf1be4c3ea934531f920713db3b278b770cfa94c6b910e18c119bd5d70ff36a", + "product/stores/auths-stores/src/lifecycle.rs": "sha256:0ecbb634275b0e468e35bbd90f9271741b6bb582a22b03b0b08fc29cffadff9d" }, "claim": { - "decision_functions": 1031, - "decision_closure_functions": 110, - "decision_code_lines": 11353, - "decision_closure_code_lines": 1289, + "decision_functions": 1047, + "decision_closure_functions": 134, + "decision_code_lines": 11563, + "decision_closure_code_lines": 1833, "check_sites": 82, - "covered_check_sites": 15, + "covered_check_sites": 23, "uncovered_components": [ "the staged verifier control flow", - "the composition evaluator", "the registry handlers", - "the codec", - "the signature suites" + "the codec" ] }, "scope": { @@ -140,6 +189,13 @@ "product/policy/auths-bounded-policy" ], "translated_crates": [ + "core/crates/auths-registries", + "core/crates/auths-verifier", + "core/crates/auths-signature", + "core/crates/auths-signature-core", + "core/crates/auths-composition", + "product/stores/auths-stores", + "core/crates/auths-codec", "core/crates/auths-model", "core/crates/auths-algebra-kernel", "core/crates/auths-authority", @@ -158,186 +214,203 @@ "non_decision_files": { "core/crates/auths-codec/src/approval.rs": "decoding", "core/crates/auths-codec/src/bounded_policy.rs": "decoding", + "core/crates/auths-codec/src/cbor.rs": "decoding", "core/crates/auths-codec/src/decode.rs": "decoding", "core/crates/auths-codec/src/encode.rs": "decoding", "core/crates/auths-codec/src/error.rs": "decoding", "core/crates/auths-codec/src/hash.rs": "decoding", "core/crates/auths-codec/src/lib.rs": "decoding", "core/crates/auths-codec/src/observation.rs": "decoding", + "core/crates/auths-codec/src/scope_decode_tests.rs": "test-support", + "core/crates/auths-composition/src/oracle.rs": "test-support", + "core/crates/auths-model/src/principal_scheme_tests.rs": "test-support", + "core/crates/auths-model/src/scope_constructor_tests.rs": "test-support", "core/crates/auths-ports/src/binding.rs": "interface", "core/crates/auths-ports/src/diagnostics.rs": "interface", "core/crates/auths-ports/src/lib.rs": "interface", "core/crates/auths-ports/src/path.rs": "interface", + "core/crates/auths-registries/src/status_selection_tests.rs": "test-support", + "core/crates/auths-signature-core/src/lib.rs": "crypto", + "core/crates/auths-signature/src/lib.rs": "crypto", "core/crates/auths-verifier/src/causal.rs": "explanation", + "core/crates/auths-verifier/src/temporal_tests.rs": "test-support", "core/crates/auths-verifier/src/trace.rs": "explanation", + "formal/qualification/aeneas/entrypoints/profile_construction.rs": "interface", + "product/runtime/auths-connections/src/record_time_tests.rs": "test-support", + "product/runtime/auths-connections/src/recovery_guard_tests.rs": "test-support", + "product/runtime/auths-connections/src/strict_order_tests.rs": "test-support", + "product/runtime/auths-connections/src/string_constructor_tests.rs": "test-support", "product/runtime/auths-lifecycle/src/codec.rs": "decoding", "product/runtime/auths-lifecycle/src/sealed.rs": "storage", - "product/runtime/auths-lifecycle/src/test_support.rs": "test-support" + "product/runtime/auths-lifecycle/src/test_support.rs": "test-support", + "product/stores/auths-stores/src/gateway_attempt.rs": "storage", + "product/stores/auths-stores/src/lib.rs": "interface", + "product/stores/auths-stores/src/lifecycle.rs": "storage" } }, "metrics": { "decision": { "scope": "decision", "minimum_code_lines": 0, - "functions": 1031, - "span_lines": 11396, - "code_lines": 11353, + "functions": 1047, + "span_lines": 11614, + "code_lines": 11563, "by_level": { "translated": { - "functions": 110, - "function_share": 0.1067, - "span_lines": 1300, - "span_line_share": 0.1141, - "code_lines": 1289, - "code_line_share": 0.1135 + "functions": 134, + "function_share": 0.128, + "span_lines": 1848, + "span_line_share": 0.1591, + "code_lines": 1833, + "code_line_share": 0.1585 }, "direct": { - "functions": 56, - "function_share": 0.0543, - "span_lines": 867, - "span_line_share": 0.0761, - "code_lines": 856, - "code_line_share": 0.0754 + "functions": 77, + "function_share": 0.0735, + "span_lines": 1371, + "span_line_share": 0.118, + "code_lines": 1356, + "code_line_share": 0.1173 }, "closure": { - "functions": 110, - "function_share": 0.1067, - "span_lines": 1300, - "span_line_share": 0.1141, - "code_lines": 1289, - "code_line_share": 0.1135 + "functions": 134, + "function_share": 0.128, + "span_lines": 1848, + "span_line_share": 0.1591, + "code_lines": 1833, + "code_line_share": 0.1585 } } }, "verifier-core": { "scope": "verifier-core", "minimum_code_lines": 0, - "functions": 785, - "span_lines": 8842, - "code_lines": 8802, + "functions": 800, + "span_lines": 9041, + "code_lines": 8993, "by_level": { "translated": { - "functions": 86, - "function_share": 0.1096, - "span_lines": 918, - "span_line_share": 0.1038, - "code_lines": 907, - "code_line_share": 0.103 + "functions": 109, + "function_share": 0.1363, + "span_lines": 1447, + "span_line_share": 0.16, + "code_lines": 1432, + "code_line_share": 0.1592 }, "direct": { - "functions": 41, - "function_share": 0.0522, - "span_lines": 569, - "span_line_share": 0.0644, - "code_lines": 558, - "code_line_share": 0.0634 + "functions": 60, + "function_share": 0.075, + "span_lines": 1048, + "span_line_share": 0.1159, + "code_lines": 1033, + "code_line_share": 0.1149 }, "closure": { - "functions": 86, - "function_share": 0.1096, - "span_lines": 918, - "span_line_share": 0.1038, - "code_lines": 907, - "code_line_share": 0.103 + "functions": 109, + "function_share": 0.1363, + "span_lines": 1447, + "span_line_share": 0.16, + "code_lines": 1432, + "code_line_share": 0.1592 } } }, "translated-crates": { "scope": "translated-crates", "minimum_code_lines": 0, - "functions": 1138, - "span_lines": 10681, - "code_lines": 10662, + "functions": 1839, + "span_lines": 22647, + "code_lines": 22550, "by_level": { "translated": { - "functions": 210, - "function_share": 0.1845, - "span_lines": 2519, - "span_line_share": 0.2358, - "code_lines": 2508, - "code_line_share": 0.2352 + "functions": 389, + "function_share": 0.2115, + "span_lines": 4567, + "span_line_share": 0.2017, + "code_lines": 4544, + "code_line_share": 0.2015 }, "direct": { - "functions": 70, - "function_share": 0.0615, - "span_lines": 1035, - "span_line_share": 0.0969, - "code_lines": 1024, - "code_line_share": 0.096 + "functions": 205, + "function_share": 0.1115, + "span_lines": 2813, + "span_line_share": 0.1242, + "code_lines": 2791, + "code_line_share": 0.1238 }, "closure": { - "functions": 210, - "function_share": 0.1845, - "span_lines": 2519, - "span_line_share": 0.2358, - "code_lines": 2508, - "code_line_share": 0.2352 + "functions": 389, + "function_share": 0.2115, + "span_lines": 4567, + "span_line_share": 0.2017, + "code_lines": 4544, + "code_line_share": 0.2015 } } }, "verifier-closure": { "scope": "verifier-closure", "minimum_code_lines": 0, - "functions": 1083, - "span_lines": 13828, - "code_lines": 13762, + "functions": 1147, + "span_lines": 14350, + "code_lines": 14272, "by_level": { "translated": { - "functions": 86, - "function_share": 0.0794, - "span_lines": 918, - "span_line_share": 0.0664, - "code_lines": 907, - "code_line_share": 0.0659 + "functions": 182, + "function_share": 0.1587, + "span_lines": 2084, + "span_line_share": 0.1452, + "code_lines": 2065, + "code_line_share": 0.1447 }, "direct": { - "functions": 41, - "function_share": 0.0379, - "span_lines": 569, - "span_line_share": 0.0411, - "code_lines": 558, - "code_line_share": 0.0405 + "functions": 98, + "function_share": 0.0854, + "span_lines": 1478, + "span_line_share": 0.103, + "code_lines": 1460, + "code_line_share": 0.1023 }, "closure": { - "functions": 86, - "function_share": 0.0794, - "span_lines": 918, - "span_line_share": 0.0664, - "code_lines": 907, - "code_line_share": 0.0659 + "functions": 182, + "function_share": 0.1587, + "span_lines": 2084, + "span_line_share": 0.1452, + "code_lines": 2065, + "code_line_share": 0.1447 } } }, "decision-nontrivial": { "scope": "decision", "minimum_code_lines": 4, - "functions": 443, - "span_lines": 9629, - "code_lines": 9589, + "functions": 456, + "span_lines": 9838, + "code_lines": 9790, "by_level": { "translated": { - "functions": 81, - "function_share": 0.1828, - "span_lines": 1213, - "span_line_share": 0.126, - "code_lines": 1202, - "code_line_share": 0.1254 + "functions": 104, + "function_share": 0.2281, + "span_lines": 1758, + "span_line_share": 0.1787, + "code_lines": 1743, + "code_line_share": 0.178 }, "direct": { - "functions": 44, - "function_share": 0.0993, - "span_lines": 831, - "span_line_share": 0.0863, - "code_lines": 820, - "code_line_share": 0.0855 + "functions": 64, + "function_share": 0.1404, + "span_lines": 1332, + "span_line_share": 0.1354, + "code_lines": 1317, + "code_line_share": 0.1345 }, "closure": { - "functions": 81, - "function_share": 0.1828, - "span_lines": 1213, - "span_line_share": 0.126, - "code_lines": 1202, - "code_line_share": 0.1254 + "functions": 104, + "function_share": 0.2281, + "span_lines": 1758, + "span_line_share": 0.1787, + "code_lines": 1743, + "code_line_share": 0.178 } } } @@ -346,132 +419,132 @@ "decision_without_macro_rules_functions": { "scope": "decision", "minimum_code_lines": 0, - "functions": 1014, - "span_lines": 11343, - "code_lines": 11300, + "functions": 1027, + "span_lines": 11549, + "code_lines": 11498, "by_level": { "translated": { - "functions": 109, - "function_share": 0.1075, - "span_lines": 1297, - "span_line_share": 0.1143, - "code_lines": 1286, - "code_line_share": 0.1138 + "functions": 133, + "function_share": 0.1295, + "span_lines": 1845, + "span_line_share": 0.1598, + "code_lines": 1830, + "code_line_share": 0.1592 }, "direct": { - "functions": 56, - "function_share": 0.0552, - "span_lines": 867, - "span_line_share": 0.0764, - "code_lines": 856, - "code_line_share": 0.0758 + "functions": 77, + "function_share": 0.075, + "span_lines": 1371, + "span_line_share": 0.1187, + "code_lines": 1356, + "code_line_share": 0.1179 }, "closure": { - "functions": 109, - "function_share": 0.1075, - "span_lines": 1297, - "span_line_share": 0.1143, - "code_lines": 1286, - "code_line_share": 0.1138 + "functions": 133, + "function_share": 0.1295, + "span_lines": 1845, + "span_line_share": 0.1598, + "code_lines": 1830, + "code_line_share": 0.1592 } } }, "decision_exact_or_verdict_exact_theorems": { "scope": "decision", "minimum_code_lines": 0, - "functions": 1031, - "span_lines": 11396, - "code_lines": 11353, + "functions": 1047, + "span_lines": 11614, + "code_lines": 11563, "by_level": { "translated": { - "functions": 110, - "function_share": 0.1067, - "span_lines": 1300, - "span_line_share": 0.1141, - "code_lines": 1289, - "code_line_share": 0.1135 + "functions": 134, + "function_share": 0.128, + "span_lines": 1848, + "span_line_share": 0.1591, + "code_lines": 1833, + "code_line_share": 0.1585 }, "direct": { - "functions": 56, - "function_share": 0.0543, - "span_lines": 867, - "span_line_share": 0.0761, - "code_lines": 856, - "code_line_share": 0.0754 + "functions": 77, + "function_share": 0.0735, + "span_lines": 1371, + "span_line_share": 0.118, + "code_lines": 1356, + "code_line_share": 0.1173 }, "closure": { - "functions": 109, - "function_share": 0.1057, - "span_lines": 1297, - "span_line_share": 0.1138, - "code_lines": 1286, - "code_line_share": 0.1133 + "functions": 128, + "function_share": 0.1223, + "span_lines": 1595, + "span_line_share": 0.1373, + "code_lines": 1584, + "code_line_share": 0.137 } } }, "decision_exact_theorems": { "scope": "decision", "minimum_code_lines": 0, - "functions": 1031, - "span_lines": 11396, - "code_lines": 11353, + "functions": 1047, + "span_lines": 11614, + "code_lines": 11563, "by_level": { "translated": { - "functions": 110, - "function_share": 0.1067, - "span_lines": 1300, - "span_line_share": 0.1141, - "code_lines": 1289, - "code_line_share": 0.1135 + "functions": 134, + "function_share": 0.128, + "span_lines": 1848, + "span_line_share": 0.1591, + "code_lines": 1833, + "code_line_share": 0.1585 }, "direct": { - "functions": 56, - "function_share": 0.0543, - "span_lines": 867, - "span_line_share": 0.0761, - "code_lines": 856, - "code_line_share": 0.0754 + "functions": 77, + "function_share": 0.0735, + "span_lines": 1371, + "span_line_share": 0.118, + "code_lines": 1356, + "code_line_share": 0.1173 }, "closure": { - "functions": 105, - "function_share": 0.1018, - "span_lines": 1202, - "span_line_share": 0.1055, - "code_lines": 1198, - "code_line_share": 0.1055 + "functions": 124, + "function_share": 0.1184, + "span_lines": 1500, + "span_line_share": 0.1292, + "code_lines": 1496, + "code_line_share": 0.1294 } } }, "decision_without_trait_instance_records": { "scope": "decision", "minimum_code_lines": 0, - "functions": 1031, - "span_lines": 11396, - "code_lines": 11353, + "functions": 1047, + "span_lines": 11614, + "code_lines": 11563, "by_level": { "translated": { - "functions": 110, - "function_share": 0.1067, - "span_lines": 1300, - "span_line_share": 0.1141, - "code_lines": 1289, - "code_line_share": 0.1135 + "functions": 134, + "function_share": 0.128, + "span_lines": 1848, + "span_line_share": 0.1591, + "code_lines": 1833, + "code_line_share": 0.1585 }, "direct": { - "functions": 56, - "function_share": 0.0543, - "span_lines": 867, - "span_line_share": 0.0761, - "code_lines": 856, - "code_line_share": 0.0754 + "functions": 77, + "function_share": 0.0735, + "span_lines": 1371, + "span_line_share": 0.118, + "code_lines": 1356, + "code_line_share": 0.1173 }, "closure": { - "functions": 109, - "function_share": 0.1057, - "span_lines": 1297, - "span_line_share": 0.1138, - "code_lines": 1286, - "code_line_share": 0.1133 + "functions": 133, + "function_share": 0.127, + "span_lines": 1845, + "span_line_share": 0.1589, + "code_lines": 1830, + "code_line_share": 0.1583 } } } @@ -506,18 +579,18 @@ "refined_closure_code_lines": 0 }, "core/crates/auths-composition": { - "decision_functions": 8, - "decision_code_lines": 160, - "translated": 0, - "refined_closure": 0, - "refined_closure_code_lines": 0 + "decision_functions": 10, + "decision_code_lines": 155, + "translated": 10, + "refined_closure": 10, + "refined_closure_code_lines": 155 }, "core/crates/auths-model": { - "decision_functions": 540, - "decision_code_lines": 3886, - "translated": 71, - "refined_closure": 71, - "refined_closure_code_lines": 649 + "decision_functions": 548, + "decision_code_lines": 3944, + "translated": 75, + "refined_closure": 75, + "refined_closure_code_lines": 695 }, "core/crates/auths-ports": { "decision_functions": 0, @@ -527,39 +600,60 @@ "refined_closure_code_lines": 0 }, "core/crates/auths-registries": { - "decision_functions": 82, - "decision_code_lines": 1152, + "decision_functions": 83, + "decision_code_lines": 1202, + "translated": 6, + "refined_closure": 6, + "refined_closure_code_lines": 262 + }, + "core/crates/auths-signature": { + "decision_functions": 0, + "decision_code_lines": 0, + "translated": 0, + "refined_closure": 0, + "refined_closure_code_lines": 0 + }, + "core/crates/auths-signature-core": { + "decision_functions": 0, + "decision_code_lines": 0, "translated": 0, "refined_closure": 0, "refined_closure_code_lines": 0 }, "core/crates/auths-verifier": { - "decision_functions": 116, - "decision_code_lines": 3143, + "decision_functions": 120, + "decision_code_lines": 3239, + "translated": 3, + "refined_closure": 3, + "refined_closure_code_lines": 62 + }, + "extraction-selector:auths_profile_construction": { + "decision_functions": 0, + "decision_code_lines": 0, "translated": 0, "refined_closure": 0, "refined_closure_code_lines": 0 }, "product/policy/auths-bounded-policy": { - "decision_functions": 108, - "decision_code_lines": 716, - "translated": 18, - "refined_closure": 18, - "refined_closure_code_lines": 182 + "decision_functions": 109, + "decision_code_lines": 735, + "translated": 19, + "refined_closure": 19, + "refined_closure_code_lines": 201 }, "product/runtime/auths-connections": { - "decision_functions": 153, - "decision_code_lines": 1887, - "translated": 5, - "refined_closure": 5, - "refined_closure_code_lines": 51 + "decision_functions": 166, + "decision_code_lines": 2059, + "translated": 24, + "refined_closure": 24, + "refined_closure_code_lines": 279 }, "product/runtime/auths-gateway-kernel": { - "decision_functions": 98, - "decision_code_lines": 1194, - "translated": 95, - "refined_closure": 95, - "refined_closure_code_lines": 1168 + "decision_functions": 132, + "decision_code_lines": 1582, + "translated": 129, + "refined_closure": 129, + "refined_closure_code_lines": 1556 }, "product/runtime/auths-lifecycle": { "decision_functions": 138, @@ -567,21 +661,28 @@ "translated": 6, "refined_closure": 6, "refined_closure_code_lines": 200 + }, + "product/stores/auths-stores": { + "decision_functions": 2, + "decision_code_lines": 12, + "translated": 2, + "refined_closure": 2, + "refined_closure_code_lines": 12 } }, "second_parser": { "parser": "syn 2 (full syntax tree), independent of the scanner's tokenizer", - "decision_functions": 1031, - "decision_files": 30, - "agreements": 1014, - "agreement_share": 0.9835, + "decision_functions": 1047, + "decision_files": 32, + "agreements": 1027, + "agreement_share": 0.9809, "disagreements": [ { "file": "core/crates/auths-model/src/lib.rs", "function": "name::parse", "scanner_span": [ - 142, - 144 + 131, + 136 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -589,8 +690,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::as_str", "scanner_span": [ - 147, - 149 + 139, + 141 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -598,8 +699,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::fmt", "scanner_span": [ - 153, - 155 + 145, + 147 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -607,8 +708,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::new", "scanner_span": [ - 271, - 273 + 253, + 255 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -616,8 +717,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::from_digest", "scanner_span": [ - 276, - 278 + 258, + 260 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -625,8 +726,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::digest", "scanner_span": [ - 281, - 283 + 263, + 265 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -634,8 +735,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::as_bytes", "scanner_span": [ - 286, - 288 + 268, + 270 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -643,8 +744,8 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "name::from", "scanner_span": [ - 292, - 294 + 274, + 276 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -652,8 +753,35 @@ "file": "core/crates/auths-model/src/lib.rs", "function": "Digest::from", "scanner_span": [ - 298, - 300 + 280, + 282 + ], + "reason": "inside a macro_rules! body (syn parses it as a token tree)" + }, + { + "file": "core/crates/auths-model/src/lib.rs", + "function": "code", + "scanner_span": [ + 4983, + 4985 + ], + "reason": "inside a macro_rules! body (syn parses it as a token tree)" + }, + { + "file": "core/crates/auths-model/src/lib.rs", + "function": "code_precedes", + "scanner_span": [ + 4993, + 4995 + ], + "reason": "inside a macro_rules! body (syn parses it as a token tree)" + }, + { + "file": "core/crates/auths-model/src/lib.rs", + "function": "code_order", + "scanner_span": [ + 4997, + 4999 ], "reason": "inside a macro_rules! body (syn parses it as a token tree)" }, @@ -734,158 +862,158 @@ }, "check_sites": { "total": 82, - "covered": 15, - "share": 0.1829, + "covered": 23, + "share": 0.2805, "sites": [ { "site": "decode.action-bytes", "code": "resource-limit-exceeded", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "Whole canonical-action input over the action-bytes limit; codec_failure maps LimitExceeded to resource-limit-exceeded.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, { "site": "decode.action-map", "code": "malformed-proof", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "A canonical-action map header with the wrong number of pairs, as when the first pair is duplicated; map returns Malformed.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "map", - "begin_line": 40, - "refined_closure": false + "begin_line": 44, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, { "site": "decode.action-key", "code": "non-canonical-proof", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "A canonical-action map key out of the canonical order; key returns NonCanonical.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "key", - "begin_line": 66, - "refined_closure": false + "begin_line": 70, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, { "site": "decode.action-field", "code": "malformed-proof", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "A canonical-action field that does not decode as its type: truncated input, a zero profile version, a media type with whitespace, a body sent as text, or an indefinite-length attachment array.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "profile_ref", - "begin_line": 118, - "refined_closure": false + "begin_line": 126, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "text", - "begin_line": 74, - "refined_closure": false + "begin_line": 78, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "bounded_bytes", - "begin_line": 78, - "refined_closure": false + "begin_line": 85, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "array", - "begin_line": 48, - "refined_closure": false + "begin_line": 52, + "refined_closure": true } ] }, { "site": "decode.action-body-bytes", "code": "resource-limit-exceeded", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "Canonical body byte string over the canonical-body-bytes limit passed by decode_canonical_action.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "bounded_bytes", - "begin_line": 78, - "refined_closure": false + "begin_line": 85, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, { "site": "decode.attachment-bytes", "code": "resource-limit-exceeded", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "Single detached attachment over the attachment-bytes limit, rejected per attachment before the cumulative check.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "bounded_bytes", - "begin_line": 78, - "refined_closure": false + "begin_line": 85, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, @@ -900,61 +1028,61 @@ "role": "refusal", "file": "core/crates/auths-model/src/lib.rs", "function": "CanonicalAction::with_detached_attachments", - "begin_line": 1674, + "begin_line": 1675, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, { "site": "decode.action-trailing", "code": "malformed-proof", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "Bytes after the canonical action's map; ensure_complete returns Malformed.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "ensure_complete", - "begin_line": 1284, - "refined_closure": false + "begin_line": 1313, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true } ] }, { "site": "decode.action-canonical", "code": "non-canonical-proof", - "covered": false, - "stage": "codec: AP-SPEC-061", + "covered": true, + "stage": "covered", "note": "Input that decodes but is not the canonical encoding, as with a non-shortest key or attachments out of order; the re-encoding comparison returns NonCanonical.", "functions": [ { "role": "refusal", "file": "core/crates/auths-codec/src/decode.rs", "function": "decode_canonical_action", - "begin_line": 1548, - "refined_closure": false + "begin_line": 1630, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-codec/src/encode.rs", "function": "encode_canonical_action", "begin_line": 380, - "refined_closure": false + "refined_closure": true } ] }, @@ -969,7 +1097,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -985,7 +1113,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1001,7 +1129,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1017,7 +1145,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1033,7 +1161,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1049,7 +1177,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1065,14 +1193,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "AcceptedRegistries::accepts_profile", - "begin_line": 4113, + "begin_line": 4162, "refined_closure": false } ] @@ -1088,7 +1216,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1104,7 +1232,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1120,14 +1248,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "ValidityWindow::contains", - "begin_line": 405, + "begin_line": 387, "refined_closure": false } ] @@ -1143,7 +1271,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false } ] @@ -1159,14 +1287,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/lib.rs", "function": "same_shared_action", - "begin_line": 2298, + "begin_line": 2316, "refined_closure": false } ] @@ -1182,14 +1310,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "evaluate_extensions", - "begin_line": 2624, + "begin_line": 2681, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "AcceptedRegistries::accepts_critical_extension", - "begin_line": 4107, + "begin_line": 4156, "refined_closure": false } ] @@ -1205,14 +1333,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "evaluate_extensions", - "begin_line": 2624, + "begin_line": 2681, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", "function": "ImmutableRegistries::extension_handler", - "begin_line": 1117, + "begin_line": 1173, "refined_closure": false } ] @@ -1228,7 +1356,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "evaluate_extensions", - "begin_line": 2624, + "begin_line": 2681, "refined_closure": false }, { @@ -1251,7 +1379,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/observation.rs", "function": "validate_observation_attachments", - "begin_line": 58, + "begin_line": 64, "refined_closure": false } ] @@ -1267,7 +1395,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_attachments", - "begin_line": 2206, + "begin_line": 2224, "refined_closure": false } ] @@ -1283,7 +1411,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_attachments", - "begin_line": 2206, + "begin_line": 2224, "refined_closure": false } ] @@ -1299,7 +1427,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_attachments", - "begin_line": 2206, + "begin_line": 2224, "refined_closure": false } ] @@ -1315,7 +1443,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_attachments", - "begin_line": 2206, + "begin_line": 2224, "refined_closure": false } ] @@ -1331,7 +1459,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_attachments", - "begin_line": 2206, + "begin_line": 2224, "refined_closure": false } ] @@ -1347,7 +1475,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_attachments", - "begin_line": 2206, + "begin_line": 2224, "refined_closure": false } ] @@ -1363,14 +1491,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_action_binding", - "begin_line": 2124, + "begin_line": 2142, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", "function": "ImmutableRegistries::profile_policy", - "begin_line": 1077, + "begin_line": 1133, "refined_closure": false } ] @@ -1386,14 +1514,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "verify_signed", - "begin_line": 1955, + "begin_line": 1973, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "control_for", - "begin_line": 2590, + "begin_line": 2647, "refined_closure": false } ] @@ -1409,7 +1537,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "verify_branch", - "begin_line": 2326, + "begin_line": 2345, "refined_closure": false } ] @@ -1425,21 +1553,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_status_extensions", - "begin_line": 2661, + "begin_line": 2718, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "AcceptedRegistries::accepts_critical_extension", - "begin_line": 4107, + "begin_line": 4156, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_principal_status", - "begin_line": 2698, + "begin_line": 2755, "refined_closure": false } ] @@ -1455,14 +1583,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_status_extensions", - "begin_line": 2661, + "begin_line": 2718, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_principal_status", - "begin_line": 2698, + "begin_line": 2755, "refined_closure": false } ] @@ -1478,21 +1606,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "status_decision", - "begin_line": 2788, - "refined_closure": false + "begin_line": 2859, + "refined_closure": true }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", - "function": "select_principal", - "begin_line": 545, - "refined_closure": false + "function": "select_principal_from_snapshot", + "begin_line": 541, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_principal_status", - "begin_line": 2698, + "begin_line": 2755, "refined_closure": false }, { @@ -1500,7 +1628,7 @@ "file": "core/crates/auths-registries/src/lib.rs", "function": "ExactStatusMethod::principal", "begin_line": 486, - "refined_closure": false + "refined_closure": true } ] }, @@ -1515,21 +1643,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_status_extensions", - "begin_line": 2661, + "begin_line": 2718, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "AcceptedRegistries::accepts_critical_extension", - "begin_line": 4107, + "begin_line": 4156, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_grant_status", - "begin_line": 2747, + "begin_line": 2805, "refined_closure": false } ] @@ -1545,14 +1673,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_status_extensions", - "begin_line": 2661, + "begin_line": 2718, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_grant_status", - "begin_line": 2747, + "begin_line": 2805, "refined_closure": false } ] @@ -1568,29 +1696,29 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "status_decision", - "begin_line": 2788, - "refined_closure": false + "begin_line": 2859, + "refined_closure": true }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", - "function": "select_grant", - "begin_line": 615, - "refined_closure": false + "function": "select_grant_from_snapshot", + "begin_line": 642, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_grant_status", - "begin_line": 2747, + "begin_line": 2805, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-registries/src/lib.rs", "function": "ExactStatusMethod::grant", - "begin_line": 515, - "refined_closure": false + "begin_line": 504, + "refined_closure": true } ] }, @@ -1605,21 +1733,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "status_decision", - "begin_line": 2788, - "refined_closure": false + "begin_line": 2859, + "refined_closure": true }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", - "function": "select_principal", - "begin_line": 545, - "refined_closure": false + "function": "select_principal_from_snapshot", + "begin_line": 541, + "refined_closure": true }, { "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "check_principal_status", - "begin_line": 2698, + "begin_line": 2755, "refined_closure": false }, { @@ -1627,7 +1755,7 @@ "file": "core/crates/auths-registries/src/lib.rs", "function": "ExactStatusMethod::principal", "begin_line": 486, - "refined_closure": false + "refined_closure": true } ] }, @@ -1642,14 +1770,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_resource_constraints", - "begin_line": 2814, + "begin_line": 2885, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", "function": "ImmutableRegistries::resource_matcher", - "begin_line": 1057, + "begin_line": 1113, "refined_closure": false } ] @@ -1665,7 +1793,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_resource_constraints", - "begin_line": 2814, + "begin_line": 2885, "refined_closure": false }, { @@ -1688,7 +1816,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_resource_constraints", - "begin_line": 2814, + "begin_line": 2885, "refined_closure": false }, { @@ -1711,14 +1839,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", "function": "ImmutableRegistries::budget_algebra", - "begin_line": 1097, + "begin_line": 1153, "refined_closure": false } ] @@ -1734,7 +1862,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { @@ -1757,7 +1885,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { @@ -1780,14 +1908,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "AcceptedRegistries::profile_budget_expression", - "begin_line": 4136, + "begin_line": 4185, "refined_closure": false } ] @@ -1803,14 +1931,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", "function": "ImmutableRegistries::budget_algebra", - "begin_line": 1097, + "begin_line": 1153, "refined_closure": false } ] @@ -1826,7 +1954,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { @@ -1856,7 +1984,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_budget_constraints", - "begin_line": 2849, + "begin_line": 2920, "refined_closure": false }, { @@ -1886,14 +2014,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/observation.rs", "function": "require_parent_requirements", - "begin_line": 111, + "begin_line": 117, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/observation.rs", "function": "chain_requirements", - "begin_line": 80, + "begin_line": 86, "refined_closure": false }, { @@ -1944,7 +2072,7 @@ "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "optional_grant_id_equal", - "begin_line": 513, + "begin_line": 495, "refined_closure": true } ] @@ -2004,7 +2132,7 @@ "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "profile_ref_equal", - "begin_line": 478, + "begin_line": 460, "refined_closure": true }, { @@ -2034,14 +2162,14 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "permission_set_is_subset", - "begin_line": 604, + "begin_line": 586, "refined_closure": true }, { "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "permission_set_contains", - "begin_line": 590, + "begin_line": 572, "refined_closure": true }, { @@ -2071,14 +2199,14 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "validity_window_contains", - "begin_line": 435, + "begin_line": 417, "refined_closure": true }, { "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "inclusive_window_contains", - "begin_line": 423, + "begin_line": 405, "refined_closure": true }, { @@ -2108,14 +2236,14 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "audience_set_is_subset", - "begin_line": 671, + "begin_line": 653, "refined_closure": true }, { "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "audience_set_contains", - "begin_line": 657, + "begin_line": 639, "refined_closure": true }, { @@ -2145,7 +2273,7 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "action_constraint_attenuates", - "begin_line": 827, + "begin_line": 809, "refined_closure": true }, { @@ -2175,7 +2303,7 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "status_policy_attenuates", - "begin_line": 1026, + "begin_line": 1008, "refined_closure": true }, { @@ -2205,7 +2333,7 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "assurance_policy_id_equal", - "begin_line": 499, + "begin_line": 481, "refined_closure": true }, { @@ -2263,7 +2391,7 @@ "role": "also", "file": "core/crates/auths-registries/src/lib.rs", "function": "AcceptedExtensionLaws::attenuates", - "begin_line": 1259, + "begin_line": 1315, "refined_closure": false }, { @@ -2307,7 +2435,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "evaluate_extensions", - "begin_line": 2624, + "begin_line": 2681, "refined_closure": false }, { @@ -2365,7 +2493,7 @@ "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "optional_grant_id_equal", - "begin_line": 513, + "begin_line": 495, "refined_closure": true } ] @@ -2395,7 +2523,7 @@ "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "profile_ref_equal", - "begin_line": 478, + "begin_line": 460, "refined_closure": true } ] @@ -2418,7 +2546,7 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "permission_set_contains", - "begin_line": 590, + "begin_line": 572, "refined_closure": true } ] @@ -2441,14 +2569,14 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "validity_window_contains", - "begin_line": 435, + "begin_line": 417, "refined_closure": true }, { "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "inclusive_window_contains", - "begin_line": 423, + "begin_line": 405, "refined_closure": true } ] @@ -2471,7 +2599,7 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "audience_set_contains", - "begin_line": 657, + "begin_line": 639, "refined_closure": true } ] @@ -2494,7 +2622,7 @@ "role": "guard", "file": "core/crates/auths-model/src/lib.rs", "function": "action_constraint_allows", - "begin_line": 816, + "begin_line": 798, "refined_closure": true } ] @@ -2510,14 +2638,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "validate_assurance_claims", - "begin_line": 2917, + "begin_line": 2988, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-registries/src/lib.rs", "function": "ImmutableRegistries::assurance_claim", - "begin_line": 1189, + "begin_line": 1245, "refined_closure": false } ] @@ -2540,7 +2668,7 @@ "role": "also", "file": "core/crates/auths-verifier/src/lib.rs", "function": "evaluate_branch_assurance", - "begin_line": 2534, + "begin_line": 2562, "refined_closure": false } ] @@ -2556,21 +2684,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/observation.rs", "function": "Stage::evaluate", - "begin_line": 137, + "begin_line": 143, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/observation.rs", "function": "Stage::in_authority_chain", - "begin_line": 181, + "begin_line": 191, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-model/src/lib.rs", "function": "principal_id_equal", - "begin_line": 201, + "begin_line": 183, "refined_closure": true } ] @@ -2586,7 +2714,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/observation.rs", "function": "Stage::requirement", - "begin_line": 218, + "begin_line": 228, "refined_closure": false }, { @@ -2616,7 +2744,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/observation.rs", "function": "Stage::requirement", - "begin_line": 218, + "begin_line": 228, "refined_closure": false }, { @@ -2639,14 +2767,14 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/observation.rs", "function": "Stage::requirement", - "begin_line": 218, + "begin_line": 228, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/observation.rs", "function": "Stage::action_facts", - "begin_line": 285, + "begin_line": 305, "refined_closure": false }, { @@ -2669,21 +2797,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate_list", - "begin_line": 185, + "begin_line": 186, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate", - "begin_line": 243, + "begin_line": 257, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/approval.rs", "function": "chain_requirements", - "begin_line": 81, + "begin_line": 82, "refined_closure": false }, { @@ -2720,21 +2848,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate_list", - "begin_line": 185, + "begin_line": 186, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate", - "begin_line": 243, + "begin_line": 257, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/approval.rs", "function": "status_verdict", - "begin_line": 367, + "begin_line": 387, "refined_closure": false }, { @@ -2764,7 +2892,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "verify_authority_measured", - "begin_line": 1628, + "begin_line": 1641, "refined_closure": false } ] @@ -2780,7 +2908,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "verify_authority_measured", - "begin_line": 1628, + "begin_line": 1641, "refined_closure": false } ] @@ -2796,7 +2924,7 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/lib.rs", "function": "verify_authority_measured", - "begin_line": 1628, + "begin_line": 1641, "refined_closure": false } ] @@ -2812,28 +2940,28 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate_list", - "begin_line": 185, + "begin_line": 186, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate", - "begin_line": 243, + "begin_line": 257, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/approval.rs", "function": "binds_exact", - "begin_line": 125, + "begin_line": 126, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/approval.rs", "function": "signature_verdict", - "begin_line": 324, + "begin_line": 344, "refined_closure": false }, { @@ -2870,21 +2998,21 @@ "role": "refusal", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate_list", - "begin_line": 185, + "begin_line": 186, "refined_closure": false }, { "role": "guard", "file": "core/crates/auths-verifier/src/approval.rs", "function": "Approvals::evaluate", - "begin_line": 243, + "begin_line": 257, "refined_closure": false }, { "role": "also", "file": "core/crates/auths-verifier/src/approval.rs", "function": "status_verdict", - "begin_line": 367, + "begin_line": 387, "refined_closure": false }, { @@ -2905,20 +3033,311 @@ } ] }, - "translated_outside_closure": [], + "translated_outside_closure": [ + { + "rust_name": "auths_profile_construction::construct", + "lean_name": "auths_profile_construction.construct", + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "span": [ + 5, + 10 + ], + "decision_scope": false + }, + { + "rust_name": "auths_profile_construction::parse_provider", + "lean_name": "auths_profile_construction.parse_provider", + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "span": [ + 13, + 17 + ], + "decision_scope": false + }, + { + "rust_name": "auths_profile_construction::parse_alias", + "lean_name": "auths_profile_construction.parse_alias", + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "span": [ + 20, + 24 + ], + "decision_scope": false + }, + { + "rust_name": "auths_profile_construction::parse_semantic", + "lean_name": "auths_profile_construction.parse_semantic", + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "span": [ + 27, + 31 + ], + "decision_scope": false + } + ], "theorem_kinds": { "classified": { + "Auths.Codec.Action.accepted_encoding_unique": "partial", + "Auths.Codec.Action.bounded_bytes_valid": "partial", + "Auths.Codec.Action.decode_encode_exact": "partial", + "Auths.Codec.Action.decoded_body_valid": "partial", + "Auths.Codec.Action.decoded_body_within_deployment": "partial", + "Auths.Codec.Collection.array_exact": "exact", + "Auths.Codec.Collection.collection_exact": "exact", + "Auths.Codec.Collection.map_exact": "exact", + "Auths.Codec.Cursor.at_exact": "exact", + "Auths.Codec.Cursor.datatype_exact": "exact", + "Auths.Codec.Cursor.ensure_complete_exact": "exact", + "Auths.Codec.Cursor.head_exact": "exact", + "Auths.Codec.Cursor.new_exact": "exact", + "Auths.Codec.Cursor.null_exact": "exact", + "Auths.Codec.Cursor.position_exact": "exact", + "Auths.Codec.Cursor.u16_exact": "exact", + "Auths.Codec.Cursor.u64_exact": "exact", + "Auths.Codec.Cursor.u8_exact": "exact", + "Auths.Codec.Examples.action_byte_limit_exact": "case", + "Auths.Codec.Examples.action_byte_limit_refused": "case", + "Auths.Codec.Examples.duplicate_key_refused": "case", + "Auths.Codec.Examples.invalid_utf8_refused": "case", + "Auths.Codec.Examples.minimal_action_accepted": "case", + "Auths.Codec.Examples.minimal_encoding_exact": "case", + "Auths.Codec.Examples.nonminimal_integer_refused": "case", + "Auths.Codec.Examples.trailing_byte_refused": "case", + "Auths.Codec.Examples.truncated_refused": "case", + "Auths.Codec.Fields.array_exact": "exact", + "Auths.Codec.Fields.bounded_bytes_exact": "exact", + "Auths.Codec.Fields.digest_bytes_exact": "exact", + "Auths.Codec.Fields.is_null_exact": "exact", + "Auths.Codec.Fields.key_exact": "exact", + "Auths.Codec.Fields.map_exact": "exact", + "Auths.Codec.Fields.null_exact": "exact", + "Auths.Codec.Fields.text_exact": "exact", + "Auths.Codec.Payload.bytes_exact": "exact", + "Auths.Codec.Payload.payload_exact": "exact", + "Auths.Codec.Payload.str_exact": "exact", + "Auths.Codec.Payload.success_earns_span": "partial", + "Auths.Codec.Refinement.Encoder.append_tail_exact": "partial", + "Auths.Codec.Refinement.Encoder.encode_head_byte_bound": "partial", + "Auths.Codec.Refinement.Encoder.encode_head_refines": "exact", + "Auths.Codec.Refinement.Encoder.encode_head_roundtrip": "partial", + "Auths.Codec.Refinement.read_head_accepts_encoding": "partial", + "Auths.Codec.Refinement.read_head_refines": "exact", + "Auths.Codec.Refinement.read_tail_bounded": "exact", + "Auths.Composition.Bounds.source_bounded_events": "partial", + "Auths.Composition.Facade.evaluate_refines": "exact", + "Auths.Composition.Facade.event_outcome_exact": "exact", + "Auths.Composition.Facade.invalid_plan_preserves_callback": "partial", + "Auths.Composition.Facade.observer_mut_exact": "exact", + "Auths.Composition.Facade.observer_once_exact": "exact", + "Auths.Composition.FacadeExamples.conjunction_authorizes": "case", + "Auths.Composition.FacadeExamples.duplicate_refused": "case", + "Auths.Composition.FacadeExamples.threshold_indeterminate": "case", + "Auths.Composition.PlanExamples.all_visits_after_denial": "case", + "Auths.Composition.PlanExamples.any_visits_after_authorization": "case", + "Auths.Composition.PlanExamples.threshold_indeterminate": "case", + "Auths.Composition.PlanExamples.threshold_refused": "case", + "Auths.Composition.PlanExamples.two_leaf_conjunction": "case", + "Auths.Composition.Refinement.all_exact": "exact", + "Auths.Composition.Refinement.push_exact": "partial", + "Auths.Composition.Refinement.threshold_authorized_exact": "verdict-exact", + "Auths.Composition.Refinement.threshold_exact": "exact", + "Auths.Composition.Traversal.evaluator_refines": "exact", + "Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks": "partial", + "Auths.Composition.ValidationContract.public_event_bound": "partial", + "Auths.Composition.ValidationContract.valid_public_evaluator_refines": "exact", + "Auths.Composition.ValidationExamples.duplicate_refused": "case", + "Auths.Composition.ValidationExamples.narrow_refused": "case", + "Auths.Composition.ValidationExamples.public_conjunction": "case", + "Auths.Composition.ValidationExamples.public_threshold_indeterminate": "case", + "Auths.Composition.ValidationExamples.shallow_refused": "case", + "Auths.Composition.ValidationExamples.zero_threshold_refused": "case", + "Auths.Composition.ValidationPublic.public_evaluator_refines": "exact", + "Auths.Composition.Work.source_event_count": "partial", + "Auths.Composition.Work.source_leaf_order": "partial", + "Auths.Crypto.BufferAllocation.accepted_capacity_fits": "partial", + "Auths.Crypto.BufferAllocation.accepted_empty": "partial", + "Auths.Crypto.BufferAllocation.buffer_refines": "exact", + "Auths.Crypto.CommitmentExamples.application_sample_admitted": "case", + "Auths.Crypto.CommitmentExamples.empty_domain_refused": "case", + "Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted": "case", + "Auths.Crypto.CommitmentExamples.oversized_domain_refused": "case", + "Auths.Crypto.CommitmentRefinement.application_preimage_exact": "partial", + "Auths.Crypto.CommitmentRefinement.identifier_preimage_exact": "partial", + "Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind": "partial", + "Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind": "partial", + "Auths.Crypto.CommitmentValidity.application_accepted_frame_valid": "partial", + "Auths.Crypto.CommitmentValidity.application_output_length": "partial", + "Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid": "partial", + "Auths.Crypto.CommitmentValidity.identifier_output_length": "partial", + "Auths.Crypto.CoordinateContract.guard_refines": "exact", + "Auths.Crypto.CoordinateScan.loop_refines": "partial", + "Auths.Crypto.Encoding.Ed25519.guard_refines": "verdict-exact", + "Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted": "case", + "Auths.Crypto.Encoding.Examples.compressed_form_accepted": "case", + "Auths.Crypto.Encoding.Examples.field_alias_refused": "case", + "Auths.Crypto.Encoding.Examples.negative_zero_refused": "case", + "Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted": "case", + "Auths.Crypto.Encoding.Examples.short_compressed_refused": "case", + "Auths.Crypto.Encoding.Examples.uncompressed_tag_refused": "case", + "Auths.Crypto.Encoding.P256.guard_refines": "verdict-exact", + "Auths.Crypto.Encoding.RootFlags.root_flags": "partial", + "Auths.Crypto.Encoding.Scan.loop_refines": "partial", + "Auths.Crypto.Examples.minimal_preimage_exact": "case", + "Auths.Crypto.Examples.unicode_preimage_exact": "case", + "Auths.Crypto.FramingTotality.application_accepts_iff": "exact", + "Auths.Crypto.FramingTotality.application_refuses_iff": "exact", + "Auths.Crypto.FramingTotality.application_total": "exact", + "Auths.Crypto.FramingTotality.identifier_accepts_iff": "exact", + "Auths.Crypto.FramingTotality.identifier_refuses_iff": "exact", + "Auths.Crypto.FramingTotality.identifier_total": "exact", + "Auths.Crypto.FramingTotality.signing_accepts_iff": "exact", + "Auths.Crypto.FramingTotality.signing_refuses_iff": "exact", + "Auths.Crypto.FramingTotality.signing_total": "exact", + "Auths.Crypto.LowContract.guard_refines": "exact", + "Auths.Crypto.LowContract.r_bytes_irrelevant": "partial", + "Auths.Crypto.LowScan.loop_refines": "partial", + "Auths.Crypto.Native.decode_leaf_refines": "exact", + "Auths.Crypto.Native.equation_leaf_refines": "exact", + "Auths.Crypto.Native.public_validate_refines": "exact", + "Auths.Crypto.Native.public_verify_accepts_iff": "verdict-exact", + "Auths.Crypto.Native.public_verify_refines": "exact", + "Auths.Crypto.NativeExamples.changed_message_is_refused": "case", + "Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract": "case", + "Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes": "case", + "Auths.Crypto.P256Encoding.guard_refines": "exact", + "Auths.Crypto.P256Examples.changed_key_is_refused": "case", + "Auths.Crypto.P256Examples.changed_message_is_refused": "case", + "Auths.Crypto.P256Examples.changed_signature_is_refused": "case", + "Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract": "case", + "Auths.Crypto.P256Examples.public_call_forwards_exact_bytes": "case", + "Auths.Crypto.P256LowContract.guard_refines": "exact", + "Auths.Crypto.P256LowContract.r_bytes_irrelevant": "partial", + "Auths.Crypto.P256LowScan.loop_refines": "exact", + "Auths.Crypto.P256Native.decode_leaf_refines": "exact", + "Auths.Crypto.P256Native.decode_refines": "exact", + "Auths.Crypto.P256Native.equation_leaf_refines": "exact", + "Auths.Crypto.P256Native.parse_leaf_refines": "exact", + "Auths.Crypto.P256Native.public_accepts_iff": "verdict-exact", + "Auths.Crypto.P256Native.public_validate_refines": "exact", + "Auths.Crypto.P256Native.public_verify_refines": "exact", + "Auths.Crypto.RContract.guard_refines": "exact", + "Auths.Crypto.Refinement.accepted_frame_valid": "partial", + "Auths.Crypto.Refinement.accepted_preimages_bind_inputs": "partial", + "Auths.Crypto.Refinement.object_domains_separate": "partial", + "Auths.Crypto.Refinement.preimage_length_exact": "partial", + "Auths.Crypto.Refinement.profile_limit_refused": "partial", + "Auths.Crypto.Refinement.signing_preimage_exact": "partial", + "Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest": "case", + "Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest": "case", + "Auths.Crypto.Sha256Native.raw_hash_refines": "exact", + "Auths.Crypto.Strict.Examples.above_half_s_refused": "case", + "Auths.Crypto.Strict.Examples.half_s_form_allowed": "case", + "Auths.Crypto.Strict.Examples.identity_coordinate_is_weak": "case", + "Auths.Crypto.Strict.Examples.maximum_s_refused": "case", + "Auths.Crypto.Strict.Examples.public_r_form_allowed": "case", + "Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak": "case", + "Auths.Crypto.Strict.Examples.weak_r_form_refused": "case", + "Auths.Crypto.Strict.Examples.zero_s_form_allowed": "case", + "Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff": "verdict-exact", + "Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff": "verdict-exact", + "Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines": "exact", + "Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines": "exact", + "Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines": "exact", + "Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines": "exact", + "Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines": "exact", + "Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused": "case", + "Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted": "case", + "Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused": "case", + "Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted": "case", + "Auths.Crypto.SuiteAdapters.ed_accepts_iff": "verdict-exact", + "Auths.Crypto.SuiteAdapters.ed_public_refines": "exact", + "Auths.Crypto.SuiteAdapters.p256_accepts_iff": "verdict-exact", + "Auths.Crypto.SuiteAdapters.p256_public_refines": "exact", + "Auths.Crypto.WeakContract.guard_refines": "exact", "Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich": "exact", "Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich": "exact", "Auths.Lifecycle.Refinement.translated_replay_refines_rich": "exact", + "Auths.Lifecycle.Refinement.translated_terminal_refines_rich": "exact", "Auths.Lifecycle.Refinement.translated_transition_refines_rich": "exact", + "Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact": "exact", + "Auths.Product.ConnectionBytes.Refinement.lower_tail_exact": "exact", + "Auths.Product.ConnectionBytes.Refinement.lower_valid_exact": "exact", + "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul": "partial", + "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound": "partial", + "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul": "partial", + "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound": "partial", + "Auths.Product.ConnectionEntry.Refinement.entry_allows_exact": "exact", + "Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact": "exact", + "Auths.Product.ConnectionEntry.Refinement.source_disabled_refused": "partial", + "Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile": "partial", + "Auths.Product.ConnectionEntry.Refinement.source_revoked_refused": "partial", + "Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact": "exact", + "Auths.Product.CounterAggregation.Refinement.aggregate_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.contribute_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.contribute_sum_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.count_capacity_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.counter_equal_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.counter_position_spec": "exact", + "Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact": "exact", + "Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities": "partial", + "Auths.Product.CounterAggregation.Refinement.source_aggregate_unique": "partial", + "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities": "partial", + "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique": "partial", + "Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum": "exact", + "Auths.Product.CounterAggregation.Refinement.sum_position_spec": "exact", + "Auths.Product.CounterFrames.Refinement.component_exact": "exact", + "Auths.Product.CounterFrames.Refinement.coordinates_exact": "exact", + "Auths.Product.CounterFrames.Refinement.count_exact": "exact", + "Auths.Product.CounterFrames.Refinement.count_slot_exact": "exact", + "Auths.Product.CounterFrames.Refinement.count_source_binds_inputs": "partial", + "Auths.Product.CounterFrames.Refinement.sum_exact": "exact", + "Auths.Product.CounterFrames.Refinement.sum_slot_exact": "exact", + "Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs": "partial", + "Auths.Product.CounterFrames.Refinement.word_exact": "exact", + "Auths.Product.Frontier.Refinement.candidate_exact": "exact", + "Auths.Product.Frontier.Refinement.observe_exact": "exact", + "Auths.Product.Frontier.Refinement.probe_exact": "exact", + "Auths.Product.Frontier.Refinement.source_work_bound": "partial", + "Auths.Product.Frontier.Refinement.start_exact": "exact", + "Auths.Product.OperationIdentity.Refinement.logical_preimage_exact": "exact", + "Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity": "partial", + "Auths.Product.OperationIdentity.Refinement.token_exact": "exact", + "Auths.Product.ProfileConstructor.Refinement.constructor_exact": "exact", + "Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields": "partial", + "Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused": "partial", + "Auths.Product.RecordShape.Refinement.profile_order_exact": "exact", + "Auths.Product.RecordShape.Refinement.profiles_exact": "exact", + "Auths.Product.RecordShape.Refinement.record_shape_exact": "exact", + "Auths.Product.RecordShape.Refinement.success_earns_all_invariants": "partial", + "Auths.Product.RecordShape.Refinement.text_order_exact": "exact", + "Auths.Product.RecordShape.Refinement.workloads_exact": "exact", + "Auths.Product.RecordTimes.Refinement.record_times_exact": "exact", + "Auths.Product.RecordTimes.Refinement.success_earns_order": "partial", + "Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape": "partial", + "Auths.Product.RecoveryGate.Refinement.binding_requirement_exact": "exact", + "Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation": "partial", + "Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time": "partial", + "Auths.Product.RecoveryGate.Refinement.record_change_exact": "exact", + "Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation": "partial", + "Auths.Product.RecoveryGate.Refinement.recovery_exact": "exact", + "Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation": "partial", + "Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time": "partial", + "Auths.Product.RecoveryGate.Refinement.state_transition_exact": "exact", + "Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state": "partial", "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model": "exact", "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model": "exact", + "Auths.Product.Refinement.CollectionFence.translated_advance_refines_model": "exact", + "Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses": "partial", + "Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model": "exact", "Auths.Product.Refinement.Connections.translated_lease_generation_refines_model": "exact", "Auths.Product.Refinement.Connections.translated_next_generation_refines_model": "exact", "Auths.Product.Refinement.Connections.translated_retained_generation_refines_model": "exact", "Auths.Product.Refinement.Connections.translated_rotation_refines_model": "exact", "Auths.Product.Refinement.Connections.translated_state_change_refines_model": "exact", + "Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses": "partial", + "Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model": "exact", + "Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model": "exact", "Auths.Product.Refinement.Gateway.translated_construct_action_read_refines_model": "exact", "Auths.Product.Refinement.Gateway.translated_construct_credential_read_refines_model": "exact", "Auths.Product.Refinement.Gateway.translated_construct_write_refines_model": "exact", @@ -2939,6 +3358,41 @@ "Auths.Product.Refinement.translated_checked_sub_refines_nat": "exact", "Auths.Product.Refinement.translated_configuration_refines_projection": "exact", "Auths.Product.Refinement.translated_window_index_refines_nat": "exact", + "Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact": "exact", + "Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds": "partial", + "Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors": "partial", + "Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow": "partial", + "Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum": "partial", + "Auths.Product.ReservationRetry.Refinement.retry_target_exact": "exact", + "Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay": "partial", + "Auths.Product.ReservationRetry.Refinement.source_count_progress_safe": "partial", + "Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe": "partial", + "Auths.Product.SchemaIndex.Refinement.field_index_spec": "exact", + "Auths.Product.SchemaIndex.Refinement.field_name_equal_spec": "exact", + "Auths.Product.SemanticId.Refinement.semantic_head_exact": "exact", + "Auths.Product.SemanticId.Refinement.semantic_tail_exact": "exact", + "Auths.Product.SemanticId.Refinement.semantic_valid_exact": "exact", + "Auths.Product.SemanticId.Refinement.source_earns_ascii": "partial", + "Auths.Product.SemanticId.Refinement.source_earns_bounds": "partial", + "Auths.Product.SemanticId.Refinement.source_earns_no_nul": "partial", + "Auths.Product.SlotBatch.Refinement.build_exact": "exact", + "Auths.Product.SlotBatch.Refinement.count_loop_exact": "exact", + "Auths.Product.SlotBatch.Refinement.source_claim_first": "partial", + "Auths.Product.SlotBatch.Refinement.source_complete_entry_count": "partial", + "Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused": "partial", + "Auths.Product.SlotBatch.Refinement.sum_loop_exact": "exact", + "Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec": "exact", + "Auths.Product.SlotRecord.Refinement.source_accepted_binds_record": "partial", + "Auths.Product.SlotRecord.Refinement.source_invalid_record_refused": "partial", + "Auths.Product.SlotRecord.Refinement.validate_cumulative_exact": "exact", + "Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates": "partial", + "Auths.Product.StrictOrder.Refinement.strict_order_exact": "exact", + "Auths.Product.StringConstructors.Refinement.actual_alias_exact": "exact", + "Auths.Product.StringConstructors.Refinement.actual_provider_exact": "exact", + "Auths.Product.StringConstructors.Refinement.actual_semantic_exact": "exact", + "Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload": "partial", + "Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload": "partial", + "Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload": "partial", "Auths.Refinement.Approval.translated_approval_counts_refines_model": "exact", "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model": "exact", "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model": "exact", @@ -2946,6 +3400,11 @@ "Auths.Refinement.Approval.translated_approver_verdict_refines_model": "exact", "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model": "exact", "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model": "exact", + "Auths.Refinement.Identifier.forbidden_at_exact": "exact", + "Auths.Refinement.Identifier.identifier_exact": "exact", + "Auths.Refinement.Identifier.identifier_string_exact": "partial", + "Auths.Refinement.Identifier.identifier_unicode_exact": "partial", + "Auths.Refinement.Identifier.scan_exact": "exact", "Auths.Refinement.Observation.translated_condition_test_equal_refines_model": "exact", "Auths.Refinement.Observation.translated_condition_value_holds_refines_model": "exact", "Auths.Refinement.Observation.translated_fact_name_equal_refines_model": "exact", @@ -2982,23 +3441,80 @@ "Auths.Refinement.translated_expressible_absent_request_is_denied": "partial", "Auths.Refinement.translated_inexpressible_absent_request_is_covered": "partial", "Auths.Refinement.translated_rust_refines_rich_spec": "exact", - "Auths.Rich.Mutations.profile_version_equality": "case" + "Auths.Rich.Mutations.profile_version_equality": "case", + "Auths.ScopeConstructor.DecodeExamples.accepts_any": "case", + "Auths.ScopeConstructor.DecodeExamples.accepts_listed": "case", + "Auths.ScopeConstructor.DecodeExamples.accepts_own": "case", + "Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit": "case", + "Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list": "case", + "Auths.ScopeConstructor.DecodeExamples.refuses_empty_list": "case", + "Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id": "case", + "Auths.ScopeConstructor.DecodeExamples.refuses_truncation": "case", + "Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag": "case", + "Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list": "case", + "Auths.ScopeConstructor.accepted_rule_valid": "partial", + "Auths.ScopeConstructor.accepted_scope_valid": "partial", + "Auths.ScopeConstructor.accepted_trust_valid": "partial", + "Auths.ScopeConstructor.constructed_grant_selection": "partial", + "Auths.ScopeConstructor.constructed_principal_selection": "partial", + "Auths.ScopeConstructor.decoded_scope_covers": "partial", + "Auths.ScopeConstructor.decoded_trust_grant": "partial", + "Auths.ScopeConstructor.decoded_trust_principal": "partial", + "Auths.StatusSelection.AnchorExamples.other_anchor_hidden": "case", + "Auths.StatusSelection.AnchorExamples.own_anchor_active": "case", + "Auths.StatusSelection.Examples.active_selected_horizon": "case", + "Auths.StatusSelection.Examples.latest_ties_conservatively_revoke": "case", + "Auths.StatusSelection.Examples.missing_uses_snapshot_window": "case", + "Auths.StatusSelection.Examples.newer_discards_old_stale_revocation": "case", + "Auths.StatusSelection.Examples.revoked_selected_horizon": "case", + "Auths.StatusSelection.Examples.rollback_despite_newer": "case", + "Auths.StatusSelection.Examples.stale_selected_refused": "case", + "Auths.StatusSelection.Examples.unknown_issuer_refused": "case", + "Auths.StatusSelection.Examples.wrong_method_refused": "case", + "Auths.StatusSelection.freshness_exact": "partial", + "Auths.StatusSelection.grant_loop_refines": "partial", + "Auths.StatusSelection.grant_method_all_views": "partial", + "Auths.StatusSelection.grant_method_approver_independent": "partial", + "Auths.StatusSelection.grant_method_approver_refines": "partial", + "Auths.StatusSelection.grant_selector_approver_refines": "partial", + "Auths.StatusSelection.principal_loop_refines": "partial", + "Auths.StatusSelection.principal_method_all_views": "partial", + "Auths.StatusSelection.principal_method_approver_independent": "partial", + "Auths.StatusSelection.principal_method_approver_refines": "partial", + "Auths.StatusSelection.principal_selector_approver_refines": "partial", + "Auths.StatusSelection.sequence_floor_refines": "exact", + "Auths.TemporalWitness.Examples.expired_status_refused": "case", + "Auths.TemporalWitness.Examples.inclusive_status_endpoint": "case", + "Auths.TemporalWitness.Examples.revoked_grant_refused": "case", + "Auths.TemporalWitness.Examples.revoked_principal_refused": "case", + "Auths.TemporalWitness.Status.decision_refines": "exact", + "Auths.TemporalWitness.assurance_entry_refines": "exact", + "Auths.TemporalWitness.assurance_loop_refines": "exact", + "Auths.TemporalWitness.native_horizon_permits_iff": "partial", + "Auths.TemporalWitness.status_decision_accepts_iff": "verdict-exact", + "Auths.TemporalWitness.status_horizon_accepts_iff": "verdict-exact", + "Auths.TemporalWitness.status_horizon_exact": "exact", + "Auths.TemporalWitness.status_horizon_stale_refused": "partial", + "Auths.TemporalWitness.successful_native_horizon_exact": "partial", + "AuthsSuiteAdapters.ed25519_delegates": "partial", + "AuthsSuiteAdapters.p256_delegates": "partial" } }, "translation_inventory": { - "aeneas_local_definitions": 318, + "aeneas_local_definitions": 598, "by_kind": { - "function": 210, - "loop": 92, - "derived": 16 + "function": 415, + "loop": 148, + "closure-shim": 11, + "derived": 24 }, - "refined_direct": 70, - "refined_closure": 215, - "theorems_naming_translated_functions": 75 + "refined_direct": 211, + "refined_closure": 431, + "theorems_naming_translated_functions": 421 }, "mutation_adequacy": { "results": "formal/model-mutations-v1.json", - "current_formal_inputs_sha256": "f250c011aa84a978f1f65e91ead3ed8aee7e3b6502e7d80868a583381df305db", + "current_formal_inputs_sha256": "bae0cd9f691cdc246d4b82603c819912a7fe18ec83a52ddb2cffadbdba354e44", "fresh": false, "campaigns": { "s1": { diff --git a/formal/qualification/aeneas/cases/BoundedPolicy.lean b/formal/qualification/aeneas/cases/BoundedPolicy.lean index d8b1de38e..bdd94a6a5 100644 --- a/formal/qualification/aeneas/cases/BoundedPolicy.lean +++ b/formal/qualification/aeneas/cases/BoundedPolicy.lean @@ -1,3 +1,4 @@ +import Auths.Product.ReservationAdmissionRefinement import qualification.aeneas.generated.bounded_policy.Funs open Aeneas Aeneas.Std Result @@ -87,3 +88,37 @@ example : kernel.scope_tightens none rfl end qualification.aeneas.cases + +#check Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact +#check Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds +#check Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum +#check Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors +#check Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow + +namespace qualification.aeneas.cases.ReservationAdmission +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_bounded_policy +open Auths.Product.ReservationAdmission.Refinement +private def oneWord (value : U64) : Slice U64 := ⟨[value], by simp; scalar_tac⟩ + +-- A nonempty count/slot reservation at the inclusive sum boundary admits. +example : kernel.reservation_admission (oneWord 0#u64) (oneWord 1#u64) + (oneWord 0#u64) (oneWord 1#u64) (oneWord 400#u64) (oneWord 1000#u64) 600#u64 + ⦃ actual => actual = .Admit ⦄ := by + step with reservation_admission_exact as ⟨actual, exactMeaning⟩ + change codeView actual = Auths.Product.ReservationAdmission.decideReservation [0] [1] [0] [1] [400] [1000] 600 at exactMeaning + have model : Auths.Product.ReservationAdmission.decideReservation [0] [1] [0] [1] [400] [1000] 600 = .admit := by decide + rw [model] at exactMeaning + cases actual <;> simp_all [codeView] + +-- When both count and sum are exhausted, the shipping window code wins. +example : kernel.reservation_admission (oneWord 1#u64) (oneWord 1#u64) + (oneWord 0#u64) (oneWord 1#u64) (oneWord 1000#u64) (oneWord 1000#u64) 1#u64 + ⦃ actual => actual = .WindowExhausted ⦄ := by + step with reservation_admission_exact as ⟨actual, exactMeaning⟩ + change codeView actual = Auths.Product.ReservationAdmission.decideReservation [1] [1] [0] [1] [1000] [1000] 1 at exactMeaning + have model : Auths.Product.ReservationAdmission.decideReservation [1] [1] [0] [1] [1000] [1000] 1 = .windowExhausted := by decide + rw [model] at exactMeaning + cases actual <;> simp_all [codeView] +end qualification.aeneas.cases.ReservationAdmission diff --git a/formal/qualification/aeneas/cases/Codec.lean b/formal/qualification/aeneas/cases/Codec.lean new file mode 100644 index 000000000..b5a13a6f3 --- /dev/null +++ b/formal/qualification/aeneas/cases/Codec.lean @@ -0,0 +1,379 @@ +import Auths.Codec.Payload +import Auths.Codec.Collection +import Auths.Codec.Fields +import Auths.Crypto.Examples +import Auths.Codec.Examples +import Auths.Codec.ActionValidity +import Auths.Codec.Encoder +import Auths.Codec.String +import Auths.Refinement.Identifier +import Auths.Codec.Refinement +import Auths.Codec.Cursor + +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open Auths.Codec Auths.Codec.Refinement + +namespace qualification.aeneas.cases + +private def inlineInput : Slice Std.U8 := ⟨[23#u8], by scalar_tac⟩ + +-- A useful positive witness runs the translated production reader. +example : auths_codec.cbor.read_head inlineInput 0#usize ⦃ result => + ∃ head, result = .Ok head ∧ head.argument.val = 23 ∧ head.next.val = 1 ⦄ := by + apply spec_mono (read_head_inline inlineInput 0#usize 23#u8 (by rfl) (by decide)) + rintro _ ⟨head, rfl, _, argumentEq, nextEq⟩ + exact ⟨head, rfl, by simpa using argumentEq, by simpa using nextEq⟩ + +-- Missing input is a typed primitive refusal, including an adversarial cursor. +example : auths_codec.cbor.read_head inlineInput 65535#usize = + ok (.Err ()) := by + apply read_head_absent + simp [inlineInput] + +private def truncatedInput : Slice Std.U8 := ⟨[26#u8, 0#u8], by scalar_tac⟩ + +example : auths_codec.cbor.read_tail truncatedInput 1#usize 4#u8 0#u64 + ⦃ result => result = .Err () ⦄ := by + apply spec_mono (read_tail_bounded truncatedInput 1#usize 4#u8 (by decide) (by decide)) + intro result contract + cases result with + | Err error => cases error; rfl + | Ok pair => + obtain ⟨decoded, next⟩ := pair + have := contract.1 + simp [truncatedInput] at this + +example : auths_codec.cbor.encode_head 8#u8 0#u64 = ok (core.result.Result.Err ()) := rfl + +private theorem encoding_case (major : Std.U8) (argument : Std.U64) + (expected : List Nat) (valid : major.val < 8) + (bytes : encodeHead ⟨major.val, argument.val⟩ = expected) : + auths_codec.cbor.encode_head major argument ⦃ result => + ∃ output, result = .Ok output ∧ byteList output.val = expected ⦄ := by + apply spec_mono (Auths.Codec.Refinement.Encoder.encode_head_refines major argument) + intro result refines + cases result with + | Err => + simp only [Auths.Codec.Refinement.Encoder.EncodingRefines] at refines + omega + | Ok output => exact ⟨output, rfl, refines.2.trans bytes⟩ + +example : auths_codec.cbor.encode_head 0#u8 23#u64 ⦃ result => + ∃ output, result = .Ok output ∧ byteList output.val = [23] ⦄ := by + apply encoding_case <;> decide + +example : auths_codec.cbor.encode_head 7#u8 18446744073709551615#u64 ⦃ result => + ∃ output, result = .Ok output ∧ + byteList output.val = [251, 255, 255, 255, 255, 255, 255, 255, 255] ⦄ := by + apply encoding_case <;> decide + +-- These exercise the exact models used by the full action extraction. +example : alloc.string.String.Insts.CoreConvertFromShared0Str.from + (toStr "auths" (by change 5 ≤ U32.max; scalar_tac)) = ok "auths" := by + apply Auths.Codec.StringRefinement.string_copy_exact + +example : core.str.converts.from_utf8 (toStr "λ" (by change 2 ≤ U32.max; scalar_tac)) = + ok (.Ok (toStr "λ" (by change 2 ≤ U32.max; scalar_tac))) := by + apply Auths.Codec.StringRefinement.utf8_accepts_string + +private def overlongUtf8 : Slice Std.U8 := ⟨[192#u8, 128#u8], by scalar_tac⟩ + +example : core.str.converts.from_utf8 overlongUtf8 = ok (.Err ()) := by + rfl + +private def surrogateUtf8 : Slice Std.U8 := ⟨[237#u8, 160#u8, 128#u8], by scalar_tac⟩ + +example : core.str.converts.from_utf8 surrogateUtf8 = ok (.Err ()) := by + rfl + +-- Full-object witnesses exercise the same production decoder as the claims. +example : auths_codec.decode.decode_canonical_action + Auths.Codec.Examples.minimalInput Auths.Codec.Examples.minimalLimits = + ok (.Ok Auths.Codec.Examples.minimalAction) := + Auths.Codec.Examples.minimal_action_accepted + +example : auths_codec.decode.decode_canonical_action + Auths.Codec.Examples.nonminimalIntegerInput Auths.Codec.Examples.minimalLimits = + ok (.Err auths_codec.error.CodecError.NonCanonical) := + Auths.Codec.Examples.nonminimal_integer_refused + +example : auths_codec.hash.signing_preimage .Grant + (toStr "t" (by change 1 ≤ U32.max; scalar_tac)) 1#u16 + (⟨[1#u8], by scalar_tac⟩ : Slice Std.U8) = + ok (.Ok Auths.Crypto.Examples.minimalPreimage) := + Auths.Crypto.Examples.minimal_preimage_exact + + +-- These cases exercise the translated decoder and its actual cursor. A wide +-- integer consumes its head before narrowing fails; a wrong major/truncated +-- head refuses before committing the cursor. +private def cursorInput (bytes : List Std.U8) (bounded : bytes.length ≤ Usize.max) : + auths_codec.cbor.Decoder := ⟨⟨bytes, bounded⟩, 0#usize⟩ + +example : auths_codec.cbor.Decoder.u8 (cursorInput [24#u8, 255#u8] (by scalar_tac)) + ⦃ actual => (Cursor.wordView actual.1, actual.2.position.val) = (some 255, 2) ⦄ := by + apply spec_mono (Cursor.u8_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning + +example : auths_codec.cbor.Decoder.u8 (cursorInput [25#u8, 1#u8, 0#u8] (by scalar_tac)) + ⦃ actual => (Cursor.wordView actual.1, actual.2.position.val) = (none, 3) ⦄ := by + apply spec_mono (Cursor.u8_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + norm_num [Cursor.narrowHead, Cursor.typedHead, cursorInput, byteList, + readHead, readArgument, unsigned, Option.filter] at meaning + simpa only [Prod.mk.injEq] using meaning + +example : auths_codec.cbor.Decoder.u16 + (cursorInput [26#u8, 0#u8, 1#u8, 0#u8, 0#u8] (by scalar_tac)) + ⦃ actual => (Cursor.wordView actual.1, actual.2.position.val) = (none, 5) ⦄ := by + apply spec_mono (Cursor.u16_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + norm_num [Cursor.narrowHead, Cursor.typedHead, cursorInput, byteList, + readHead, readArgument, unsigned, Option.filter] at meaning + simpa only [Prod.mk.injEq] using meaning + +example : auths_codec.cbor.Decoder.u64 (cursorInput [65#u8, 0#u8] (by scalar_tac)) + ⦃ actual => (Cursor.wordView actual.1, actual.2.position.val) = (none, 0) ⦄ := by + apply spec_mono (Cursor.u64_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning + +example : auths_codec.cbor.Decoder.u16 (cursorInput [25#u8, 1#u8] (by scalar_tac)) + ⦃ actual => (Cursor.wordView actual.1, actual.2.position.val) = (none, 0) ⦄ := by + apply spec_mono (Cursor.u16_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning + +example : auths_codec.cbor.Decoder.null (cursorInput [246#u8] (by scalar_tac)) + ⦃ actual => (Cursor.unitView actual.1, actual.2.position.val) = (true, 1) ⦄ := by + apply spec_mono (Cursor.null_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning + +example : auths_codec.cbor.Decoder.null (cursorInput [0#u8] (by scalar_tac)) + ⦃ actual => (Cursor.unitView actual.1, actual.2.position.val) = (false, 0) ⦄ := by + apply spec_mono (Cursor.null_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning + +-- A type peek is not a successful parse: this U16 has no payload. +example : auths_codec.cbor.Decoder.datatype (cursorInput [25#u8] (by scalar_tac)) + ⦃ actual => actual = .Ok .U16 ⦄ := by + apply spec_mono (Cursor.datatype_exact _) + intro actual meaning + exact meaning + +example : auths_codec.cbor.Decoder.u16 (cursorInput [25#u8] (by scalar_tac)) + ⦃ actual => (Cursor.wordView actual.1, actual.2.position.val) = (none, 0) ⦄ := by + apply spec_mono (Cursor.u16_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning + +example : auths_codec.cbor.Decoder.datatype (cursorInput [95#u8] (by scalar_tac)) + ⦃ actual => actual = .Ok .Other ⦄ := by + apply spec_mono (Cursor.datatype_exact _) + intro actual meaning + exact meaning + +-- This helper compares lengths only. Binding the supplied input to the +-- decoder's input is a separate caller obligation, made visible here. +example : auths_codec.decode.ensure_complete + ⟨⟨[1#u8], by scalar_tac⟩, 1#usize⟩ ⟨[2#u8], by scalar_tac⟩ + ⦃ actual => actual = .Ok () ⦄ := by + apply spec_mono (Cursor.ensure_complete_exact _ _) + intro actual meaning + simpa using meaning + +-- Source-composed payload and protocol-field cases. These deliberately +-- distinguish borrowed payload success from complete-object canonicality, +-- raw indefinite collection heads from protocol acceptance, and the cursor +-- already consumed before a payload/UTF-8/size refusal. +example : auths_codec.cbor.Decoder.bytes (cursorInput [66#u8, 1#u8, 2#u8, 0#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (some [1, 2], 3) ⦄ := by + apply spec_mono (Payload.bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.bytes (cursorInput [66#u8, 1#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (none, 1) ⦄ := by + apply spec_mono (Payload.bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.bytes (cursorInput [64#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (some [], 1) ⦄ := by + apply spec_mono (Payload.bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.bytes (cursorInput [0#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (none, 0) ⦄ := by + apply spec_mono (Payload.bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.bytes (cursorInput [91#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (none, 9) ⦄ := by + apply spec_mono (Payload.bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.str (cursorInput [98#u8, 194#u8, 163#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (some [194, 163], 3) ⦄ := by + apply spec_mono (Payload.str_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.str (cursorInput [98#u8, 192#u8, 128#u8] (by scalar_tac)) + ⦃ actual => (Payload.bytesView actual.1, actual.2.position.val) = (none, 3) ⦄ := by + apply spec_mono (Payload.str_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.array (cursorInput [159#u8] (by scalar_tac)) + ⦃ actual => (Collection.collectionView actual.1, actual.2.position.val) = (some none, 1) ⦄ := by + apply spec_mono (Collection.array_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.map (cursorInput [191#u8] (by scalar_tac)) + ⦃ actual => (Collection.collectionView actual.1, actual.2.position.val) = (some none, 1) ⦄ := by + apply spec_mono (Collection.map_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.array (cursorInput [130#u8] (by scalar_tac)) + ⦃ actual => (Collection.collectionView actual.1, actual.2.position.val) = (some (some 2), 1) ⦄ := by + apply spec_mono (Collection.array_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.cbor.Decoder.array (cursorInput [255#u8] (by scalar_tac)) + ⦃ actual => (Collection.collectionView actual.1, actual.2.position.val) = (none, 0) ⦄ := by + apply spec_mono (Collection.array_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.array (cursorInput [159#u8] (by scalar_tac)) 10#usize + ⦃ actual => (Fields.sizeView actual.1, actual.2.position.val) = (.Err .Malformed, 1) ⦄ := by + apply spec_mono (Fields.array_exact _ 10#usize) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.array (cursorInput [130#u8] (by scalar_tac)) 1#usize + ⦃ actual => (Fields.sizeView actual.1, actual.2.position.val) = (.Err .LimitExceeded, 1) ⦄ := by + apply spec_mono (Fields.array_exact _ 1#usize) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.array (cursorInput [130#u8] (by scalar_tac)) 2#usize + ⦃ actual => (Fields.sizeView actual.1, actual.2.position.val) = (.Ok 2, 1) ⦄ := by + apply spec_mono (Fields.array_exact _ 2#usize) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.map (cursorInput [162#u8] (by scalar_tac)) 2#u64 + ⦃ actual => (actual.1, actual.2.position.val) = (.Ok (), 1) ⦄ := by + apply spec_mono (Fields.map_exact _ 2#u64) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.map (cursorInput [162#u8] (by scalar_tac)) 3#u64 + ⦃ actual => (actual.1, actual.2.position.val) = (.Err .Malformed, 1) ⦄ := by + apply spec_mono (Fields.map_exact _ 3#u64) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.map (cursorInput [191#u8] (by scalar_tac)) 2#u64 + ⦃ actual => (actual.1, actual.2.position.val) = (.Err .Malformed, 1) ⦄ := by + apply spec_mono (Fields.map_exact _ 2#u64) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.key (cursorInput [0#u8] (by scalar_tac)) 1#u8 + ⦃ actual => (actual.1, actual.2.position.val) = (.Err .NonCanonical, 1) ⦄ := by + apply spec_mono (Fields.key_exact _ 1#u8) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.key (cursorInput [24#u8, 0#u8] (by scalar_tac)) 0#u8 + ⦃ actual => (actual.1, actual.2.position.val) = (.Ok (), 2) ⦄ := by + apply spec_mono (Fields.key_exact _ 0#u8) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.key (cursorInput [25#u8, 1#u8, 0#u8] (by scalar_tac)) 0#u8 + ⦃ actual => (actual.1, actual.2.position.val) = (.Err .Malformed, 3) ⦄ := by + apply spec_mono (Fields.key_exact _ 0#u8) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.bounded_bytes (cursorInput [64#u8] (by scalar_tac)) 0#usize false + ⦃ actual => (Fields.vecView actual.1, actual.2.position.val) = (.Ok [], 1) ⦄ := by + apply spec_mono (Fields.bounded_bytes_exact _ 0#usize false) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.bounded_bytes (cursorInput [64#u8] (by scalar_tac)) 0#usize true + ⦃ actual => (Fields.vecView actual.1, actual.2.position.val) = (.Err .LimitExceeded, 1) ⦄ := by + apply spec_mono (Fields.bounded_bytes_exact _ 0#usize true) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.bounded_bytes (cursorInput [66#u8, 1#u8, 2#u8] (by scalar_tac)) 1#usize false + ⦃ actual => (Fields.vecView actual.1, actual.2.position.val) = (.Err .LimitExceeded, 3) ⦄ := by + apply spec_mono (Fields.bounded_bytes_exact _ 1#usize false) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.bounded_bytes (cursorInput [66#u8, 1#u8, 2#u8] (by scalar_tac)) 2#usize true + ⦃ actual => (Fields.vecView actual.1, actual.2.position.val) = (.Ok [1, 2], 3) ⦄ := by + apply spec_mono (Fields.bounded_bytes_exact _ 2#usize true) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.bounded_bytes (cursorInput [66#u8, 1#u8] (by scalar_tac)) 2#usize false + ⦃ actual => (Fields.vecView actual.1, actual.2.position.val) = (.Err .Malformed, 1) ⦄ := by + apply spec_mono (Fields.bounded_bytes_exact _ 2#usize false) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.digest_bytes (cursorInput ([88#u8, 32#u8] ++ List.replicate 32 0#u8) (by scalar_tac)) + ⦃ actual => (Fields.digestView actual.1, actual.2.position.val) = (.Ok (List.replicate 32 0), 34) ⦄ := by + apply spec_mono (Fields.digest_bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.digest_bytes (cursorInput ([88#u8, 31#u8] ++ List.replicate 31 0#u8) (by scalar_tac)) + ⦃ actual => (Fields.digestView actual.1, actual.2.position.val) = (.Err .Malformed, 33) ⦄ := by + apply spec_mono (Fields.digest_bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.digest_bytes (cursorInput ([88#u8, 33#u8] ++ List.replicate 33 0#u8) (by scalar_tac)) + ⦃ actual => (Fields.digestView actual.1, actual.2.position.val) = (.Err .Malformed, 35) ⦄ := by + apply spec_mono (Fields.digest_bytes_exact _) + rintro ⟨result, next⟩ ⟨meaning, _⟩ + exact meaning.trans (by cbv) + +example : auths_codec.decode.is_null (cursorInput [246#u8] (by scalar_tac)) + ⦃ actual => actual = (.Ok true) ⦄ := by + apply spec_mono (Fields.is_null_exact _) + intro actual meaning + exact meaning.trans (by cbv) + +example : auths_codec.decode.is_null (cursorInput [25#u8] (by scalar_tac)) + ⦃ actual => actual = (.Ok false) ⦄ := by + apply spec_mono (Fields.is_null_exact _) + intro actual meaning + exact meaning.trans (by cbv) + +example : auths_codec.decode.is_null (cursorInput [] (by scalar_tac)) + ⦃ actual => actual = (.Err .Malformed) ⦄ := by + apply spec_mono (Fields.is_null_exact _) + intro actual meaning + exact meaning.trans (by cbv) + +end qualification.aeneas.cases diff --git a/formal/qualification/aeneas/cases/Composition.lean b/formal/qualification/aeneas/cases/Composition.lean new file mode 100644 index 000000000..35f33cf20 --- /dev/null +++ b/formal/qualification/aeneas/cases/Composition.lean @@ -0,0 +1,24 @@ +import Auths.Composition.FacadeExamples +import Auths.Composition.ValidationExamples +import Auths.Composition.Examples +import Auths.Composition.PlanExamples +import Auths.Composition.Work +import Auths.Composition.Bounds +import Auths.Refinement.Production +open Aeneas Aeneas.Std Result + +-- Loading the independent extractions together used to collide on anonymous +-- short instance names. The reviewed naming bridge preserves exact values. +namespace qualification.Composition.First +@[qualified_discriminant u16 [3, 9]] +inductive Reason where | left | right +example : read_discriminant Reason.left = 3#u16 := rfl +example : read_discriminant Reason.right = 9#u16 := rfl +end qualification.Composition.First + +namespace qualification.Composition.Second +@[qualified_discriminant u16 [5, 12]] +inductive Reason where | left | right +example : read_discriminant Reason.left = 5#u16 := rfl +example : read_discriminant Reason.right = 12#u16 := rfl +end qualification.Composition.Second diff --git a/formal/qualification/aeneas/cases/Connections.lean b/formal/qualification/aeneas/cases/Connections.lean index f8e730c1d..4cdc3e99a 100644 --- a/formal/qualification/aeneas/cases/Connections.lean +++ b/formal/qualification/aeneas/cases/Connections.lean @@ -1,3 +1,12 @@ +import Auths.Product.RecordShapeRefinement +import Auths.Product.StrictOrderRefinement +import Auths.Product.RecordTimesRefinement +import Auths.Product.StringConstructorsRefinement +import Auths.Product.RecoveryGateRefinement +import Auths.Product.SemanticIdRefinement +import Auths.Product.ConnectionFrameRefinement +import Auths.Product.ProfileConstructorRefinement +import Auths.Product.ConnectionBytesRefinement import qualification.aeneas.generated.connections.Funs open Aeneas Aeneas.Std Result @@ -21,3 +30,238 @@ example : example : kernel.next_generation 18446744073709551615#u64 = ok none := by rfl end qualification.aeneas.cases + +#check Auths.Product.ConnectionBytes.Refinement.lower_tail_exact +#check Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact +#check Auths.Product.ConnectionBytes.Refinement.lower_valid_exact +#check Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul +#check Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul +#check Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound +#check Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound + +#check Auths.Product.ProfileConstructor.Refinement.constructor_exact +#check Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields +#check Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused + +namespace qualification.aeneas.cases.ConnectionBytes +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +open Auths.Product.ConnectionBytes.Refinement +private def token : Slice U8 := ⟨[115#u8, 116#u8, 114#u8, 105#u8, 112#u8, 101#u8], by simp; scalar_tac⟩ +private def injected : Slice U8 := ⟨[97#u8, 0#u8, 98#u8], by simp; scalar_tac⟩ + +example : kernel.lower_token_valid token 64#usize ⦃ actual => actual = true ⦄ := by + step with lower_valid_exact as ⟨actual, exactMeaning⟩ + change actual = decide (Auths.Product.ConnectionBytes.lowerValid [115, 116, 114, 105, 112, 101] 64) at exactMeaning + have allowed : Auths.Product.ConnectionBytes.lowerValid [115, 116, 114, 105, 112, 101] 64 := by decide + simpa [allowed] using exactMeaning + +example : kernel.lower_token_valid injected 64#usize ⦃ actual => actual = false ⦄ := by + step with lower_valid_exact as ⟨actual, exactMeaning⟩ + change actual = decide (Auths.Product.ConnectionBytes.lowerValid [97, 0, 98] 64) at exactMeaning + have denied : ¬ Auths.Product.ConnectionBytes.lowerValid [97, 0, 98] 64 := by decide + simpa [denied] using exactMeaning + +example : kernel.ascii_graphic_valid injected 128#usize ⦃ actual => actual = false ⦄ := by + step with graphic_valid_exact as ⟨actual, exactMeaning⟩ + change actual = decide (Auths.Product.ConnectionBytes.graphicValid [97, 0, 98] 128) at exactMeaning + have denied : ¬ Auths.Product.ConnectionBytes.graphicValid [97, 0, 98] 128 := by decide + simpa [denied] using exactMeaning +end qualification.aeneas.cases.ConnectionBytes + +namespace qualification.aeneas.cases.ProfileConstruction +open Aeneas Aeneas.Std Result +open auths_profile_construction.auths_connections +open Auths.Product.ProfileConstructor.Refinement +example : model.ConnectionProfile.new "auths.test" 1#u16 + ⦃ actual => actual = .Ok ⟨"auths.test", 1#u16⟩ ⦄ := by + exact constructor_exact "auths.test" 1#u16 +example : model.ConnectionProfile.new "auths.test" 0#u16 + ⦃ actual => actual = .Err .InvalidProfile ⦄ := by + exact source_zero_version_refused "auths.test" +end qualification.aeneas.cases.ProfileConstruction + +namespace qualification.aeneas.cases.SemanticIdentifier +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +open Auths.Product.SemanticId.Refinement +private def accepted : Slice U8 := ⟨[65#u8, 58#u8, 49#u8], by simp; scalar_tac⟩ +private def badHead : Slice U8 := ⟨[58#u8, 65#u8], by simp; scalar_tac⟩ + +example : kernel.semantic_id_valid accepted 128#usize ⦃ actual => actual = true ⦄ := by + step with semantic_valid_exact as ⟨actual, exactMeaning⟩ + change actual = decide (Auths.Product.SemanticId.valid [65, 58, 49] 128) at exactMeaning + have allowed : Auths.Product.SemanticId.valid [65, 58, 49] 128 := by decide + simpa [allowed] using exactMeaning + +example : kernel.semantic_id_valid badHead 128#usize ⦃ actual => actual = false ⦄ := by + step with semantic_valid_exact as ⟨actual, exactMeaning⟩ + change actual = decide (Auths.Product.SemanticId.valid [58, 65] 128) at exactMeaning + have refused : ¬ Auths.Product.SemanticId.valid [58, 65] 128 := by decide + simpa [refused] using exactMeaning + +example : kernel.semantic_id_valid accepted 2#usize ⦃ actual => actual = false ⦄ := by + step with semantic_valid_exact as ⟨actual, exactMeaning⟩ + change actual = decide (Auths.Product.SemanticId.valid [65, 58, 49] 2) at exactMeaning + have refused : ¬ Auths.Product.SemanticId.valid [65, 58, 49] 2 := by decide + simpa [refused] using exactMeaning +end qualification.aeneas.cases.SemanticIdentifier + +namespace qualification.aeneas.cases.RecoveryGuards +open Aeneas Aeneas.Std Result +open auths_connections +example : kernel.recovery_lease .Disabled 3#u64 2#u64 = ok (.Ok ()) := by rfl +example : kernel.recovery_lease .Revoked 0#u64 0#u64 = ok (.Err .Revoked) := by rfl +example : kernel.recovery_lease .Active 3#u64 0#u64 = ok (.Err .InvalidGeneration) := by rfl +example : kernel.recovery_lease .Active 3#u64 4#u64 = ok (.Err .InvalidGeneration) := by rfl +example : kernel.recovery_binding_requirement 4#u64 5#u64 4#u64 = ok .CurrentCommitment := by rfl +example : kernel.recovery_binding_requirement 4#u64 3#u64 2#u64 = ok .RecordedCommitment := by rfl +example : kernel.recovery_binding_requirement 4#u64 5#u64 3#u64 = ok .Refuse := by rfl +example : kernel.recovery_binding_requirement 4#u64 2#u64 3#u64 = ok .Refuse := by rfl +example : kernel.state_transition_allows .Active .Disabled 10#u64 10#u64 = ok true := by rfl +example : kernel.state_transition_allows .Revoked .Active 10#u64 11#u64 = ok false := by rfl +example : kernel.state_transition_allows .Disabled .Disabled 10#u64 11#u64 = ok false := by rfl +example : kernel.state_transition_allows .Active .Revoked 10#u64 9#u64 = ok false := by rfl +end qualification.aeneas.cases.RecoveryGuards + +namespace qualification.aeneas.cases.AdministrativeChanges +open Aeneas Aeneas.Std Result +open auths_connections +example : kernel.record_change_allows .Disabled 10#u64 10#u64 = ok true := by rfl +example : kernel.record_change_allows .Revoked 10#u64 11#u64 = ok false := by rfl +example : kernel.record_change_allows .Active 10#u64 9#u64 = ok false := by rfl +end qualification.aeneas.cases.AdministrativeChanges + +namespace qualification.aeneas.cases.OwnedStringConstructors +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open Auths.Product.StringConstructors.Refinement +private def provider := String.ofList ['s', 't', 'r', 'i', 'p', 'e'] +private def unicodeAlias := String.ofList ['é'] +private def semantic := String.ofList ['A', ':', '1'] +example : + auths_profile_construction.auths_connections.model.ProviderKind.parse + (core.convert.IntoFrom (core.convert.FromSame String)) provider ⦃ actual => actual = .Ok provider ⦄ := by + step with actual_provider_exact provider (by change 6 ≤ U32.max; scalar_tac) as ⟨actual, exactMeaning⟩ + have accepted : Auths.Product.ConnectionBytes.lowerValid (utf8Bytes provider) 64 := by + unfold utf8Bytes provider + simp only [String.toByteArray_ofList] + unfold ByteArray.toList + iterate 7 (rw [ByteArray.toList.loop]; norm_num only) + change Auths.Product.ConnectionBytes.lowerValid [115, 116, 114, 105, 112, 101] 64 + decide + simpa [accepted] using exactMeaning + +example : + auths_profile_construction.auths_connections.model.ConnectionAlias.parse + (core.convert.IntoFrom (core.convert.FromSame String)) unicodeAlias ⦃ actual => actual = .Err .InvalidAlias ⦄ := by + step with actual_alias_exact unicodeAlias (by change 2 ≤ U32.max; scalar_tac) as ⟨actual, exactMeaning⟩ + have refused : ¬ Auths.Product.ConnectionBytes.lowerValid (utf8Bytes unicodeAlias) 64 := by + unfold utf8Bytes unicodeAlias + simp only [String.toByteArray_ofList] + unfold ByteArray.toList + iterate 3 (rw [ByteArray.toList.loop]; norm_num only) + change ¬ Auths.Product.ConnectionBytes.lowerValid [195, 169] 64 + decide + simpa [refused] using exactMeaning + +example : + auths_profile_construction.auths_connections.model.SemanticId.parse + (core.convert.IntoFrom (core.convert.FromSame String)) semantic ⦃ actual => actual = .Ok semantic ⦄ := by + step with actual_semantic_exact semantic (by change 3 ≤ U32.max; scalar_tac) as ⟨actual, exactMeaning⟩ + have accepted : Auths.Product.SemanticId.valid (utf8Bytes semantic) 128 := by + unfold utf8Bytes semantic + simp only [String.toByteArray_ofList] + unfold ByteArray.toList + iterate 4 (rw [ByteArray.toList.loop]; norm_num only) + change Auths.Product.SemanticId.valid [65, 58, 49] 128 + decide + simpa [accepted] using exactMeaning +end qualification.aeneas.cases.OwnedStringConstructors + +namespace qualification.aeneas.cases.RecordTimes +open Aeneas Aeneas.Std Result +open auths_connections +example : kernel.record_times_valid .Revoked 1#u64 3#u64 (some 2#u64) = ok true := by rfl +example : kernel.record_times_valid .Revoked 1#u64 3#u64 (some 3#u64) = ok true := by rfl +example : kernel.record_times_valid .Active 1#u64 3#u64 (some 2#u64) = ok false := by rfl +example : kernel.record_times_valid .Revoked 1#u64 3#u64 none = ok false := by rfl +example : kernel.record_times_valid .Revoked 1#u64 3#u64 (some 0#u64) = ok false := by rfl +example : kernel.record_times_valid .Active 3#u64 1#u64 none = ok false := by rfl +end qualification.aeneas.cases.RecordTimes + +namespace qualification.aeneas.cases.StrictOrdering +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +open Auths.Product.StrictOrder.Refinement +private def ascending : Slice U64 := ⟨[1#u64, 2#u64, 3#u64], by simp; scalar_tac⟩ +private def repeated : Slice U64 := ⟨[1#u64, 2#u64, 2#u64], by simp; scalar_tac⟩ +private def less (a b : U64) : Bool := decide (a.val < b.val) + +example (order : core.cmp.Ord U64) + (comparison : ∀ a b, order.partialOrdInst.lt a b ⦃ actual => actual = less a b ⦄) : + kernel.strictly_sorted_unique order ascending ⦃ actual => actual = true ⦄ := by + step with strict_order_exact order less comparison as ⟨actual, meaning⟩ + change actual = true at meaning + exact meaning + +example (order : core.cmp.Ord U64) + (comparison : ∀ a b, order.partialOrdInst.lt a b ⦃ actual => actual = less a b ⦄) : + kernel.strictly_sorted_unique order repeated ⦃ actual => actual = false ⦄ := by + step with strict_order_exact order less comparison as ⟨actual, meaning⟩ + change actual = false at meaning + exact meaning +end qualification.aeneas.cases.StrictOrdering + +namespace qualification.aeneas.cases.CompleteRecordShape +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_connections +open Auths.Product.RecordShape.Refinement +private def taskName := String.ofList ['a'] +private def taskNames : Slice String := ⟨[taskName], by simp; scalar_tac⟩ +private def profile : Profile := ⟨String.ofList ['p'], 1#u16⟩ +private def profiles : Slice Profile := ⟨[profile], by simp; scalar_tac⟩ +private theorem bounded : ∀ value ∈ taskNames.val, value.toByteArray.size ≤ U32.max := by + intro value member + have same : value = taskName := by simpa [taskNames] using member + subst value + change 1 ≤ U32.max + scalar_tac +private theorem goodWork : workloadsValid taskNames.val = true := by + have printable : textValid taskName := by + unfold textValid Auths.Product.StringConstructors.Refinement.utf8Bytes taskName + simp only [String.toByteArray_ofList] + unfold ByteArray.toList + iterate 2 (rw [ByteArray.toList.loop]; norm_num only) + change Auths.Product.ConnectionBytes.graphicValid [97] 128 + decide + simp [workloadsValid, taskNames, Auths.Product.StrictOrder.Refinement.ordered, + Auths.Product.StrictOrder.Refinement.chain, allText, printable] +private theorem goodProfiles : profilesValid profiles.val = true := by + simp [profilesValid, profiles, Auths.Product.StrictOrder.Refinement.ordered, + Auths.Product.StrictOrder.Refinement.chain] + +example : kernel.validate_record_shape taskNames profiles .Active 0#u64 0#u64 none + ⦃ actual => actual = .Ok () ⦄ := by + step with record_shape_exact taskNames profiles .Active 0#u64 0#u64 none bounded as ⟨actual, meaning⟩ + simpa [verdict, goodWork, goodProfiles, stateView, Auths.Product.RecordTimes.Refinement.valid] using meaning + +example : kernel.validate_record_shape taskNames profiles .Active 2#u64 1#u64 none + ⦃ actual => actual = .Err .InvalidTimestamps ⦄ := by + step with record_shape_exact taskNames profiles .Active 2#u64 1#u64 none bounded as ⟨actual, meaning⟩ + simpa [verdict, goodWork, goodProfiles, stateView, Auths.Product.RecordTimes.Refinement.valid] using meaning + +example (someProfiles : Slice Profile) : + kernel.validate_record_shape ⟨[], by simp⟩ someProfiles .Revoked 2#u64 1#u64 none = + ok (.Err .InvalidWorkloads) := by rfl + +private def duplicates : Slice Profile := ⟨[profile, profile], by simp; scalar_tac⟩ +example : kernel.profiles_valid duplicates ⦃ actual => actual = false ⦄ := by + step with profiles_exact duplicates as ⟨actual, meaning⟩ + simpa [profilesValid, duplicates, Auths.Product.StrictOrder.Refinement.ordered, + Auths.Product.StrictOrder.Refinement.chain, profileLess] using meaning +end qualification.aeneas.cases.CompleteRecordShape diff --git a/formal/qualification/aeneas/cases/Gateway.lean b/formal/qualification/aeneas/cases/Gateway.lean index e197bf179..5a3f59d94 100644 --- a/formal/qualification/aeneas/cases/Gateway.lean +++ b/formal/qualification/aeneas/cases/Gateway.lean @@ -1,3 +1,12 @@ +import Auths.Product.ConnectionEntryRefinement +import Auths.Product.SlotRecordRefinement +import Auths.Product.SlotBatchRefinement +import Auths.Product.ReservationRetryRefinement +import Auths.Product.SumAggregationRefinement +import Auths.Product.CounterAggregationRefinement +import Auths.Product.CounterRefinement +import Auths.Product.Frontier.Refinement +import Auths.Product.Refinement.EntryDeadline import qualification.aeneas.generated.gateway.Funs open Aeneas Aeneas.Std Result @@ -94,4 +103,130 @@ example : action := order.SubmitAction.Stop order.Stop.Halted } := by rfl +-- Inclusive native windows and exclusive operator windows keep their exact +-- endpoints, including the maximum timestamp without adding one. +example : deadline.entry_time_allows 10#u64 20#u64 ⟨20#u64, true⟩ = ok true := rfl +example : deadline.entry_time_allows 10#u64 20#u64 ⟨20#u64, false⟩ = ok false := rfl +example : deadline.entry_time_allows 10#u64 9#u64 ⟨20#u64, true⟩ = ok false := rfl +example : deadline.intersect_entry_bounds ⟨18446744073709551615#u64, true⟩ + ⟨18446744073709551615#u64, false⟩ = ok ⟨18446744073709551615#u64, false⟩ := rfl + end qualification.aeneas.cases + +#check Auths.Product.Frontier.Refinement.start_exact +#check Auths.Product.Frontier.Refinement.probe_exact +#check Auths.Product.Frontier.Refinement.observe_exact +#check Auths.Product.Frontier.Refinement.candidate_exact +#check Auths.Product.Frontier.Refinement.source_work_bound + +#check Auths.Product.CounterFrames.Refinement.word_exact +#check Auths.Product.CounterFrames.Refinement.component_exact +#check Auths.Product.CounterFrames.Refinement.coordinates_exact +#check Auths.Product.CounterFrames.Refinement.count_exact +#check Auths.Product.CounterFrames.Refinement.sum_exact +#check Auths.Product.CounterFrames.Refinement.count_slot_exact +#check Auths.Product.CounterFrames.Refinement.sum_slot_exact +#check Auths.Product.CounterFrames.Refinement.count_source_binds_inputs +#check Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs + +#check Auths.Product.CounterAggregation.Refinement.counter_equal_spec +#check Auths.Product.CounterAggregation.Refinement.counter_position_spec +#check Auths.Product.CounterAggregation.Refinement.contribute_spec +#check Auths.Product.CounterAggregation.Refinement.aggregate_spec +#check Auths.Product.CounterAggregation.Refinement.source_aggregate_unique +#check Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities + +#check Auths.Product.CounterAggregation.Refinement.sum_position_spec +#check Auths.Product.CounterAggregation.Refinement.contribute_sum_spec +#check Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec +#check Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique +#check Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities + +#check Auths.Product.ReservationRetry.Refinement.retry_target_exact +#check Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay +#check Auths.Product.ReservationRetry.Refinement.source_count_progress_safe +#check Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe + +#check Auths.Product.SlotBatch.Refinement.count_loop_exact +#check Auths.Product.SlotBatch.Refinement.sum_loop_exact +#check Auths.Product.SlotBatch.Refinement.build_exact +#check Auths.Product.SlotBatch.Refinement.source_claim_first +#check Auths.Product.SlotBatch.Refinement.source_complete_entry_count +#check Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused + +#check Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec +#check Auths.Product.SlotRecord.Refinement.validate_cumulative_exact +#check Auths.Product.SlotRecord.Refinement.source_accepted_binds_record +#check Auths.Product.SlotRecord.Refinement.source_invalid_record_refused + +#check Auths.Product.CounterAggregation.Refinement.count_capacity_spec +#check Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact +#check Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum + + +namespace qualification.aeneas.cases.CumulativeRecord +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +open Auths.Product.SlotRecord.Refinement +-- A real source-path success witness: accepting useful cumulative state is +-- proved alongside the all-input refusal theorem, not left to vacuity. +private def sumSchema : Slice Std.U8 := ⟨[97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 98#u8, 111#u8, 117#u8, 110#u8, 100#u8, 101#u8, 100#u8, 45#u8, 115#u8, 117#u8, 109#u8, 47#u8, 49#u8], by simp; scalar_tac⟩ +private def zeroCounter : Array Std.U8 32#usize := ⟨List.replicate 32 0#u8, by simp⟩ +private def zeroHex : Slice Std.U8 := ⟨List.replicate 64 48#u8, by simp; scalar_tac⟩ +example : + slot_record.validate_cumulative sumSchema sumSchema zeroHex zeroCounter 5#u64 ⟨5#u64, 3#u64, 7#u64⟩ + ⦃ actual => actual = some 7#u64 ⦄ := by + step with validate_cumulative_exact as ⟨actual, exactMeaning⟩ + have modelValue : Auths.Product.SlotRecord.validate (bytes sumSchema.val) (bytes sumSchema.val) (List.replicate 64 48) (List.replicate 32 0) + 5 ⟨5, 3, 7⟩ = some 7 := by decide + change actual.map UScalar.val = Auths.Product.SlotRecord.validate (bytes sumSchema.val) (bytes sumSchema.val) (List.replicate 64 48) + (List.replicate 32 0) 5 ⟨5, 3, 7⟩ at exactMeaning + have mapped : actual.map UScalar.val = some 7 := exactMeaning.trans modelValue + cases actual with + | none => simp at mapped + | some value => + simp only [Option.map_some, Option.some.injEq] at mapped + congr 1 + scalar_tac + +end qualification.aeneas.cases.CumulativeRecord + +#check Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact +#check Auths.Product.ConnectionEntry.Refinement.entry_allows_exact +#check Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile +#check Auths.Product.ConnectionEntry.Refinement.source_disabled_refused +#check Auths.Product.ConnectionEntry.Refinement.source_revoked_refused + +namespace qualification.aeneas.cases.ConnectionEntry +open Aeneas Aeneas.Std Result +open Aeneas.Std.WP +open auths_gateway_kernel +open Auths.Product.ConnectionEntry.Refinement +private def identifier : alloc.vec.Vec U8 := ⟨[97#u8], by simp; scalar_tac⟩ +private def workload : Slice U8 := alloc.vec.Vec.deref identifier +private def workloads : Slice (alloc.vec.Vec U8) := ⟨[identifier], by simp; scalar_tac⟩ +private def profile : entry_authorization.EntryProfile := ⟨identifier, 1#u16⟩ +private def profiles : Slice entry_authorization.EntryProfile := ⟨[profile], by simp; scalar_tac⟩ + +-- Matching nonempty workload and full profile/version fields really permit. +example : entry_authorization.entry_allows .Active workloads profiles workload profile + ⦃ actual => actual = true ⦄ := by + step with entry_allows_exact as ⟨actual, exactMeaning⟩ + change actual = Auths.Product.ConnectionEntry.allows .active [[97]] [⟨[97], 1⟩] [97] ⟨[97], 1⟩ at exactMeaning + have model : Auths.Product.ConnectionEntry.allows .active [[97]] [⟨[97], 1⟩] [97] ⟨[97], 1⟩ = true := by decide + exact exactMeaning.trans model + +-- The same otherwise-admissible record cannot authorize after disablement. +example : entry_authorization.entry_allows .Disabled workloads profiles workload profile + ⦃ actual => actual = false ⦄ := by + exact source_disabled_refused workloads profiles workload profile + +-- An equal profile identifier at another version is a refusal. +example : entry_authorization.entry_allows .Active workloads profiles workload ⟨identifier, 2#u16⟩ + ⦃ actual => actual = false ⦄ := by + step with entry_allows_exact as ⟨actual, exactMeaning⟩ + change actual = Auths.Product.ConnectionEntry.allows .active [[97]] [⟨[97], 1⟩] [97] ⟨[97], 2⟩ at exactMeaning + have model : Auths.Product.ConnectionEntry.allows .active [[97]] [⟨[97], 1⟩] [97] ⟨[97], 2⟩ = false := by decide + exact exactMeaning.trans model +end qualification.aeneas.cases.ConnectionEntry diff --git a/formal/qualification/aeneas/cases/Model.lean b/formal/qualification/aeneas/cases/Model.lean index 3572a15d4..f2bc8cf4d 100644 --- a/formal/qualification/aeneas/cases/Model.lean +++ b/formal/qualification/aeneas/cases/Model.lean @@ -1,4 +1,5 @@ import qualification.aeneas.generated.model.Funs +import Auths.Refinement.Identifier open Aeneas Aeneas.Std Result open auths_model @@ -245,3 +246,35 @@ example : rfl #check bounded_policy.digest_equal + +-- Identifier witnesses use the translated shipping validator and its exact +-- refinement. `decide` reduces only the small, independent byte predicate. +private theorem identifier_case (value : Str) (maximum : Std.Usize) + (expected : Bool) + (meaning : (!value.val.isEmpty && decide (value.val.length ≤ maximum.val) && + !Auths.Refinement.Identifier.containsExcluded value.val) = expected) : + identifier.bounded_identifier_valid value maximum ⦃ result => result = expected ⦄ := by + apply WP.spec_mono (Auths.Refinement.Identifier.identifier_exact value maximum) + intro result resultEq + exact resultEq.trans meaning + +private def asciiIdentifier : Str := + ⟨[97#u8, 117#u8, 116#u8, 104#u8, 115#u8], by scalar_tac⟩ +example : identifier.bounded_identifier_valid asciiIdentifier 5#usize ⦃ result => result = true ⦄ := by + apply identifier_case + decide +example : identifier.bounded_identifier_valid asciiIdentifier 4#usize ⦃ result => result = false ⦄ := by + apply identifier_case + decide +example : identifier.bounded_identifier_valid ⟨[], by scalar_tac⟩ 128#usize ⦃ result => result = false ⦄ := by + apply identifier_case + decide +-- U+2028 is whitespace; U+200B is permitted by the pinned character rule. +example : identifier.bounded_identifier_valid ⟨[226#u8, 128#u8, 168#u8], by scalar_tac⟩ 3#usize + ⦃ result => result = false ⦄ := by + apply identifier_case + decide +example : identifier.bounded_identifier_valid ⟨[226#u8, 128#u8, 139#u8], by scalar_tac⟩ 3#usize + ⦃ result => result = true ⦄ := by + apply identifier_case + decide diff --git a/formal/qualification/aeneas/cases/P256.lean b/formal/qualification/aeneas/cases/P256.lean new file mode 100644 index 000000000..df5bd23f0 --- /dev/null +++ b/formal/qualification/aeneas/cases/P256.lean @@ -0,0 +1,4 @@ +import Auths.Crypto.P256Examples + +-- Actual native public entry points under explicit primitive contracts. +-- Forwarding mocks make no curve-correctness or authenticity claim. diff --git a/formal/qualification/aeneas/cases/ScopeCodec.lean b/formal/qualification/aeneas/cases/ScopeCodec.lean new file mode 100644 index 000000000..2d1a2fa4f --- /dev/null +++ b/formal/qualification/aeneas/cases/ScopeCodec.lean @@ -0,0 +1,46 @@ +import Auths.Codec.PrincipalScheme +import Auths.Codec.ScopeTrustSelectors +import Auths.Codec.ScopeDecodedUse +import Auths.Codec.ScopeDecodeSafety +import Auths.Codec.ScopeDecodeExamples +import Auths.Codec.ScopeSelectors +import Auths.Codec.ScopeExamples + +-- Actual sorting/validation constructor and constructor-earned native lookup. +-- Decoder success earns structural scope validity; complete byte-decoder +-- totality, canonical round trips and verifier/runtime composition remain open. +#check Auths.ScopeConstructor.constructor_refines +#check Auths.ScopeConstructor.constructor_validity +#check Auths.ScopeConstructor.constructed_lookup +#check Auths.ScopeConstructor.Examples.accepts_unsorted +#check Auths.ScopeConstructor.Examples.rejects_duplicate +#check Auths.ScopeConstructor.Examples.rejects_empty +#check Auths.ScopeConstructor.Examples.rejects_oversized + +#check Auths.ScopeConstructor.constructed_principal_selection + +#check Auths.ScopeConstructor.constructed_grant_selection + +#check Auths.ScopeConstructor.DecodeExamples.accepts_own +#check Auths.ScopeConstructor.DecodeExamples.accepts_any +#check Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag +#check Auths.ScopeConstructor.DecodeExamples.refuses_truncation +#check Auths.ScopeConstructor.DecodeExamples.accepts_listed +#check Auths.ScopeConstructor.DecodeExamples.refuses_empty_list +#check Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id +#check Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit + +#check Auths.ScopeConstructor.accepted_scope_valid + +#check Auths.ScopeConstructor.decoded_scope_covers + +#check Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list +#check Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list + +-- Pending implementation-first batch: checked once the enlarged source unit +-- has been translated and its complete statement/source inventory reviewed. +#check Auths.PrincipalScheme.scheme_refines +#check Auths.ScopeConstructor.accepted_rule_valid +#check Auths.ScopeConstructor.accepted_trust_valid +#check Auths.ScopeConstructor.decoded_trust_principal +#check Auths.ScopeConstructor.decoded_trust_grant diff --git a/formal/qualification/aeneas/cases/Sha256.lean b/formal/qualification/aeneas/cases/Sha256.lean new file mode 100644 index 000000000..d4f811703 --- /dev/null +++ b/formal/qualification/aeneas/cases/Sha256.lean @@ -0,0 +1,6 @@ +import Auths.Crypto.FramingTotality +import Auths.Crypto.CommitmentValidity +import Auths.Crypto.Sha256Examples + +-- Explicit foreign digest/output contracts; concrete witnesses check forwarding, +-- never hash security or the correctness of the selected cryptographic library. diff --git a/formal/qualification/aeneas/cases/Signature.lean b/formal/qualification/aeneas/cases/Signature.lean new file mode 100644 index 000000000..7fdecde50 --- /dev/null +++ b/formal/qualification/aeneas/cases/Signature.lean @@ -0,0 +1,7 @@ +import Auths.Crypto.NativeExamples +import Auths.Crypto.Strict.Examples +import Auths.Crypto.Encoding.Examples + +-- The actual public Ed25519 wrapper and its guards are proved with explicit +-- foreign primitive parameters. Mock witnesses check call binding only; +-- published authentic tuples are checked by native cross-language evidence. diff --git a/formal/qualification/aeneas/cases/StatusSelection.lean b/formal/qualification/aeneas/cases/StatusSelection.lean new file mode 100644 index 000000000..b40c24b9f --- /dev/null +++ b/formal/qualification/aeneas/cases/StatusSelection.lean @@ -0,0 +1,25 @@ +import Auths.Verifier.StatusAnchorExamples +import Auths.Verifier.StatusExamples +-- Exact shipping selector components: first-rule lookup, freshness, and the +-- public port results against the independent specification. All-view source +-- statements require ordered listed scopes; constructor validity and evidence +-- authentication remain separate obligations. +#check Auths.StatusSelection.sequence_floor_refines +#check Auths.StatusSelection.approver_visibility_refines +#check Auths.StatusSelection.principal_method_approver_refines +#check Auths.StatusSelection.grant_method_approver_refines +#check Auths.StatusSelection.Examples.active_selected_horizon +#check Auths.StatusSelection.Examples.rollback_despite_newer +#check Auths.StatusSelection.Examples.newer_discards_old_stale_revocation +#check Auths.StatusSelection.Examples.latest_ties_conservatively_revoke + +#check Auths.StatusSelection.Search.search_loop +#check Auths.StatusSelection.Search.scope_contains +#check Auths.StatusSelection.visibility_refines +#check Auths.StatusSelection.principal_method_all_views +#check Auths.StatusSelection.grant_method_all_views +#check Auths.StatusSelection.AnchorExamples.first_listed_anchor +#check Auths.StatusSelection.AnchorExamples.last_listed_anchor +#check Auths.StatusSelection.AnchorExamples.unlisted_anchor_refused +#check Auths.StatusSelection.AnchorExamples.own_anchor_active +#check Auths.StatusSelection.AnchorExamples.other_anchor_hidden diff --git a/formal/qualification/aeneas/cases/Stores.lean b/formal/qualification/aeneas/cases/Stores.lean new file mode 100644 index 000000000..2bac5c38c --- /dev/null +++ b/formal/qualification/aeneas/cases/Stores.lean @@ -0,0 +1,16 @@ +import Auths.Product.Refinement.CollectionFence + +open Aeneas Aeneas.Std Result +open auths_stores + +namespace qualification.aeneas.cases + +example : gateway_fence.gateway_window_open 100#u64 none = ok true := rfl + +example : gateway_fence.gateway_window_open 100#u64 (some 100#u64) = ok false := rfl + +example : gateway_fence.gateway_window_open 101#u64 (some 100#u64) = ok true := rfl + +example : gateway_fence.advance_gateway_collection (some 100#u64) 1#u64 = ok 100#u64 := rfl + +end qualification.aeneas.cases diff --git a/formal/qualification/aeneas/cases/SuiteAdapters.lean b/formal/qualification/aeneas/cases/SuiteAdapters.lean new file mode 100644 index 000000000..209204897 --- /dev/null +++ b/formal/qualification/aeneas/cases/SuiteAdapters.lean @@ -0,0 +1,4 @@ +import Auths.Crypto.SuiteAdapterExamples + +-- Exact adapter fields and errors under qualified primitive contracts. +-- Constructor/registry selection remains separate. diff --git a/formal/qualification/aeneas/cases/TemporalWitness.lean b/formal/qualification/aeneas/cases/TemporalWitness.lean new file mode 100644 index 000000000..dacd7590c --- /dev/null +++ b/formal/qualification/aeneas/cases/TemporalWitness.lean @@ -0,0 +1,4 @@ +import Auths.Verifier.TemporalExamples + +-- Actual expiry helpers and independent status/expiry semantics. +-- Selection, full verification and runtime consumption remain separate. diff --git a/formal/qualification/aeneas/entrypoints/profile_construction.rs b/formal/qualification/aeneas/entrypoints/profile_construction.rs new file mode 100644 index 000000000..7abc5e2b6 --- /dev/null +++ b/formal/qualification/aeneas/entrypoints/profile_construction.rs @@ -0,0 +1,31 @@ +//! Extraction selection only. The constructor's body remains the shipping +//! `auths-connections` implementation, translated transparently by Charon. + +/// Selects the actual inherent constructor without duplicating its checks. +pub fn construct( + id: auths_connections::SemanticId, + version: u16, +) -> Result { + auths_connections::ConnectionProfile::new(id, version) +} + +/// Selects the actual provider constructor with String's identity conversion. +pub fn parse_provider( + value: String, +) -> Result { + auths_connections::ProviderKind::parse(value) +} + +/// Selects the actual alias constructor with String's identity conversion. +pub fn parse_alias( + value: String, +) -> Result { + auths_connections::ConnectionAlias::parse(value) +} + +/// Selects the actual semantic-ID constructor with String's identity conversion. +pub fn parse_semantic( + value: String, +) -> Result { + auths_connections::SemanticId::parse(value) +} diff --git a/formal/qualification/aeneas/generated/authority/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/authority/FunsExternal_Template.lean index cfab1cfa8..256e64a9a 100644 --- a/formal/qualification/aeneas/generated/authority/FunsExternal_Template.lean +++ b/formal/qualification/aeneas/generated/authority/FunsExternal_Template.lean @@ -34,7 +34,7 @@ axiom auths_algebra_kernel.root_preserved auths_algebra_kernel.RootLinkage Identity → Result Bool /-- [auths_model::principal_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 201:0-201:74 + Source: 'core/crates/auths-model/src/lib.rs', lines 183:0-183:74 Name pattern: [auths_model::principal_id_equal] Visibility: public -/ @[rust_fun "auths_model::principal_id_equal"] @@ -42,7 +42,7 @@ axiom auths_model.principal_id_equal : auths_model.PrincipalId → auths_model.PrincipalId → Result Bool /-- [auths_model::validity_window_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 435:0-435:92 + Source: 'core/crates/auths-model/src/lib.rs', lines 417:0-417:92 Name pattern: [auths_model::validity_window_contains] Visibility: public -/ @[rust_fun "auths_model::validity_window_contains"] @@ -50,7 +50,7 @@ axiom auths_model.validity_window_contains : auths_model.ValidityWindow → auths_model.ValidityWindow → Result Bool /-- [auths_model::profile_ref_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 478:0-478:71 + Source: 'core/crates/auths-model/src/lib.rs', lines 460:0-460:71 Name pattern: [auths_model::profile_ref_equal] Visibility: public -/ @[rust_fun "auths_model::profile_ref_equal"] @@ -58,7 +58,7 @@ axiom auths_model.profile_ref_equal : auths_model.ProfileRef → auths_model.ProfileRef → Result Bool /-- [auths_model::profile_slice_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 485:0-485:84 + Source: 'core/crates/auths-model/src/lib.rs', lines 467:0-467:84 Name pattern: [auths_model::profile_slice_contains] Visibility: public -/ @[rust_fun "auths_model::profile_slice_contains"] @@ -66,7 +66,7 @@ axiom auths_model.profile_slice_contains : Slice auths_model.ProfileRef → auths_model.ProfileRef → Result Bool /-- [auths_model::assurance_policy_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 499:0-499:93 + Source: 'core/crates/auths-model/src/lib.rs', lines 481:0-481:93 Name pattern: [auths_model::assurance_policy_id_equal] Visibility: public -/ @[rust_fun "auths_model::assurance_policy_id_equal"] @@ -76,7 +76,7 @@ axiom auths_model.assurance_policy_id_equal Bool /-- [auths_model::optional_grant_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 513:0-513:85 + Source: 'core/crates/auths-model/src/lib.rs', lines 495:0-495:85 Name pattern: [auths_model::optional_grant_id_equal] Visibility: public -/ @[rust_fun "auths_model::optional_grant_id_equal"] @@ -84,7 +84,7 @@ axiom auths_model.optional_grant_id_equal : Option auths_model.GrantId → Option auths_model.GrantId → Result Bool /-- [auths_model::permission_set_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 590:0-590:84 + Source: 'core/crates/auths-model/src/lib.rs', lines 572:0-572:84 Name pattern: [auths_model::permission_set_contains] Visibility: public -/ @[rust_fun "auths_model::permission_set_contains"] @@ -92,7 +92,7 @@ axiom auths_model.permission_set_contains : auths_model.PermissionSet → auths_model.Permission → Result Bool /-- [auths_model::permission_set_is_subset]: - Source: 'core/crates/auths-model/src/lib.rs', lines 604:0-604:86 + Source: 'core/crates/auths-model/src/lib.rs', lines 586:0-586:86 Name pattern: [auths_model::permission_set_is_subset] Visibility: public -/ @[rust_fun "auths_model::permission_set_is_subset"] @@ -100,7 +100,7 @@ axiom auths_model.permission_set_is_subset : auths_model.PermissionSet → auths_model.PermissionSet → Result Bool /-- [auths_model::audience_set_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 657:0-657:76 + Source: 'core/crates/auths-model/src/lib.rs', lines 639:0-639:76 Name pattern: [auths_model::audience_set_contains] Visibility: public -/ @[rust_fun "auths_model::audience_set_contains"] @@ -108,7 +108,7 @@ axiom auths_model.audience_set_contains : auths_model.AudienceSet → auths_model.Audience → Result Bool /-- [auths_model::audience_set_is_subset]: - Source: 'core/crates/auths-model/src/lib.rs', lines 671:0-671:80 + Source: 'core/crates/auths-model/src/lib.rs', lines 653:0-653:80 Name pattern: [auths_model::audience_set_is_subset] Visibility: public -/ @[rust_fun "auths_model::audience_set_is_subset"] @@ -116,7 +116,7 @@ axiom auths_model.audience_set_is_subset : auths_model.AudienceSet → auths_model.AudienceSet → Result Bool /-- [auths_model::action_constraint_allows]: - Source: 'core/crates/auths-model/src/lib.rs', lines 816:0-816:86 + Source: 'core/crates/auths-model/src/lib.rs', lines 798:0-798:86 Name pattern: [auths_model::action_constraint_allows] Visibility: public -/ @[rust_fun "auths_model::action_constraint_allows"] @@ -124,7 +124,7 @@ axiom auths_model.action_constraint_allows : auths_model.ActionConstraint → auths_model.Digest → Result Bool /-- [auths_model::action_constraint_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 827:0-827:96 + Source: 'core/crates/auths-model/src/lib.rs', lines 809:0-809:96 Name pattern: [auths_model::action_constraint_attenuates] Visibility: public -/ @[rust_fun "auths_model::action_constraint_attenuates"] @@ -133,7 +133,7 @@ axiom auths_model.action_constraint_attenuates auths_model.ActionConstraint → auths_model.ActionConstraint → Result Bool /-- [auths_model::optional_budget_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 896:0-899:9 + Source: 'core/crates/auths-model/src/lib.rs', lines 878:0-881:9 Name pattern: [auths_model::optional_budget_attenuates] Visibility: public -/ @[rust_fun "auths_model::optional_budget_attenuates"] @@ -143,7 +143,7 @@ axiom auths_model.optional_budget_attenuates Result Bool /-- [auths_model::budget_ceiling_covers_action]: - Source: 'core/crates/auths-model/src/lib.rs', lines 964:0-968:9 + Source: 'core/crates/auths-model/src/lib.rs', lines 946:0-950:9 Name pattern: [auths_model::budget_ceiling_covers_action] Visibility: public -/ @[rust_fun "auths_model::budget_ceiling_covers_action"] @@ -153,7 +153,7 @@ axiom auths_model.budget_ceiling_covers_action auths_model.ProfileBudgetExpression → Result Bool /-- [auths_model::status_policy_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1026:0-1026:84 + Source: 'core/crates/auths-model/src/lib.rs', lines 1008:0-1008:84 Name pattern: [auths_model::status_policy_attenuates] Visibility: public -/ @[rust_fun "auths_model::status_policy_attenuates"] @@ -161,7 +161,7 @@ axiom auths_model.status_policy_attenuates : auths_model.StatusPolicy → auths_model.StatusPolicy → Result Bool /-- [auths_model::critical_extension_find]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1129:0-1132:34 + Source: 'core/crates/auths-model/src/lib.rs', lines 1111:0-1114:34 Name pattern: [auths_model::critical_extension_find] Visibility: public -/ @[rust_fun "auths_model::critical_extension_find"] @@ -171,7 +171,7 @@ axiom auths_model.critical_extension_find auths_model.CriticalExtension) /-- [auths_model::critical_extension_entries]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1146:0-1146:90 + Source: 'core/crates/auths-model/src/lib.rs', lines 1128:0-1128:90 Name pattern: [auths_model::critical_extension_entries] Visibility: public -/ @[rust_fun "auths_model::critical_extension_entries"] @@ -181,7 +181,7 @@ axiom auths_model.critical_extension_entries auths_model.CriticalExtension) /-- [auths_model::critical_extension_id]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1153:0-1153:75 + Source: 'core/crates/auths-model/src/lib.rs', lines 1135:0-1135:75 Name pattern: [auths_model::critical_extension_id] Visibility: public -/ @[rust_fun "auths_model::critical_extension_id"] @@ -189,7 +189,7 @@ axiom auths_model.critical_extension_id : auths_model.CriticalExtension → Result auths_model.ExtensionId /-- [auths_model::critical_extension_payload]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1160:0-1160:73 + Source: 'core/crates/auths-model/src/lib.rs', lines 1142:0-1142:73 Name pattern: [auths_model::critical_extension_payload] Visibility: public -/ @[rust_fun "auths_model::critical_extension_payload"] diff --git a/formal/qualification/aeneas/generated/authority/Types.lean b/formal/qualification/aeneas/generated/authority/Types.lean index 61bdd4df2..69eda6654 100644 --- a/formal/qualification/aeneas/generated/authority/Types.lean +++ b/formal/qualification/aeneas/generated/authority/Types.lean @@ -45,7 +45,7 @@ structure auths_algebra_kernel.RootLinkage (Identity : Type) where grant_issuer : Identity /-- Trait declaration: [auths_model::CriticalExtensionLaws] - Source: 'core/crates/auths-model/src/lib.rs', lines 1121:0-1121:31 + Source: 'core/crates/auths-model/src/lib.rs', lines 1103:0-1103:31 Name pattern: [auths_model::CriticalExtensionLaws] Visibility: public -/ @[rust_trait "auths_model::CriticalExtensionLaws"] @@ -54,7 +54,7 @@ structure auths_model.CriticalExtensionLaws (Self : Type) where Option (Slice Std.U8) → Result Bool /-- [auths_model::GrantAuthorityView] - Source: 'core/crates/auths-model/src/lib.rs', lines 1369:0-1369:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 1351:0-1351:33 Name pattern: [auths_model::GrantAuthorityView] Visibility: public -/ @[rust_type "auths_model::GrantAuthorityView"] @@ -74,7 +74,7 @@ structure auths_model.GrantAuthorityView where extensions : auths_model.CriticalExtensions /-- [auths_model::ScopeAuthorityView] - Source: 'core/crates/auths-model/src/lib.rs', lines 1389:0-1389:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 1371:0-1371:33 Name pattern: [auths_model::ScopeAuthorityView] Visibility: public -/ @[rust_type "auths_model::ScopeAuthorityView"] @@ -91,7 +91,7 @@ structure auths_model.ScopeAuthorityView where extensions : auths_model.CriticalExtensions /-- [auths_model::ActionAuthorityView] - Source: 'core/crates/auths-model/src/lib.rs', lines 1597:0-1597:34 + Source: 'core/crates/auths-model/src/lib.rs', lines 1579:0-1579:34 Name pattern: [auths_model::ActionAuthorityView] Visibility: public -/ @[rust_type "auths_model::ActionAuthorityView"] @@ -106,7 +106,7 @@ structure auths_model.ActionAuthorityView where terminal_grant : Option auths_model.GrantId /-- [auths_model::DenialReason] - Source: 'core/crates/auths-model/src/lib.rs', lines 4879:0-4879:21 + Source: 'core/crates/auths-model/src/lib.rs', lines 4928:0-4928:21 Name pattern: [auths_model::DenialReason] Visibility: public -/ @[discriminant isize, rust_type "auths_model::DenialReason"] diff --git a/formal/qualification/aeneas/generated/authority/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/authority/TypesExternal_Template.lean index 2ec970bd0..dbf502de1 100644 --- a/formal/qualification/aeneas/generated/authority/TypesExternal_Template.lean +++ b/formal/qualification/aeneas/generated/authority/TypesExternal_Template.lean @@ -14,119 +14,119 @@ set_option maxHeartbeats 1000000 set_option maxRecDepth 2048 /-- [auths_model::AssurancePolicyId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Name pattern: [auths_model::AssurancePolicyId] Visibility: public -/ @[rust_type "auths_model::AssurancePolicyId"] axiom auths_model.AssurancePolicyId : Type /-- [auths_model::Audience] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Name pattern: [auths_model::Audience] Visibility: public -/ @[rust_type "auths_model::Audience"] axiom auths_model.Audience : Type /-- [auths_model::ExtensionId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Name pattern: [auths_model::ExtensionId] Visibility: public -/ @[rust_type "auths_model::ExtensionId"] axiom auths_model.ExtensionId : Type /-- [auths_model::PrincipalId] - Source: 'core/crates/auths-model/src/lib.rs', lines 162:0-162:22 + Source: 'core/crates/auths-model/src/lib.rs', lines 154:0-154:22 Name pattern: [auths_model::PrincipalId] Visibility: public -/ @[rust_type "auths_model::PrincipalId"] axiom auths_model.PrincipalId : Type /-- [auths_model::Digest] - Source: 'core/crates/auths-model/src/lib.rs', lines 248:0-248:17 + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:17 Name pattern: [auths_model::Digest] Visibility: public -/ @[rust_type "auths_model::Digest"] axiom auths_model.Digest : Type /-- [auths_model::GrantId] - Source: 'core/crates/auths-model/src/lib.rs', lines 267:8-267:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 Name pattern: [auths_model::GrantId] Visibility: public -/ @[rust_type "auths_model::GrantId"] axiom auths_model.GrantId : Type /-- [auths_model::ValidityWindow] - Source: 'core/crates/auths-model/src/lib.rs', lines 372:0-372:25 + Source: 'core/crates/auths-model/src/lib.rs', lines 354:0-354:25 Name pattern: [auths_model::ValidityWindow] Visibility: public -/ @[rust_type "auths_model::ValidityWindow"] axiom auths_model.ValidityWindow : Type /-- [auths_model::ProfileRef] - Source: 'core/crates/auths-model/src/lib.rs', lines 445:0-445:21 + Source: 'core/crates/auths-model/src/lib.rs', lines 427:0-427:21 Name pattern: [auths_model::ProfileRef] Visibility: public -/ @[rust_type "auths_model::ProfileRef"] axiom auths_model.ProfileRef : Type /-- [auths_model::Permission] - Source: 'core/crates/auths-model/src/lib.rs', lines 522:0-522:21 + Source: 'core/crates/auths-model/src/lib.rs', lines 504:0-504:21 Name pattern: [auths_model::Permission] Visibility: public -/ @[rust_type "auths_model::Permission"] axiom auths_model.Permission : Type /-- [auths_model::PermissionSet] - Source: 'core/crates/auths-model/src/lib.rs', lines 553:0-553:24 + Source: 'core/crates/auths-model/src/lib.rs', lines 535:0-535:24 Name pattern: [auths_model::PermissionSet] Visibility: public -/ @[rust_type "auths_model::PermissionSet"] axiom auths_model.PermissionSet : Type /-- [auths_model::AudienceSet] - Source: 'core/crates/auths-model/src/lib.rs', lines 616:0-616:22 + Source: 'core/crates/auths-model/src/lib.rs', lines 598:0-598:22 Name pattern: [auths_model::AudienceSet] Visibility: public -/ @[rust_type "auths_model::AudienceSet"] axiom auths_model.AudienceSet : Type /-- [auths_model::ActionConstraint] - Source: 'core/crates/auths-model/src/lib.rs', lines 773:0-773:25 + Source: 'core/crates/auths-model/src/lib.rs', lines 755:0-755:25 Name pattern: [auths_model::ActionConstraint] Visibility: public -/ @[rust_type "auths_model::ActionConstraint"] axiom auths_model.ActionConstraint : Type /-- [auths_model::BudgetCeiling] - Source: 'core/crates/auths-model/src/lib.rs', lines 850:0-850:24 + Source: 'core/crates/auths-model/src/lib.rs', lines 832:0-832:24 Name pattern: [auths_model::BudgetCeiling] Visibility: public -/ @[rust_type "auths_model::BudgetCeiling"] axiom auths_model.BudgetCeiling : Type /-- [auths_model::ProfileBudgetExpression] - Source: 'core/crates/auths-model/src/lib.rs', lines 945:0-945:32 + Source: 'core/crates/auths-model/src/lib.rs', lines 927:0-927:32 Name pattern: [auths_model::ProfileBudgetExpression] Visibility: public -/ @[rust_type "auths_model::ProfileBudgetExpression"] axiom auths_model.ProfileBudgetExpression : Type /-- [auths_model::StatusPolicy] - Source: 'core/crates/auths-model/src/lib.rs', lines 1003:0-1003:21 + Source: 'core/crates/auths-model/src/lib.rs', lines 985:0-985:21 Name pattern: [auths_model::StatusPolicy] Visibility: public -/ @[rust_type "auths_model::StatusPolicy"] axiom auths_model.StatusPolicy : Type /-- [auths_model::CriticalExtension] - Source: 'core/crates/auths-model/src/lib.rs', lines 1047:0-1047:28 + Source: 'core/crates/auths-model/src/lib.rs', lines 1029:0-1029:28 Name pattern: [auths_model::CriticalExtension] Visibility: public -/ @[rust_type "auths_model::CriticalExtension"] axiom auths_model.CriticalExtension : Type /-- [auths_model::CriticalExtensions] - Source: 'core/crates/auths-model/src/lib.rs', lines 1078:0-1078:29 + Source: 'core/crates/auths-model/src/lib.rs', lines 1060:0-1060:29 Name pattern: [auths_model::CriticalExtensions] Visibility: public -/ @[rust_type "auths_model::CriticalExtensions"] diff --git a/formal/qualification/aeneas/generated/authority/translation.json b/formal/qualification/aeneas/generated/authority/translation.json index c7fdae891..194cfc1fe 100644 --- a/formal/qualification/aeneas/generated/authority/translation.json +++ b/formal/qualification/aeneas/generated/authority/translation.json @@ -45,8 +45,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 201, - "end_line": 201 + "begin_line": 183, + "end_line": 183 }, "is_opaque": true, "can_fail": true, @@ -62,8 +62,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 435, - "end_line": 435 + "begin_line": 417, + "end_line": 417 }, "is_opaque": true, "can_fail": true, @@ -79,8 +79,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 478, - "end_line": 478 + "begin_line": 460, + "end_line": 460 }, "is_opaque": true, "can_fail": true, @@ -96,8 +96,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 485, - "end_line": 485 + "begin_line": 467, + "end_line": 467 }, "is_opaque": true, "can_fail": true, @@ -113,8 +113,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 499, - "end_line": 499 + "begin_line": 481, + "end_line": 481 }, "is_opaque": true, "can_fail": true, @@ -130,8 +130,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 513, - "end_line": 513 + "begin_line": 495, + "end_line": 495 }, "is_opaque": true, "can_fail": true, @@ -147,8 +147,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 590, - "end_line": 590 + "begin_line": 572, + "end_line": 572 }, "is_opaque": true, "can_fail": true, @@ -164,8 +164,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 604, - "end_line": 604 + "begin_line": 586, + "end_line": 586 }, "is_opaque": true, "can_fail": true, @@ -181,8 +181,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 657, - "end_line": 657 + "begin_line": 639, + "end_line": 639 }, "is_opaque": true, "can_fail": true, @@ -198,8 +198,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 671, - "end_line": 671 + "begin_line": 653, + "end_line": 653 }, "is_opaque": true, "can_fail": true, @@ -215,8 +215,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 816, - "end_line": 816 + "begin_line": 798, + "end_line": 798 }, "is_opaque": true, "can_fail": true, @@ -232,8 +232,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 827, - "end_line": 827 + "begin_line": 809, + "end_line": 809 }, "is_opaque": true, "can_fail": true, @@ -249,8 +249,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 896, - "end_line": 899 + "begin_line": 878, + "end_line": 881 }, "is_opaque": true, "can_fail": true, @@ -266,8 +266,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 964, - "end_line": 968 + "begin_line": 946, + "end_line": 950 }, "is_opaque": true, "can_fail": true, @@ -283,8 +283,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1026, - "end_line": 1026 + "begin_line": 1008, + "end_line": 1008 }, "is_opaque": true, "can_fail": true, @@ -300,8 +300,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1129, - "end_line": 1132 + "begin_line": 1111, + "end_line": 1114 }, "is_opaque": true, "can_fail": true, @@ -317,8 +317,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1146, - "end_line": 1146 + "begin_line": 1128, + "end_line": 1128 }, "is_opaque": true, "can_fail": true, @@ -334,8 +334,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1153, - "end_line": 1153 + "begin_line": 1135, + "end_line": 1135 }, "is_opaque": true, "can_fail": true, @@ -351,8 +351,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1160, - "end_line": 1160 + "begin_line": 1142, + "end_line": 1142 }, "is_opaque": true, "can_fail": true, @@ -691,8 +691,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -703,8 +703,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -715,8 +715,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -727,8 +727,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 162, - "end_line": 162 + "begin_line": 154, + "end_line": 154 } }, { @@ -739,8 +739,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 248, - "end_line": 248 + "begin_line": 230, + "end_line": 230 } }, { @@ -751,8 +751,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 267, - "end_line": 267 + "begin_line": 249, + "end_line": 249 } }, { @@ -763,8 +763,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 372, - "end_line": 372 + "begin_line": 354, + "end_line": 354 } }, { @@ -775,8 +775,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 445, - "end_line": 445 + "begin_line": 427, + "end_line": 427 } }, { @@ -787,8 +787,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 522, - "end_line": 522 + "begin_line": 504, + "end_line": 504 } }, { @@ -799,8 +799,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 553, - "end_line": 553 + "begin_line": 535, + "end_line": 535 } }, { @@ -811,8 +811,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 616, - "end_line": 616 + "begin_line": 598, + "end_line": 598 } }, { @@ -823,8 +823,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 773, - "end_line": 773 + "begin_line": 755, + "end_line": 755 } }, { @@ -835,8 +835,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 850, - "end_line": 850 + "begin_line": 832, + "end_line": 832 } }, { @@ -847,8 +847,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 945, - "end_line": 945 + "begin_line": 927, + "end_line": 927 } }, { @@ -859,8 +859,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1003, - "end_line": 1003 + "begin_line": 985, + "end_line": 985 } }, { @@ -871,8 +871,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1047, - "end_line": 1047 + "begin_line": 1029, + "end_line": 1029 } }, { @@ -883,8 +883,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1078, - "end_line": 1078 + "begin_line": 1060, + "end_line": 1060 } }, { @@ -919,8 +919,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1369, - "end_line": 1369 + "begin_line": 1351, + "end_line": 1351 } }, { @@ -931,8 +931,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1389, - "end_line": 1389 + "begin_line": 1371, + "end_line": 1371 } }, { @@ -943,8 +943,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1597, - "end_line": 1597 + "begin_line": 1579, + "end_line": 1579 } }, { @@ -955,8 +955,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 4879, - "end_line": 4879 + "begin_line": 4928, + "end_line": 4928 } }, { @@ -1066,8 +1066,8 @@ "is_local": false, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1121, - "end_line": 1121 + "begin_line": 1103, + "end_line": 1103 } } ], diff --git a/formal/qualification/aeneas/generated/bounded_policy/Funs.lean b/formal/qualification/aeneas/generated/bounded_policy/Funs.lean index e0393919c..abda84edd 100644 --- a/formal/qualification/aeneas/generated/bounded_policy/Funs.lean +++ b/formal/qualification/aeneas/generated/bounded_policy/Funs.lean @@ -196,8 +196,31 @@ def kernel.chain_sums_admit then ok false else kernel.chain_sums_admit_loop sums argument capacities 0#usize +/-- [auths_bounded_policy::kernel::reservation_admission]: + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 192:0-210:1 + Visibility: public -/ +def kernel.reservation_admission + (counts : Slice Std.U64) (count_capacities : Slice Std.U64) + (sum_slots : Slice Std.U64) (sum_slot_capacities : Slice Std.U64) + (totals : Slice Std.U64) (sum_capacities : Slice Std.U64) + (argument : Std.U64) : + Result kernel.ReservationCode + := do + let b ← kernel.chain_counts_admit counts count_capacities + if b + then + let b1 ← kernel.chain_counts_admit sum_slots sum_slot_capacities + if b1 + then + let b2 ← kernel.chain_sums_admit totals argument sum_capacities + if b2 + then ok kernel.ReservationCode.Admit + else ok kernel.ReservationCode.SumExhausted + else ok kernel.ReservationCode.WindowExhausted + else ok kernel.ReservationCode.WindowExhausted + /-- [auths_bounded_policy::kernel::bytes_equal]: loop body 0: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 219:4-226:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 255:4-262:1 Visibility: public -/ @[rust_loop_body] def kernel.bytes_equal_loop.body @@ -216,7 +239,7 @@ def kernel.bytes_equal_loop.body else ok (done true) /-- [auths_bounded_policy::kernel::bytes_equal]: loop 0: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 219:4-226:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 255:4-262:1 Visibility: public -/ @[rust_loop] def kernel.bytes_equal_loop @@ -228,7 +251,7 @@ def kernel.bytes_equal_loop index /-- [auths_bounded_policy::kernel::bytes_equal]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 214:0-226:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 250:0-262:1 Visibility: public -/ def kernel.bytes_equal (left : Slice Std.U8) (right : Slice Std.U8) : Result Bool := do @@ -239,7 +262,7 @@ def kernel.bytes_equal else kernel.bytes_equal_loop left right 0#usize /-- [auths_bounded_policy::kernel::values_contain]: loop body 0: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 232:4-239:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 268:4-275:1 Visibility: public -/ @[rust_loop_body] def kernel.values_contain_loop.body @@ -260,7 +283,7 @@ def kernel.values_contain_loop.body else ok (done false) /-- [auths_bounded_policy::kernel::values_contain]: loop 0: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 232:4-239:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 268:4-275:1 Visibility: public -/ @[rust_loop] def kernel.values_contain_loop @@ -273,7 +296,7 @@ def kernel.values_contain_loop index /-- [auths_bounded_policy::kernel::values_contain]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 230:0-239:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 266:0-275:1 Visibility: public -/ @[reducible] def kernel.values_contain @@ -283,7 +306,7 @@ def kernel.values_contain kernel.values_contain_loop values value 0#usize /-- [auths_bounded_policy::kernel::values_subset]: loop body 0: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 245:4-252:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 281:4-288:1 Visibility: public -/ @[rust_loop_body] def kernel.values_subset_loop.body @@ -304,7 +327,7 @@ def kernel.values_subset_loop.body else ok (done true) /-- [auths_bounded_policy::kernel::values_subset]: loop 0: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 245:4-252:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 281:4-288:1 Visibility: public -/ @[rust_loop] def kernel.values_subset_loop @@ -317,7 +340,7 @@ def kernel.values_subset_loop index /-- [auths_bounded_policy::kernel::values_subset]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 243:0-252:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 279:0-288:1 Visibility: public -/ @[reducible] def kernel.values_subset @@ -328,7 +351,7 @@ def kernel.values_subset kernel.values_subset_loop child parent 0#usize /-- [auths_bounded_policy::kernel::values_narrow]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 256:0-258:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 292:0-294:1 Visibility: public -/ def kernel.values_narrow (child : kernel.ValueList) (parent : kernel.ValueList) : Result Bool := do @@ -343,7 +366,7 @@ def kernel.values_narrow else ok false /-- [auths_bounded_policy::kernel::partition_narrows]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 267:0-278:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 303:0-314:1 Visibility: public -/ def kernel.partition_narrows (child : Option kernel.ValueList) (parent : Option kernel.ValueList) : @@ -359,7 +382,7 @@ def kernel.partition_narrows | some child1 => kernel.values_narrow child1 parent1 /-- [auths_bounded_policy::kernel::sum_tightens]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 284:0-295:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 320:0-331:1 Visibility: public -/ def kernel.sum_tightens (child : Option kernel.SumBound) (parent : Option kernel.SumBound) : @@ -376,7 +399,7 @@ def kernel.sum_tightens else ok false /-- [auths_bounded_policy::kernel::scope_tightens]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 300:0-308:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 336:0-344:1 Visibility: public -/ def kernel.scope_tightens (child : Option kernel.ValueList) (parent : Option kernel.ValueList) : @@ -390,7 +413,7 @@ def kernel.scope_tightens | some child1 => kernel.values_narrow child1 parent1 /-- [auths_bounded_policy::kernel::argument_policy_tightens]: - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 314:0-332:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 350:0-368:1 Visibility: public -/ def kernel.argument_policy_tightens (child : kernel.PolicyMembers) (parent : kernel.PolicyMembers) : diff --git a/formal/qualification/aeneas/generated/bounded_policy/Types.lean b/formal/qualification/aeneas/generated/bounded_policy/Types.lean index b51c9ec53..350fc7b41 100644 --- a/formal/qualification/aeneas/generated/bounded_policy/Types.lean +++ b/formal/qualification/aeneas/generated/bounded_policy/Types.lean @@ -34,22 +34,31 @@ inductive kernel.CeilingCountCode where | AboveCeiling : kernel.CeilingCountCode | WindowExhausted : kernel.CeilingCountCode +/-- [auths_bounded_policy::kernel::ReservationCode] + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 178:0-185:1 + Visibility: public -/ +@[discriminant isize] +inductive kernel.ReservationCode where +| Admit : kernel.ReservationCode +| WindowExhausted : kernel.ReservationCode +| SumExhausted : kernel.ReservationCode + /-- [auths_bounded_policy::kernel::ValueList] - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 178:0-183:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 214:0-219:1 Visibility: public -/ structure kernel.ValueList where argument : alloc.vec.Vec Std.U8 values : alloc.vec.Vec (alloc.vec.Vec Std.U8) /-- [auths_bounded_policy::kernel::SumBound] - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 187:0-193:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 223:0-229:1 Visibility: public -/ structure kernel.SumBound where limit : Std.U64 partition : Option kernel.ValueList /-- [auths_bounded_policy::kernel::PolicyMembers] - Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 197:0-210:1 + Source: 'product/policy/auths-bounded-policy/src/kernel.rs', lines 233:0-246:1 Visibility: public -/ structure kernel.PolicyMembers where argument : alloc.vec.Vec Std.U8 diff --git a/formal/qualification/aeneas/generated/bounded_policy/translation.json b/formal/qualification/aeneas/generated/bounded_policy/translation.json index 5daede087..5f6cf76d9 100644 --- a/formal/qualification/aeneas/generated/bounded_policy/translation.json +++ b/formal/qualification/aeneas/generated/bounded_policy/translation.json @@ -4,7 +4,7 @@ "crate": "auths_bounded_policy", "functions": [ { - "def_id": 0, + "def_id": 1, "lean_name": "auths_bounded_policy.kernel.configuration_match_code", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::configuration_match_code", @@ -21,7 +21,7 @@ "reducible": false }, { - "def_id": 1, + "def_id": 2, "lean_name": "auths_bounded_policy.kernel.checked_add_u64", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::checked_add_u64", @@ -38,7 +38,7 @@ "reducible": false }, { - "def_id": 2, + "def_id": 3, "lean_name": "auths_bounded_policy.kernel.checked_sub_u64", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::checked_sub_u64", @@ -55,7 +55,7 @@ "reducible": false }, { - "def_id": 3, + "def_id": 4, "lean_name": "auths_bounded_policy.kernel.checked_mul_u64", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::checked_mul_u64", @@ -72,7 +72,7 @@ "reducible": false }, { - "def_id": 4, + "def_id": 5, "lean_name": "auths_bounded_policy.kernel.checked_div_u64", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::checked_div_u64", @@ -89,7 +89,7 @@ "reducible": false }, { - "def_id": 5, + "def_id": 6, "lean_name": "auths_bounded_policy.kernel.ceiling_count_code", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::ceiling_count_code", @@ -106,7 +106,7 @@ "reducible": false }, { - "def_id": 6, + "def_id": 7, "lean_name": "auths_bounded_policy.kernel.ceiling_count_tightens", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::ceiling_count_tightens", @@ -123,7 +123,7 @@ "reducible": false }, { - "def_id": 7, + "def_id": 8, "lean_name": "auths_bounded_policy.kernel.window_index", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::window_index", @@ -140,7 +140,7 @@ "reducible": false }, { - "def_id": 8, + "def_id": 9, "lean_name": "auths_bounded_policy.kernel.chain_counts_admit_loop.body", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::chain_counts_admit", @@ -165,7 +165,7 @@ "parent_lean_name": "auths_bounded_policy.kernel.chain_counts_admit" }, { - "def_id": 8, + "def_id": 9, "lean_name": "auths_bounded_policy.kernel.chain_counts_admit_loop", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::chain_counts_admit", @@ -190,7 +190,7 @@ "parent_lean_name": "auths_bounded_policy.kernel.chain_counts_admit" }, { - "def_id": 8, + "def_id": 9, "lean_name": "auths_bounded_policy.kernel.chain_counts_admit", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::chain_counts_admit", @@ -207,7 +207,7 @@ "reducible": false }, { - "def_id": 9, + "def_id": 10, "lean_name": "auths_bounded_policy.kernel.chain_sums_admit_loop.body", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::chain_sums_admit", @@ -232,7 +232,7 @@ "parent_lean_name": "auths_bounded_policy.kernel.chain_sums_admit" }, { - "def_id": 9, + "def_id": 10, "lean_name": "auths_bounded_policy.kernel.chain_sums_admit_loop", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::chain_sums_admit", @@ -257,7 +257,7 @@ "parent_lean_name": "auths_bounded_policy.kernel.chain_sums_admit" }, { - "def_id": 9, + "def_id": 10, "lean_name": "auths_bounded_policy.kernel.chain_sums_admit", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::chain_sums_admit", @@ -274,15 +274,32 @@ "reducible": false }, { - "def_id": 17, + "def_id": 0, + "lean_name": "auths_bounded_policy.kernel.reservation_admission", + "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", + "rust_name": "auths_bounded_policy::kernel::reservation_admission", + "is_local": true, + "source": { + "file": "product/policy/auths-bounded-policy/src/kernel.rs", + "begin_line": 192, + "end_line": 210 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 18, "lean_name": "auths_bounded_policy.kernel.bytes_equal_loop.body", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::bytes_equal", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 219, - "end_line": 226 + "begin_line": 255, + "end_line": 262 }, "is_opaque": false, "can_fail": true, @@ -299,15 +316,15 @@ "parent_lean_name": "auths_bounded_policy.kernel.bytes_equal" }, { - "def_id": 17, + "def_id": 18, "lean_name": "auths_bounded_policy.kernel.bytes_equal_loop", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::bytes_equal", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 219, - "end_line": 226 + "begin_line": 255, + "end_line": 262 }, "is_opaque": false, "can_fail": true, @@ -324,15 +341,15 @@ "parent_lean_name": "auths_bounded_policy.kernel.bytes_equal" }, { - "def_id": 17, + "def_id": 18, "lean_name": "auths_bounded_policy.kernel.bytes_equal", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::bytes_equal", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 214, - "end_line": 226 + "begin_line": 250, + "end_line": 262 }, "is_opaque": false, "can_fail": true, @@ -341,15 +358,15 @@ "reducible": false }, { - "def_id": 23, + "def_id": 24, "lean_name": "auths_bounded_policy.kernel.values_contain_loop.body", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_contain", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 232, - "end_line": 239 + "begin_line": 268, + "end_line": 275 }, "is_opaque": false, "can_fail": true, @@ -366,15 +383,15 @@ "parent_lean_name": "auths_bounded_policy.kernel.values_contain" }, { - "def_id": 23, + "def_id": 24, "lean_name": "auths_bounded_policy.kernel.values_contain_loop", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_contain", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 232, - "end_line": 239 + "begin_line": 268, + "end_line": 275 }, "is_opaque": false, "can_fail": true, @@ -391,15 +408,15 @@ "parent_lean_name": "auths_bounded_policy.kernel.values_contain" }, { - "def_id": 23, + "def_id": 24, "lean_name": "auths_bounded_policy.kernel.values_contain", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_contain", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 230, - "end_line": 239 + "begin_line": 266, + "end_line": 275 }, "is_opaque": false, "can_fail": true, @@ -408,15 +425,15 @@ "reducible": true }, { - "def_id": 22, + "def_id": 23, "lean_name": "auths_bounded_policy.kernel.values_subset_loop.body", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_subset", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 245, - "end_line": 252 + "begin_line": 281, + "end_line": 288 }, "is_opaque": false, "can_fail": true, @@ -433,15 +450,15 @@ "parent_lean_name": "auths_bounded_policy.kernel.values_subset" }, { - "def_id": 22, + "def_id": 23, "lean_name": "auths_bounded_policy.kernel.values_subset_loop", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_subset", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 245, - "end_line": 252 + "begin_line": 281, + "end_line": 288 }, "is_opaque": false, "can_fail": true, @@ -458,15 +475,15 @@ "parent_lean_name": "auths_bounded_policy.kernel.values_subset" }, { - "def_id": 22, + "def_id": 23, "lean_name": "auths_bounded_policy.kernel.values_subset", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_subset", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 243, - "end_line": 252 + "begin_line": 279, + "end_line": 288 }, "is_opaque": false, "can_fail": true, @@ -475,15 +492,15 @@ "reducible": true }, { - "def_id": 21, + "def_id": 22, "lean_name": "auths_bounded_policy.kernel.values_narrow", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::values_narrow", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 256, - "end_line": 258 + "begin_line": 292, + "end_line": 294 }, "is_opaque": false, "can_fail": true, @@ -492,15 +509,15 @@ "reducible": false }, { - "def_id": 20, + "def_id": 21, "lean_name": "auths_bounded_policy.kernel.partition_narrows", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::partition_narrows", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 267, - "end_line": 278 + "begin_line": 303, + "end_line": 314 }, "is_opaque": false, "can_fail": true, @@ -509,15 +526,15 @@ "reducible": false }, { - "def_id": 18, + "def_id": 19, "lean_name": "auths_bounded_policy.kernel.sum_tightens", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::sum_tightens", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 284, - "end_line": 295 + "begin_line": 320, + "end_line": 331 }, "is_opaque": false, "can_fail": true, @@ -526,15 +543,15 @@ "reducible": false }, { - "def_id": 19, + "def_id": 20, "lean_name": "auths_bounded_policy.kernel.scope_tightens", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::scope_tightens", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 300, - "end_line": 308 + "begin_line": 336, + "end_line": 344 }, "is_opaque": false, "can_fail": true, @@ -543,15 +560,15 @@ "reducible": false }, { - "def_id": 10, + "def_id": 11, "lean_name": "auths_bounded_policy.kernel.argument_policy_tightens", "lean_file": "qualification/aeneas/generated/bounded_policy/Funs.lean", "rust_name": "auths_bounded_policy::kernel::argument_policy_tightens", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 314, - "end_line": 332 + "begin_line": 350, + "end_line": 368 }, "is_opaque": false, "can_fail": true, @@ -562,7 +579,7 @@ ], "types": [ { - "def_id": 0, + "def_id": 1, "lean_name": "auths_bounded_policy.kernel.ConfigurationMatchCode", "lean_file": "qualification/aeneas/generated/bounded_policy/Types.lean", "rust_name": "auths_bounded_policy::kernel::ConfigurationMatchCode", @@ -574,7 +591,7 @@ } }, { - "def_id": 2, + "def_id": 3, "lean_name": "auths_bounded_policy.kernel.CeilingCountCode", "lean_file": "qualification/aeneas/generated/bounded_policy/Types.lean", "rust_name": "auths_bounded_policy::kernel::CeilingCountCode", @@ -586,39 +603,51 @@ } }, { - "def_id": 7, + "def_id": 0, + "lean_name": "auths_bounded_policy.kernel.ReservationCode", + "lean_file": "qualification/aeneas/generated/bounded_policy/Types.lean", + "rust_name": "auths_bounded_policy::kernel::ReservationCode", + "is_local": true, + "source": { + "file": "product/policy/auths-bounded-policy/src/kernel.rs", + "begin_line": 178, + "end_line": 185 + } + }, + { + "def_id": 8, "lean_name": "auths_bounded_policy.kernel.ValueList", "lean_file": "qualification/aeneas/generated/bounded_policy/Types.lean", "rust_name": "auths_bounded_policy::kernel::ValueList", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 178, - "end_line": 183 + "begin_line": 214, + "end_line": 219 } }, { - "def_id": 6, + "def_id": 7, "lean_name": "auths_bounded_policy.kernel.SumBound", "lean_file": "qualification/aeneas/generated/bounded_policy/Types.lean", "rust_name": "auths_bounded_policy::kernel::SumBound", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 187, - "end_line": 193 + "begin_line": 223, + "end_line": 229 } }, { - "def_id": 3, + "def_id": 4, "lean_name": "auths_bounded_policy.kernel.PolicyMembers", "lean_file": "qualification/aeneas/generated/bounded_policy/Types.lean", "rust_name": "auths_bounded_policy::kernel::PolicyMembers", "is_local": true, "source": { "file": "product/policy/auths-bounded-policy/src/kernel.rs", - "begin_line": 197, - "end_line": 210 + "begin_line": 233, + "end_line": 246 } } ], diff --git a/formal/qualification/aeneas/generated/codec/Funs.lean b/formal/qualification/aeneas/generated/codec/Funs.lean new file mode 100644 index 000000000..6f476f8d9 --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/Funs.lean @@ -0,0 +1,3831 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: function definitions +import Aeneas +import qualification.aeneas.generated.codec.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +namespace auths_codec + +/-- Trait implementation: [core::option::{impl core::cmp::PartialEq> for core::option::Option}] + Source: '/rustc/library/core/src/option.rs', lines 2438:0-2438:56 + Name pattern: [core::cmp::PartialEq, core::option::Option<@T>>] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq, core::option::Option<@T>>"] +impl_def core.option.Option.Insts.CoreCmpPartialEqOption {T : Type} + (cmpPartialEqInst : core.cmp.PartialEq T T) : core.cmp.PartialEq (Option T) + (Option T) := { + eq := core.option.Option.Insts.CoreCmpPartialEqOption.eq cmpPartialEqInst + ne := core.cmp.PartialEq.ne.trait_default + (core.option.Option.Insts.CoreCmpPartialEqOption cmpPartialEqInst) +} + +/-- Trait implementation: [core::slice::cmp::{impl core::cmp::PartialEq<[U]> for [T]}] + Source: '/rustc/library/core/src/slice/cmp.rs', lines 14:0-16:28 + Name pattern: [core::cmp::PartialEq<[@T], [@U]>] -/ +@[reducible, rust_trait_impl "core::cmp::PartialEq<[@T], [@U]>"] +impl_def Slice.Insts.CoreCmpPartialEqSlice {T : Type} {U : Type} + (cmpPartialEqInst : core.cmp.PartialEq T U) : core.cmp.PartialEq (Slice T) + (Slice U) := { + eq := core.slice.cmp.PartialEqSlice.eq cmpPartialEqInst + ne := core.cmp.PartialEq.ne.trait_default (Slice.Insts.CoreCmpPartialEqSlice + cmpPartialEqInst) +} + +/-- [auths_model::identifier::forbidden_three_byte_prefix]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 9:0-9:72 + Name pattern: [auths_model::identifier::forbidden_three_byte_prefix] -/ +@[rust_fun "auths_model::identifier::forbidden_three_byte_prefix"] +def auths_model.identifier.forbidden_three_byte_prefix + (first : Std.U8) (second : Std.U8) (third : Std.U8) : Result Bool := do + if first = 225#u8 + then if second = 154#u8 + then ok (third = 128#u8) + else ok false + else + if first = 226#u8 + then + if second = 128#u8 + then + let b ← + if 128#u8 <= third + then if third <= 138#u8 + then ok true + else ok false + else ok false + if b + then ok true + else + if third = 168#u8 + then ok true + else if third = 169#u8 + then ok true + else ok (third = 175#u8) + else if second = 129#u8 + then ok (third = 159#u8) + else ok false + else + if first = 227#u8 + then if second = 128#u8 + then ok (third = 128#u8) + else ok false + else ok false + +/-- [auths_model::identifier::forbidden_identifier_at]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 23:0-23:65 + Name pattern: [auths_model::identifier::forbidden_identifier_at] -/ +@[rust_fun "auths_model::identifier::forbidden_identifier_at"] +def auths_model.identifier.forbidden_identifier_at + (input : Slice Std.U8) (position : Std.Usize) : Result Bool := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok false + | some byte => + if byte <= 32#u8 + then ok true + else + if byte = 127#u8 + then ok true + else + let i := Slice.len input + let i1 ← i - position + if i1 < 2#usize + then ok false + else + let i2 ← position + 1#usize + let second ← Slice.index_usize input i2 + if byte = 194#u8 + then + if 128#u8 <= second + then if second <= 160#u8 + then ok true + else ok false + else ok false + else + let i3 := Slice.len input + let i4 ← i3 - position + if i4 < 3#usize + then ok false + else + let i5 ← position + 2#usize + let i6 ← Slice.index_usize input i5 + auths_model.identifier.forbidden_three_byte_prefix byte second i6 + +/-- [auths_model::identifier::contains_forbidden_identifier]: loop body 0: + Source: 'core/crates/auths-model/src/identifier.rs', lines 46:4-53:1 + Name pattern: [auths_model::identifier::contains_forbidden_identifier] -/ +@[rust_loop_body, rust_fun + "auths_model::identifier::contains_forbidden_identifier"] +def auths_model.identifier.contains_forbidden_identifier_loop.body + (input : Slice Std.U8) (position : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len input + if position < i + then + let b ← auths_model.identifier.forbidden_identifier_at input position + if b + then ok (done true) + else let position1 ← position + 1#usize + ok (cont position1) + else ok (done false) + +/-- [auths_model::identifier::contains_forbidden_identifier]: loop 0: + Source: 'core/crates/auths-model/src/identifier.rs', lines 46:4-53:1 + Name pattern: [auths_model::identifier::contains_forbidden_identifier] -/ +@[rust_loop, rust_fun "auths_model::identifier::contains_forbidden_identifier"] +def auths_model.identifier.contains_forbidden_identifier_loop + (input : Slice Std.U8) (position : Std.Usize) : Result Bool := do + loop + (fun position1 => + auths_model.identifier.contains_forbidden_identifier_loop.body input + position1) + position + +/-- [auths_model::identifier::contains_forbidden_identifier]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 44:0-44:54 + Name pattern: [auths_model::identifier::contains_forbidden_identifier] -/ +@[reducible, rust_fun "auths_model::identifier::contains_forbidden_identifier"] +def auths_model.identifier.contains_forbidden_identifier + (input : Slice Std.U8) : Result Bool := do + auths_model.identifier.contains_forbidden_identifier_loop input 0#usize + +/-- [auths_model::identifier::bounded_identifier_valid]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 55:0-55:75 + Name pattern: [auths_model::identifier::bounded_identifier_valid] -/ +@[rust_fun "auths_model::identifier::bounded_identifier_valid"] +def auths_model.identifier.bounded_identifier_valid + (value : Str) (maximum : Std.Usize) : Result Bool := do + let b ← core.str.Str.is_empty value + if b + then ok false + else + let i ← core.str.Str.len value + if i <= maximum + then + let s ← core.str.Str.as_bytes value + let b1 ← auths_model.identifier.contains_forbidden_identifier s + ok (¬ b1) + else ok false + +/-- [auths_model::PROTOCOL_V1] + Source: 'core/crates/auths-model/src/lib.rs', lines 22:0-22:26 + Name pattern: [auths_model::PROTOCOL_V1] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::PROTOCOL_V1"] +def auths_model.PROTOCOL_V1 : Std.U16 := 1#u16 + +/-- [auths_model::HARD_MAX_BUNDLE_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 23:0-23:38 + Name pattern: [auths_model::HARD_MAX_BUNDLE_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_BUNDLE_BYTES"] +def auths_model.HARD_MAX_BUNDLE_BYTES : Result Std.Usize := do + let i ← 8#usize * 1024#usize + i * 1024#usize + +/-- [auths_model::HARD_MAX_ACTION_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 25:0-25:38 + Name pattern: [auths_model::HARD_MAX_ACTION_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_ACTION_BYTES"] +def auths_model.HARD_MAX_ACTION_BYTES : Result Std.Usize := do + let i ← 16#usize * 1024#usize + i * 1024#usize + +/-- [auths_model::HARD_MAX_CONTEXT_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 27:0-27:39 + Name pattern: [auths_model::HARD_MAX_CONTEXT_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_CONTEXT_BYTES"] +def auths_model.HARD_MAX_CONTEXT_BYTES : Result Std.Usize := do + let i ← 16#usize * 1024#usize + i * 1024#usize + +/-- [auths_model::HARD_MAX_GRANTS] + Source: 'core/crates/auths-model/src/lib.rs', lines 29:0-29:32 + Name pattern: [auths_model::HARD_MAX_GRANTS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_GRANTS"] +def auths_model.HARD_MAX_GRANTS : Std.Usize := 256#usize + +/-- [auths_model::HARD_MAX_ACTIONS] + Source: 'core/crates/auths-model/src/lib.rs', lines 31:0-31:33 + Name pattern: [auths_model::HARD_MAX_ACTIONS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_ACTIONS"] +def auths_model.HARD_MAX_ACTIONS : Std.Usize := 128#usize + +/-- [auths_model::HARD_MAX_PLAN_LEAVES] + Source: 'core/crates/auths-model/src/lib.rs', lines 33:0-33:37 + Name pattern: [auths_model::HARD_MAX_PLAN_LEAVES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_PLAN_LEAVES"] +def auths_model.HARD_MAX_PLAN_LEAVES : Std.Usize := 128#usize + +/-- [auths_model::HARD_MAX_PLAN_DEPTH] + Source: 'core/crates/auths-model/src/lib.rs', lines 35:0-35:36 + Name pattern: [auths_model::HARD_MAX_PLAN_DEPTH] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_PLAN_DEPTH"] +def auths_model.HARD_MAX_PLAN_DEPTH : Std.Usize := 16#usize + +/-- [auths_model::HARD_MAX_PLAN_BRANCHING] + Source: 'core/crates/auths-model/src/lib.rs', lines 37:0-37:40 + Name pattern: [auths_model::HARD_MAX_PLAN_BRANCHING] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_PLAN_BRANCHING"] +def auths_model.HARD_MAX_PLAN_BRANCHING : Std.Usize := 128#usize + +/-- [auths_model::HARD_MAX_EVIDENCE] + Source: 'core/crates/auths-model/src/lib.rs', lines 39:0-39:34 + Name pattern: [auths_model::HARD_MAX_EVIDENCE] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_EVIDENCE"] +def auths_model.HARD_MAX_EVIDENCE : Std.Usize := 512#usize + +/-- [auths_model::HARD_MAX_EVIDENCE_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 41:0-41:40 + Name pattern: [auths_model::HARD_MAX_EVIDENCE_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_EVIDENCE_BYTES"] +def auths_model.HARD_MAX_EVIDENCE_BYTES : Result Std.Usize := do + let i ← 2#usize * 1024#usize + i * 1024#usize + +/-- [auths_model::HARD_MAX_BINDINGS] + Source: 'core/crates/auths-model/src/lib.rs', lines 43:0-43:34 + Name pattern: [auths_model::HARD_MAX_BINDINGS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_BINDINGS"] +def auths_model.HARD_MAX_BINDINGS : Std.Usize := 512#usize + +/-- [auths_model::HARD_MAX_PRINCIPAL_STATUS] + Source: 'core/crates/auths-model/src/lib.rs', lines 45:0-45:42 + Name pattern: [auths_model::HARD_MAX_PRINCIPAL_STATUS] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_PRINCIPAL_STATUS"] +def auths_model.HARD_MAX_PRINCIPAL_STATUS : Std.Usize := 512#usize + +/-- [auths_model::HARD_MAX_GRANT_STATUS] + Source: 'core/crates/auths-model/src/lib.rs', lines 47:0-47:38 + Name pattern: [auths_model::HARD_MAX_GRANT_STATUS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_GRANT_STATUS"] +def auths_model.HARD_MAX_GRANT_STATUS : Std.Usize := 512#usize + +/-- [auths_model::HARD_MAX_ATTACHMENTS] + Source: 'core/crates/auths-model/src/lib.rs', lines 49:0-49:37 + Name pattern: [auths_model::HARD_MAX_ATTACHMENTS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_ATTACHMENTS"] +def auths_model.HARD_MAX_ATTACHMENTS : Std.Usize := 512#usize + +/-- [auths_model::HARD_MAX_ATTACHMENT_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 51:0-51:42 + Name pattern: [auths_model::HARD_MAX_ATTACHMENT_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_ATTACHMENT_BYTES"] +def auths_model.HARD_MAX_ATTACHMENT_BYTES : Result Std.Usize := do + let i ← 8#usize * 1024#usize + i * 1024#usize + +/-- [auths_model::HARD_MAX_SIGNATURES] + Source: 'core/crates/auths-model/src/lib.rs', lines 53:0-53:36 + Name pattern: [auths_model::HARD_MAX_SIGNATURES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_SIGNATURES"] +def auths_model.HARD_MAX_SIGNATURES : Std.Usize := 1024#usize + +/-- [auths_model::HARD_MAX_SIGNATURE_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 55:0-55:41 + Name pattern: [auths_model::HARD_MAX_SIGNATURE_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_SIGNATURE_BYTES"] +def auths_model.HARD_MAX_SIGNATURE_BYTES : Std.Usize := 4096#usize + +/-- [auths_model::HARD_MAX_PERMISSIONS] + Source: 'core/crates/auths-model/src/lib.rs', lines 57:0-57:37 + Name pattern: [auths_model::HARD_MAX_PERMISSIONS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_PERMISSIONS"] +def auths_model.HARD_MAX_PERMISSIONS : Std.Usize := 1024#usize + +/-- [auths_model::HARD_MAX_AUDIENCES] + Source: 'core/crates/auths-model/src/lib.rs', lines 59:0-59:35 + Name pattern: [auths_model::HARD_MAX_AUDIENCES] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_AUDIENCES"] +def auths_model.HARD_MAX_AUDIENCES : Std.Usize := 256#usize + +/-- [auths_model::HARD_MAX_EXTENSIONS] + Source: 'core/crates/auths-model/src/lib.rs', lines 61:0-61:36 + Name pattern: [auths_model::HARD_MAX_EXTENSIONS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_EXTENSIONS"] +def auths_model.HARD_MAX_EXTENSIONS : Std.Usize := 32#usize + +/-- [auths_model::HARD_MAX_EXTENSION_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 63:0-63:41 + Name pattern: [auths_model::HARD_MAX_EXTENSION_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_EXTENSION_BYTES"] +def auths_model.HARD_MAX_EXTENSION_BYTES : Std.Usize := 65536#usize + +/-- [auths_model::HARD_MAX_BODY_DIGESTS] + Source: 'core/crates/auths-model/src/lib.rs', lines 65:0-65:38 + Name pattern: [auths_model::HARD_MAX_BODY_DIGESTS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_BODY_DIGESTS"] +def auths_model.HARD_MAX_BODY_DIGESTS : Std.Usize := 256#usize + +/-- [auths_model::HARD_MAX_BINDING_EVIDENCE] + Source: 'core/crates/auths-model/src/lib.rs', lines 67:0-67:42 + Name pattern: [auths_model::HARD_MAX_BINDING_EVIDENCE] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_BINDING_EVIDENCE"] +def auths_model.HARD_MAX_BINDING_EVIDENCE : Std.Usize := 32#usize + +/-- [auths_model::HARD_MAX_CANONICAL_BODY_BYTES] + Source: 'core/crates/auths-model/src/lib.rs', lines 69:0-69:46 + Name pattern: [auths_model::HARD_MAX_CANONICAL_BODY_BYTES] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_CANONICAL_BODY_BYTES"] +def auths_model.HARD_MAX_CANONICAL_BODY_BYTES : Result Std.Usize := do + let i ← 8#usize * 1024#usize + i * 1024#usize + +/-- [auths_model::HARD_MAX_WORK_UNITS] + Source: 'core/crates/auths-model/src/lib.rs', lines 71:0-71:34 + Name pattern: [auths_model::HARD_MAX_WORK_UNITS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_WORK_UNITS"] +def auths_model.HARD_MAX_WORK_UNITS : Std.U64 := 1000000#u64 + +/-- [auths_model::HARD_MAX_REGISTRY_ENTRIES] + Source: 'core/crates/auths-model/src/lib.rs', lines 73:0-73:42 + Name pattern: [auths_model::HARD_MAX_REGISTRY_ENTRIES] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_REGISTRY_ENTRIES"] +def auths_model.HARD_MAX_REGISTRY_ENTRIES : Std.Usize := 1024#usize + +/-- [auths_model::HARD_MAX_TRUST_ANCHORS] + Source: 'core/crates/auths-model/src/lib.rs', lines 75:0-75:39 + Name pattern: [auths_model::HARD_MAX_TRUST_ANCHORS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_TRUST_ANCHORS"] +def auths_model.HARD_MAX_TRUST_ANCHORS : Std.Usize := 1024#usize + +/-- [auths_model::HARD_MAX_APPROVALS] + Source: 'core/crates/auths-model/src/lib.rs', lines 78:0-78:35 + Name pattern: [auths_model::HARD_MAX_APPROVALS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_APPROVALS"] +def auths_model.HARD_MAX_APPROVALS : Std.Usize := 128#usize + +/-- [auths_model::HARD_MAX_APPROVER_ANCHORS] + Source: 'core/crates/auths-model/src/lib.rs', lines 81:0-81:42 + Name pattern: [auths_model::HARD_MAX_APPROVER_ANCHORS] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_APPROVER_ANCHORS"] +def auths_model.HARD_MAX_APPROVER_ANCHORS : Std.Usize := 32#usize + +/-- [auths_model::HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS] + Source: 'core/crates/auths-model/src/lib.rs', lines 84:0-84:55 + Name pattern: [auths_model::HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS] + Visibility: public -/ +@[global_simps, irreducible, rust_const + "auths_model::HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS"] +def auths_model.HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS : Std.Usize := 4#usize + +/-- [auths_model::{auths_model::MediaType}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::MediaType}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::MediaType}::parse"] +def auths_model.MediaType.parse + (value : Str) : + Result (core.result.Result auths_model.MediaType auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 128#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidMediaType) + +/-- [auths_model::{auths_model::ProfileId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::ProfileId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ProfileId}::parse"] +def auths_model.ProfileId.parse + (value : Str) : + Result (core.result.Result auths_model.ProfileId auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 128#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidProfile) + +/-- [auths_model::{auths_model::CapabilityId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::CapabilityId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CapabilityId}::parse"] +def auths_model.CapabilityId.parse + (value : Str) : + Result (core.result.Result auths_model.CapabilityId auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 128#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidCapability) + +/-- [auths_model::{auths_model::ResourceId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::ResourceId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ResourceId}::parse"] +def auths_model.ResourceId.parse + (value : Str) : + Result (core.result.Result auths_model.ResourceId auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 1024#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidResource) + +/-- [auths_model::{auths_model::BudgetAlgebraId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::BudgetAlgebraId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::BudgetAlgebraId}::parse"] +def auths_model.BudgetAlgebraId.parse + (value : Str) : + Result (core.result.Result auths_model.BudgetAlgebraId + auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 128#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidRegistryId) + +/-- [auths_model::{auths_model::MediaType}::as_str]: + Source: 'core/crates/auths-model/src/lib.rs', lines 139:12-139:40 + Name pattern: [auths_model::{auths_model::MediaType}::as_str] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::MediaType}::as_str"] +def auths_model.MediaType.as_str + (self : auths_model.MediaType) : Result Str := do + alloc.string.String.Insts.CoreOpsDerefDerefStr.deref self + +/-- [auths_model::{auths_model::ProfileId}::as_str]: + Source: 'core/crates/auths-model/src/lib.rs', lines 139:12-139:40 + Name pattern: [auths_model::{auths_model::ProfileId}::as_str] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ProfileId}::as_str"] +def auths_model.ProfileId.as_str + (self : auths_model.ProfileId) : Result Str := do + alloc.string.String.Insts.CoreOpsDerefDerefStr.deref self + +/-- [auths_model::{auths_model::CapabilityId}::as_str]: + Source: 'core/crates/auths-model/src/lib.rs', lines 139:12-139:40 + Name pattern: [auths_model::{auths_model::CapabilityId}::as_str] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CapabilityId}::as_str"] +def auths_model.CapabilityId.as_str + (self : auths_model.CapabilityId) : Result Str := do + alloc.string.String.Insts.CoreOpsDerefDerefStr.deref self + +/-- [auths_model::{auths_model::ResourceId}::as_str]: + Source: 'core/crates/auths-model/src/lib.rs', lines 139:12-139:40 + Name pattern: [auths_model::{auths_model::ResourceId}::as_str] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ResourceId}::as_str"] +def auths_model.ResourceId.as_str + (self : auths_model.ResourceId) : Result Str := do + alloc.string.String.Insts.CoreOpsDerefDerefStr.deref self + +/-- [auths_model::{auths_model::BudgetAlgebraId}::as_str]: + Source: 'core/crates/auths-model/src/lib.rs', lines 139:12-139:40 + Name pattern: [auths_model::{auths_model::BudgetAlgebraId}::as_str] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::BudgetAlgebraId}::as_str"] +def auths_model.BudgetAlgebraId.as_str + (self : auths_model.BudgetAlgebraId) : Result Str := do + alloc.string.String.Insts.CoreOpsDerefDerefStr.deref self + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 229:33-229:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq + (self : auths_model.Digest) (other : auths_model.Digest) : Result Bool := do + core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 self other + +/-- [auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 229:44-229:47 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.Digest.Insts.CoreCmpOrd.cmp + (self : auths_model.Digest) (other : auths_model.Digest) : + Result Ordering + := do + Array.Insts.CoreCmpOrd.cmp core.cmp.OrdU8 self other + +/-- [auths_model::{auths_model::Digest}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 236:4-236:45 + Name pattern: [auths_model::{auths_model::Digest}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Digest}::new"] +def auths_model.Digest.new + (bytes : Array Std.U8 32#usize) : Result auths_model.Digest := do + ok bytes + +/-- [auths_model::{auths_model::Digest}::as_bytes]: + Source: 'core/crates/auths-model/src/lib.rs', lines 241:4-241:45 + Name pattern: [auths_model::{auths_model::Digest}::as_bytes] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Digest}::as_bytes"] +def auths_model.Digest.as_bytes + (self : auths_model.Digest) : Result (Array Std.U8 32#usize) := do + ok self + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::AttachmentDigest}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:41-248:50 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest.eq + (self : auths_model.AttachmentDigest) (other : auths_model.AttachmentDigest) + : + Result Bool + := do + auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq self other + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::AttachmentDigest}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:41-248:50 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest : + core.cmp.PartialEq auths_model.AttachmentDigest auths_model.AttachmentDigest + := { + eq := auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest +} + +/-- [auths_model::{impl core::cmp::Eq for auths_model::AttachmentDigest}::assert_fields_are_eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:37-248:39 + Name pattern: [auths_model::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::Eq}::assert_fields_are_eq"] +def auths_model.AttachmentDigest.Insts.CoreCmpEq.assert_fields_are_eq + (self : auths_model.AttachmentDigest) : Result Unit := do + ok () + +/-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::AttachmentDigest}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:37-248:39 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def auths_model.AttachmentDigest.Insts.CoreCmpEq : core.cmp.Eq + auths_model.AttachmentDigest := { + partialEqInst := + auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest + assert_fields_are_eq := + auths_model.AttachmentDigest.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- [auths_model::{impl core::cmp::Ord for auths_model::AttachmentDigest}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:52-248:55 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.AttachmentDigest.Insts.CoreCmpOrd.cmp + (self : auths_model.AttachmentDigest) (other : auths_model.AttachmentDigest) + : + Result Ordering + := do + auths_model.Digest.Insts.CoreCmpOrd.cmp self other + +/-- [auths_model::{impl core::cmp::PartialOrd for auths_model::AttachmentDigest}::partial_cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:57-248:67 + Name pattern: [auths_model::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialOrd}::partial_cmp"] +def + auths_model.AttachmentDigest.Insts.CoreCmpPartialOrdAttachmentDigest.partial_cmp + (self : auths_model.AttachmentDigest) (other : auths_model.AttachmentDigest) + : + Result (Option Ordering) + := do + let o ← auths_model.AttachmentDigest.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::AttachmentDigest}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:57-248:67 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +def auths_model.AttachmentDigest.Insts.CoreCmpPartialOrdAttachmentDigest : + core.cmp.PartialOrd auths_model.AttachmentDigest auths_model.AttachmentDigest + := { + partialEqInst := + auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest + partial_cmp := + auths_model.AttachmentDigest.Insts.CoreCmpPartialOrdAttachmentDigest.partial_cmp +} + +/-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::AttachmentDigest}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:52-248:55 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +def auths_model.AttachmentDigest.Insts.CoreCmpOrd : core.cmp.Ord + auths_model.AttachmentDigest := { + eqInst := auths_model.AttachmentDigest.Insts.CoreCmpEq + partialOrdInst := + auths_model.AttachmentDigest.Insts.CoreCmpPartialOrdAttachmentDigest + cmp := auths_model.AttachmentDigest.Insts.CoreCmpOrd.cmp +} + +/-- [auths_model::{auths_model::AttachmentDigest}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 253:12-253:53 + Name pattern: [auths_model::{auths_model::AttachmentDigest}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AttachmentDigest}::new"] +def auths_model.AttachmentDigest.new + (bytes : Array Std.U8 32#usize) : Result auths_model.AttachmentDigest := do + let d ← auths_model.Digest.new bytes + ok d + +/-- [auths_model::{auths_model::AttachmentDigest}::as_bytes]: + Source: 'core/crates/auths-model/src/lib.rs', lines 268:12-268:53 + Name pattern: [auths_model::{auths_model::AttachmentDigest}::as_bytes] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AttachmentDigest}::as_bytes"] +def auths_model.AttachmentDigest.as_bytes + (self : auths_model.AttachmentDigest) : Result (Array Std.U8 32#usize) := do + auths_model.Digest.as_bytes self + +/-- [auths_model::{auths_model::ProfileRef}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 439:4-439:71 + Name pattern: [auths_model::{auths_model::ProfileRef}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ProfileRef}::new"] +def auths_model.ProfileRef.new + (id : auths_model.ProfileId) (version : Std.U16) : + Result (core.result.Result auths_model.ProfileRef auths_model.ModelError) + := do + if version = 0#u16 + then ok (core.result.Result.Err auths_model.ModelError.InvalidProfile) + else ok (core.result.Result.Ok { id, version }) + +/-- [auths_model::{auths_model::ProfileRef}::id]: + Source: 'core/crates/auths-model/src/lib.rs', lines 447:4-447:40 + Name pattern: [auths_model::{auths_model::ProfileRef}::id] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ProfileRef}::id"] +def auths_model.ProfileRef.impl.id + (self : auths_model.ProfileRef) : Result auths_model.ProfileId := do + ok self.id + +/-- [auths_model::{auths_model::ProfileRef}::version]: + Source: 'core/crates/auths-model/src/lib.rs', lines 452:4-452:38 + Name pattern: [auths_model::{auths_model::ProfileRef}::version] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::ProfileRef}::version"] +def auths_model.ProfileRef.impl.version + (self : auths_model.ProfileRef) : Result Std.U16 := do + ok self.version + +/-- [auths_model::{auths_model::Permission}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 511:4-511:76 + Name pattern: [auths_model::{auths_model::Permission}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Permission}::new"] +def auths_model.Permission.new + (capability : auths_model.CapabilityId) (resource : auths_model.ResourceId) : + Result auths_model.Permission + := do + ok { capability, resource } + +/-- [auths_model::{auths_model::Permission}::capability]: + Source: 'core/crates/auths-model/src/lib.rs', lines 519:4-519:51 + Name pattern: [auths_model::{auths_model::Permission}::capability] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Permission}::capability"] +def auths_model.Permission.impl.capability + (self : auths_model.Permission) : Result auths_model.CapabilityId := do + ok self.capability + +/-- [auths_model::{auths_model::Permission}::resource]: + Source: 'core/crates/auths-model/src/lib.rs', lines 524:4-524:47 + Name pattern: [auths_model::{auths_model::Permission}::resource] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Permission}::resource"] +def auths_model.Permission.impl.resource + (self : auths_model.Permission) : Result auths_model.ResourceId := do + ok self.resource + +/-- [auths_model::{auths_model::BudgetCeiling}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 839:4-839:66 + Name pattern: [auths_model::{auths_model::BudgetCeiling}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::BudgetCeiling}::new"] +def auths_model.BudgetCeiling.new + (algebra : auths_model.BudgetAlgebraId) (value : Std.U64) : + Result auths_model.BudgetCeiling + := do + ok { algebra, value } + +/-- [auths_model::{auths_model::BudgetCeiling}::algebra]: + Source: 'core/crates/auths-model/src/lib.rs', lines 844:4-844:51 + Name pattern: [auths_model::{auths_model::BudgetCeiling}::algebra] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::BudgetCeiling}::algebra"] +def auths_model.BudgetCeiling.impl.algebra + (self : auths_model.BudgetCeiling) : Result auths_model.BudgetAlgebraId := do + ok self.algebra + +/-- [auths_model::{auths_model::BudgetCeiling}::value]: + Source: 'core/crates/auths-model/src/lib.rs', lines 849:4-849:36 + Name pattern: [auths_model::{auths_model::BudgetCeiling}::value] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::BudgetCeiling}::value"] +def auths_model.BudgetCeiling.impl.value + (self : auths_model.BudgetCeiling) : Result Std.U64 := do + ok self.value + +/-- [auths_model::{auths_model::DetachedAttachment}::bytes]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2881:4-2881:32 + Name pattern: [auths_model::{auths_model::DetachedAttachment}::bytes] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::DetachedAttachment}::bytes"] +def auths_model.DetachedAttachment.impl.bytes + (self : auths_model.DetachedAttachment) : Result (Slice Std.U8) := do + ok (alloc.vec.Vec.deref self.bytes) + +/-- [auths_model::{auths_model::DetachedAttachment}::digest]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2875:4-2875:50 + Name pattern: [auths_model::{auths_model::DetachedAttachment}::digest] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::DetachedAttachment}::digest"] +def auths_model.DetachedAttachment.impl.digest + (self : auths_model.DetachedAttachment) : + Result auths_model.AttachmentDigest + := do + ok self.digest + +/-- [auths_model::canonical_attachments_valid]: loop body 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 1625:4-1639:1 + Name pattern: [auths_model::canonical_attachments_valid] -/ +@[rust_loop_body, rust_fun "auths_model::canonical_attachments_valid"] +def auths_model.canonical_attachments_valid_loop.body + (attachments : Slice auths_model.DetachedAttachment) (index : Std.Usize) + (total : Std.Usize) : + Result (ControlFlow (Std.Usize × Std.Usize) Bool) + := do + let i := Slice.len attachments + if index < i + then + if index > 0#usize + then + let i1 ← index - 1#usize + let da ← Slice.index_usize attachments i1 + let ad ← auths_model.DetachedAttachment.impl.digest da + let da1 ← Slice.index_usize attachments index + let ad1 ← auths_model.DetachedAttachment.impl.digest da1 + let b ← + auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest.eq + ad ad1 + if b + then ok (done false) + else + let s ← auths_model.DetachedAttachment.impl.bytes da1 + let i2 := Slice.len s + let o ← lift (Usize.checked_add total i2) + match o with + | none => ok (done false) + | some value => + let i3 ← auths_model.HARD_MAX_ATTACHMENT_BYTES + if value > i3 + then ok (done false) + else let index1 ← index + 1#usize + ok (cont (index1, value)) + else + let da ← Slice.index_usize attachments index + let s ← auths_model.DetachedAttachment.impl.bytes da + let i1 := Slice.len s + let o ← lift (Usize.checked_add total i1) + match o with + | none => ok (done false) + | some value => + let i2 ← auths_model.HARD_MAX_ATTACHMENT_BYTES + if value > i2 + then ok (done false) + else let index1 ← index + 1#usize + ok (cont (index1, value)) + else ok (done true) + +/-- [auths_model::canonical_attachments_valid]: loop 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 1625:4-1639:1 + Name pattern: [auths_model::canonical_attachments_valid] -/ +@[rust_loop, rust_fun "auths_model::canonical_attachments_valid"] +def auths_model.canonical_attachments_valid_loop + (attachments : Slice auths_model.DetachedAttachment) (index : Std.Usize) + (total : Std.Usize) : + Result Bool + := do + loop + (fun (index1, total1) => auths_model.canonical_attachments_valid_loop.body + attachments index1 total1) + (index, total) + +/-- [auths_model::canonical_attachments_valid]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1622:0-1622:74 + Name pattern: [auths_model::canonical_attachments_valid] -/ +@[reducible, rust_fun "auths_model::canonical_attachments_valid"] +def auths_model.canonical_attachments_valid + (attachments : Slice auths_model.DetachedAttachment) : Result Bool := do + auths_model.canonical_attachments_valid_loop attachments 0#usize 0#usize + +/-- [auths_model::{auths_model::CanonicalAction}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1648:4-1654:33 + Name pattern: [auths_model::{auths_model::CanonicalAction}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::new"] +def auths_model.CanonicalAction.new + (profile : auths_model.ProfileRef) (media_type : auths_model.MediaType) + (body : alloc.vec.Vec Std.U8) (permission : auths_model.Permission) + (requested_budget : Option auths_model.BudgetCeiling) : + Result (core.result.Result auths_model.CanonicalAction + auths_model.ModelError) + := do + let b ← alloc.vec.Vec.is_empty Global body + if b + then + ok (core.result.Result.Err auths_model.ModelError.InvalidCanonicalAction) + else + let i := alloc.vec.Vec.len body + let i1 ← auths_model.HARD_MAX_CANONICAL_BODY_BYTES + if i > i1 + then + ok (core.result.Result.Err auths_model.ModelError.InvalidCanonicalAction) + else + ok (core.result.Result.Ok + { + profile, + media_type, + body, + permission, + requested_budget, + detached_attachments := + (alloc.vec.Vec.new auths_model.DetachedAttachment) + }) + +/-- [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnMut<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}::call_mut]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1684:32-1684:44 + Name pattern: [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{core::ops::function::FnMut}::call_mut] -/ +@[rust_fun + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{core::ops::function::FnMut}::call_mut"] +def + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest.call_mut + (c : auths_model.CanonicalAction.with_detached_attachments.closure) + (tupled_args : auths_model.DetachedAttachment) : + Result (auths_model.AttachmentDigest × + auths_model.CanonicalAction.with_detached_attachments.closure) + := do + let ad ← auths_model.DetachedAttachment.impl.digest tupled_args + ok (ad, c) + +/-- [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnOnce<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}::call_once]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1684:32-1684:44 + Name pattern: [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{core::ops::function::FnOnce}::call_once] -/ +@[rust_fun + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{core::ops::function::FnOnce}::call_once"] +def + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnOnceTupleSharedDetachedAttachmentAttachmentDigest.call_once + (c : auths_model.CanonicalAction.with_detached_attachments.closure) + (da : auths_model.DetachedAttachment) : + Result auths_model.AttachmentDigest + := do + let (ad, _) ← + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest.call_mut + c da + ok ad + +/-- Trait implementation: [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnOnce<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}] + Source: 'core/crates/auths-model/src/lib.rs', lines 1684:32-1684:44 + Name pattern: [core::ops::function::FnOnce] -/ +@[reducible, rust_trait_impl + "core::ops::function::FnOnce"] +def + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnOnceTupleSharedDetachedAttachmentAttachmentDigest + : core.ops.function.FnOnce + auths_model.CanonicalAction.with_detached_attachments.closure + auths_model.DetachedAttachment auths_model.AttachmentDigest := { + call_once := + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnOnceTupleSharedDetachedAttachmentAttachmentDigest.call_once +} + +/-- Trait implementation: [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnMut<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}] + Source: 'core/crates/auths-model/src/lib.rs', lines 1684:32-1684:44 + Name pattern: [core::ops::function::FnMut] -/ +@[reducible, rust_trait_impl + "core::ops::function::FnMut"] +def + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest + : core.ops.function.FnMut + auths_model.CanonicalAction.with_detached_attachments.closure + auths_model.DetachedAttachment auths_model.AttachmentDigest := { + FnOnceInst := + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnOnceTupleSharedDetachedAttachmentAttachmentDigest + call_mut := + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest.call_mut +} + +/-- [auths_model::{auths_model::CanonicalAction}::with_detached_attachments]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1675:4-1678:33 + Name pattern: [auths_model::{auths_model::CanonicalAction}::with_detached_attachments] + Visibility: public -/ +@[rust_fun + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments"] +def auths_model.CanonicalAction.with_detached_attachments + (self : auths_model.CanonicalAction) + (attachments : alloc.vec.Vec auths_model.DetachedAttachment) : + Result (core.result.Result auths_model.CanonicalAction + auths_model.ModelError) + := do + let i := alloc.vec.Vec.len attachments + if i > auths_model.HARD_MAX_ATTACHMENTS + then ok (core.result.Result.Err auths_model.ModelError.InvalidAttachment) + else + let (s, deref_mut_back) ← lift (alloc.vec.Vec.deref_mut attachments) + let s1 ← + alloc.slice.Slice.sort_by_key + auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest + auths_model.AttachmentDigest.Insts.CoreCmpOrd s () + let attachments1 := deref_mut_back s1 + let s2 := alloc.vec.Vec.deref attachments1 + let b ← auths_model.canonical_attachments_valid s2 + if b + then + ok (core.result.Result.Ok + { self with detached_attachments := attachments1 }) + else ok (core.result.Result.Err auths_model.ModelError.InvalidAttachment) + +/-- [auths_model::{auths_model::CanonicalAction}::profile]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1696:4-1696:46 + Name pattern: [auths_model::{auths_model::CanonicalAction}::profile] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::profile"] +def auths_model.CanonicalAction.impl.profile + (self : auths_model.CanonicalAction) : Result auths_model.ProfileRef := do + ok self.profile + +/-- [auths_model::{auths_model::CanonicalAction}::media_type]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1702:4-1702:48 + Name pattern: [auths_model::{auths_model::CanonicalAction}::media_type] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::media_type"] +def auths_model.CanonicalAction.impl.media_type + (self : auths_model.CanonicalAction) : Result auths_model.MediaType := do + ok self.media_type + +/-- [auths_model::{auths_model::CanonicalAction}::body]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1708:4-1708:31 + Name pattern: [auths_model::{auths_model::CanonicalAction}::body] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::body"] +def auths_model.CanonicalAction.impl.body + (self : auths_model.CanonicalAction) : Result (Slice Std.U8) := do + ok (alloc.vec.Vec.deref self.body) + +/-- [auths_model::{auths_model::CanonicalAction}::permission]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1714:4-1714:49 + Name pattern: [auths_model::{auths_model::CanonicalAction}::permission] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::permission"] +def auths_model.CanonicalAction.impl.permission + (self : auths_model.CanonicalAction) : Result auths_model.Permission := do + ok self.permission + +/-- [auths_model::{auths_model::CanonicalAction}::requested_budget]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1720:4-1720:66 + Name pattern: [auths_model::{auths_model::CanonicalAction}::requested_budget] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::requested_budget"] +def auths_model.CanonicalAction.impl.requested_budget + (self : auths_model.CanonicalAction) : + Result (Option auths_model.BudgetCeiling) + := do + core.option.Option.as_ref self.requested_budget + +/-- [auths_model::{auths_model::CanonicalAction}::detached_attachments]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1726:4-1726:63 + Name pattern: [auths_model::{auths_model::CanonicalAction}::detached_attachments] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::CanonicalAction}::detached_attachments"] +def auths_model.CanonicalAction.impl.detached_attachments + (self : auths_model.CanonicalAction) : + Result (Slice auths_model.DetachedAttachment) + := do + ok (alloc.vec.Vec.deref self.detached_attachments) + +/-- [auths_model::{auths_model::DetachedAttachment}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2866:4-2866:84 + Name pattern: [auths_model::{auths_model::DetachedAttachment}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::DetachedAttachment}::new"] +def auths_model.DetachedAttachment.new + (digest : auths_model.AttachmentDigest) (bytes : alloc.vec.Vec Std.U8) : + Result (core.result.Result auths_model.DetachedAttachment + auths_model.ModelError) + := do + let b ← alloc.vec.Vec.is_empty Global bytes + if b + then ok (core.result.Result.Err auths_model.ModelError.InvalidAttachment) + else + let i := alloc.vec.Vec.len bytes + let i1 ← auths_model.HARD_MAX_BUNDLE_BYTES + if i > i1 + then ok (core.result.Result.Err auths_model.ModelError.InvalidAttachment) + else ok (core.result.Result.Ok { digest, bytes }) + +/-- [auths_model::{auths_model::VerifierLimits}::hard]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3717:4-3717:31 + Name pattern: [auths_model::{auths_model::VerifierLimits}::hard] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::VerifierLimits}::hard"] +def auths_model.VerifierLimits.hard : Result auths_model.VerifierLimits := do + let i ← auths_model.HARD_MAX_BUNDLE_BYTES + let i1 ← auths_model.HARD_MAX_ACTION_BYTES + let i2 ← auths_model.HARD_MAX_CONTEXT_BYTES + let i3 ← auths_model.HARD_MAX_EVIDENCE_BYTES + let i4 ← auths_model.HARD_MAX_ATTACHMENT_BYTES + let i5 ← auths_model.HARD_MAX_CANONICAL_BODY_BYTES + ok + { + bundle_bytes := i, + action_bytes := i1, + context_bytes := i2, + grants := auths_model.HARD_MAX_GRANTS, + actions := auths_model.HARD_MAX_ACTIONS, + plan_leaves := auths_model.HARD_MAX_PLAN_LEAVES, + plan_depth := auths_model.HARD_MAX_PLAN_DEPTH, + plan_branching := auths_model.HARD_MAX_PLAN_BRANCHING, + evidence := auths_model.HARD_MAX_EVIDENCE, + evidence_bytes := i3, + bindings := auths_model.HARD_MAX_BINDINGS, + principal_status := auths_model.HARD_MAX_PRINCIPAL_STATUS, + grant_status := auths_model.HARD_MAX_GRANT_STATUS, + attachments := auths_model.HARD_MAX_ATTACHMENTS, + attachment_bytes := i4, + signatures := auths_model.HARD_MAX_SIGNATURES, + signature_bytes := auths_model.HARD_MAX_SIGNATURE_BYTES, + permissions := auths_model.HARD_MAX_PERMISSIONS, + audiences := auths_model.HARD_MAX_AUDIENCES, + extensions := auths_model.HARD_MAX_EXTENSIONS, + extension_bytes := auths_model.HARD_MAX_EXTENSION_BYTES, + body_digests := auths_model.HARD_MAX_BODY_DIGESTS, + binding_evidence := auths_model.HARD_MAX_BINDING_EVIDENCE, + canonical_body_bytes := i5, + registry_entries := auths_model.HARD_MAX_REGISTRY_ENTRIES, + trust_anchors := auths_model.HARD_MAX_TRUST_ANCHORS, + work_units := auths_model.HARD_MAX_WORK_UNITS, + approvals := auths_model.HARD_MAX_APPROVALS, + approver_anchors := auths_model.HARD_MAX_APPROVER_ANCHORS, + approval_requirements := + auths_model.HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS + } + +/-- [auths_model::{auths_model::VerifierLimits}::get]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3808:4-3808:53 + Name pattern: [auths_model::{auths_model::VerifierLimits}::get] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::VerifierLimits}::get"] +def auths_model.VerifierLimits.get + (self : auths_model.VerifierLimits) (kind : auths_model.LimitKind) : + Result Std.Usize + := do + match kind with + | auths_model.LimitKind.BundleBytes => ok self.bundle_bytes + | auths_model.LimitKind.ActionBytes => ok self.action_bytes + | auths_model.LimitKind.ContextBytes => ok self.context_bytes + | auths_model.LimitKind.Grants => ok self.grants + | auths_model.LimitKind.Actions => ok self.actions + | auths_model.LimitKind.PlanLeaves => ok self.plan_leaves + | auths_model.LimitKind.PlanDepth => ok self.plan_depth + | auths_model.LimitKind.PlanBranching => ok self.plan_branching + | auths_model.LimitKind.EvidenceObjects => ok self.evidence + | auths_model.LimitKind.EvidenceBytes => ok self.evidence_bytes + | auths_model.LimitKind.ControlBindings => ok self.bindings + | auths_model.LimitKind.PrincipalStatusStatements => ok self.principal_status + | auths_model.LimitKind.GrantStatusStatements => ok self.grant_status + | auths_model.LimitKind.Attachments => ok self.attachments + | auths_model.LimitKind.AttachmentBytes => ok self.attachment_bytes + | auths_model.LimitKind.Signatures => ok self.signatures + | auths_model.LimitKind.SignatureBytes => ok self.signature_bytes + | auths_model.LimitKind.Permissions => ok self.permissions + | auths_model.LimitKind.Audiences => ok self.audiences + | auths_model.LimitKind.CriticalExtensions => ok self.extensions + | auths_model.LimitKind.CriticalExtensionBytes => ok self.extension_bytes + | auths_model.LimitKind.AllowedBodyDigests => ok self.body_digests + | auths_model.LimitKind.BindingEvidence => ok self.binding_evidence + | auths_model.LimitKind.CanonicalBodyBytes => ok self.canonical_body_bytes + | auths_model.LimitKind.RegistryEntries => ok self.registry_entries + | auths_model.LimitKind.TrustAnchors => ok self.trust_anchors + | auths_model.LimitKind.Approvals => ok self.approvals + | auths_model.LimitKind.ApproverAnchors => ok self.approver_anchors + | auths_model.LimitKind.ApprovalRequirements => ok self.approval_requirements + +/-- [auths_model::{auths_model::VerifierLimits}::validate]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3855:4-3855:52 + Name pattern: [auths_model::{auths_model::VerifierLimits}::validate] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::VerifierLimits}::validate"] +def auths_model.VerifierLimits.validate + (self : auths_model.VerifierLimits) : + Result (core.result.Result Unit auths_model.ModelError) + := do + let hard ← auths_model.VerifierLimits.hard + if self.bundle_bytes > hard.bundle_bytes + then + ok (core.result.Result.Err auths_model.ModelError.CollectionLimitExceeded) + else + if self.action_bytes > hard.action_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.context_bytes > hard.context_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.grants > hard.grants + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.actions > hard.actions + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.plan_leaves > hard.plan_leaves + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.plan_depth > hard.plan_depth + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.plan_branching > hard.plan_branching + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.evidence > hard.evidence + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.evidence_bytes > hard.evidence_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.bindings > hard.bindings + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.principal_status > hard.principal_status + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.grant_status > hard.grant_status + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.attachments > hard.attachments + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.attachment_bytes > hard.attachment_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.signatures > hard.signatures + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.signature_bytes > + hard.signature_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.permissions > hard.permissions + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.audiences > hard.audiences + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.extensions > hard.extensions + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.extension_bytes > + hard.extension_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.body_digests > + hard.body_digests + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.binding_evidence > + hard.binding_evidence + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.canonical_body_bytes > + hard.canonical_body_bytes + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.registry_entries > + hard.registry_entries + then + ok (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.trust_anchors > + hard.trust_anchors + then + ok + (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.approvals > + hard.approvals + then + ok + (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if + self.approver_anchors + > + hard.approver_anchors + then + ok + (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if + self.approval_requirements + > + hard.approval_requirements + then + ok + (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + if self.work_units + > hard.work_units + then + ok + (core.result.Result.Err + auths_model.ModelError.CollectionLimitExceeded) + else + ok + (core.result.Result.Ok + ()) + +/-- [auths_codec::cbor::malformed]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 14:0-16:1 -/ +def cbor.malformed {T : Type} (_error : T) : Result cbor.Error := do + ok () + +/-- [auths_codec::cbor::{impl core::cmp::PartialEq for auths_codec::cbor::Type}::eq]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 19:33-19:42 + Visibility: public -/ +def cbor.Type.Insts.CoreCmpPartialEqType.eq + (self : cbor.Type) (other : cbor.Type) : Result Bool := do + let self1 := read_discriminant self + let other1 := read_discriminant other + ok (self1 = other1) + +/-- [auths_codec::cbor::read_tail]: loop body 0: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 46:4-62:1 -/ +@[rust_loop_body] +def cbor.read_tail_loop.body + (input : Slice Std.U8) (position : Std.Usize) (remaining : Std.U8) + (value : Std.U64) : + Result (ControlFlow (Std.Usize × Std.U8 × Std.U64) (core.result.Result + (Std.U64 × Std.Usize) cbor.Error)) + := do + if remaining > 0#u8 + then + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok (done (core.result.Result.Err ())) + | some byte => + let o1 ← lift (U64.checked_mul value 256#u64) + match o1 with + | none => ok (done (core.result.Result.Err ())) + | some shifted => + let i ← lift (core.convert.num.FromU64U8.from byte) + let o2 ← lift (U64.checked_add shifted i) + match o2 with + | none => ok (done (core.result.Result.Err ())) + | some value1 => + let position1 ← position + 1#usize + let remaining1 ← remaining - 1#u8 + ok (cont (position1, remaining1, value1)) + else ok (done (core.result.Result.Ok (value, position))) + +/-- [auths_codec::cbor::read_tail]: loop 0: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 46:4-62:1 -/ +@[rust_loop] +def cbor.read_tail_loop + (input : Slice Std.U8) (position : Std.Usize) (remaining : Std.U8) + (value : Std.U64) : + Result (core.result.Result (Std.U64 × Std.Usize) cbor.Error) + := do + loop + (fun (position1, remaining1, value1) => cbor.read_tail_loop.body input + position1 remaining1 value1) + (position, remaining, value) + +/-- [auths_codec::cbor::read_tail]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 40:0-62:1 -/ +@[reducible] +def cbor.read_tail + (input : Slice Std.U8) (position : Std.Usize) (remaining : Std.U8) + (value : Std.U64) : + Result (core.result.Result (Std.U64 × Std.Usize) cbor.Error) + := do + cbor.read_tail_loop input position remaining value + +/-- [auths_codec::cbor::read_head]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 68:0-92:1 -/ +def cbor.read_head + (input : Slice Std.U8) (position : Std.Usize) : + Result (core.result.Result cbor.Head cbor.Error) + := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok (core.result.Result.Err ()) + | some first => + let additional ← first % 32#u8 + let start ← position + 1#usize + if additional < 24#u8 + then + let argument ← lift (core.convert.num.FromU64U8.from additional) + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next := start }) + else + match additional with + | 24#uscalar => + let r ← cbor.read_tail input start 1#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | 25#uscalar => + let r ← cbor.read_tail input start 2#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | 26#uscalar => + let r ← cbor.read_tail input start 4#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | 27#uscalar => + let r ← cbor.read_tail input start 8#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | _ => ok (core.result.Result.Err ()) + +/-- [auths_codec::cbor::append_tail]: loop body 0: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 99:4-102:5 -/ +@[rust_loop_body] +def cbor.append_tail_loop.body + (value : Std.U64) (output : alloc.vec.Vec Std.U8) (remaining : Std.U8) : + Result (ControlFlow ((alloc.vec.Vec Std.U8) × Std.U8) (alloc.vec.Vec + Std.U8)) + := do + if remaining > 0#u8 + then + let remaining1 ← remaining - 1#u8 + let i ← lift (core.convert.num.FromU32U8.from remaining1) + let i1 ← i * 8#u32 + let i2 ← value >>> i1 + let i3 ← lift (UScalar.cast .U8 i2) + let output1 ← alloc.vec.Vec.push output i3 + ok (cont (output1, remaining1)) + else ok (done output) + +/-- [auths_codec::cbor::append_tail]: loop 0: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 99:4-102:5 -/ +@[rust_loop] +def cbor.append_tail_loop + (output : alloc.vec.Vec Std.U8) (value : Std.U64) (remaining : Std.U8) : + Result (alloc.vec.Vec Std.U8) + := do + loop + (fun (output1, remaining1) => cbor.append_tail_loop.body value output1 + remaining1) + (output, remaining) + +/-- [auths_codec::cbor::append_tail]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 98:0-104:1 -/ +@[reducible] +def cbor.append_tail + (output : alloc.vec.Vec Std.U8) (value : Std.U64) (remaining : Std.U8) : + Result (alloc.vec.Vec Std.U8) + := do + cbor.append_tail_loop output value remaining + +/-- [auths_codec::cbor::encode_head]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 111:0-134:1 -/ +def cbor.encode_head + (major : Std.U8) (argument : Std.U64) : + Result (core.result.Result (alloc.vec.Vec Std.U8) cbor.Error) + := do + if major > 7#u8 + then ok (core.result.Result.Err ()) + else + let prefix1 ← major * 32#u8 + let output := alloc.vec.Vec.with_capacity Std.U8 9#usize + if argument <= 23#u64 + then + let i ← lift (UScalar.cast .U8 argument) + let i1 ← prefix1 + i + let output1 ← alloc.vec.Vec.push output i1 + ok (core.result.Result.Ok output1) + else + let (output1, width) ← + if argument <= 255#u64 + then + do + let i ← prefix1 + 24#u8 + let output2 ← alloc.vec.Vec.push output i + ok (output2, 1#u8) + else + if argument <= 65535#u64 + then + do + let i ← prefix1 + 25#u8 + let output2 ← alloc.vec.Vec.push output i + ok (output2, 2#u8) + else + if argument <= 4294967295#u64 + then + do + let i ← prefix1 + 26#u8 + let output2 ← alloc.vec.Vec.push output i + ok (output2, 4#u8) + else + do + let i ← prefix1 + 27#u8 + let output2 ← alloc.vec.Vec.push output i + ok (output2, 8#u8) + let v ← cbor.append_tail output1 argument width + ok (core.result.Result.Ok v) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::new]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 143:4-145:5 -/ +def cbor.Decoder.new (input : Slice Std.U8) : Result cbor.Decoder := do + ok { input, position := 0#usize } + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::at]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 147:4-152:5 -/ +def cbor.Decoder.at + (input : Slice Std.U8) (position : Std.Usize) : + Result (core.result.Result cbor.Decoder cbor.Error) + := do + let i := Slice.len input + if position > i + then ok (core.result.Result.Err ()) + else ok (core.result.Result.Ok { input, position }) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::position]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 154:4-156:5 -/ +def cbor.Decoder.impl.position (self : cbor.Decoder) : Result Std.Usize := do + ok self.position + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 158:4-165:5 -/ +def cbor.Decoder.head + (self : cbor.Decoder) (major : Std.U8) : + Result ((core.result.Result Std.U64 cbor.Error) × cbor.Decoder) + := do + let r ← cbor.read_head self.input self.position + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + if val.major != major + then ok (core.result.Result.Err (), self) + else + ok (core.result.Result.Ok val.argument, + { self with position := val.next }) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.U64 (core.convert.FromSame cbor.Error) residual + ok (r1, self) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 167:4-173:5 -/ +def cbor.Decoder.collection + (self : cbor.Decoder) (major : Std.U8) : + Result ((core.result.Result (Option Std.U64) cbor.Error) × cbor.Decoder) + := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) + self.input self.position + let i ← major <<< 5#i32 + let i1 ← lift (i ||| 31#u8) + let b ← + core.option.Option.Insts.CoreCmpPartialEqOption.eq + (core.cmp.PartialEqShared core.cmp.PartialEqU8) o (some i1) + if b + then + let i2 ← self.position + 1#usize + ok (core.result.Result.Ok none, { self with position := i2 }) + else + let (r, self1) ← cbor.Decoder.head self major + let r1 ← + core.result.Result.map (BuiltinFnOnce Std.U64 (Option Std.U64)) r + (core.option.Option.Some) + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 175:4-177:5 -/ +def cbor.Decoder.map + (self : cbor.Decoder) : + Result ((core.result.Result (Option Std.U64) cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.collection self 5#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 179:4-181:5 -/ +def cbor.Decoder.array + (self : cbor.Decoder) : + Result ((core.result.Result (Option Std.U64) cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.collection self 4#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 183:4-185:5 -/ +def cbor.Decoder.u64 + (self : cbor.Decoder) : + Result ((core.result.Result Std.U64 cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.head self 0#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u16]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 191:4-193:5 -/ +def cbor.Decoder.u16 + (self : cbor.Decoder) : + Result ((core.result.Result Std.U16 cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.u64 self + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + cbor.Error) r1 (cbor.malformed) + ok (r2, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.U16 (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 195:4-197:5 -/ +def cbor.Decoder.u8 + (self : cbor.Decoder) : + Result ((core.result.Result Std.U8 cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.u64 self + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + cbor.Error) r1 (cbor.malformed) + ok (r2, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.U8 (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 199:4-205:5 -/ +def cbor.Decoder.payload + (self : cbor.Decoder) (major : Std.U8) : + Result ((core.result.Result (Slice Std.U8) cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.head self major + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + cbor.Error) r1 (cbor.malformed) + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let o ← lift (Usize.checked_add self1.position val1) + let r3 ← core.option.Option.ok_or o () + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let o1 ← + core.slice.Slice.get (core.slice.index.SliceIndexRangeUsizeSlice + Std.U8) self1.input { start := self1.position, «end» := val2 } + let r4 ← core.option.Option.ok_or o1 () + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val3 => + ok (core.result.Result.Ok val3, { self1 with position := val2 }) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r5, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r4 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r4, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r3, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::bytes]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 207:4-209:5 -/ +def cbor.Decoder.bytes + (self : cbor.Decoder) : + Result ((core.result.Result (Slice Std.U8) cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.payload self 2#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 211:4-216:5 -/ +def cbor.Decoder.str + (self : cbor.Decoder) : + Result ((core.result.Result Str cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.payload self 3#u8 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← core.str.converts.from_utf8 val + match r1 with + | core.result.Result.Ok value => ok (core.result.Result.Ok value, self1) + | core.result.Result.Err _ => ok (core.result.Result.Err (), self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Str (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::null]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 228:4-234:5 -/ +def cbor.Decoder.null + (self : cbor.Decoder) : + Result ((core.result.Result Unit cbor.Error) × cbor.Decoder) + := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) + self.input self.position + let b ← + core.cmp.PartialEq.ne.trait_default + (core.option.Option.Insts.CoreCmpPartialEqOption + (core.cmp.PartialEqShared core.cmp.PartialEqU8)) o (some 246#u8) + if b + then ok (core.result.Result.Err (), self) + else + let i ← self.position + 1#usize + ok (core.result.Result.Ok (), { self with position := i }) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::datatype]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 236:4-248:5 -/ +def cbor.Decoder.datatype + (self : cbor.Decoder) : + Result (core.result.Result cbor.Type cbor.Error) + := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) + self.input self.position + let r ← core.option.Option.ok_or o () + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + if 0#u8 <= val + then + if val <= 24#u8 + then ok (core.result.Result.Ok cbor.Type.U8) + else + match val with + | 25#uscalar => ok (core.result.Result.Ok cbor.Type.U16) + | 26#uscalar => ok (core.result.Result.Ok cbor.Type.U32) + | 27#uscalar => ok (core.result.Result.Ok cbor.Type.U64) + | 246#uscalar => ok (core.result.Result.Ok cbor.Type.Null) + | _ => + if 64#u8 <= val + then + if val <= 91#u8 + then ok (core.result.Result.Ok cbor.Type.Bytes) + else + if 96#u8 <= val + then + if val <= 123#u8 + then ok (core.result.Result.Ok cbor.Type.String) + else ok (core.result.Result.Ok cbor.Type.Other) + else ok (core.result.Result.Ok cbor.Type.Other) + else + if 96#u8 <= val + then + if val <= 123#u8 + then ok (core.result.Result.Ok cbor.Type.String) + else ok (core.result.Result.Ok cbor.Type.Other) + else ok (core.result.Result.Ok cbor.Type.Other) + else + match val with + | 25#uscalar => ok (core.result.Result.Ok cbor.Type.U16) + | 26#uscalar => ok (core.result.Result.Ok cbor.Type.U32) + | 27#uscalar => ok (core.result.Result.Ok cbor.Type.U64) + | 246#uscalar => ok (core.result.Result.Ok cbor.Type.Null) + | _ => + if 64#u8 <= val + then + if val <= 91#u8 + then ok (core.result.Result.Ok cbor.Type.Bytes) + else + if 96#u8 <= val + then + if val <= 123#u8 + then ok (core.result.Result.Ok cbor.Type.String) + else ok (core.result.Result.Ok cbor.Type.Other) + else ok (core.result.Result.Ok cbor.Type.Other) + else + if 96#u8 <= val + then + if val <= 123#u8 + then ok (core.result.Result.Ok cbor.Type.String) + else ok (core.result.Result.Ok cbor.Type.Other) + else ok (core.result.Result.Ok cbor.Type.Other) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Type (core.convert.FromSame cbor.Error) residual + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::new]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 257:4-259:5 -/ +def cbor.Encoder.new + (output : alloc.vec.Vec Std.U8) : Result cbor.Encoder := do + ok { output } + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::into_writer]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 261:4-263:5 -/ +def cbor.Encoder.into_writer + (self : cbor.Encoder) : Result (alloc.vec.Vec Std.U8) := do + ok self.output + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::head]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 265:4-269:5 -/ +def cbor.Encoder.head + (self : cbor.Encoder) (major : Std.U8) (argument : Std.U64) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + let r ← cbor.encode_head major argument + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let s := alloc.vec.Vec.deref val + let v ← alloc.vec.Vec.extend_from_slice core.clone.CloneU8 self.output s + ok (core.result.Result.Ok (), { output := v }) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame cbor.Error) residual + ok (r1, self) + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::map]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 271:4-273:5 -/ +def cbor.Encoder.map + (self : cbor.Encoder) (entries : Std.U64) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + cbor.Encoder.head self 5#u8 entries + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::array]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 275:4-277:5 -/ +def cbor.Encoder.array + (self : cbor.Encoder) (entries : Std.U64) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + cbor.Encoder.head self 4#u8 entries + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::u64]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 279:4-281:5 -/ +def cbor.Encoder.u64 + (self : cbor.Encoder) (value : Std.U64) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + cbor.Encoder.head self 0#u8 value + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::u16]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 287:4-289:5 -/ +def cbor.Encoder.u16 + (self : cbor.Encoder) (value : Std.U16) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + let i ← lift (core.convert.num.FromU64U16.from value) + cbor.Encoder.u64 self i + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::u8]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 291:4-293:5 -/ +def cbor.Encoder.u8 + (self : cbor.Encoder) (value : Std.U8) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + let i ← lift (core.convert.num.FromU64U8.from value) + cbor.Encoder.u64 self i + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::payload]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 295:4-299:5 -/ +def cbor.Encoder.payload + (self : cbor.Encoder) (major : Std.U8) (bytes : Slice Std.U8) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + let i := Slice.len bytes + let r ← U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i + let r1 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + cbor.Error) r (cbor.malformed) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (r2, self1) ← cbor.Encoder.head self major val + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let v ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 self1.output bytes + ok (core.result.Result.Ok (), { output := v }) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame cbor.Error) residual + ok (r3, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame cbor.Error) residual + ok (r2, self) + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::bytes]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 301:4-303:5 -/ +def cbor.Encoder.bytes + (self : cbor.Encoder) (bytes : Slice Std.U8) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + cbor.Encoder.payload self 2#u8 bytes + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::str]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 305:4-307:5 -/ +def cbor.Encoder.str + (self : cbor.Encoder) (text : Str) : + Result ((core.result.Result Unit cbor.Error) × cbor.Encoder) + := do + let s ← core.str.Str.as_bytes text + cbor.Encoder.payload self 3#u8 s + +/-- [auths_codec::cbor::{auths_codec::cbor::Encoder}::null]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 313:4-315:5 -/ +def cbor.Encoder.null (self : cbor.Encoder) : Result cbor.Encoder := do + let v ← alloc.vec.Vec.push self.output 246#u8 + ok { output := v } + +/-- [auths_codec::decode::decode_error]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 40:0-42:1 -/ +def decode.decode_error {T : Type} (_error : T) : Result error.CodecError := do + ok error.CodecError.Malformed + +/-- [auths_codec::decode::map]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 44:0-50:1 -/ +def decode.map + (decoder : cbor.Decoder) (expected : Std.U64) : + Result ((core.result.Result Unit error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.map decoder + let o ← core.result.Result.unwrap_or r none + let b ← + core.option.Option.Insts.CoreCmpPartialEqOption.eq core.cmp.PartialEqU64 o + (some expected) + if b + then ok (core.result.Result.Ok (), decoder1) + else ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + +/-- [auths_codec::error::limit_error]: + Source: 'core/crates/auths-codec/src/error.rs', lines 23:0-25:1 -/ +def error.limit_error + (_error : core.num.error.TryFromIntError) : Result error.CodecError := do + ok error.CodecError.LimitExceeded + +/-- [auths_codec::decode::array]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 52:0-60:1 -/ +def decode.array + (decoder : cbor.Decoder) (maximum : Std.Usize) : + Result ((core.result.Result Std.Usize error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.array decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r2 ← core.option.Option.ok_or val error.CodecError.Malformed + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let r3 ← Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from val1 + let r4 ← + core.result.Result.map_err (BuiltinFnOnce + core.num.error.TryFromIntError error.CodecError) r3 + (error.limit_error) + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + if val2 > maximum + then + ok (core.result.Result.Err error.CodecError.LimitExceeded, decoder1) + else ok (core.result.Result.Ok val2, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.Usize (core.convert.FromSame error.CodecError) residual + ok (r5, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.Usize (core.convert.FromSame error.CodecError) residual + ok (r3, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.Usize (core.convert.FromSame error.CodecError) residual + ok (r2, decoder1) + +/-- [auths_codec::decode::key]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 70:0-76:1 -/ +def decode.key + (decoder : cbor.Decoder) (expected : Std.U8) : + Result ((core.result.Result Unit error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.u8 decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + if val = expected + then ok (core.result.Result.Ok (), decoder1) + else ok (core.result.Result.Err error.CodecError.NonCanonical, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, decoder1) + +/-- [auths_codec::decode::text]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 78:0-83:1 -/ +def decode.text + (decoder : cbor.Decoder) : + Result ((core.result.Result Str error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.str decoder + match r with + | core.result.Result.Ok value => ok (core.result.Result.Ok value, decoder1) + | core.result.Result.Err _ => + ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + +/-- [auths_codec::decode::bounded_bytes]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 85:0-97:1 -/ +def decode.bounded_bytes + (decoder : cbor.Decoder) (maximum : Std.Usize) (non_empty : Bool) : + Result ((core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.bytes decoder + match r with + | core.result.Result.Ok bytes => + let i := Slice.len bytes + if i > maximum + then ok (core.result.Result.Err error.CodecError.LimitExceeded, decoder1) + else + if non_empty + then + let b ← core.slice.Slice.is_empty bytes + if b + then + ok (core.result.Result.Err error.CodecError.LimitExceeded, decoder1) + else + let v ← alloc.slice.Slice.to_vec core.clone.CloneU8 bytes + ok (core.result.Result.Ok v, decoder1) + else + let v ← alloc.slice.Slice.to_vec core.clone.CloneU8 bytes + ok (core.result.Result.Ok v, decoder1) + | core.result.Result.Err _ => + ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + +/-- [auths_codec::decode::digest_bytes]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 99:0-104:1 -/ +def decode.digest_bytes + (decoder : cbor.Decoder) : + Result ((core.result.Result (Array Std.U8 32#usize) error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.bytes decoder + match r with + | core.result.Result.Ok bytes => + let r1 ← + core.array.TryFromArrayCopySlice.try_from 32#usize core.marker.CopyU8 + bytes + let r2 ← + core.result.Result.map_err (BuiltinFnOnce core.array.TryFromSliceError + error.CodecError) r1 (decode.decode_error) + ok (r2, decoder1) + | core.result.Result.Err _ => + ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + +/-- [auths_codec::decode::is_null]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 106:0-108:1 -/ +def decode.is_null + (decoder : cbor.Decoder) : + Result (core.result.Result Bool error.CodecError) + := do + let r ← cbor.Decoder.datatype decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let b ← cbor.Type.Insts.CoreCmpPartialEqType.eq val cbor.Type.Null + ok (core.result.Result.Ok b) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Bool (core.convert.FromSame error.CodecError) residual + +/-- [auths_codec::decode::null]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 110:0-112:1 -/ +def decode.null + (decoder : cbor.Decoder) : + Result ((core.result.Result Unit error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.null decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + ok (r1, decoder1) + +/-- [auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}::from]: + Source: 'core/crates/auths-codec/src/error.rs', lines 28:4-30:5 + Visibility: public -/ +def error.CodecError.Insts.CoreConvertFromModelError.from + (model_error : auths_model.ModelError) : Result error.CodecError := do + ok (error.CodecError.Model model_error) + +/-- [auths_codec::decode::profile_ref]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 126:0-133:1 -/ +def decode.profile_ref + (decoder : cbor.Decoder) : + Result ((core.result.Result auths_model.ProfileRef error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← decode.map decoder 2#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, decoder2) ← decode.key decoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r2, decoder3) ← decode.text decoder2 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val => + let r3 ← auths_model.ProfileId.parse val + let r4 ← + core.result.Result.map_err (BuiltinFnOnce auths_model.ModelError + error.CodecError) r3 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let (r5, decoder4) ← decode.key decoder3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r6, decoder5) ← cbor.Decoder.u16 decoder4 + let r7 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error + error.CodecError) r6 (decode.decode_error) + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let r8 ← auths_model.ProfileRef.new val1 val2 + let r9 ← + core.result.Result.map_err (BuiltinFnOnce + auths_model.ModelError error.CodecError) r8 + (error.CodecError.Insts.CoreConvertFromModelError.from) + ok (r9, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r8 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.ProfileRef (core.convert.FromSame + error.CodecError) residual + ok (r8, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.ProfileRef (core.convert.FromSame error.CodecError) + residual + ok (r6, decoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.ProfileRef (core.convert.FromSame error.CodecError) + residual + ok (r5, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.ProfileRef (core.convert.FromSame error.CodecError) + residual + ok (r3, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.ProfileRef (core.convert.FromSame error.CodecError) + residual + ok (r2, decoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.ProfileRef (core.convert.FromSame error.CodecError) + residual + ok (r1, decoder1) + +/-- [auths_codec::decode::permission]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 135:0-142:1 -/ +def decode.permission + (decoder : cbor.Decoder) : + Result ((core.result.Result auths_model.Permission error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← decode.map decoder 2#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, decoder2) ← decode.key decoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r2, decoder3) ← decode.text decoder2 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val => + let r3 ← auths_model.CapabilityId.parse val + let r4 ← + core.result.Result.map_err (BuiltinFnOnce auths_model.ModelError + error.CodecError) r3 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let (r5, decoder4) ← decode.key decoder3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r6, decoder5) ← decode.text decoder4 + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r6 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let r7 ← auths_model.ResourceId.parse val2 + let r8 ← + core.result.Result.map_err (BuiltinFnOnce + auths_model.ModelError error.CodecError) r7 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf6 ← core.result.Result.Insts.CoreOpsTry.branch r8 + match cf6 with + | core.ops.control_flow.ControlFlow.Continue val3 => + let p ← auths_model.Permission.new val1 val3 + ok (core.result.Result.Ok p, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r9 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame + error.CodecError) residual + ok (r9, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r7 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame + error.CodecError) residual + ok (r7, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame error.CodecError) + residual + ok (r6, decoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame error.CodecError) + residual + ok (r5, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame error.CodecError) + residual + ok (r3, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame error.CodecError) + residual + ok (r2, decoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Permission (core.convert.FromSame error.CodecError) + residual + ok (r1, decoder1) + +/-- [auths_codec::decode::budget]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 187:0-194:1 -/ +def decode.budget + (decoder : cbor.Decoder) : + Result ((core.result.Result auths_model.BudgetCeiling error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← decode.map decoder 2#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, decoder2) ← decode.key decoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r2, decoder3) ← decode.text decoder2 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val => + let r3 ← auths_model.BudgetAlgebraId.parse val + let r4 ← + core.result.Result.map_err (BuiltinFnOnce auths_model.ModelError + error.CodecError) r3 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let (r5, decoder4) ← decode.key decoder3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r6, decoder5) ← cbor.Decoder.u64 decoder4 + let r7 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error + error.CodecError) r6 (decode.decode_error) + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let bc ← auths_model.BudgetCeiling.new val1 val2 + ok (core.result.Result.Ok bc, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r8 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.BudgetCeiling (core.convert.FromSame + error.CodecError) residual + ok (r8, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.BudgetCeiling (core.convert.FromSame + error.CodecError) residual + ok (r6, decoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.BudgetCeiling (core.convert.FromSame + error.CodecError) residual + ok (r5, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.BudgetCeiling (core.convert.FromSame error.CodecError) + residual + ok (r3, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.BudgetCeiling (core.convert.FromSame error.CodecError) + residual + ok (r2, decoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.BudgetCeiling (core.convert.FromSame error.CodecError) + residual + ok (r1, decoder1) + +/-- [auths_codec::decode::optional_budget]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 196:0-205:1 -/ +def decode.optional_budget + (decoder : cbor.Decoder) : + Result ((core.result.Result (Option auths_model.BudgetCeiling) + error.CodecError) × cbor.Decoder) + := do + let r ← decode.is_null decoder + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + if val + then + let (r1, decoder1) ← decode.null decoder + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok none, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Option auths_model.BudgetCeiling) (core.convert.FromSame + error.CodecError) residual + ok (r2, decoder1) + else + let (r1, decoder1) ← decode.budget decoder + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + ok (core.result.Result.Ok (some val1), decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Option auths_model.BudgetCeiling) (core.convert.FromSame + error.CodecError) residual + ok (r2, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Option auths_model.BudgetCeiling) (core.convert.FromSame + error.CodecError) residual + ok (r1, decoder) + +/-- [auths_codec::decode::ensure_complete]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1313:0-1319:1 -/ +def decode.ensure_complete + (decoder : cbor.Decoder) (input : Slice Std.U8) : + Result (core.result.Result Unit error.CodecError) + := do + let i ← cbor.Decoder.impl.position decoder + let i1 := Slice.len input + if i = i1 + then ok (core.result.Result.Ok ()) + else ok (core.result.Result.Err error.CodecError.Malformed) + +/-- Trait implementation: [auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}] + Source: 'core/crates/auths-codec/src/error.rs', lines 27:0-31:1 -/ +@[reducible] +def error.CodecError.Insts.CoreConvertFromModelError : core.convert.From + error.CodecError auths_model.ModelError := { + «from» := error.CodecError.Insts.CoreConvertFromModelError.from +} + +/-- [auths_codec::decode::attachment_batch_step]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1577:0-1604:1 -/ +def decode.attachment_batch_step + (input : Slice Std.U8) (limits : auths_model.VerifierLimits) + (state : core.result.Result decode.AttachmentBatch error.CodecError) : + Result (core.result.Result decode.AttachmentBatch error.CodecError) + := do + let cf ← core.result.Result.Insts.CoreOpsTry.branch state + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r ← cbor.Decoder.at input val.position + match r with + | core.result.Result.Ok d => + let (r1, decoder) ← decode.map d 2#u64 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r2, decoder1) ← decode.key decoder 0#u8 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, decoder2) ← decode.digest_bytes decoder1 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let digest ← auths_model.AttachmentDigest.new val1 + let (r4, decoder3) ← decode.key decoder2 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let i ← + auths_model.VerifierLimits.get limits + auths_model.LimitKind.AttachmentBytes + let (r5, decoder4) ← decode.bounded_bytes decoder3 i true + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let i1 := alloc.vec.Vec.len val2 + let o ← lift (Usize.checked_add val.attachment_bytes i1) + let r6 ← + core.option.Option.ok_or o error.CodecError.LimitExceeded + let cf6 ← core.result.Result.Insts.CoreOpsTry.branch r6 + match cf6 with + | core.ops.control_flow.ControlFlow.Continue val3 => + if val3 > i + then + ok (core.result.Result.Err error.CodecError.LimitExceeded) + else + let r7 ← auths_model.DetachedAttachment.new digest val2 + let cf7 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf7 with + | core.ops.control_flow.ControlFlow.Continue val4 => + let v ← alloc.vec.Vec.push val.attachments val4 + let i2 ← cbor.Decoder.impl.position decoder4 + ok (core.result.Result.Ok + { + attachments := v, + attachment_bytes := val3, + position := i2 + }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch + error.CodecError.Insts.CoreConvertFromModelError + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame error.CodecError) + residual + | core.result.Result.Err _ => + ok (core.result.Result.Err error.CodecError.Malformed) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + decode.AttachmentBatch (core.convert.FromSame error.CodecError) residual + +/-- [auths_codec::decode::attachment_batch]: loop body 0: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1617:4-1620:5 -/ +@[rust_loop_body] +def decode.attachment_batch_loop.body + (input : Slice Std.U8) (limits : auths_model.VerifierLimits) + (remaining : Std.Usize) + (state : core.result.Result decode.AttachmentBatch error.CodecError) : + Result (ControlFlow (Std.Usize × (core.result.Result decode.AttachmentBatch + error.CodecError)) (core.result.Result decode.AttachmentBatch + error.CodecError)) + := do + if remaining > 0#usize + then + let state1 ← decode.attachment_batch_step input limits state + let remaining1 ← remaining - 1#usize + ok (cont (remaining1, state1)) + else ok (done state) + +/-- [auths_codec::decode::attachment_batch]: loop 0: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1617:4-1620:5 -/ +@[rust_loop] +def decode.attachment_batch_loop + (input : Slice Std.U8) (limits : auths_model.VerifierLimits) + (remaining : Std.Usize) + (state : core.result.Result decode.AttachmentBatch error.CodecError) : + Result (core.result.Result decode.AttachmentBatch error.CodecError) + := do + loop + (fun (remaining1, state1) => decode.attachment_batch_loop.body input limits + remaining1 state1) + (remaining, state) + +/-- [auths_codec::decode::attachment_batch]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1606:0-1622:1 -/ +def decode.attachment_batch + (input : Slice Std.U8) (limits : auths_model.VerifierLimits) + (position : Std.Usize) (remaining : Std.Usize) : + Result (core.result.Result decode.AttachmentBatch error.CodecError) + := do + let v := alloc.vec.Vec.with_capacity auths_model.DetachedAttachment remaining + decode.attachment_batch_loop input limits remaining (core.result.Result.Ok + { attachments := v, attachment_bytes := 0#usize, position }) + +/-- [auths_codec::encode::encode_error]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 27:0-29:1 -/ +def encode.encode_error (_error : cbor.Error) : Result error.CodecError := do + ok error.CodecError.Malformed + +/-- [auths_codec::encode::bytes]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 63:0-66:1 -/ +def encode.bytes + (encoder : cbor.Encoder) (value : Slice Std.U8) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← cbor.Encoder.bytes encoder value + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (encode.encode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder1) + +/-- [auths_codec::encode::key]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 53:0-56:1 -/ +def encode.key + (encoder : cbor.Encoder) (value : Std.U8) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← cbor.Encoder.u8 encoder value + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (encode.encode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder1) + +/-- [auths_codec::encode::map]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 43:0-46:1 -/ +def encode.map + (encoder : cbor.Encoder) (entries : Std.U64) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← cbor.Encoder.map encoder entries + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (encode.encode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder1) + +/-- [auths_codec::encode::encode_canonical_attachment]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 402:0-413:1 -/ +def encode.encode_canonical_attachment + (state : core.result.Result cbor.Encoder error.CodecError) + (attachment : auths_model.DetachedAttachment) : + Result (core.result.Result cbor.Encoder error.CodecError) + := do + let cf ← core.result.Result.Insts.CoreOpsTry.branch state + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (r, val1) ← encode.map val 2#u64 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, val2) ← encode.key val1 0#u8 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let ad ← auths_model.DetachedAttachment.impl.digest attachment + let a ← auths_model.AttachmentDigest.as_bytes ad + let s ← lift (Array.to_slice a) + let (r2, val3) ← encode.bytes val2 s + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, val4) ← encode.key val3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let s1 ← auths_model.DetachedAttachment.impl.bytes attachment + let (r4, val5) ← encode.bytes val4 s1 + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok val5) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Encoder (core.convert.FromSame error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Encoder (core.convert.FromSame error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Encoder (core.convert.FromSame error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Encoder (core.convert.FromSame error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Encoder (core.convert.FromSame error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Encoder (core.convert.FromSame error.CodecError) residual + +/-- [auths_codec::encode::text]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 58:0-61:1 -/ +def encode.text + (encoder : cbor.Encoder) (value : Str) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← cbor.Encoder.str encoder value + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (encode.encode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder1) + +/-- [auths_codec::encode::encode_budget]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 120:0-127:1 -/ +def encode.encode_budget + (encoder : cbor.Encoder) (budget : auths_model.BudgetCeiling) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← encode.map encoder 2#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, encoder2) ← encode.key encoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let bai ← auths_model.BudgetCeiling.impl.algebra budget + let s ← auths_model.BudgetAlgebraId.as_str bai + let (r2, encoder3) ← encode.text encoder2 s + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, encoder4) ← encode.key encoder3 1#u8 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue _ => + let i ← auths_model.BudgetCeiling.impl.value budget + let (r4, encoder5) ← cbor.Encoder.u64 encoder4 i + let r5 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error + error.CodecError) r4 (encode.encode_error) + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r6, encoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r4 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r4, encoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r3, encoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r1, encoder1) + +/-- [auths_codec::encode::encode_optional_budget]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 129:0-139:1 -/ +def encode.encode_optional_budget + (encoder : cbor.Encoder) (budget : Option auths_model.BudgetCeiling) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + match budget with + | none => + let encoder1 ← cbor.Encoder.null encoder + ok (core.result.Result.Ok (), encoder1) + | some budget1 => encode.encode_budget encoder budget1 + +/-- [auths_codec::encode::encode_permission]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 77:0-84:1 -/ +def encode.encode_permission + (encoder : cbor.Encoder) (permission : auths_model.Permission) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← encode.map encoder 2#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, encoder2) ← encode.key encoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let ci ← auths_model.Permission.impl.capability permission + let s ← auths_model.CapabilityId.as_str ci + let (r2, encoder3) ← encode.text encoder2 s + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, encoder4) ← encode.key encoder3 1#u8 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue _ => + let ri ← auths_model.Permission.impl.resource permission + let s1 ← auths_model.ResourceId.as_str ri + let (r4, encoder5) ← encode.text encoder4 s1 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r5, encoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r4 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r4, encoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r3, encoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r1, encoder1) + +/-- [auths_codec::encode::encode_profile_ref]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 68:0-75:1 -/ +def encode.encode_profile_ref + (encoder : cbor.Encoder) (profile : auths_model.ProfileRef) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let (r, encoder1) ← encode.map encoder 2#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, encoder2) ← encode.key encoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let pi ← auths_model.ProfileRef.impl.id profile + let s ← auths_model.ProfileId.as_str pi + let (r2, encoder3) ← encode.text encoder2 s + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, encoder4) ← encode.key encoder3 1#u8 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue _ => + let i ← auths_model.ProfileRef.impl.version profile + let (r4, encoder5) ← cbor.Encoder.u16 encoder4 i + let r5 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error + error.CodecError) r4 (encode.encode_error) + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r6, encoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r4 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r4, encoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r3, encoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, encoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r1, encoder1) + +/-- [auths_codec::encode::length]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 31:0-33:1 -/ +def encode.length + (value : Std.Usize) : + Result (core.result.Result Std.U64 error.CodecError) + := do + let r ← U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from value + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + error.CodecError) r (error.limit_error) + +/-- [auths_codec::encode::array]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 48:0-51:1 -/ +def encode.array + (encoder : cbor.Encoder) (entries : Std.Usize) : + Result ((core.result.Result Unit error.CodecError) × cbor.Encoder) + := do + let r ← encode.length entries + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (r1, encoder1) ← cbor.Encoder.array encoder val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r1 + (encode.encode_error) + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), encoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r3, encoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r1, encoder) + +/-- [auths_codec::encode::encode_canonical_action]: loop body 0: + Source: 'core/crates/auths-codec/src/encode.rs', lines 396:4-398:5 + Visibility: public -/ +@[rust_loop_body] +def encode.encode_canonical_action_loop.body + (iter : core.slice.iter.Iter auths_model.DetachedAttachment) + (state : core.result.Result cbor.Encoder error.CodecError) : + Result (ControlFlow ((core.slice.iter.Iter auths_model.DetachedAttachment) × + (core.result.Result cbor.Encoder error.CodecError)) (core.result.Result + cbor.Encoder error.CodecError)) + := do + let (o, iter1) ← core.slice.iter.IteratorSliceIter.next iter + match o with + | none => ok (done state) + | some attachment => + let state1 ← encode.encode_canonical_attachment state attachment + ok (cont (iter1, state1)) + +/-- [auths_codec::encode::encode_canonical_action]: loop 0: + Source: 'core/crates/auths-codec/src/encode.rs', lines 396:4-398:5 + Visibility: public -/ +@[rust_loop] +def encode.encode_canonical_action_loop + (iter : core.slice.iter.Iter auths_model.DetachedAttachment) + (state : core.result.Result cbor.Encoder error.CodecError) : + Result (core.result.Result cbor.Encoder error.CodecError) + := do + loop + (fun (iter1, state1) => encode.encode_canonical_action_loop.body iter1 + state1) + (iter, state) + +/-- [auths_codec::encode::encode_canonical_action]: + Source: 'core/crates/auths-codec/src/encode.rs', lines 380:0-400:1 + Visibility: public -/ +def encode.encode_canonical_action + (action : auths_model.CanonicalAction) : + Result (core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) + := do + let encoder ← cbor.Encoder.new (alloc.vec.Vec.new Std.U8) + let (r, encoder1) ← encode.map encoder 6#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, encoder2) ← encode.key encoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let pr ← auths_model.CanonicalAction.impl.profile action + let (r2, encoder3) ← encode.encode_profile_ref encoder2 pr + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, encoder4) ← encode.key encoder3 1#u8 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue _ => + let mt ← auths_model.CanonicalAction.impl.media_type action + let s ← auths_model.MediaType.as_str mt + let (r4, encoder5) ← encode.text encoder4 s + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r5, encoder6) ← encode.key encoder5 2#u8 + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue _ => + let s1 ← auths_model.CanonicalAction.impl.body action + let (r6, encoder7) ← encode.bytes encoder6 s1 + let cf6 ← core.result.Result.Insts.CoreOpsTry.branch r6 + match cf6 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r7, encoder8) ← encode.key encoder7 3#u8 + let cf7 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf7 with + | core.ops.control_flow.ControlFlow.Continue _ => + let p ← auths_model.CanonicalAction.impl.permission action + let (r8, encoder9) ← encode.encode_permission encoder8 p + let cf8 ← core.result.Result.Insts.CoreOpsTry.branch r8 + match cf8 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r9, encoder10) ← encode.key encoder9 4#u8 + let cf9 ← core.result.Result.Insts.CoreOpsTry.branch r9 + match cf9 with + | core.ops.control_flow.ControlFlow.Continue _ => + let o ← + auths_model.CanonicalAction.impl.requested_budget + action + let (r10, encoder11) ← + encode.encode_optional_budget encoder10 o + let cf10 ← + core.result.Result.Insts.CoreOpsTry.branch r10 + match cf10 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r11, encoder12) ← encode.key encoder11 5#u8 + let cf11 ← + core.result.Result.Insts.CoreOpsTry.branch r11 + match cf11 with + | core.ops.control_flow.ControlFlow.Continue _ => + let s2 ← + auths_model.CanonicalAction.impl.detached_attachments + action + let i := Slice.len s2 + let (r12, encoder13) ← encode.array encoder12 i + let cf12 ← + core.result.Result.Insts.CoreOpsTry.branch r12 + match cf12 with + | core.ops.control_flow.ControlFlow.Continue _ => + let iter ← + SharedSlice.Insts.CoreIterTraitsCollectIntoIteratorSharedIter.into_iter + s2 + let state ← + encode.encode_canonical_action_loop iter + (core.result.Result.Ok encoder13) + let cf13 ← + core.result.Result.Insts.CoreOpsTry.branch state + match cf13 with + | core.ops.control_flow.ControlFlow.Continue val => + let v ← cbor.Encoder.into_writer val + ok (core.result.Result.Ok v) + | core.ops.control_flow.ControlFlow.Break residual + => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) residual + +/-- [auths_codec::decode::decode_canonical_action]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1630:0-1668:1 + Visibility: public -/ +def decode.decode_canonical_action + (input : Slice Std.U8) (limits : auths_model.VerifierLimits) : + Result (core.result.Result auths_model.CanonicalAction error.CodecError) + := do + let r ← auths_model.VerifierLimits.validate limits + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let i := Slice.len input + let i1 ← + auths_model.VerifierLimits.get limits auths_model.LimitKind.ActionBytes + if i > i1 + then ok (core.result.Result.Err error.CodecError.LimitExceeded) + else + let decoder ← cbor.Decoder.new input + let (r1, decoder1) ← decode.map decoder 6#u64 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r2, decoder2) ← decode.key decoder1 0#u8 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r3, decoder3) ← decode.profile_ref decoder2 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val => + let (r4, decoder4) ← decode.key decoder3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r5, decoder5) ← decode.text decoder4 + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let r6 ← auths_model.MediaType.parse val1 + let r7 ← + core.result.Result.map_err (BuiltinFnOnce + auths_model.ModelError error.CodecError) r6 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf6 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf6 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let (r8, decoder6) ← decode.key decoder5 2#u8 + let cf7 ← core.result.Result.Insts.CoreOpsTry.branch r8 + match cf7 with + | core.ops.control_flow.ControlFlow.Continue _ => + let i2 ← + auths_model.VerifierLimits.get limits + auths_model.LimitKind.CanonicalBodyBytes + let (r9, decoder7) ← + decode.bounded_bytes decoder6 i2 true + let cf8 ← core.result.Result.Insts.CoreOpsTry.branch r9 + match cf8 with + | core.ops.control_flow.ControlFlow.Continue val3 => + let (r10, decoder8) ← decode.key decoder7 3#u8 + let cf9 ← + core.result.Result.Insts.CoreOpsTry.branch r10 + match cf9 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r11, decoder9) ← decode.permission decoder8 + let cf10 ← + core.result.Result.Insts.CoreOpsTry.branch r11 + match cf10 with + | core.ops.control_flow.ControlFlow.Continue val4 => + let (r12, decoder10) ← decode.key decoder9 4#u8 + let cf11 ← + core.result.Result.Insts.CoreOpsTry.branch r12 + match cf11 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r13, decoder11) ← + decode.optional_budget decoder10 + let cf12 ← + core.result.Result.Insts.CoreOpsTry.branch r13 + match cf12 with + | core.ops.control_flow.ControlFlow.Continue val5 + => + let (r14, decoder12) ← + decode.key decoder11 5#u8 + let cf13 ← + core.result.Result.Insts.CoreOpsTry.branch r14 + match cf13 with + | core.ops.control_flow.ControlFlow.Continue _ => + let i3 ← + auths_model.VerifierLimits.get limits + auths_model.LimitKind.Attachments + let (r15, decoder13) ← + decode.array decoder12 i3 + let cf14 ← + core.result.Result.Insts.CoreOpsTry.branch + r15 + match cf14 with + | core.ops.control_flow.ControlFlow.Continue + val6 => + let i4 ← + cbor.Decoder.impl.position decoder13 + let r16 ← + decode.attachment_batch input limits i4 + val6 + let cf15 ← + core.result.Result.Insts.CoreOpsTry.branch + r16 + match cf15 with + | core.ops.control_flow.ControlFlow.Continue + val7 => + let r17 ← + cbor.Decoder.at input val7.position + match r17 with + | core.result.Result.Ok d => + let r18 ← + auths_model.CanonicalAction.new val + val2 val3 val4 val5 + let cf16 ← + core.result.Result.Insts.CoreOpsTry.branch + r18 + match cf16 with + | + core.ops.control_flow.ControlFlow.Continue + val8 => + let r19 ← + auths_model.CanonicalAction.with_detached_attachments + val8 val7.attachments + let cf17 ← + core.result.Result.Insts.CoreOpsTry.branch + r19 + match cf17 with + | + core.ops.control_flow.ControlFlow.Continue + val9 => + let r20 ← + decode.ensure_complete d input + let cf18 ← + core.result.Result.Insts.CoreOpsTry.branch + r20 + match cf18 with + | + core.ops.control_flow.ControlFlow.Continue + _ => + let r21 ← + encode.encode_canonical_action + val9 + let cf19 ← + core.result.Result.Insts.CoreOpsTry.branch + r21 + match cf19 with + | + core.ops.control_flow.ControlFlow.Continue + val10 => + let s ← + alloc.vec.Vec.as_slice Global + val10 + let b ← + core.cmp.impls.PartialEqShared.ne + (Slice.Insts.CoreCmpPartialEqSlice + core.cmp.PartialEqU8) s input + if b + then + ok (core.result.Result.Err + error.CodecError.NonCanonical) + else + ok (core.result.Result.Ok val9) + | + core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame + error.CodecError) residual + | + core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame + error.CodecError) residual + | + core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + error.CodecError.Insts.CoreConvertFromModelError + residual + | core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + error.CodecError.Insts.CoreConvertFromModelError + residual + | core.result.Result.Err _ => + ok (core.result.Result.Err + error.CodecError.Malformed) + | core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break + residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual + => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + (core.convert.FromSame error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame + error.CodecError) residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.CanonicalAction + error.CodecError.Insts.CoreConvertFromModelError residual + +/-- [auths_codec::hash::SIGNING_PREFIX] + Source: 'core/crates/auths-codec/src/hash.rs', lines 23:0-23:39 -/ +@[global_simps, irreducible] +def hash.SIGNING_PREFIX : Slice Std.U8 := + Array.to_slice (Array.make 5#usize [ 65#u8, 85#u8, 84#u8, 72#u8, 83#u8 ]) + +/-- [auths_codec::hash::COMMITMENT_PREFIX] + Source: 'core/crates/auths-codec/src/hash.rs', lines 24:0-24:53 -/ +@[global_simps, irreducible] +def hash.COMMITMENT_PREFIX : Slice Std.U8 := + Array.to_slice + (Array.make 16#usize [ + 65#u8, 85#u8, 84#u8, 72#u8, 83#u8, 45#u8, 67#u8, 79#u8, 77#u8, 77#u8, + 73#u8, 84#u8, 77#u8, 69#u8, 78#u8, 84#u8 + ]) + +/-- [auths_codec::hash::MAX_COMMITMENT_DOMAIN_BYTES] + Source: 'core/crates/auths-codec/src/hash.rs', lines 25:0-25:47 -/ +@[global_simps, irreducible] +def hash.MAX_COMMITMENT_DOMAIN_BYTES : Std.Usize := 128#usize + +/-- [auths_codec::hash::IDENTIFIER_PREFIX] + Source: 'core/crates/auths-codec/src/hash.rs', lines 26:0-26:45 -/ +@[global_simps, irreducible] +def hash.IDENTIFIER_PREFIX : Slice Std.U8 := + Array.to_slice + (Array.make 8#usize [ + 65#u8, 85#u8, 84#u8, 72#u8, 83#u8, 45#u8, 73#u8, 68#u8 + ]) + +/-- [auths_codec::hash::preimage_buffer]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 69:0-75:1 -/ +def hash.preimage_buffer + (capacity : Std.Usize) : + Result (core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) + := do + let r ← + Isize.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from capacity + let r1 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + error.CodecError) r (error.limit_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let v := alloc.vec.Vec.with_capacity Std.U8 capacity + ok (core.result.Result.Ok v) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) residual + +/-- [auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure#1<'_0>}::call_once]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 88:18-88:58 -/ +def + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once + (c : hash.commitment_preimage.closure_1) (tupled_args : Std.Usize) : + Result (Option Std.Usize) + := do + let i := Slice.len c + ok (Usize.checked_add tupled_args i) + +/-- Trait implementation: [auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure#1<'_0>}] + Source: 'core/crates/auths-codec/src/hash.rs', lines 88:18-88:58 -/ +@[reducible] +def + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize + : core.ops.function.FnOnce hash.commitment_preimage.closure_1 Std.Usize + (Option Std.Usize) := { + call_once := + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once +} + +/-- [auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure<'_0>}::call_once]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 87:18-87:61 -/ +def + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once + (c : hash.commitment_preimage.closure) (tupled_args : Std.Usize) : + Result (Option Std.Usize) + := do + let i := Slice.len c + ok (Usize.checked_add tupled_args i) + +/-- Trait implementation: [auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure<'_0>}] + Source: 'core/crates/auths-codec/src/hash.rs', lines 87:18-87:61 -/ +@[reducible] +def + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize + : core.ops.function.FnOnce hash.commitment_preimage.closure Std.Usize (Option + Std.Usize) := { + call_once := + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once +} + +/-- [auths_codec::hash::commitment_preimage]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 77:0-98:1 -/ +def hash.commitment_preimage + (domain : Str) (canonical : Slice Std.U8) : + Result (core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) + := do + let domain_bytes ← core.str.Str.as_bytes domain + let b ← core.slice.Slice.is_empty domain_bytes + if b + then ok (core.result.Result.Err error.CodecError.LimitExceeded) + else + let i := Slice.len domain_bytes + if i > hash.MAX_COMMITMENT_DOMAIN_BYTES + then ok (core.result.Result.Err error.CodecError.LimitExceeded) + else + let i1 := Slice.len domain_bytes + let r ← U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i1 + let r1 ← + core.result.Result.map_err (BuiltinFnOnce + core.num.error.TryFromIntError error.CodecError) r + (error.limit_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let i2 := Slice.len canonical + let r2 ← U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i2 + let r3 ← + core.result.Result.map_err (BuiltinFnOnce + core.num.error.TryFromIntError error.CodecError) r2 + (error.limit_error) + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let i3 := Slice.len hash.COMMITMENT_PREFIX + let i4 ← 2#usize + 2#usize + let i5 ← i4 + 8#usize + let o ← lift (Usize.checked_add i3 i5) + let o1 ← + core.option.Option.and_then + hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize + o domain_bytes + let o2 ← + core.option.Option.and_then + hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize + o1 canonical + let r4 ← core.option.Option.ok_or o2 error.CodecError.LimitExceeded + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let r5 ← hash.preimage_buffer val2 + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val3 => + let val4 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val3 + hash.COMMITMENT_PREFIX + let a ← lift (core.num.U16.to_be_bytes auths_model.PROTOCOL_V1) + let s ← lift (Array.to_slice a) + let val5 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val4 s + let a1 ← lift (core.num.U16.to_be_bytes val) + let s1 ← lift (Array.to_slice a1) + let val6 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val5 s1 + let val7 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val6 + domain_bytes + let a2 ← lift (core.num.U64.to_be_bytes val1) + let s2 ← lift (Array.to_slice a2) + let val8 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val7 s2 + let val9 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val8 + canonical + ok (core.result.Result.Ok val9) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + +/-- [auths_codec::hash::identifier_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::identifier_preimage::closure<'_0>}::call_once]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 125:18-125:58 -/ +def + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once + (c : hash.identifier_preimage.closure) (tupled_args : Std.Usize) : + Result (Option Std.Usize) + := do + let i := Slice.len c + ok (Usize.checked_add tupled_args i) + +/-- Trait implementation: [auths_codec::hash::identifier_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::identifier_preimage::closure<'_0>}] + Source: 'core/crates/auths-codec/src/hash.rs', lines 125:18-125:58 -/ +@[reducible] +def + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize + : core.ops.function.FnOnce hash.identifier_preimage.closure Std.Usize (Option + Std.Usize) := { + call_once := + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once +} + +/-- [auths_codec::hash::identifier_preimage]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 117:0-134:1 -/ +def hash.identifier_preimage + (identifier_type : hash.IdentifierType) (canonical : Slice Std.U8) : + Result (core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) + := do + let i := Slice.len canonical + let r ← U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i + let r1 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + error.CodecError) r (error.limit_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let i1 := Slice.len hash.IDENTIFIER_PREFIX + let i2 ← 2#usize + 2#usize + let i3 ← i2 + 8#usize + let o ← lift (Usize.checked_add i1 i3) + let o1 ← + core.option.Option.and_then + hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize + o canonical + let r2 ← core.option.Option.ok_or o1 error.CodecError.LimitExceeded + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let r3 ← hash.preimage_buffer val1 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let val3 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val2 + hash.IDENTIFIER_PREFIX + let a ← lift (core.num.U16.to_be_bytes auths_model.PROTOCOL_V1) + let s ← lift (Array.to_slice a) + let val4 ← alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val3 s + let identifier_type1 := read_discriminant identifier_type + let i4 ← lift (IScalar.hcast .U16 identifier_type1) + let a1 ← lift (core.num.U16.to_be_bytes i4) + let s1 ← lift (Array.to_slice a1) + let val5 ← alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val4 s1 + let a2 ← lift (core.num.U64.to_be_bytes val) + let s2 ← lift (Array.to_slice a2) + let val6 ← alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val5 s2 + let val7 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val6 canonical + ok (core.result.Result.Ok val7) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) residual + +/-- [auths_codec::hash::signing_preimage]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 136:0-165:1 -/ +def hash.signing_preimage + (object_type : hash.ObjectType) (profile_id : Str) + (profile_version : Std.U16) (canonical_signing_object : Slice Std.U8) : + Result (core.result.Result (alloc.vec.Vec Std.U8) error.CodecError) + := do + let i ← core.str.Str.len profile_id + let r ← U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i + let r1 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + error.CodecError) r (error.limit_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let i1 := Slice.len canonical_signing_object + let r2 ← U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i1 + let r3 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + error.CodecError) r2 (error.limit_error) + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let i2 := Slice.len hash.SIGNING_PREFIX + let i3 ← 2#usize + 2#usize + let i4 ← i3 + 2#usize + let i5 ← i4 + 2#usize + let i6 ← i5 + 8#usize + let o ← lift (Usize.checked_add i2 i6) + let r4 ← core.option.Option.ok_or o error.CodecError.LimitExceeded + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let o1 ← lift (Usize.checked_add val2 i) + let r5 ← core.option.Option.ok_or o1 error.CodecError.LimitExceeded + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val3 => + let i7 := Slice.len canonical_signing_object + let o2 ← lift (Usize.checked_add val3 i7) + let r6 ← core.option.Option.ok_or o2 error.CodecError.LimitExceeded + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r6 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue val4 => + let r7 ← hash.preimage_buffer val4 + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val5 => + let val6 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val5 + hash.SIGNING_PREFIX + let a ← lift (core.num.U16.to_be_bytes auths_model.PROTOCOL_V1) + let s ← lift (Array.to_slice a) + let val7 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val6 s + let object_type1 := read_discriminant object_type + let i8 ← lift (IScalar.hcast .U16 object_type1) + let a1 ← lift (core.num.U16.to_be_bytes i8) + let s1 ← lift (Array.to_slice a1) + let val8 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val7 s1 + let a2 ← lift (core.num.U16.to_be_bytes val) + let s2 ← lift (Array.to_slice a2) + let val9 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val8 s2 + let s3 ← core.str.Str.as_bytes profile_id + let val10 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val9 s3 + let a3 ← lift (core.num.U16.to_be_bytes profile_version) + let s4 ← lift (Array.to_slice a3) + let val11 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val10 s4 + let a4 ← lift (core.num.U64.to_be_bytes val1) + let s5 ← lift (Array.to_slice a4) + let val12 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val11 s5 + let val13 ← + alloc.vec.Vec.extend_from_slice core.clone.CloneU8 val12 + canonical_signing_object + ok (core.result.Result.Ok val13) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec Std.U8) (core.convert.FromSame error.CodecError) residual + +end auths_codec diff --git a/formal/qualification/aeneas/generated/codec/FunsExternal.lean b/formal/qualification/aeneas/generated/codec/FunsExternal.lean new file mode 100644 index 000000000..61328f30c --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/FunsExternal.lean @@ -0,0 +1,165 @@ +-- REVIEWED TRANSPARENT STANDARD-LIBRARY MODELS; NO AUTHS ALGORITHM IS OPAQUE. +import qualification.aeneas.generated.codec.Types +import qualification.aeneas.generated.standard.CheckedResult +import qualification.aeneas.generated.model.FunsExternal +open Aeneas Aeneas.Std Result +set_option linter.unusedVariables false + +-- UTF-8 error payload is unobserved; all failures map to Malformed. +def Auths.Codec.StdModel.bytes (bytes : Str) : ByteArray := + (bytes.val.map (fun byte => UInt8.ofNat byte.val)).toByteArray + +def Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from (value : Std.U64) := + core.num.tryFromUScalar .Usize value + +def U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from (value : Std.U64) := + core.num.tryFromUScalar .U8 value + +def U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from (value : Std.U64) := + core.num.tryFromUScalar .U16 value + +def U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from (value : Std.Usize) := + core.num.tryFromUScalar .U16 value + +def core.option.Option.Some {T : Type} (value : T) : Result (Option T) := ok (some value) +def core.option.Option.as_ref {T : Type} (value : Option T) : Result (Option T) := ok value + +def core.option.Option.ok_or {T E : Type} (value : Option T) (error : E) : + Result (core.result.Result T E) := + ok (match value with | some x => .Ok x | none => .Err error) + +def core.option.Option.Insts.CoreCmpPartialEqOption.eq {T : Type} + (eqInst : core.cmp.PartialEq T T) (left right : Option T) : Result Bool := + match left, right with + | none, none => ok true + | some left, some right => eqInst.eq left right + | _, _ => ok false + +def core.result.Result.map {T E U F : Type} + (function : core.ops.function.FnOnce F T U) + (value : core.result.Result T E) (callback : F) : Result (core.result.Result U E) := do + match value with + | .Ok value => + let output ← function.call_once callback value + ok (.Ok output) + | .Err error => ok (.Err error) + +def core.result.Result.map_err {T E F O : Type} + (function : core.ops.function.FnOnce O E F) + (value : core.result.Result T E) (callback : O) : Result (core.result.Result T F) := do + match value with + | .Ok value => ok (.Ok value) + | .Err error => + let output ← function.call_once callback error + ok (.Err output) + +def core.str.converts.from_utf8 (bytes : Slice Std.U8) : + Result (core.result.Result Str core.str.error.Utf8Error) := + ok (if (Auths.Codec.StdModel.bytes bytes).IsValidUTF8 then .Ok bytes else .Err ()) + +def alloc.string.String.Insts.CoreOpsDerefDerefStr.deref (value : String) : Result Str := + if bounded : value.toByteArray.size ≤ U32.max then ok (toStr value bounded) else fail .panic + +def alloc.string.String.Insts.CoreConvertFromShared0Str.from (value : Str) : Result String := + match String.fromUTF8? (Auths.Codec.StdModel.bytes value) with + | some value => ok value + | none => fail .panic + +def alloc.vec.Vec.as_slice {T : Type} (A : Type) (value : alloc.vec.Vec T) : Result (Slice T) := + ok (alloc.vec.Vec.deref value) + +def alloc.vec.Vec.is_empty {T : Type} (A : Type) (value : alloc.vec.Vec T) : Result Bool := + ok value.val.isEmpty + +-- The action call uses a stateless Unit closure for the digest key; the +-- scope constructor reuses this model with a stateless identity key. +-- This sorting model is sound only after proving purity and total-order laws +-- for that concrete callback; it is not an arbitrary FnMut Rust algorithm model. +private def insertKey {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item : T) : + (items : List T) → Result {output : List T // output.length = items.length + 1} + | [] => ok ⟨[item], rfl⟩ + | first :: rest => do + let (left, _) ← key.call_mut callback item + let (right, _) ← key.call_mut callback first + let comparison ← order.cmp left right + if comparison = .gt then + let inserted ← insertKey key order callback item rest + ok ⟨first :: inserted.val, by simp [inserted.property]⟩ + else ok ⟨item :: first :: rest, rfl⟩ + +private def sortKey {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) : + (items : List T) → Result {output : List T // output.length = items.length} + | [] => ok ⟨[], rfl⟩ + | first :: rest => do + let sorted ← sortKey key order callback rest + let inserted ← insertKey key order callback first sorted.val + ok ⟨inserted.val, by simp [inserted.property, sorted.property]⟩ + +def alloc.slice.Slice.sort_by_key {T K F : Type} + (key : core.ops.function.FnMut F T K) (order : core.cmp.Ord K) + (input : Slice T) (callback : F) : Result (Slice T) := do + let output ← sortKey key order callback input.val + ok ⟨output.val, by rw [output.property]; exact input.property⟩ + +-- A fallible pointer-sized signed conversion, exactly as Rust TryFrom specifies. +def Isize.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from (value : Std.Usize) : + Result (core.result.Result Std.Isize core.num.error.TryFromIntError) := + ok (match IScalar.tryMkOpt .Isize value.val with + | some signed => .Ok signed + | none => .Err ()) + +def core.option.Option.and_then {T U F : Type} + (callback : core.ops.function.FnOnce F T (Option U)) (value : Option T) (function : F) : + Result (Option U) := + match value with + | none => ok none + | some value => callback.call_once function value + +-- Public equations expose the existing reviewed key-sort model without +-- duplicating or changing its algorithm. Downstream ordinary sorting uses +-- only the stateless identity key and earns its comparison laws separately. +namespace Auths.Codec.StdModel + +def insertKeyValues {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item : T) (items : List T) := + insertKey key order callback item items + +theorem insertKeyValues_nil {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item : T) : + insertKeyValues key order callback item [] = ok ⟨[item], rfl⟩ := rfl + +theorem insertKeyValues_cons {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item first : T) (rest : List T) : + insertKeyValues key order callback item (first :: rest) = + (do let (left, _) ← key.call_mut callback item + let (right, _) ← key.call_mut callback first + let comparison ← order.cmp left right + if comparison = .gt then + let inserted ← insertKeyValues key order callback item rest + ok ⟨first :: inserted.val, by simp [inserted.property]⟩ + else ok ⟨item :: first :: rest, rfl⟩) := rfl + +def sortKeyValues {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (items : List T) := + sortKey key order callback items + +theorem sortKeyValues_nil {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) : + sortKeyValues key order callback [] = ok ⟨[], rfl⟩ := rfl + +theorem sortKeyValues_cons {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (first : T) (rest : List T) : + sortKeyValues key order callback (first :: rest) = + (do let sorted ← sortKeyValues key order callback rest + let inserted ← insertKeyValues key order callback first sorted.val + ok ⟨inserted.val, by simp [inserted.property, sorted.property]⟩) := rfl + +theorem sort_by_key_values {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (input : Slice T) (callback : F) : + _root_.alloc.slice.Slice.sort_by_key key order input callback = + (do let output ← sortKeyValues key order callback input.val + ok ⟨output.val, by rw [output.property]; exact input.property⟩) := rfl + +end Auths.Codec.StdModel diff --git a/formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean new file mode 100644 index 000000000..6ece160dd --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean @@ -0,0 +1,233 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.codec.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open auths_codec + +/-- [core::array::{impl core::cmp::Ord for [T; N]}::cmp]: + Source: '/rustc/library/core/src/array/mod.rs', lines 438:4-438:45 + Name pattern: [core::array::{core::cmp::Ord<[@T; @N]>}::cmp] + Visibility: public -/ +@[rust_fun "core::array::{core::cmp::Ord<[@T; @N]>}::cmp"] +axiom Array.Insts.CoreCmpOrd.cmp + {T : Type} {N : Std.Usize} (cmpOrdInst : core.cmp.Ord T) : + Array T N → Array T N → Result Ordering + +/-- [core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 258:12-258:68 + Name pattern: [core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from"] +axiom U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + : + Std.Usize → Result (core.result.Result Std.U64 + core.num.error.TryFromIntError) + +/-- [core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 258:12-258:68 + Name pattern: [core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from"] +axiom Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from + : + Std.U64 → Result (core.result.Result Std.Usize + core.num.error.TryFromIntError) + +/-- [core::convert::num::{impl core::convert::TryFrom for u8}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 300:12-300:64 + Name pattern: [core::convert::num::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::{core::convert::TryFrom}::try_from"] +axiom U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from + : + Std.U64 → Result (core.result.Result Std.U8 core.num.error.TryFromIntError) + +/-- [core::convert::num::{impl core::convert::TryFrom for u16}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 300:12-300:64 + Name pattern: [core::convert::num::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::{core::convert::TryFrom}::try_from"] +axiom U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from + : + Std.U64 → Result (core.result.Result Std.U16 + core.num.error.TryFromIntError) + +/-- [core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 300:12-300:64 + Name pattern: [core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from"] +axiom U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + : + Std.Usize → Result (core.result.Result Std.U16 + core.num.error.TryFromIntError) + +/-- [core::convert::num::{impl core::convert::TryFrom for isize}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 300:12-300:64 + Name pattern: [core::convert::num::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::{core::convert::TryFrom}::try_from"] +axiom Isize.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + : + Std.Usize → Result (core.result.Result Std.Isize + core.num.error.TryFromIntError) + +/-- [core::option::Option::Some]: + Source: '/rustc/library/core/src/option.rs', lines 605:4-605:8 + Name pattern: [core::option::Option::Some] -/ +@[rust_fun "core::option::Option::Some"] +axiom core.option.Option.Some {T : Type} : T → Result (Option T) + +/-- [core::option::{core::option::Option}::as_ref]: + Source: '/rustc/library/core/src/option.rs', lines 741:4-741:44 + Name pattern: [core::option::{core::option::Option<@T>}::as_ref] + Visibility: public -/ +@[rust_fun "core::option::{core::option::Option<@T>}::as_ref"] +axiom core.option.Option.as_ref {T : Type} : Option T → Result (Option T) + +/-- [core::option::{core::option::Option}::ok_or]: + Source: '/rustc/library/core/src/option.rs', lines 1334:4-1334:73 + Name pattern: [core::option::{core::option::Option<@T>}::ok_or] + Visibility: public -/ +@[rust_fun "core::option::{core::option::Option<@T>}::ok_or"] +axiom core.option.Option.ok_or + {T : Type} {E : Type} : Option T → E → Result (core.result.Result T E) + +/-- [core::option::{core::option::Option}::and_then]: + Source: '/rustc/library/core/src/option.rs', lines 1538:4-1540:61 + Name pattern: [core::option::{core::option::Option<@T>}::and_then] + Visibility: public -/ +@[rust_fun "core::option::{core::option::Option<@T>}::and_then"] +axiom core.option.Option.and_then + {T : Type} {U : Type} {F : Type} (opsfunctionFnOnceFTupleTOptionInst : + core.ops.function.FnOnce F T (Option U)) : + Option T → F → Result (Option U) + +/-- [core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq]: + Source: '/rustc/library/core/src/option.rs', lines 2440:4-2440:38 + Name pattern: [core::option::{core::cmp::PartialEq, core::option::Option<@T>>}::eq] + Visibility: public -/ +@[rust_fun + "core::option::{core::cmp::PartialEq, core::option::Option<@T>>}::eq"] +axiom core.option.Option.Insts.CoreCmpPartialEqOption.eq + {T : Type} (cmpPartialEqInst : core.cmp.PartialEq T T) : + Option T → Option T → Result Bool + +/-- [core::result::{core::result::Result}::map]: + Source: '/rustc/library/core/src/result.rs', lines 831:4-833:53 + Name pattern: [core::result::{core::result::Result<@T, @E>}::map] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::map"] +axiom core.result.Result.map + {T : Type} {E : Type} {U : Type} {F : Type} (opsfunctionFnOnceFTupleTUInst : + core.ops.function.FnOnce F T U) : + core.result.Result T E → F → Result (core.result.Result U E) + +/-- [core::result::{core::result::Result}::map_err]: + Source: '/rustc/library/core/src/result.rs', lines 962:4-964:53 + Name pattern: [core::result::{core::result::Result<@T, @E>}::map_err] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::map_err"] +axiom core.result.Result.map_err + {T : Type} {E : Type} {F : Type} {O : Type} (opsfunctionFnOnceOTupleEFInst : + core.ops.function.FnOnce O E F) : + core.result.Result T E → O → Result (core.result.Result T F) + +/-- [core::result::{core::result::Result}::unwrap_or]: + Source: '/rustc/library/core/src/result.rs', lines 1590:4-1593:28 + Name pattern: [core::result::{core::result::Result<@T, @E>}::unwrap_or] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::unwrap_or"] +axiom core.result.Result.unwrap_or + {T : Type} {E : Type} : core.result.Result T E → T → Result T + +/-- [core::str::converts::from_utf8]: + Source: '/rustc/library/core/src/str/converts.rs', lines 89:0-89:59 + Name pattern: [core::str::converts::from_utf8] + Visibility: public -/ +@[rust_fun "core::str::converts::from_utf8"] +axiom core.str.converts.from_utf8 + : Slice Std.U8 → Result (core.result.Result Str core.str.error.Utf8Error) + +/-- [core::str::{str}::len]: + Source: '/rustc/library/core/src/str/mod.rs', lines 153:4-153:36 + Name pattern: [core::str::{str}::len] + Visibility: public -/ +@[rust_fun "core::str::{str}::len"] +axiom core.str.Str.len : Str → Result Std.Usize + +/-- [core::str::{str}::is_empty]: + Source: '/rustc/library/core/src/str/mod.rs', lines 173:4-173:40 + Name pattern: [core::str::{str}::is_empty] + Visibility: public -/ +@[rust_fun "core::str::{str}::is_empty"] +axiom core.str.Str.is_empty : Str → Result Bool + +/-- [core::str::{str}::as_bytes]: + Source: '/rustc/library/core/src/str/mod.rs', lines 498:4-498:41 + Name pattern: [core::str::{str}::as_bytes] + Visibility: public -/ +@[rust_fun "core::str::{str}::as_bytes"] +axiom core.str.Str.as_bytes : Str → Result (Slice Std.U8) + +/-- [alloc::slice::{[T]}::sort_by_key]: + Source: '/rustc/library/alloc/src/slice.rs', lines 247:4-250:15 + Name pattern: [alloc::slice::{[@T]}::sort_by_key] + Visibility: public -/ +@[rust_fun "alloc::slice::{[@T]}::sort_by_key"] +axiom alloc.slice.Slice.sort_by_key + {T : Type} {K : Type} {F : Type} (coreopsfunctionFnMutFTupleShared0TKInst : + core.ops.function.FnMut F T K) (corecmpOrdInst : core.cmp.Ord K) : + Slice T → F → Result (Slice T) + +/-- [alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref]: + Source: '/rustc/library/alloc/src/string.rs', lines 2835:4-2835:27 + Name pattern: [alloc::string::{core::ops::deref::Deref}::deref] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::ops::deref::Deref}::deref"] +axiom alloc.string.String.Insts.CoreOpsDerefDerefStr.deref + : String → Result Str + +/-- [alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from]: + Source: '/rustc/library/alloc/src/string.rs', lines 3126:4-3126:30 + Name pattern: [alloc::string::{core::convert::From}::from] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::convert::From}::from"] +axiom alloc.string.String.Insts.CoreConvertFromShared0Str.from + : Str → Result String + +/-- [alloc::vec::{alloc::vec::Vec}::as_slice]: + Source: '/rustc/library/alloc/src/vec/mod.rs', lines 1854:4-1854:40 + Name pattern: [alloc::vec::{alloc::vec::Vec<@T>}::as_slice] + Visibility: public -/ +@[rust_fun "alloc::vec::{alloc::vec::Vec<@T>}::as_slice"] +axiom alloc.vec.Vec.as_slice + {T : Type} (A : Type) : alloc.vec.Vec T → Result (Slice T) + +/-- [alloc::vec::{alloc::vec::Vec}::is_empty]: + Source: '/rustc/library/alloc/src/vec/mod.rs', lines 3085:4-3085:40 + Name pattern: [alloc::vec::{alloc::vec::Vec<@T>}::is_empty] + Visibility: public -/ +@[rust_fun "alloc::vec::{alloc::vec::Vec<@T>}::is_empty"] +axiom alloc.vec.Vec.is_empty + {T : Type} (A : Type) : alloc.vec.Vec T → Result Bool + diff --git a/formal/qualification/aeneas/generated/codec/Types.lean b/formal/qualification/aeneas/generated/codec/Types.lean new file mode 100644 index 000000000..fd603dac4 --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/Types.lean @@ -0,0 +1,340 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: type definitions +import Aeneas +import qualification.aeneas.generated.codec.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace auths_codec + +/-- [auths_model::MediaType] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::MediaType] + Visibility: public -/ +@[reducible, rust_type "auths_model::MediaType"] +def auths_model.MediaType := String + +/-- [auths_model::ProfileId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ProfileId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProfileId"] +def auths_model.ProfileId := String + +/-- [auths_model::CapabilityId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::CapabilityId] + Visibility: public -/ +@[reducible, rust_type "auths_model::CapabilityId"] +def auths_model.CapabilityId := String + +/-- [auths_model::ResourceId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ResourceId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ResourceId"] +def auths_model.ResourceId := String + +/-- [auths_model::BudgetAlgebraId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::BudgetAlgebraId] + Visibility: public -/ +@[reducible, rust_type "auths_model::BudgetAlgebraId"] +def auths_model.BudgetAlgebraId := String + +/-- [auths_model::ModelError] + Source: 'core/crates/auths-model/src/lib.rs', lines 5194:0-5194:19 + Name pattern: [auths_model::ModelError] + Visibility: public -/ +@[discriminant isize, rust_type "auths_model::ModelError"] +inductive auths_model.ModelError where +| UnsupportedProtocol : auths_model.ModelError +| InvalidBundleHeader : auths_model.ModelError +| InvalidPrincipal : auths_model.ModelError +| InvalidVerificationMethod : auths_model.ModelError +| InvalidProfile : auths_model.ModelError +| InvalidCapability : auths_model.ModelError +| InvalidResource : auths_model.ModelError +| InvalidAudience : auths_model.ModelError +| InvalidAudienceSet : auths_model.ModelError +| DuplicateAudience : auths_model.ModelError +| InvalidMediaType : auths_model.ModelError +| InvalidRegistryId : auths_model.ModelError +| InvalidExtensionId : auths_model.ModelError +| InvalidValidity : auths_model.ModelError +| InvalidPermissionSet : auths_model.ModelError +| DuplicatePermission : auths_model.ModelError +| InvalidActionConstraint : auths_model.ModelError +| DuplicateBodyDigest : auths_model.ModelError +| InvalidCanonicalAction : auths_model.ModelError +| InvalidExtension : auths_model.ModelError +| DuplicateExtension : auths_model.ModelError +| InvalidSignature : auths_model.ModelError +| InvalidEvidence : auths_model.ModelError +| InvalidEvidenceBinding : auths_model.ModelError +| InvalidStatus : auths_model.ModelError +| InvalidStatusSnapshot : auths_model.ModelError +| InvalidAttachment : auths_model.ModelError +| InvalidPlan : auths_model.ModelError +| PlanLimitExceeded : auths_model.ModelError +| InvalidAssurance : auths_model.ModelError +| InvalidTrustAnchor : auths_model.ModelError +| InvalidRegistrySelection : auths_model.ModelError +| InvalidVerifierContext : auths_model.ModelError +| DuplicateObject : auths_model.ModelError +| CollectionLimitExceeded : auths_model.ModelError +| InvalidObservation : auths_model.ModelError +| InvalidObservationRequirement : auths_model.ModelError +| InvalidObserverAnchor : auths_model.ModelError +| InvalidBoundedPolicy : auths_model.ModelError +| InvalidApproval : auths_model.ModelError +| InvalidApprovalRequirement : auths_model.ModelError +| InvalidApproverAnchor : auths_model.ModelError + +/-- [auths_model::Digest] + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:17 + Name pattern: [auths_model::Digest] + Visibility: public -/ +@[reducible, rust_type "auths_model::Digest"] +def auths_model.Digest := Array Std.U8 32#usize + +/-- [auths_model::AttachmentDigest] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::AttachmentDigest] + Visibility: public -/ +@[reducible, rust_type "auths_model::AttachmentDigest"] +def auths_model.AttachmentDigest := auths_model.Digest + +/-- [auths_model::ProfileRef] + Source: 'core/crates/auths-model/src/lib.rs', lines 427:0-427:21 + Name pattern: [auths_model::ProfileRef] + Visibility: public -/ +@[rust_type "auths_model::ProfileRef"] +structure auths_model.ProfileRef where + id : auths_model.ProfileId + version : Std.U16 + +/-- [auths_model::Permission] + Source: 'core/crates/auths-model/src/lib.rs', lines 504:0-504:21 + Name pattern: [auths_model::Permission] + Visibility: public -/ +@[rust_type "auths_model::Permission"] +structure auths_model.Permission where + capability : auths_model.CapabilityId + resource : auths_model.ResourceId + +/-- [auths_model::BudgetCeiling] + Source: 'core/crates/auths-model/src/lib.rs', lines 832:0-832:24 + Name pattern: [auths_model::BudgetCeiling] + Visibility: public -/ +@[rust_type "auths_model::BudgetCeiling"] +structure auths_model.BudgetCeiling where + algebra : auths_model.BudgetAlgebraId + value : Std.U64 + +/-- [auths_model::DetachedAttachment] + Source: 'core/crates/auths-model/src/lib.rs', lines 2854:0-2854:29 + Name pattern: [auths_model::DetachedAttachment] + Visibility: public -/ +@[rust_type "auths_model::DetachedAttachment"] +structure auths_model.DetachedAttachment where + digest : auths_model.AttachmentDigest + bytes : alloc.vec.Vec Std.U8 + +/-- [auths_model::CanonicalAction] + Source: 'core/crates/auths-model/src/lib.rs', lines 1613:0-1613:26 + Name pattern: [auths_model::CanonicalAction] + Visibility: public -/ +@[rust_type "auths_model::CanonicalAction"] +structure auths_model.CanonicalAction where + profile : auths_model.ProfileRef + media_type : auths_model.MediaType + body : alloc.vec.Vec Std.U8 + permission : auths_model.Permission + requested_budget : Option auths_model.BudgetCeiling + detached_attachments : alloc.vec.Vec auths_model.DetachedAttachment + +/-- [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure] + Source: 'core/crates/auths-model/src/lib.rs', lines 1684:32-1684:44 + Name pattern: [auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure] -/ +@[reducible, rust_type + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure"] +def auths_model.CanonicalAction.with_detached_attachments.closure := Unit + +/-- [auths_model::VerifierLimits] + Source: 'core/crates/auths-model/src/lib.rs', lines 3612:0-3612:25 + Name pattern: [auths_model::VerifierLimits] + Visibility: public -/ +@[rust_type "auths_model::VerifierLimits"] +structure auths_model.VerifierLimits where + bundle_bytes : Std.Usize + action_bytes : Std.Usize + context_bytes : Std.Usize + grants : Std.Usize + actions : Std.Usize + plan_leaves : Std.Usize + plan_depth : Std.Usize + plan_branching : Std.Usize + evidence : Std.Usize + evidence_bytes : Std.Usize + bindings : Std.Usize + principal_status : Std.Usize + grant_status : Std.Usize + attachments : Std.Usize + attachment_bytes : Std.Usize + signatures : Std.Usize + signature_bytes : Std.Usize + permissions : Std.Usize + audiences : Std.Usize + extensions : Std.Usize + extension_bytes : Std.Usize + body_digests : Std.Usize + binding_evidence : Std.Usize + canonical_body_bytes : Std.Usize + registry_entries : Std.Usize + trust_anchors : Std.Usize + work_units : Std.U64 + approvals : Std.Usize + approver_anchors : Std.Usize + approval_requirements : Std.Usize + +/-- [auths_model::LimitKind] + Source: 'core/crates/auths-model/src/lib.rs', lines 3647:0-3647:18 + Name pattern: [auths_model::LimitKind] + Visibility: public -/ +@[discriminant isize, rust_type "auths_model::LimitKind"] +inductive auths_model.LimitKind where +| BundleBytes : auths_model.LimitKind +| ActionBytes : auths_model.LimitKind +| ContextBytes : auths_model.LimitKind +| Grants : auths_model.LimitKind +| Actions : auths_model.LimitKind +| PlanLeaves : auths_model.LimitKind +| PlanDepth : auths_model.LimitKind +| PlanBranching : auths_model.LimitKind +| EvidenceObjects : auths_model.LimitKind +| EvidenceBytes : auths_model.LimitKind +| ControlBindings : auths_model.LimitKind +| PrincipalStatusStatements : auths_model.LimitKind +| GrantStatusStatements : auths_model.LimitKind +| Attachments : auths_model.LimitKind +| AttachmentBytes : auths_model.LimitKind +| Signatures : auths_model.LimitKind +| SignatureBytes : auths_model.LimitKind +| Permissions : auths_model.LimitKind +| Audiences : auths_model.LimitKind +| CriticalExtensions : auths_model.LimitKind +| CriticalExtensionBytes : auths_model.LimitKind +| AllowedBodyDigests : auths_model.LimitKind +| BindingEvidence : auths_model.LimitKind +| CanonicalBodyBytes : auths_model.LimitKind +| RegistryEntries : auths_model.LimitKind +| TrustAnchors : auths_model.LimitKind +| Approvals : auths_model.LimitKind +| ApproverAnchors : auths_model.LimitKind +| ApprovalRequirements : auths_model.LimitKind + +/-- [auths_codec::cbor::Error] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 12:0-12:24 -/ +@[reducible] +def cbor.Error := Unit + +/-- [auths_codec::cbor::Type] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 20:0-29:1 -/ +@[discriminant isize] +inductive cbor.Type where +| U8 : cbor.Type +| U16 : cbor.Type +| U32 : cbor.Type +| U64 : cbor.Type +| Bytes : cbor.Type +| String : cbor.Type +| Null : cbor.Type +| Other : cbor.Type + +/-- [auths_codec::cbor::Head] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 33:0-37:1 -/ +structure cbor.Head where + major : Std.U8 + argument : Std.U64 + next : Std.Usize + +/-- [auths_codec::cbor::Decoder] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 137:0-140:1 -/ +structure cbor.Decoder where + input : Slice Std.U8 + position : Std.Usize + +/-- [auths_codec::cbor::Encoder] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 252:0-254:1 -/ +structure cbor.Encoder where + output : alloc.vec.Vec Std.U8 + +/-- [auths_codec::error::CodecError] + Source: 'core/crates/auths-codec/src/error.rs', lines 8:0-21:1 + Visibility: public -/ +@[discriminant isize] +inductive error.CodecError where +| LimitExceeded : error.CodecError +| Malformed : error.CodecError +| NonCanonical : error.CodecError +| DigestMismatch : error.CodecError +| DuplicateObject : error.CodecError +| Model : auths_model.ModelError → error.CodecError + +/-- [auths_codec::decode::AttachmentBatch] + Source: 'core/crates/auths-codec/src/decode.rs', lines 1571:0-1575:1 -/ +structure decode.AttachmentBatch where + attachments : alloc.vec.Vec auths_model.DetachedAttachment + attachment_bytes : Std.Usize + position : Std.Usize + +/-- [auths_codec::hash::ObjectType] + Source: 'core/crates/auths-codec/src/hash.rs', lines 29:0-36:1 -/ +@[discriminant isize [1,2,3,4,9,10]] +inductive hash.ObjectType where +| Grant : hash.ObjectType +| Action : hash.ObjectType +| PrincipalStatus : hash.ObjectType +| GrantStatus : hash.ObjectType +| Observation : hash.ObjectType +| Approval : hash.ObjectType + +/-- [auths_codec::hash::IdentifierType] + Source: 'core/crates/auths-codec/src/hash.rs', lines 39:0-49:1 -/ +@[discriminant isize [1,2,3,4,5,6,9,11,12]] +inductive hash.IdentifierType where +| Grant : hash.IdentifierType +| Action : hash.IdentifierType +| Plan : hash.IdentifierType +| Evidence : hash.IdentifierType +| PrincipalStatus : hash.IdentifierType +| GrantStatus : hash.IdentifierType +| Context : hash.IdentifierType +| ObservationRequirement : hash.IdentifierType +| ApprovalRequirement : hash.IdentifierType + +/-- [auths_codec::hash::commitment_preimage::closure#1] + Source: 'core/crates/auths-codec/src/hash.rs', lines 88:18-88:58 -/ +@[reducible] +def hash.commitment_preimage.closure_1 := Slice Std.U8 + +/-- [auths_codec::hash::commitment_preimage::closure] + Source: 'core/crates/auths-codec/src/hash.rs', lines 87:18-87:61 -/ +@[reducible] +def hash.commitment_preimage.closure := Slice Std.U8 + +/-- [auths_codec::hash::identifier_preimage::closure] + Source: 'core/crates/auths-codec/src/hash.rs', lines 125:18-125:58 -/ +@[reducible] +def hash.identifier_preimage.closure := Slice Std.U8 + +end auths_codec diff --git a/formal/qualification/aeneas/generated/codec/TypesExternal.lean b/formal/qualification/aeneas/generated/codec/TypesExternal.lean new file mode 100644 index 000000000..2f3d78bdf --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/TypesExternal.lean @@ -0,0 +1,3 @@ +import Aeneas +open Aeneas Aeneas.Std +def core.str.error.Utf8Error : Type := Unit diff --git a/formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean new file mode 100644 index 000000000..e8c6c5753 --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean @@ -0,0 +1,22 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [core::str::error::Utf8Error] + Source: '/rustc/library/core/src/str/error.rs', lines 47:0-47:20 + Name pattern: [core::str::error::Utf8Error] + Visibility: public -/ +@[rust_type "core::str::error::Utf8Error"] +axiom core.str.error.Utf8Error : Type + diff --git a/formal/qualification/aeneas/generated/codec/translation.json b/formal/qualification/aeneas/generated/codec/translation.json new file mode 100644 index 000000000..dc5c1fec3 --- /dev/null +++ b/formal/qualification/aeneas/generated/codec/translation.json @@ -0,0 +1,3779 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_codec", + "functions": [ + { + "def_id": 372, + "lean_name": "auths_codec.Array.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::array::{impl core::cmp::Ord for [T; N]}::cmp", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/array/mod.rs", + "begin_line": 438, + "end_line": 438 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 41, + "lean_name": "auths_codec.U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 258, + "end_line": 258 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 91, + "lean_name": "auths_codec.Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 258, + "end_line": 258 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 320, + "lean_name": "auths_codec.U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::{impl core::convert::TryFrom for u8}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 300, + "end_line": 300 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 321, + "lean_name": "auths_codec.U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::{impl core::convert::TryFrom for u16}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 300, + "end_line": 300 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 39, + "lean_name": "auths_codec.U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 300, + "end_line": 300 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 129, + "lean_name": "auths_codec.Isize.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::{impl core::convert::TryFrom for isize}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 300, + "end_line": 300 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 319, + "lean_name": "auths_codec.core.option.Option.Some", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::option::Option::Some", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 605, + "end_line": 605 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 191, + "lean_name": "auths_codec.core.option.Option.as_ref", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::option::{core::option::Option}::as_ref", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 741, + "end_line": 741 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 43, + "lean_name": "auths_codec.core.option.Option.ok_or", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::option::{core::option::Option}::ok_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 1334, + "end_line": 1334 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 50, + "lean_name": "auths_codec.core.option.Option.and_then", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::option::{core::option::Option}::and_then", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 1538, + "end_line": 1540 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 67, + "lean_name": "auths_codec.core.option.Option.Insts.CoreCmpPartialEqOption.eq", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 2440, + "end_line": 2440 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 318, + "lean_name": "auths_codec.core.result.Result.map", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::map", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 831, + "end_line": 833 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 23, + "lean_name": "auths_codec.core.result.Result.map_err", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::map_err", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 962, + "end_line": 964 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 66, + "lean_name": "auths_codec.core.result.Result.unwrap_or", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::unwrap_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 1590, + "end_line": 1593 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 151, + "lean_name": "auths_codec.core.str.converts.from_utf8", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::str::converts::from_utf8", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/converts.rs", + "begin_line": 89, + "end_line": 89 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 38, + "lean_name": "auths_codec.core.str.Str.len", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::len", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 153, + "end_line": 153 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 152, + "lean_name": "auths_codec.core.str.Str.is_empty", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::is_empty", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 173, + "end_line": 173 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 47, + "lean_name": "auths_codec.core.str.Str.as_bytes", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::as_bytes", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 498, + "end_line": 498 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 99, + "lean_name": "auths_codec.alloc.slice.Slice.sort_by_key", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "alloc::slice::{[T]}::sort_by_key", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/slice.rs", + "begin_line": 247, + "end_line": 250 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 184, + "lean_name": "auths_codec.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 2835, + "end_line": 2835 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 78, + "lean_name": "auths_codec.alloc.string.String.Insts.CoreConvertFromShared0Str.from", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 3126, + "end_line": 3126 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 36, + "lean_name": "auths_codec.alloc.vec.Vec.as_slice", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "alloc::vec::{alloc::vec::Vec}::as_slice", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/vec/mod.rs", + "begin_line": 1854, + "end_line": 1854 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 94, + "lean_name": "auths_codec.alloc.vec.Vec.is_empty", + "lean_file": "qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "rust_name": "alloc::vec::{alloc::vec::Vec}::is_empty", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/vec/mod.rs", + "begin_line": 3085, + "end_line": 3085 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 368, + "lean_name": "auths_codec.auths_model.identifier.forbidden_three_byte_prefix", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::identifier::forbidden_three_byte_prefix", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 9, + "end_line": 9 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 322, + "lean_name": "auths_codec.auths_model.identifier.forbidden_identifier_at", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::identifier::forbidden_identifier_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 23, + "end_line": 23 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 153, + "lean_name": "auths_codec.auths_model.identifier.contains_forbidden_identifier_loop.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 46, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_codec.auths_model.identifier.contains_forbidden_identifier" + }, + { + "def_id": 153, + "lean_name": "auths_codec.auths_model.identifier.contains_forbidden_identifier_loop", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 46, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_codec.auths_model.identifier.contains_forbidden_identifier" + }, + { + "def_id": 153, + "lean_name": "auths_codec.auths_model.identifier.contains_forbidden_identifier", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 44, + "end_line": 44 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 77, + "lean_name": "auths_codec.auths_model.identifier.bounded_identifier_valid", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::identifier::bounded_identifier_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 55, + "end_line": 55 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 22, + "lean_name": "auths_codec.auths_model.MediaType.parse", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::MediaType}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 70, + "lean_name": "auths_codec.auths_model.ProfileId.parse", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ProfileId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 82, + "lean_name": "auths_codec.auths_model.CapabilityId.parse", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CapabilityId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 83, + "lean_name": "auths_codec.auths_model.ResourceId.parse", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ResourceId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 159, + "lean_name": "auths_codec.auths_model.BudgetAlgebraId.parse", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::BudgetAlgebraId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 108, + "lean_name": "auths_codec.auths_model.MediaType.as_str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::MediaType}::as_str", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 139, + "end_line": 139 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 181, + "lean_name": "auths_codec.auths_model.ProfileId.as_str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ProfileId}::as_str", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 139, + "end_line": 139 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 188, + "lean_name": "auths_codec.auths_model.CapabilityId.as_str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CapabilityId}::as_str", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 139, + "end_line": 139 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 190, + "lean_name": "auths_codec.auths_model.ResourceId.as_str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ResourceId}::as_str", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 139, + "end_line": 139 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 348, + "lean_name": "auths_codec.auths_model.BudgetAlgebraId.as_str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::BudgetAlgebraId}::as_str", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 139, + "end_line": 139 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 342, + "lean_name": "auths_codec.auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 229, + "end_line": 229 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 341, + "lean_name": "auths_codec.auths_model.Digest.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 229, + "end_line": 229 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 327, + "lean_name": "auths_codec.auths_model.Digest.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::Digest}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 236, + "end_line": 236 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 361, + "lean_name": "auths_codec.auths_model.Digest.as_bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::Digest}::as_bytes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 241, + "end_line": 241 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 175, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest.eq", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::AttachmentDigest}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 339, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::AttachmentDigest}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 172, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::AttachmentDigest}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 340, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpPartialOrdAttachmentDigest.partial_cmp", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::AttachmentDigest}::partial_cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 163, + "lean_name": "auths_codec.auths_model.AttachmentDigest.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::AttachmentDigest}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 253, + "end_line": 253 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 288, + "lean_name": "auths_codec.auths_model.AttachmentDigest.as_bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::AttachmentDigest}::as_bytes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 268, + "end_line": 268 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 72, + "lean_name": "auths_codec.auths_model.ProfileRef.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ProfileRef}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 439, + "end_line": 439 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 180, + "lean_name": "auths_codec.auths_model.ProfileRef.impl.id", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ProfileRef}::id", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 447, + "end_line": 447 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 182, + "lean_name": "auths_codec.auths_model.ProfileRef.impl.version", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::ProfileRef}::version", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 452, + "end_line": 452 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 84, + "lean_name": "auths_codec.auths_model.Permission.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::Permission}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 511, + "end_line": 511 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 187, + "lean_name": "auths_codec.auths_model.Permission.impl.capability", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::Permission}::capability", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 519, + "end_line": 519 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 189, + "lean_name": "auths_codec.auths_model.Permission.impl.resource", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::Permission}::resource", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 524, + "end_line": 524 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 160, + "lean_name": "auths_codec.auths_model.BudgetCeiling.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::BudgetCeiling}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 839, + "end_line": 839 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 347, + "lean_name": "auths_codec.auths_model.BudgetCeiling.impl.algebra", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::BudgetCeiling}::algebra", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 844, + "end_line": 844 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 349, + "lean_name": "auths_codec.auths_model.BudgetCeiling.impl.value", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::BudgetCeiling}::value", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 849, + "end_line": 849 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 174, + "lean_name": "auths_codec.auths_model.DetachedAttachment.impl.bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::DetachedAttachment}::bytes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2881, + "end_line": 2881 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 173, + "lean_name": "auths_codec.auths_model.DetachedAttachment.impl.digest", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::DetachedAttachment}::digest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2875, + "end_line": 2875 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 101, + "lean_name": "auths_codec.auths_model.canonical_attachments_valid_loop.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::canonical_attachments_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1625, + "end_line": 1639 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_codec.auths_model.canonical_attachments_valid" + }, + { + "def_id": 101, + "lean_name": "auths_codec.auths_model.canonical_attachments_valid_loop", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::canonical_attachments_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1625, + "end_line": 1639 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_codec.auths_model.canonical_attachments_valid" + }, + { + "def_id": 101, + "lean_name": "auths_codec.auths_model.canonical_attachments_valid", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::canonical_attachments_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1622, + "end_line": 1622 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 32, + "lean_name": "auths_codec.auths_model.CanonicalAction.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1648, + "end_line": 1654 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 167, + "lean_name": "auths_codec.auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest.call_mut", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnMut<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}::call_mut", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1684, + "end_line": 1684 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 166, + "lean_name": "auths_codec.auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnOnceTupleSharedDetachedAttachmentAttachmentDigest.call_once", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnOnce<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}::call_once", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1684, + "end_line": 1684 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 33, + "lean_name": "auths_codec.auths_model.CanonicalAction.with_detached_attachments", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::with_detached_attachments", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1675, + "end_line": 1678 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 105, + "lean_name": "auths_codec.auths_model.CanonicalAction.impl.profile", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::profile", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1696, + "end_line": 1696 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 107, + "lean_name": "auths_codec.auths_model.CanonicalAction.impl.media_type", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::media_type", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1702, + "end_line": 1702 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 110, + "lean_name": "auths_codec.auths_model.CanonicalAction.impl.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::body", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1708, + "end_line": 1708 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 112, + "lean_name": "auths_codec.auths_model.CanonicalAction.impl.permission", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::permission", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1714, + "end_line": 1714 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 114, + "lean_name": "auths_codec.auths_model.CanonicalAction.impl.requested_budget", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::requested_budget", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1720, + "end_line": 1720 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 116, + "lean_name": "auths_codec.auths_model.CanonicalAction.impl.detached_attachments", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::detached_attachments", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1726, + "end_line": 1726 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 164, + "lean_name": "auths_codec.auths_model.DetachedAttachment.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::DetachedAttachment}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2866, + "end_line": 2866 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 64, + "lean_name": "auths_codec.auths_model.VerifierLimits.hard", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::VerifierLimits}::hard", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3717, + "end_line": 3717 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "auths_codec.auths_model.VerifierLimits.get", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::VerifierLimits}::get", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3808, + "end_line": 3808 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "auths_codec.auths_model.VerifierLimits.validate", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::VerifierLimits}::validate", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3855, + "end_line": 3855 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 148, + "lean_name": "auths_codec.cbor.malformed", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::malformed", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 14, + "end_line": 16 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 157, + "lean_name": "auths_codec.cbor.Type.Insts.CoreCmpPartialEqType.eq", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{impl core::cmp::PartialEq for auths_codec::cbor::Type}::eq", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 19, + "end_line": 19 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 8, + "lean_name": "auths_codec.cbor.read_tail_loop.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 46, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_codec.cbor.read_tail" + }, + { + "def_id": 8, + "lean_name": "auths_codec.cbor.read_tail_loop", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 46, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_codec.cbor.read_tail" + }, + { + "def_id": 8, + "lean_name": "auths_codec.cbor.read_tail", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 40, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 0, + "lean_name": "auths_codec.cbor.read_head", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 68, + "end_line": 92 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 13, + "lean_name": "auths_codec.cbor.append_tail_loop.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::append_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 99, + "end_line": 102 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_codec.cbor.append_tail" + }, + { + "def_id": 13, + "lean_name": "auths_codec.cbor.append_tail_loop", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::append_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 99, + "end_line": 102 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_codec.cbor.append_tail" + }, + { + "def_id": 13, + "lean_name": "auths_codec.cbor.append_tail", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::append_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 98, + "end_line": 104 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 1, + "lean_name": "auths_codec.cbor.encode_head", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::encode_head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 111, + "end_line": 134 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "auths_codec.cbor.Decoder.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::new", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 143, + "end_line": 145 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 31, + "lean_name": "auths_codec.cbor.Decoder.at", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::at", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 147, + "end_line": 152 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 29, + "lean_name": "auths_codec.cbor.Decoder.impl.position", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::position", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 154, + "end_line": 156 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 317, + "lean_name": "auths_codec.cbor.Decoder.head", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 158, + "end_line": 165 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 142, + "lean_name": "auths_codec.cbor.Decoder.collection", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 167, + "end_line": 173 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 65, + "lean_name": "auths_codec.cbor.Decoder.map", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 175, + "end_line": 177 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 90, + "lean_name": "auths_codec.cbor.Decoder.array", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 179, + "end_line": 181 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 146, + "lean_name": "auths_codec.cbor.Decoder.u64", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 183, + "end_line": 185 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 71, + "lean_name": "auths_codec.cbor.Decoder.u16", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u16", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 191, + "end_line": 193 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 68, + "lean_name": "auths_codec.cbor.Decoder.u8", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 195, + "end_line": 197 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 150, + "lean_name": "auths_codec.cbor.Decoder.payload", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 199, + "end_line": 205 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 80, + "lean_name": "auths_codec.cbor.Decoder.bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::bytes", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 207, + "end_line": 209 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 76, + "lean_name": "auths_codec.cbor.Decoder.str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 211, + "end_line": 216 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 158, + "lean_name": "auths_codec.cbor.Decoder.null", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::null", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 228, + "end_line": 234 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 156, + "lean_name": "auths_codec.cbor.Decoder.datatype", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::datatype", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 236, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 102, + "lean_name": "auths_codec.cbor.Encoder.new", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::new", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 257, + "end_line": 259 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 121, + "lean_name": "auths_codec.cbor.Encoder.into_writer", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::into_writer", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 261, + "end_line": 263 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 343, + "lean_name": "auths_codec.cbor.Encoder.head", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 265, + "end_line": 269 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 176, + "lean_name": "auths_codec.cbor.Encoder.map", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::map", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 271, + "end_line": 273 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 195, + "lean_name": "auths_codec.cbor.Encoder.array", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::array", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 275, + "end_line": 277 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 344, + "lean_name": "auths_codec.cbor.Encoder.u64", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::u64", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 279, + "end_line": 281 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 183, + "lean_name": "auths_codec.cbor.Encoder.u16", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::u16", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 287, + "end_line": 289 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 179, + "lean_name": "auths_codec.cbor.Encoder.u8", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::u8", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 291, + "end_line": 293 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 346, + "lean_name": "auths_codec.cbor.Encoder.payload", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::payload", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 295, + "end_line": 299 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 186, + "lean_name": "auths_codec.cbor.Encoder.bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::bytes", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 301, + "end_line": 303 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 185, + "lean_name": "auths_codec.cbor.Encoder.str", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::str", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 305, + "end_line": 307 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 192, + "lean_name": "auths_codec.cbor.Encoder.null", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Encoder}::null", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 313, + "end_line": 315 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 69, + "lean_name": "auths_codec.decode.decode_error", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::decode_error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 40, + "end_line": 42 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 18, + "lean_name": "auths_codec.decode.map", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::map", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 44, + "end_line": 50 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 40, + "lean_name": "auths_codec.error.limit_error", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::error::limit_error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 23, + "end_line": 25 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 28, + "lean_name": "auths_codec.decode.array", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::array", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 52, + "end_line": 60 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "auths_codec.decode.key", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::key", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 70, + "end_line": 76 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 21, + "lean_name": "auths_codec.decode.text", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::text", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 78, + "end_line": 83 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 25, + "lean_name": "auths_codec.decode.bounded_bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::bounded_bytes", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 85, + "end_line": 97 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 162, + "lean_name": "auths_codec.decode.digest_bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::digest_bytes", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 99, + "end_line": 104 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 86, + "lean_name": "auths_codec.decode.is_null", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::is_null", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 106, + "end_line": 108 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 87, + "lean_name": "auths_codec.decode.null", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::null", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 110, + "end_line": 112 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 24, + "lean_name": "auths_codec.error.CodecError.Insts.CoreConvertFromModelError.from", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}::from", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 28, + "end_line": 30 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "auths_codec.decode.profile_ref", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::profile_ref", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 126, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 26, + "lean_name": "auths_codec.decode.permission", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::permission", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 135, + "end_line": 142 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 88, + "lean_name": "auths_codec.decode.budget", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::budget", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 187, + "end_line": 194 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 27, + "lean_name": "auths_codec.decode.optional_budget", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::optional_budget", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 196, + "end_line": 205 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 34, + "lean_name": "auths_codec.decode.ensure_complete", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::ensure_complete", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1313, + "end_line": 1319 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 92, + "lean_name": "auths_codec.decode.attachment_batch_step", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::attachment_batch_step", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1577, + "end_line": 1604 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 30, + "lean_name": "auths_codec.decode.attachment_batch_loop.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::attachment_batch", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1617, + "end_line": 1620 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_codec.decode.attachment_batch" + }, + { + "def_id": 30, + "lean_name": "auths_codec.decode.attachment_batch_loop", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::attachment_batch", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1617, + "end_line": 1620 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_codec.decode.attachment_batch" + }, + { + "def_id": 30, + "lean_name": "auths_codec.decode.attachment_batch", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::attachment_batch", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1606, + "end_line": 1622 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 177, + "lean_name": "auths_codec.encode.encode_error", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 27, + "end_line": 29 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 111, + "lean_name": "auths_codec.encode.bytes", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::bytes", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 63, + "end_line": 66 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 104, + "lean_name": "auths_codec.encode.key", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::key", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 53, + "end_line": 56 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 103, + "lean_name": "auths_codec.encode.map", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::map", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 43, + "end_line": 46 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 120, + "lean_name": "auths_codec.encode.encode_canonical_attachment", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_canonical_attachment", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 402, + "end_line": 413 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 109, + "lean_name": "auths_codec.encode.text", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::text", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 58, + "end_line": 61 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 193, + "lean_name": "auths_codec.encode.encode_budget", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_budget", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 120, + "end_line": 127 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 115, + "lean_name": "auths_codec.encode.encode_optional_budget", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_optional_budget", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 129, + "end_line": 139 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 113, + "lean_name": "auths_codec.encode.encode_permission", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_permission", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 77, + "end_line": 84 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 106, + "lean_name": "auths_codec.encode.encode_profile_ref", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_profile_ref", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 68, + "end_line": 75 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 194, + "lean_name": "auths_codec.encode.length", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::length", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 31, + "end_line": 33 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 117, + "lean_name": "auths_codec.encode.array", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::array", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 48, + "end_line": 51 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 35, + "lean_name": "auths_codec.encode.encode_canonical_action_loop.body", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_canonical_action", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 396, + "end_line": 398 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_codec.encode.encode_canonical_action" + }, + { + "def_id": 35, + "lean_name": "auths_codec.encode.encode_canonical_action_loop", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_canonical_action", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 396, + "end_line": 398 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_codec.encode.encode_canonical_action" + }, + { + "def_id": 35, + "lean_name": "auths_codec.encode.encode_canonical_action", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::encode::encode_canonical_action", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/encode.rs", + "begin_line": 380, + "end_line": 400 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "auths_codec.decode.decode_canonical_action", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::decode::decode_canonical_action", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1630, + "end_line": 1668 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 44, + "lean_name": "auths_codec.hash.preimage_buffer", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::preimage_buffer", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 69, + "end_line": 75 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 134, + "lean_name": "auths_codec.hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure#1<'_0>}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 88, + "end_line": 88 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 133, + "lean_name": "auths_codec.hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure<'_0>}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 87, + "end_line": 87 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "auths_codec.hash.commitment_preimage", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::commitment_preimage", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 77, + "end_line": 98 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 139, + "lean_name": "auths_codec.hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize.call_once", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::identifier_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::identifier_preimage::closure<'_0>}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 125, + "end_line": 125 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 5, + "lean_name": "auths_codec.hash.identifier_preimage", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::identifier_preimage", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 117, + "end_line": 134 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "auths_codec.hash.signing_preimage", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::signing_preimage", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 136, + "end_line": 165 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 40, + "lean_name": "auths_codec.core.str.error.Utf8Error", + "lean_file": "qualification/aeneas/generated/codec/TypesExternal_Template.lean", + "rust_name": "core::str::error::Utf8Error", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/error.rs", + "begin_line": 47, + "end_line": 47 + } + }, + { + "def_id": 15, + "lean_name": "auths_codec.auths_model.MediaType", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::MediaType", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 27, + "lean_name": "auths_codec.auths_model.ProfileId", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::ProfileId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 29, + "lean_name": "auths_codec.auths_model.CapabilityId", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::CapabilityId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 30, + "lean_name": "auths_codec.auths_model.ResourceId", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::ResourceId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 31, + "lean_name": "auths_codec.auths_model.BudgetAlgebraId", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::BudgetAlgebraId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 11, + "lean_name": "auths_codec.auths_model.ModelError", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::ModelError", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 5194, + "end_line": 5194 + } + }, + { + "def_id": 39, + "lean_name": "auths_codec.auths_model.Digest", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::Digest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 230, + "end_line": 230 + } + }, + { + "def_id": 32, + "lean_name": "auths_codec.auths_model.AttachmentDigest", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::AttachmentDigest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 14, + "lean_name": "auths_codec.auths_model.ProfileRef", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::ProfileRef", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 427, + "end_line": 427 + } + }, + { + "def_id": 16, + "lean_name": "auths_codec.auths_model.Permission", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::Permission", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 504, + "end_line": 504 + } + }, + { + "def_id": 17, + "lean_name": "auths_codec.auths_model.BudgetCeiling", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::BudgetCeiling", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 832, + "end_line": 832 + } + }, + { + "def_id": 19, + "lean_name": "auths_codec.auths_model.DetachedAttachment", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::DetachedAttachment", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2854, + "end_line": 2854 + } + }, + { + "def_id": 9, + "lean_name": "auths_codec.auths_model.CanonicalAction", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::CanonicalAction", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1613, + "end_line": 1613 + } + }, + { + "def_id": 34, + "lean_name": "auths_codec.auths_model.CanonicalAction.with_detached_attachments.closure", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1684, + "end_line": 1684 + } + }, + { + "def_id": 8, + "lean_name": "auths_codec.auths_model.VerifierLimits", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::VerifierLimits", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3612, + "end_line": 3612 + } + }, + { + "def_id": 12, + "lean_name": "auths_codec.auths_model.LimitKind", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_model::LimitKind", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3647, + "end_line": 3647 + } + }, + { + "def_id": 2, + "lean_name": "auths_codec.cbor.Error", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::cbor::Error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 12, + "end_line": 12 + } + }, + { + "def_id": 41, + "lean_name": "auths_codec.cbor.Type", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::cbor::Type", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 20, + "end_line": 29 + } + }, + { + "def_id": 1, + "lean_name": "auths_codec.cbor.Head", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::cbor::Head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 33, + "end_line": 37 + } + }, + { + "def_id": 13, + "lean_name": "auths_codec.cbor.Decoder", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::cbor::Decoder", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 137, + "end_line": 140 + } + }, + { + "def_id": 35, + "lean_name": "auths_codec.cbor.Encoder", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::cbor::Encoder", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 252, + "end_line": 254 + } + }, + { + "def_id": 10, + "lean_name": "auths_codec.error.CodecError", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::error::CodecError", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 8, + "end_line": 21 + } + }, + { + "def_id": 18, + "lean_name": "auths_codec.decode.AttachmentBatch", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::decode::AttachmentBatch", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1571, + "end_line": 1575 + } + }, + { + "def_id": 20, + "lean_name": "auths_codec.hash.ObjectType", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::hash::ObjectType", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 29, + "end_line": 36 + } + }, + { + "def_id": 24, + "lean_name": "auths_codec.hash.IdentifierType", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::hash::IdentifierType", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 39, + "end_line": 49 + } + }, + { + "def_id": 23, + "lean_name": "auths_codec.hash.commitment_preimage.closure_1", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::hash::commitment_preimage::closure#1", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 88, + "end_line": 88 + } + }, + { + "def_id": 22, + "lean_name": "auths_codec.hash.commitment_preimage.closure", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::hash::commitment_preimage::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 87, + "end_line": 87 + } + }, + { + "def_id": 25, + "lean_name": "auths_codec.hash.identifier_preimage.closure", + "lean_file": "qualification/aeneas/generated/codec/Types.lean", + "rust_name": "auths_codec::hash::identifier_preimage::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 125, + "end_line": 125 + } + } + ], + "globals": [ + { + "def_id": 1, + "lean_name": "auths_codec.auths_model.PROTOCOL_V1", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::PROTOCOL_V1", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 22, + "end_line": 22 + }, + "can_fail": false + }, + { + "def_id": 12, + "lean_name": "auths_codec.auths_model.HARD_MAX_BUNDLE_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_BUNDLE_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 23, + "end_line": 23 + }, + "can_fail": true + }, + { + "def_id": 13, + "lean_name": "auths_codec.auths_model.HARD_MAX_ACTION_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_ACTION_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 25, + "end_line": 25 + }, + "can_fail": true + }, + { + "def_id": 14, + "lean_name": "auths_codec.auths_model.HARD_MAX_CONTEXT_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_CONTEXT_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 27, + "end_line": 27 + }, + "can_fail": true + }, + { + "def_id": 15, + "lean_name": "auths_codec.auths_model.HARD_MAX_GRANTS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_GRANTS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 29, + "end_line": 29 + }, + "can_fail": false + }, + { + "def_id": 16, + "lean_name": "auths_codec.auths_model.HARD_MAX_ACTIONS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_ACTIONS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 31, + "end_line": 31 + }, + "can_fail": false + }, + { + "def_id": 17, + "lean_name": "auths_codec.auths_model.HARD_MAX_PLAN_LEAVES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_PLAN_LEAVES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 33, + "end_line": 33 + }, + "can_fail": false + }, + { + "def_id": 18, + "lean_name": "auths_codec.auths_model.HARD_MAX_PLAN_DEPTH", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_PLAN_DEPTH", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 35, + "end_line": 35 + }, + "can_fail": false + }, + { + "def_id": 19, + "lean_name": "auths_codec.auths_model.HARD_MAX_PLAN_BRANCHING", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_PLAN_BRANCHING", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 37, + "end_line": 37 + }, + "can_fail": false + }, + { + "def_id": 20, + "lean_name": "auths_codec.auths_model.HARD_MAX_EVIDENCE", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_EVIDENCE", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 39, + "end_line": 39 + }, + "can_fail": false + }, + { + "def_id": 21, + "lean_name": "auths_codec.auths_model.HARD_MAX_EVIDENCE_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_EVIDENCE_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 41, + "end_line": 41 + }, + "can_fail": true + }, + { + "def_id": 22, + "lean_name": "auths_codec.auths_model.HARD_MAX_BINDINGS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_BINDINGS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 43, + "end_line": 43 + }, + "can_fail": false + }, + { + "def_id": 23, + "lean_name": "auths_codec.auths_model.HARD_MAX_PRINCIPAL_STATUS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_PRINCIPAL_STATUS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 45, + "end_line": 45 + }, + "can_fail": false + }, + { + "def_id": 24, + "lean_name": "auths_codec.auths_model.HARD_MAX_GRANT_STATUS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_GRANT_STATUS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 47, + "end_line": 47 + }, + "can_fail": false + }, + { + "def_id": 7, + "lean_name": "auths_codec.auths_model.HARD_MAX_ATTACHMENTS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_ATTACHMENTS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 49, + "end_line": 49 + }, + "can_fail": false + }, + { + "def_id": 25, + "lean_name": "auths_codec.auths_model.HARD_MAX_ATTACHMENT_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_ATTACHMENT_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 51, + "end_line": 51 + }, + "can_fail": true + }, + { + "def_id": 26, + "lean_name": "auths_codec.auths_model.HARD_MAX_SIGNATURES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_SIGNATURES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 53, + "end_line": 53 + }, + "can_fail": false + }, + { + "def_id": 27, + "lean_name": "auths_codec.auths_model.HARD_MAX_SIGNATURE_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_SIGNATURE_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 55, + "end_line": 55 + }, + "can_fail": false + }, + { + "def_id": 28, + "lean_name": "auths_codec.auths_model.HARD_MAX_PERMISSIONS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_PERMISSIONS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 57, + "end_line": 57 + }, + "can_fail": false + }, + { + "def_id": 29, + "lean_name": "auths_codec.auths_model.HARD_MAX_AUDIENCES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_AUDIENCES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 59, + "end_line": 59 + }, + "can_fail": false + }, + { + "def_id": 30, + "lean_name": "auths_codec.auths_model.HARD_MAX_EXTENSIONS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_EXTENSIONS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 61, + "end_line": 61 + }, + "can_fail": false + }, + { + "def_id": 31, + "lean_name": "auths_codec.auths_model.HARD_MAX_EXTENSION_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_EXTENSION_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 63, + "end_line": 63 + }, + "can_fail": false + }, + { + "def_id": 32, + "lean_name": "auths_codec.auths_model.HARD_MAX_BODY_DIGESTS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_BODY_DIGESTS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 65, + "end_line": 65 + }, + "can_fail": false + }, + { + "def_id": 33, + "lean_name": "auths_codec.auths_model.HARD_MAX_BINDING_EVIDENCE", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_BINDING_EVIDENCE", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 67, + "end_line": 67 + }, + "can_fail": false + }, + { + "def_id": 6, + "lean_name": "auths_codec.auths_model.HARD_MAX_CANONICAL_BODY_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_CANONICAL_BODY_BYTES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 69, + "end_line": 69 + }, + "can_fail": true + }, + { + "def_id": 36, + "lean_name": "auths_codec.auths_model.HARD_MAX_WORK_UNITS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_WORK_UNITS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 71, + "end_line": 71 + }, + "can_fail": false + }, + { + "def_id": 34, + "lean_name": "auths_codec.auths_model.HARD_MAX_REGISTRY_ENTRIES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_REGISTRY_ENTRIES", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 73, + "end_line": 73 + }, + "can_fail": false + }, + { + "def_id": 35, + "lean_name": "auths_codec.auths_model.HARD_MAX_TRUST_ANCHORS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_TRUST_ANCHORS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 75, + "end_line": 75 + }, + "can_fail": false + }, + { + "def_id": 37, + "lean_name": "auths_codec.auths_model.HARD_MAX_APPROVALS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_APPROVALS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 78, + "end_line": 78 + }, + "can_fail": false + }, + { + "def_id": 38, + "lean_name": "auths_codec.auths_model.HARD_MAX_APPROVER_ANCHORS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_APPROVER_ANCHORS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 81, + "end_line": 81 + }, + "can_fail": false + }, + { + "def_id": 39, + "lean_name": "auths_codec.auths_model.HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_CONTEXT_APPROVAL_REQUIREMENTS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 84, + "end_line": 84 + }, + "can_fail": false + }, + { + "def_id": 0, + "lean_name": "auths_codec.hash.SIGNING_PREFIX", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::SIGNING_PREFIX", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 23, + "end_line": 23 + }, + "can_fail": false + }, + { + "def_id": 3, + "lean_name": "auths_codec.hash.COMMITMENT_PREFIX", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::COMMITMENT_PREFIX", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 24, + "end_line": 24 + }, + "can_fail": false + }, + { + "def_id": 2, + "lean_name": "auths_codec.hash.MAX_COMMITMENT_DOMAIN_BYTES", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::MAX_COMMITMENT_DOMAIN_BYTES", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 25, + "end_line": 25 + }, + "can_fail": false + }, + { + "def_id": 4, + "lean_name": "auths_codec.hash.IDENTIFIER_PREFIX", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::IDENTIFIER_PREFIX", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 26, + "end_line": 26 + }, + "can_fail": false + } + ], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 33, + "lean_name": "auths_codec.core.option.Option.Insts.CoreCmpPartialEqOption", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "core::option::{impl core::cmp::PartialEq> for core::option::Option}", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 2438, + "end_line": 2438 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 17, + "lean_name": "auths_codec.Slice.Insts.CoreCmpPartialEqSlice", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "core::slice::cmp::{impl core::cmp::PartialEq<[U]> for [T]}", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/slice/cmp.rs", + "begin_line": 14, + "end_line": 16 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 59, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpPartialEqAttachmentDigest", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::AttachmentDigest}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 57, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::AttachmentDigest}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 15, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 58, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpPartialOrdAttachmentDigest", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::AttachmentDigest}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 16, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 44, + "lean_name": "auths_codec.auths_model.AttachmentDigest.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::AttachmentDigest}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 11, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + }, + { + "def_id": 41, + "lean_name": "auths_codec.auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnOnceTupleSharedDetachedAttachmentAttachmentDigest", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnOnce<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1684, + "end_line": 1684 + }, + "impl_trait_def_id": 3, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 42, + "lean_name": "auths_codec.auths_model.CanonicalAction.with_detached_attachments.closure.Insts.CoreOpsFunctionFnMutTupleSharedDetachedAttachmentAttachmentDigest", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnMut<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1684, + "end_line": 1684 + }, + "impl_trait_def_id": 10, + "impl_trait_rust_name": "core::ops::function::FnMut", + "impl_trait_is_builtin": true + }, + { + "def_id": 7, + "lean_name": "auths_codec.error.CodecError.Insts.CoreConvertFromModelError", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 27, + "end_line": 31 + }, + "impl_trait_def_id": 1, + "impl_trait_rust_name": "core::convert::From", + "impl_trait_is_builtin": true + }, + { + "def_id": 24, + "lean_name": "auths_codec.hash.commitment_preimage.closure_1.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure#1<'_0>}", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 88, + "end_line": 88 + }, + "impl_trait_def_id": 3, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 23, + "lean_name": "auths_codec.hash.commitment_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure<'_0>}", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 87, + "end_line": 87 + }, + "impl_trait_def_id": 3, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 27, + "lean_name": "auths_codec.hash.identifier_preimage.closure.Insts.CoreOpsFunctionFnOnceTupleUsizeOptionUsize", + "lean_file": "qualification/aeneas/generated/codec/Funs.lean", + "rust_name": "auths_codec::hash::identifier_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::identifier_preimage::closure<'_0>}", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 125, + "end_line": 125 + }, + "impl_trait_def_id": 3, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/generated/composition/Funs.lean b/formal/qualification/aeneas/generated/composition/Funs.lean new file mode 100644 index 000000000..b2179390b --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/Funs.lean @@ -0,0 +1,848 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_composition]: function definitions +import Aeneas +import Auths.Support.UnitCallback +import qualification.aeneas.generated.composition.Types +import qualification.aeneas.generated.composition.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +namespace auths_composition + +/-- [auths_algebra_kernel::generated::threshold_counts]: + Source: 'core/crates/auths-algebra-kernel/src/generated.rs', lines 157:0-157:88 + Name pattern: [auths_algebra_kernel::generated::threshold_counts] + Visibility: public -/ +@[rust_fun "auths_algebra_kernel::generated::threshold_counts"] +def auths_algebra_kernel.generated.threshold_counts + (required : Std.U16) (authorized : Std.Usize) (indeterminate : Std.Usize) : + Result auths_algebra_kernel.generated.Truth + := do + let required1 ← lift (core.convert.num.FromUsizeU16.from required) + if authorized >= required1 + then ok auths_algebra_kernel.generated.Truth.Authorized + else + let i ← lift (core.num.Usize.saturating_add authorized indeterminate) + if i >= required1 + then ok auths_algebra_kernel.generated.Truth.Indeterminate + else ok auths_algebra_kernel.generated.Truth.Denied + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 229:33-229:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq + (self : auths_model.Digest) (other : auths_model.Digest) : Result Bool := do + core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 self other + +/-- [auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 229:44-229:47 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.Digest.Insts.CoreCmpOrd.cmp + (self : auths_model.Digest) (other : auths_model.Digest) : + Result Ordering + := do + Array.Insts.CoreCmpOrd.cmp core.cmp.OrdU8 self other + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::ProofRef}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:41-248:50 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef.eq + (self : auths_model.ProofRef) (other : auths_model.ProofRef) : + Result Bool + := do + auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq self other + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::ProofRef}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:41-248:50 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +def auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef : core.cmp.PartialEq + auths_model.ProofRef auths_model.ProofRef := { + eq := auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef.eq +} + +/-- [auths_model::{impl core::cmp::Eq for auths_model::ProofRef}::assert_fields_are_eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:37-248:39 + Name pattern: [auths_model::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::Eq}::assert_fields_are_eq"] +def auths_model.ProofRef.Insts.CoreCmpEq.assert_fields_are_eq + (self : auths_model.ProofRef) : Result Unit := do + ok () + +/-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::ProofRef}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:37-248:39 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def auths_model.ProofRef.Insts.CoreCmpEq : core.cmp.Eq auths_model.ProofRef + := { + partialEqInst := auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef + assert_fields_are_eq := + auths_model.ProofRef.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- [auths_model::{impl core::cmp::Ord for auths_model::ProofRef}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:52-248:55 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.ProofRef.Insts.CoreCmpOrd.cmp + (self : auths_model.ProofRef) (other : auths_model.ProofRef) : + Result Ordering + := do + auths_model.Digest.Insts.CoreCmpOrd.cmp self other + +/-- [auths_model::{impl core::cmp::PartialOrd for auths_model::ProofRef}::partial_cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:57-248:67 + Name pattern: [auths_model::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialOrd}::partial_cmp"] +def auths_model.ProofRef.Insts.CoreCmpPartialOrdProofRef.partial_cmp + (self : auths_model.ProofRef) (other : auths_model.ProofRef) : + Result (Option Ordering) + := do + let o ← auths_model.ProofRef.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::ProofRef}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:57-248:67 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +def auths_model.ProofRef.Insts.CoreCmpPartialOrdProofRef : core.cmp.PartialOrd + auths_model.ProofRef auths_model.ProofRef := { + partialEqInst := auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef + partial_cmp := + auths_model.ProofRef.Insts.CoreCmpPartialOrdProofRef.partial_cmp +} + +/-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::ProofRef}] + Source: 'core/crates/auths-model/src/lib.rs', lines 248:52-248:55 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +impl_def auths_model.ProofRef.Insts.CoreCmpOrd : core.cmp.Ord + auths_model.ProofRef := { + eqInst := auths_model.ProofRef.Insts.CoreCmpEq + partialOrdInst := auths_model.ProofRef.Insts.CoreCmpPartialOrdProofRef + cmp := auths_model.ProofRef.Insts.CoreCmpOrd.cmp + max := core.cmp.Ord.max.default auths_model.ProofRef.Insts.CoreCmpOrd +} + +/-- [auths_model::{auths_model::AuthorizationPlan}::as_ref]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1861:4-1861:52 + Name pattern: [auths_model::{auths_model::AuthorizationPlan}::as_ref] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AuthorizationPlan}::as_ref"] +def auths_model.AuthorizationPlan.as_ref + (self : auths_model.AuthorizationPlan) : + Result auths_model.AuthorizationPlanRef + := do + match self._0 with + | auths_model.AuthorizationPlanNode.Proof reference => + ok (auths_model.AuthorizationPlanRef.Proof reference) + | auths_model.AuthorizationPlanNode.AllOf members => + let s := alloc.vec.Vec.deref members + ok (auths_model.AuthorizationPlanRef.AllOf s) + | auths_model.AuthorizationPlanNode.AnyOf members => + let s := alloc.vec.Vec.deref members + ok (auths_model.AuthorizationPlanRef.AnyOf s) + | auths_model.AuthorizationPlanNode.KOfN k members => + let s := alloc.vec.Vec.deref members + ok (auths_model.AuthorizationPlanRef.KOfN k s) + +mutual + +/-- [auths_model::{auths_model::AuthorizationPlan}::validate::walk_members]: loop 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 1887:12-1891:9 + Name pattern: [auths_model::{auths_model::AuthorizationPlan}::validate::walk_members] -/ +@[rust_loop, rust_fun + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members"] +def auths_model.AuthorizationPlan.validate.walk_members_loop + (iter : core.slice.iter.Iter auths_model.AuthorizationPlan) + (depth : Std.Usize) (limits : auths_model.VerifierLimits) + (refs : alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) + (maximum_depth : Std.Usize) : + Result ((core.result.Result Unit auths_model.ModelError) × + (alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) × + Std.Usize) + := do + let (o, iter1) ← core.slice.iter.IteratorSliceIter.next iter + match o with + | none => ok (core.result.Result.Ok (), refs, maximum_depth) + | some member => + let i ← depth + 1#usize + let (r, refs1, maximum_depth1) ← + auths_model.AuthorizationPlan.validate.walk member i limits refs + maximum_depth + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + auths_model.AuthorizationPlan.validate.walk_members_loop iter1 depth + limits refs1 maximum_depth1 + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame auths_model.ModelError) residual + ok (r1, refs1, maximum_depth1) +partial_fixpoint + +/-- [auths_model::{auths_model::AuthorizationPlan}::validate::walk_members]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1880:8-1886:35 + Name pattern: [auths_model::{auths_model::AuthorizationPlan}::validate::walk_members] -/ +@[rust_fun + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members"] +def auths_model.AuthorizationPlan.validate.walk_members + (members : Slice auths_model.AuthorizationPlan) (depth : Std.Usize) + (limits : auths_model.VerifierLimits) + (refs : alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) + (maximum_depth : Std.Usize) : + Result ((core.result.Result Unit auths_model.ModelError) × + (alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) × + Std.Usize) + := do + let iter ← + SharedSlice.Insts.CoreIterTraitsCollectIntoIteratorSharedIter.into_iter + members + auths_model.AuthorizationPlan.validate.walk_members_loop iter depth limits + refs maximum_depth +partial_fixpoint + +/-- [auths_model::{auths_model::AuthorizationPlan}::validate::walk]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1893:8-1899:35 + Name pattern: [auths_model::{auths_model::AuthorizationPlan}::validate::walk] -/ +@[rust_fun "auths_model::{auths_model::AuthorizationPlan}::validate::walk"] +def auths_model.AuthorizationPlan.validate.walk + (plan : auths_model.AuthorizationPlan) (depth : Std.Usize) + (limits : auths_model.VerifierLimits) + (refs : alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) + (maximum_depth : Std.Usize) : + Result ((core.result.Result Unit auths_model.ModelError) × + (alloc.collections.btree.set.BTreeSet auths_model.ProofRef Global) × + Std.Usize) + := do + if depth > limits.plan_depth + then + ok (core.result.Result.Err auths_model.ModelError.PlanLimitExceeded, refs, + maximum_depth) + else + let maximum_depth1 ← + core.cmp.Ord.max.default core.cmp.OrdUsize maximum_depth depth + match plan._0 with + | auths_model.AuthorizationPlanNode.Proof reference => + let (b, refs1) ← + alloc.collections.btree.set.BTreeSet.insert core.core.clone.CloneGlobal + auths_model.ProofRef.Insts.CoreCmpOrd refs reference + if b + then + let i ← + alloc.collections.btree.set.BTreeSet.len core.core.clone.CloneGlobal + refs1 + if i > limits.plan_leaves + then + ok (core.result.Result.Err auths_model.ModelError.PlanLimitExceeded, + refs1, maximum_depth1) + else ok (core.result.Result.Ok (), refs1, maximum_depth1) + else + ok (core.result.Result.Err auths_model.ModelError.PlanLimitExceeded, + refs1, maximum_depth1) + | auths_model.AuthorizationPlanNode.AllOf members => + let b ← alloc.vec.Vec.is_empty Global members + if b + then + ok (core.result.Result.Err auths_model.ModelError.InvalidPlan, refs, + maximum_depth1) + else + let i := alloc.vec.Vec.len members + if i > limits.plan_branching + then + ok (core.result.Result.Err auths_model.ModelError.PlanLimitExceeded, + refs, maximum_depth1) + else + let s := alloc.vec.Vec.deref members + let (r, refs1, maximum_depth2) ← + auths_model.AuthorizationPlan.validate.walk_members s depth limits + refs maximum_depth1 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), refs1, maximum_depth2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame auths_model.ModelError) residual + ok (r1, refs1, maximum_depth2) + | auths_model.AuthorizationPlanNode.AnyOf members => + let b ← alloc.vec.Vec.is_empty Global members + if b + then + ok (core.result.Result.Err auths_model.ModelError.InvalidPlan, refs, + maximum_depth1) + else + let i := alloc.vec.Vec.len members + if i > limits.plan_branching + then + ok (core.result.Result.Err auths_model.ModelError.PlanLimitExceeded, + refs, maximum_depth1) + else + let s := alloc.vec.Vec.deref members + let (r, refs1, maximum_depth2) ← + auths_model.AuthorizationPlan.validate.walk_members s depth limits + refs maximum_depth1 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), refs1, maximum_depth2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame auths_model.ModelError) residual + ok (r1, refs1, maximum_depth2) + | auths_model.AuthorizationPlanNode.KOfN k members => + if k = 0#u16 + then + ok (core.result.Result.Err auths_model.ModelError.InvalidPlan, refs, + maximum_depth1) + else + let i ← lift (core.convert.num.FromUsizeU16.from k) + let i1 := alloc.vec.Vec.len members + if i > i1 + then + ok (core.result.Result.Err auths_model.ModelError.InvalidPlan, refs, + maximum_depth1) + else + let b ← alloc.vec.Vec.is_empty Global members + if b + then + ok (core.result.Result.Err auths_model.ModelError.InvalidPlan, + refs, maximum_depth1) + else + let i2 := alloc.vec.Vec.len members + if i2 > limits.plan_branching + then + ok (core.result.Result.Err + auths_model.ModelError.PlanLimitExceeded, refs, maximum_depth1) + else + let s := alloc.vec.Vec.deref members + let (r, refs1, maximum_depth2) ← + auths_model.AuthorizationPlan.validate.walk_members s depth + limits refs maximum_depth1 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + ok (core.result.Result.Ok (), refs1, maximum_depth2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame auths_model.ModelError) + residual + ok (r1, refs1, maximum_depth2) +partial_fixpoint + +end + +/-- [auths_model::{auths_model::AuthorizationPlan}::validate]: loop 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 1938:8-1940:9 + Name pattern: [auths_model::{auths_model::AuthorizationPlan}::validate] + Visibility: public -/ +@[rust_loop, rust_fun + "auths_model::{auths_model::AuthorizationPlan}::validate"] +def auths_model.AuthorizationPlan.validate_loop + (iter : alloc.collections.btree.set.IntoIter auths_model.ProofRef Global) + (leaves : alloc.vec.Vec auths_model.ProofRef) : + Result (alloc.vec.Vec auths_model.ProofRef) + := do + let (o, iter1) ← + alloc.collections.btree.set.IntoIter.Insts.CoreIterTraitsIteratorIterator.next + core.core.clone.CloneGlobal iter + match o with + | none => ok leaves + | some reference => + let leaves1 ← alloc.vec.Vec.push leaves reference + auths_model.AuthorizationPlan.validate_loop iter1 leaves1 +partial_fixpoint + +/-- [auths_model::{auths_model::AuthorizationPlan}::validate]: + Source: 'core/crates/auths-model/src/lib.rs', lines 1879:4-1879:84 + Name pattern: [auths_model::{auths_model::AuthorizationPlan}::validate] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AuthorizationPlan}::validate"] +def auths_model.AuthorizationPlan.validate + (self : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + : + Result (core.result.Result auths_model.PlanShape auths_model.ModelError) + := do + let refs ← + alloc.collections.btree.set.BTreeSetTGlobal.new auths_model.ProofRef + let (r, refs1, maximum_depth) ← + auths_model.AuthorizationPlan.validate.walk self 1#usize limits refs + 0#usize + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let i ← + alloc.collections.btree.set.BTreeSet.len core.core.clone.CloneGlobal + refs1 + let leaves := alloc.vec.Vec.with_capacity auths_model.ProofRef i + let iter ← + alloc.collections.btree.set.BTreeSet.Insts.CoreIterTraitsCollectIntoIteratorTIntoIter.into_iter + core.core.clone.CloneGlobal refs1 + let leaves1 ← auths_model.AuthorizationPlan.validate_loop iter leaves + ok (core.result.Result.Ok { leaves := leaves1, maximum_depth }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.PlanShape (core.convert.FromSame auths_model.ModelError) + residual + +/-- [auths_model::{auths_model::Requirement}::code_order]: + Source: 'core/crates/auths-model/src/lib.rs', lines 4997:8-4997:39 + Name pattern: [auths_model::{auths_model::Requirement}::code_order] -/ +@[rust_fun "auths_model::{auths_model::Requirement}::code_order"] +def auths_model.Requirement.code_order + (self : auths_model.Requirement) : Result Std.U8 := do + match self with + | auths_model.Requirement.UnsupportedProtocol => ok 17#u8 + | auths_model.Requirement.UnsupportedPrincipalMethod => ok 14#u8 + | auths_model.Requirement.UnsupportedSignatureSuite => ok 19#u8 + | auths_model.Requirement.UnsupportedEvidenceType => ok 13#u8 + | auths_model.Requirement.UnsupportedStatusMethod => ok 20#u8 + | auths_model.Requirement.UnsupportedProfile => ok 15#u8 + | auths_model.Requirement.UnsupportedProfilePolicy => ok 16#u8 + | auths_model.Requirement.UnsupportedResourceMatcher => ok 18#u8 + | auths_model.Requirement.UnsupportedBudgetAlgebra => ok 11#u8 + | auths_model.Requirement.UnsupportedCriticalExtension => ok 12#u8 + | auths_model.Requirement.UnsupportedAssuranceClaim => ok 10#u8 + | auths_model.Requirement.MissingPrincipalEvidence => ok 5#u8 + | auths_model.Requirement.MissingPrincipalStatus => ok 6#u8 + | auths_model.Requirement.MissingGrantStatus => ok 4#u8 + | auths_model.Requirement.StaleStatus => ok 9#u8 + | auths_model.Requirement.HistoricalStateUnavailable => ok 3#u8 + | auths_model.Requirement.AssuranceRequirementNotMet => ok 1#u8 + | auths_model.Requirement.ExternalFactUnavailable => ok 2#u8 + | auths_model.Requirement.ObservationMissing => ok 8#u8 + | auths_model.Requirement.ObservationActionFactUnavailable => ok 7#u8 + | auths_model.Requirement.ApprovalUnavailable => ok 0#u8 + +/-- [auths_model::{auths_model::Requirement}::code_precedes]: + Source: 'core/crates/auths-model/src/lib.rs', lines 4993:8-4993:61 + Name pattern: [auths_model::{auths_model::Requirement}::code_precedes] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Requirement}::code_precedes"] +def auths_model.Requirement.code_precedes + (self : auths_model.Requirement) (other : auths_model.Requirement) : + Result Bool + := do + let i ← auths_model.Requirement.code_order self + let i1 ← auths_model.Requirement.code_order other + ok (i < i1) + +/-- [auths_model::{auths_model::DenialReason}::code_order]: + Source: 'core/crates/auths-model/src/lib.rs', lines 4997:8-4997:39 + Name pattern: [auths_model::{auths_model::DenialReason}::code_order] -/ +@[rust_fun "auths_model::{auths_model::DenialReason}::code_order"] +def auths_model.DenialReason.code_order + (self : auths_model.DenialReason) : Result Std.U8 := do + match self with + | auths_model.DenialReason.MalformedProof => ok 22#u8 + | auths_model.DenialReason.NonCanonicalProof => ok 24#u8 + | auths_model.DenialReason.ResourceLimitExceeded => ok 35#u8 + | auths_model.DenialReason.DigestMismatch => ok 16#u8 + | auths_model.DenialReason.DuplicateObject => ok 18#u8 + | auths_model.DenialReason.MissingReference => ok 23#u8 + | auths_model.DenialReason.ReferenceCycle => ok 33#u8 + | auths_model.DenialReason.AmbiguousTerminalGrant => ok 3#u8 + | auths_model.DenialReason.UnusedCriticalEvidence => ok 43#u8 + | auths_model.DenialReason.InvalidSignature => ok 20#u8 + | auths_model.DenialReason.PrincipalMethodMismatch => ok 31#u8 + | auths_model.DenialReason.VerificationMethodMismatch => ok 44#u8 + | auths_model.DenialReason.SignatureSuiteMismatch => ok 37#u8 + | auths_model.DenialReason.UntrustedRoot => ok 41#u8 + | auths_model.DenialReason.BrokenGrantChain => ok 10#u8 + | auths_model.DenialReason.DelegationExpanded => ok 15#u8 + | auths_model.DenialReason.PermissionNotGranted => ok 29#u8 + | auths_model.DenialReason.ActionConstraintMismatch => ok 1#u8 + | auths_model.DenialReason.BudgetCeilingExceeded => ok 11#u8 + | auths_model.DenialReason.AuthorizationPlanInvalid => ok 9#u8 + | auths_model.DenialReason.CompositionRequirementNotMet => ok 13#u8 + | auths_model.DenialReason.PlanActionMismatch => ok 30#u8 + | auths_model.DenialReason.ActionBodyMismatch => ok 0#u8 + | auths_model.DenialReason.AudienceMismatch => ok 8#u8 + | auths_model.DenialReason.ChallengeMismatch => ok 12#u8 + | auths_model.DenialReason.ActionOutsideValidity => ok 2#u8 + | auths_model.DenialReason.PrincipalRevoked => ok 32#u8 + | auths_model.DenialReason.GrantRevoked => ok 19#u8 + | auths_model.DenialReason.StatusSequenceRollback => ok 40#u8 + | auths_model.DenialReason.StatusMethodMismatch => ok 39#u8 + | auths_model.DenialReason.StatusIssuerUntrusted => ok 38#u8 + | auths_model.DenialReason.RegistryManifestMismatch => ok 34#u8 + | auths_model.DenialReason.VerifierConfigurationMismatch => ok 45#u8 + | auths_model.DenialReason.ResourceNamespaceMismatch => ok 36#u8 + | auths_model.DenialReason.CriticalExtensionUnknown => ok 14#u8 + | auths_model.DenialReason.AttachmentMissing => ok 7#u8 + | auths_model.DenialReason.AttachmentDigestMismatch => ok 5#u8 + | auths_model.DenialReason.AttachmentLengthMismatch => ok 6#u8 + | auths_model.DenialReason.DuplicateAttachment => ok 17#u8 + | auths_model.DenialReason.UnusedCriticalAttachment => ok 42#u8 + | auths_model.DenialReason.OpaqueAttachmentNotAllowed => ok 28#u8 + | auths_model.DenialReason.LocalPolicyDenied => ok 21#u8 + | auths_model.DenialReason.ObservationConditionFalse => ok 25#u8 + | auths_model.DenialReason.ObserverInAuthorityChain => ok 27#u8 + | auths_model.DenialReason.ObservationRequirementDropped => ok 26#u8 + | auths_model.DenialReason.ApprovalThresholdNotMet => ok 4#u8 + +/-- [auths_model::{auths_model::DenialReason}::code_precedes]: + Source: 'core/crates/auths-model/src/lib.rs', lines 4993:8-4993:61 + Name pattern: [auths_model::{auths_model::DenialReason}::code_precedes] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::DenialReason}::code_precedes"] +def auths_model.DenialReason.code_precedes + (self : auths_model.DenialReason) (other : auths_model.DenialReason) : + Result Bool + := do + let i ← auths_model.DenialReason.code_order self + let i1 ← auths_model.DenialReason.code_order other + ok (i < i1) + +/-- [auths_composition::{auths_composition::EvaluationEvent}::outcome]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 54:4-58:5 + Visibility: public -/ +def EvaluationEvent.outcome + (self : EvaluationEvent) : Result BranchOutcome := do + match self with + | EvaluationEvent.Proof _ outcome => ok outcome + | EvaluationEvent.Aggregate _ _ _ _ outcome => ok outcome + +/-- [auths_composition::evaluate_threshold_counts]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 65:0-71:1 + Visibility: public -/ +def evaluate_threshold_counts + (k : Std.U16) (authorized : Std.Usize) (indeterminate : Std.Usize) : + Result auths_algebra_kernel.generated.Truth + := do + auths_algebra_kernel.generated.threshold_counts k authorized indeterminate + +/-- [auths_composition::summary::threshold]: + Source: 'core/crates/auths-composition/src/summary.rs', lines 50:0-62:1 -/ +def summary.threshold + (state : summary.Summary) (required : Std.U16) : Result BranchOutcome := do + let t ← + evaluate_threshold_counts required state.authorized state.indeterminate + match t with + | auths_algebra_kernel.generated.Truth.Denied => + match state.denial with + | none => + ok (BranchOutcome.Denied + auths_model.DenialReason.AuthorizationPlanInvalid) + | some reason => ok (BranchOutcome.Denied reason) + | auths_algebra_kernel.generated.Truth.Indeterminate => + match state.requirement with + | none => + ok (BranchOutcome.Indeterminate + auths_model.Requirement.ExternalFactUnavailable) + | some requirement => ok (BranchOutcome.Indeterminate requirement) + | auths_algebra_kernel.generated.Truth.Authorized => + ok BranchOutcome.Authorized + +/-- [auths_composition::summary::all]: + Source: 'core/crates/auths-composition/src/summary.rs', lines 40:0-48:1 -/ +def summary.all (state : summary.Summary) : Result BranchOutcome := do + match state.denial with + | none => + match state.requirement with + | none => ok BranchOutcome.Authorized + | some requirement => ok (BranchOutcome.Indeterminate requirement) + | some reason => ok (BranchOutcome.Denied reason) + +/-- [auths_composition::summary::push]: + Source: 'core/crates/auths-composition/src/summary.rs', lines 13:0-38:1 -/ +def summary.push + (state : summary.Summary) (outcome : BranchOutcome) : + Result summary.Summary + := do + match outcome with + | BranchOutcome.Authorized => + let i ← state.authorized + 1#usize + ok { state with authorized := i } + | BranchOutcome.Denied reason => + match state.denial with + | none => ok { state with denial := (some reason) } + | some current => + let b ← auths_model.DenialReason.code_precedes reason current + if b + then ok { state with denial := (some reason) } + else ok state + | BranchOutcome.Indeterminate requirement => + let i ← state.indeterminate + 1#usize + match state.requirement with + | none => + ok { state with indeterminate := i, requirement := (some requirement) } + | some current => + let b ← auths_model.Requirement.code_precedes requirement current + if b + then + ok { state with indeterminate := i, requirement := (some requirement) } + else ok { state with indeterminate := i } + | BranchOutcome.StructurallyInvalid reason => + match state.denial with + | none => ok { state with denial := (some reason) } + | some current => + let b ← auths_model.DenialReason.code_precedes reason current + if b + then ok { state with denial := (some reason) } + else ok state + +/-- [auths_composition::summary::{impl core::default::Default for auths_composition::summary::Summary}::default]: + Source: 'core/crates/auths-composition/src/summary.rs', lines 5:29-5:36 + Visibility: public -/ +def summary.Summary.Insts.CoreDefaultDefault.default + : Result summary.Summary := do + let o ← + core.option.Option.Insts.CoreDefaultDefault.default + auths_model.DenialReason + let o1 ← + core.option.Option.Insts.CoreDefaultDefault.default auths_model.Requirement + ok + { + authorized := (core.default.DefaultUsize.default), + indeterminate := (core.default.DefaultUsize.default), + denial := o, + requirement := o1 + } + +/-- [auths_composition::observe_aggregate]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 173:0-189:1 -/ +def observe_aggregate + {T0 : Type} (coreopsfunctionFnMutT0TupleEvaluationEventTupleInst : + core.ops.function.FnMut T0 EvaluationEvent Unit) (observer : T0) + (child_count : Std.Usize) (required : Std.U16) (authorized : Std.Usize) + (indeterminate : Std.Usize) (outcome : BranchOutcome) : + Result (BranchOutcome × T0) + := do + let (_, observer1) ← + coreopsfunctionFnMutT0TupleEvaluationEventTupleInst.call_mut observer + (EvaluationEvent.Aggregate child_count required authorized indeterminate + outcome) + ok (outcome, observer1) + +mutual + +/-- [auths_composition::evaluate_members]: loop 0: + Source: 'core/crates/auths-composition/src/lib.rs', lines 119:4-122:5 -/ +@[rust_loop] +def evaluate_members_loop + {T0 : Type} {T1 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + : core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (coreopsfunctionFnMutT1TupleEvaluationEventTupleInst : + core.ops.function.FnMut T1 EvaluationEvent Unit) + (members : Slice auths_model.AuthorizationPlan) (branch : T0) (observer : T1) + (state : summary.Summary) (index : Std.Usize) : + Result (summary.Summary × T0 × T1) + := do + let i := Slice.len members + if index < i + then + let ap ← Slice.index_usize members index + let (bo, branch1, observer1) ← + evaluate_node coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst ap branch observer + let state1 ← summary.push state bo + let index1 ← index + 1#usize + evaluate_members_loop coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst members branch1 + observer1 state1 index1 + else ok (state, branch, observer) +partial_fixpoint + +/-- [auths_composition::evaluate_members]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 112:0-124:1 -/ +def evaluate_members + {T0 : Type} {T1 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + : core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (coreopsfunctionFnMutT1TupleEvaluationEventTupleInst : + core.ops.function.FnMut T1 EvaluationEvent Unit) + (members : Slice auths_model.AuthorizationPlan) (branch : T0) (observer : T1) + : + Result (summary.Summary × T0 × T1) + := do + let state ← summary.Summary.Insts.CoreDefaultDefault.default + evaluate_members_loop coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst members branch observer + state 0#usize +partial_fixpoint + +/-- [auths_composition::evaluate_node]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 126:0-171:1 -/ +def evaluate_node + {T0 : Type} {T1 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + : core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (coreopsfunctionFnMutT1TupleEvaluationEventTupleInst : + core.ops.function.FnMut T1 EvaluationEvent Unit) + (plan : auths_model.AuthorizationPlan) (branch : T0) (observer : T1) : + Result (BranchOutcome × T0 × T1) + := do + let apr ← auths_model.AuthorizationPlan.as_ref plan + match apr with + | auths_model.AuthorizationPlanRef.Proof reference => + let (outcome, branch1) ← + coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst.call_mut branch + reference + let (_, observer1) ← + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst.call_mut observer + (EvaluationEvent.Proof reference outcome) + ok (outcome, branch1, observer1) + | auths_model.AuthorizationPlanRef.AllOf members => + let (state, branch1, observer1) ← + evaluate_members coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst members branch + observer + let i := Slice.len members + let i1 := Slice.len members + let r ← U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i1 + let i2 ← core.result.Result.unwrap_or r core.num.U16.MAX + let bo ← summary.all state + let (outcome, observer2) ← + observe_aggregate coreopsfunctionFnMutT1TupleEvaluationEventTupleInst + observer1 i i2 state.authorized state.indeterminate bo + ok (outcome, branch1, observer2) + | auths_model.AuthorizationPlanRef.AnyOf members => + let (state, branch1, observer1) ← + evaluate_members coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst members branch + observer + let i := Slice.len members + let bo ← summary.threshold state 1#u16 + let (outcome, observer2) ← + observe_aggregate coreopsfunctionFnMutT1TupleEvaluationEventTupleInst + observer1 i 1#u16 state.authorized state.indeterminate bo + ok (outcome, branch1, observer2) + | auths_model.AuthorizationPlanRef.KOfN k members => + let (state, branch1, observer1) ← + evaluate_members coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst members branch + observer + let i := Slice.len members + let bo ← summary.threshold state k + let (outcome, observer2) ← + observe_aggregate coreopsfunctionFnMutT1TupleEvaluationEventTupleInst + observer1 i k state.authorized state.indeterminate bo + ok (outcome, branch1, observer2) +partial_fixpoint + +end + +/-- [auths_composition::evaluate_observed]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 99:0-110:1 + Visibility: public -/ +def evaluate_observed + {T0 : Type} {T1 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + : core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (coreopsfunctionFnMutT1TupleEvaluationEventTupleInst : + core.ops.function.FnMut T1 EvaluationEvent Unit) + (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (branch : T0) (observer : T1) : + Result ((core.result.Result BranchOutcome auths_model.DenialReason) × T0 × + T1) + := do + let r ← auths_model.AuthorizationPlan.validate plan limits + match r with + | core.result.Result.Ok _ => + let (bo, branch1, observer1) ← + evaluate_node coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + coreopsfunctionFnMutT1TupleEvaluationEventTupleInst plan branch + observer + ok (core.result.Result.Ok bo, branch1, observer1) + | core.result.Result.Err _ => + ok (core.result.Result.Err + auths_model.DenialReason.AuthorizationPlanInvalid, branch, observer) + +/-- [auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 84:49-84:55 -/ +def + evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut + {T0 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst : + core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (c : evaluate.closure T0) (tupled_args : EvaluationEvent) : + Result (evaluate.closure T0) + := do + ok c + +/-- [auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_once]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 84:49-84:55 -/ +def + evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple.call_once + {T0 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst : + core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (c : evaluate.closure T0) (ee : EvaluationEvent) : + Result Unit + := do + let _ ← + evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut + coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst c ee + ok () + +/-- Trait implementation: [auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}] + Source: 'core/crates/auths-composition/src/lib.rs', lines 84:49-84:55 -/ +@[reducible] +def evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple {T0 : + Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst : + core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) : + core.ops.function.FnOnce (evaluate.closure T0) EvaluationEvent Unit := { + call_once := + evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple.call_once + coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst +} + +/-- Trait implementation: [auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}] + Source: 'core/crates/auths-composition/src/lib.rs', lines 84:49-84:55 -/ +@[reducible] +def evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple {T0 : + Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst : + core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) : + core.ops.function.FnMut (evaluate.closure T0) EvaluationEvent Unit := { + FnOnceInst := + evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple + coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + call_mut := fun state event => Auths.Support.UnitCallback.restore ( + evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut + coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst state event) +} + +/-- [auths_composition::evaluate]: + Source: 'core/crates/auths-composition/src/lib.rs', lines 79:0-85:1 + Visibility: public -/ +def evaluate + {T0 : Type} (coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst : + core.ops.function.FnMut T0 auths_model.ProofRef BranchOutcome) + (plan : auths_model.AuthorizationPlan) (limits : auths_model.VerifierLimits) + (branch : T0) : + Result ((core.result.Result BranchOutcome auths_model.DenialReason) × T0) + := do + let (r, branch1, _) ← + evaluate_observed coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst + (evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple + coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst) plan limits branch + () + ok (r, branch1) + +end auths_composition diff --git a/formal/qualification/aeneas/generated/composition/FunsExternal.lean b/formal/qualification/aeneas/generated/composition/FunsExternal.lean new file mode 100644 index 000000000..50c625495 --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/FunsExternal.lean @@ -0,0 +1,72 @@ +-- REVIEWED: exact standard-container links and the pinned Rust Ord::max rule. +-- Ordered-set models are scoped to Global + copied ProofRef values and their +-- proved lawful order. They model set behavior, not Rust allocation or tree cost. +import qualification.aeneas.generated.composition.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result + +namespace auths_composition.alloc.vec + +def Vec.with_capacity (T : Type) (capacity : Std.Usize) : Vec T := + Vec.ofBase (Aeneas.Std.alloc.vec.Vec.with_capacity T capacity) + +def Vec.len {T : Type} (value : Vec T) : Std.Usize := + Aeneas.Std.alloc.vec.Vec.len value.toBase + +def Vec.push {T : Type} (value : Vec T) (element : T) : Result (Vec T) := do + let updated ← Aeneas.Std.alloc.vec.Vec.push value.toBase element + ok (Vec.ofBase updated) + +def Vec.is_empty {T : Type} (_A : Type) (value : Vec T) : Result Bool := + ok value.elements.toList.isEmpty + +end auths_composition.alloc.vec + +@[trait_default] def auths_composition.core.cmp.Ord.max.default {T : Type} + (order : Aeneas.Std.core.cmp.Ord T) (left right : T) : Result T := do + let greater ← order.partialOrdInst.lt right left + if greater then ok left else ok right + +def core.option.Option.Insts.CoreDefaultDefault.default (T : Type) : Result (Option T) := ok none + +namespace alloc.collections.btree.set + +def insertValues {T : Type} (order : core.cmp.Ord T) (value : T) : + List T → Result (Bool × List T) + | [] => ok (true, [value]) + | head :: tail => do + let comparison ← order.cmp value head + match comparison with + | .lt => ok (true, value :: head :: tail) + | .eq => ok (false, head :: tail) + | .gt => + let (added, remaining) ← insertValues order value tail + ok (added, head :: remaining) + +def BTreeSetTGlobal.new (T : Type) : Result (BTreeSet T Global) := + ok ⟨[], by simp⟩ + +def BTreeSet.insert {T A : Type} (_allocator : core.clone.Clone A) (order : core.cmp.Ord T) + (state : BTreeSet T A) (value : T) : Result (Bool × BTreeSet T A) := do + let (added, values) ← insertValues order value state.values + (if bound : values.length ≤ Usize.max then + ok (added, ⟨values, bound⟩) + else + fail .maximumSizeExceeded) + +def BTreeSet.len {T A : Type} (_allocator : core.clone.Clone A) + (state : BTreeSet T A) : Result Std.Usize := + ok (Usize.ofNatCore state.values.length (by have bound := state.bound; scalar_tac)) + +def BTreeSet.Insts.CoreIterTraitsCollectIntoIteratorTIntoIter.into_iter + {T A : Type} (_allocator : core.clone.Clone A) (state : BTreeSet T A) : + Result (IntoIter T A) := ok ⟨state.values, state.bound⟩ + +def IntoIter.Insts.CoreIterTraitsIteratorIterator.next + {T A : Type} (_allocator : core.clone.Clone A) (state : IntoIter T A) : + Result (Option T × IntoIter T A) := + match same : state.values with + | [] => ok (none, state) + | head :: tail => ok (some head, ⟨tail, by have bound := state.bound; rw [same] at bound; simp only [List.length_cons] at bound; omega⟩) + +end alloc.collections.btree.set diff --git a/formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean new file mode 100644 index 000000000..a6f241679 --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean @@ -0,0 +1,117 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_composition]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.composition.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open auths_composition + +/-- [core::array::{impl core::cmp::Ord for [T; N]}::cmp]: + Source: '/rustc/library/core/src/array/mod.rs', lines 438:4-438:45 + Name pattern: [core::array::{core::cmp::Ord<[@T; @N]>}::cmp] + Visibility: public -/ +@[rust_fun "core::array::{core::cmp::Ord<[@T; @N]>}::cmp"] +axiom Array.Insts.CoreCmpOrd.cmp + {T : Type} {N : Std.Usize} (cmpOrdInst : core.cmp.Ord T) : + Array T N → Array T N → Result Ordering + +/-- [core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 300:12-300:64 + Name pattern: [core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from"] +axiom U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + : + Std.Usize → Result (core.result.Result Std.U16 + core.num.error.TryFromIntError) + +/-- [core::option::{impl core::default::Default for core::option::Option}::default]: + Source: '/rustc/library/core/src/option.rs', lines 2313:4-2313:29 + Name pattern: [core::option::{core::default::Default>}::default] + Visibility: public -/ +@[rust_fun + "core::option::{core::default::Default>}::default"] +axiom core.option.Option.Insts.CoreDefaultDefault.default + (T : Type) : Result (Option T) + +/-- [core::result::{core::result::Result}::unwrap_or]: + Source: '/rustc/library/core/src/result.rs', lines 1590:4-1593:28 + Name pattern: [core::result::{core::result::Result<@T, @E>}::unwrap_or] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::unwrap_or"] +axiom core.result.Result.unwrap_or + {T : Type} {E : Type} : core.result.Result T E → T → Result T + +/-- [alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::new]: + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 344:4-344:37 + Name pattern: [alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet<@T, alloc::alloc::Global>}::new] + Visibility: public -/ +@[rust_fun + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet<@T, alloc::alloc::Global>}::new"] +axiom alloc.collections.btree.set.BTreeSetTGlobal.new + (T : Type) : Result (alloc.collections.btree.set.BTreeSet T Global) + +/-- [alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::insert]: + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 900:4-902:15 + Name pattern: [alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet<@T, @A>}::insert] + Visibility: public -/ +@[rust_fun + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet<@T, @A>}::insert"] +axiom alloc.collections.btree.set.BTreeSet.insert + {T : Type} {A : Type} (corecloneCloneInst : core.clone.Clone A) + (corecmpOrdInst : core.cmp.Ord T) : + alloc.collections.btree.set.BTreeSet T A → T → Result (Bool × + (alloc.collections.btree.set.BTreeSet T A)) + +/-- [alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::len]: + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 1269:4-1269:36 + Name pattern: [alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet<@T, @A>}::len] + Visibility: public -/ +@[rust_fun + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet<@T, @A>}::len"] +axiom alloc.collections.btree.set.BTreeSet.len + {T : Type} {A : Type} (corecloneCloneInst : core.clone.Clone A) : + alloc.collections.btree.set.BTreeSet T A → Result Std.Usize + +/-- [alloc::collections::btree::set::{impl core::iter::traits::collect::IntoIterator> for alloc::collections::btree::set::BTreeSet}::into_iter]: + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 1536:4-1536:40 + Name pattern: [alloc::collections::btree::set::{core::iter::traits::collect::IntoIterator, @T, alloc::collections::btree::set::IntoIter<@T, @A>>}::into_iter] + Visibility: public -/ +@[rust_fun + "alloc::collections::btree::set::{core::iter::traits::collect::IntoIterator, @T, alloc::collections::btree::set::IntoIter<@T, @A>>}::into_iter"] +axiom + alloc.collections.btree.set.BTreeSet.Insts.CoreIterTraitsCollectIntoIteratorTIntoIter.into_iter + {T : Type} {A : Type} (corecloneCloneInst : core.clone.Clone A) : + alloc.collections.btree.set.BTreeSet T A → Result + (alloc.collections.btree.set.IntoIter T A) + +/-- [alloc::collections::btree::set::{impl core::iter::traits::iterator::Iterator for alloc::collections::btree::set::IntoIter}::next]: + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 1816:4-1816:35 + Name pattern: [alloc::collections::btree::set::{core::iter::traits::iterator::Iterator, @T>}::next] + Visibility: public -/ +@[rust_fun + "alloc::collections::btree::set::{core::iter::traits::iterator::Iterator, @T>}::next"] +axiom + alloc.collections.btree.set.IntoIter.Insts.CoreIterTraitsIteratorIterator.next + {T : Type} {A : Type} (corecloneCloneInst : core.clone.Clone A) : + alloc.collections.btree.set.IntoIter T A → Result ((Option T) × + (alloc.collections.btree.set.IntoIter T A)) + +/-- [alloc::vec::{alloc::vec::Vec}::is_empty]: + Source: '/rustc/library/alloc/src/vec/mod.rs', lines 3085:4-3085:40 + Name pattern: [alloc::vec::{alloc::vec::Vec<@T>}::is_empty] + Visibility: public -/ +@[rust_fun "alloc::vec::{alloc::vec::Vec<@T>}::is_empty"] +axiom alloc.vec.Vec.is_empty + {T : Type} (A : Type) : alloc.vec.Vec T → Result Bool + diff --git a/formal/qualification/aeneas/generated/composition/Types.lean b/formal/qualification/aeneas/generated/composition/Types.lean new file mode 100644 index 000000000..209a4cbdf --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/Types.lean @@ -0,0 +1,312 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_composition]: type definitions +import Aeneas +import Auths.Support.Discriminant +import Auths.Support.PositiveVec +import qualification.aeneas.generated.composition.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace auths_composition + +/-- [auths_algebra_kernel::generated::Truth] + Source: 'core/crates/auths-algebra-kernel/src/generated.rs', lines 11:0-11:14 + Name pattern: [auths_algebra_kernel::generated::Truth] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_algebra_kernel::generated::Truth"] +inductive auths_algebra_kernel.generated.Truth where +| Denied : auths_algebra_kernel.generated.Truth +| Indeterminate : auths_algebra_kernel.generated.Truth +| Authorized : auths_algebra_kernel.generated.Truth + +/-- [auths_model::Digest] + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:17 + Name pattern: [auths_model::Digest] + Visibility: public -/ +@[reducible, rust_type "auths_model::Digest"] +def auths_model.Digest := Array Std.U8 32#usize + +/-- [auths_model::ProofRef] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::ProofRef] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProofRef"] +def auths_model.ProofRef := auths_model.Digest + +mutual + +/-- [auths_model::AuthorizationPlan] + Source: 'core/crates/auths-model/src/lib.rs', lines 1760:0-1760:28 + Name pattern: [auths_model::AuthorizationPlan] + Visibility: public -/ +@[rust_type "auths_model::AuthorizationPlan"] +inductive auths_model.AuthorizationPlan where +| mk : auths_model.AuthorizationPlanNode → auths_model.AuthorizationPlan + +/-- [auths_model::AuthorizationPlanNode] + Source: 'core/crates/auths-model/src/lib.rs', lines 1763:0-1763:26 + Name pattern: [auths_model::AuthorizationPlanNode] -/ +@[qualified_discriminant isize, rust_type "auths_model::AuthorizationPlanNode"] +inductive auths_model.AuthorizationPlanNode where +| Proof : auths_model.ProofRef → auths_model.AuthorizationPlanNode +| AllOf : + alloc.vec.Vec auths_model.AuthorizationPlan → + auths_model.AuthorizationPlanNode +| AnyOf : + alloc.vec.Vec auths_model.AuthorizationPlan → + auths_model.AuthorizationPlanNode +| KOfN : + Std.U16 → + alloc.vec.Vec auths_model.AuthorizationPlan → + auths_model.AuthorizationPlanNode + +end + +def auths_model.AuthorizationPlan._0 (x : auths_model.AuthorizationPlan) := + match x with | auths_model.AuthorizationPlan.mk x1 => x1 + +@[simp] +theorem auths_model.AuthorizationPlan._0._simpLemma_ (_0 : + auths_model.AuthorizationPlanNode) : + (auths_model.AuthorizationPlan.mk _0)._0 = _0 := by rfl + +/-- [auths_model::AuthorizationPlanRef] + Source: 'core/crates/auths-model/src/lib.rs', lines 1775:0-1775:33 + Name pattern: [auths_model::AuthorizationPlanRef] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::AuthorizationPlanRef"] +inductive auths_model.AuthorizationPlanRef where +| Proof : auths_model.ProofRef → auths_model.AuthorizationPlanRef +| AllOf : + Slice auths_model.AuthorizationPlan → + auths_model.AuthorizationPlanRef +| AnyOf : + Slice auths_model.AuthorizationPlan → + auths_model.AuthorizationPlanRef +| KOfN : + Std.U16 → + Slice auths_model.AuthorizationPlan → + auths_model.AuthorizationPlanRef + +/-- [auths_model::ModelError] + Source: 'core/crates/auths-model/src/lib.rs', lines 5194:0-5194:19 + Name pattern: [auths_model::ModelError] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::ModelError"] +inductive auths_model.ModelError where +| UnsupportedProtocol : auths_model.ModelError +| InvalidBundleHeader : auths_model.ModelError +| InvalidPrincipal : auths_model.ModelError +| InvalidVerificationMethod : auths_model.ModelError +| InvalidProfile : auths_model.ModelError +| InvalidCapability : auths_model.ModelError +| InvalidResource : auths_model.ModelError +| InvalidAudience : auths_model.ModelError +| InvalidAudienceSet : auths_model.ModelError +| DuplicateAudience : auths_model.ModelError +| InvalidMediaType : auths_model.ModelError +| InvalidRegistryId : auths_model.ModelError +| InvalidExtensionId : auths_model.ModelError +| InvalidValidity : auths_model.ModelError +| InvalidPermissionSet : auths_model.ModelError +| DuplicatePermission : auths_model.ModelError +| InvalidActionConstraint : auths_model.ModelError +| DuplicateBodyDigest : auths_model.ModelError +| InvalidCanonicalAction : auths_model.ModelError +| InvalidExtension : auths_model.ModelError +| DuplicateExtension : auths_model.ModelError +| InvalidSignature : auths_model.ModelError +| InvalidEvidence : auths_model.ModelError +| InvalidEvidenceBinding : auths_model.ModelError +| InvalidStatus : auths_model.ModelError +| InvalidStatusSnapshot : auths_model.ModelError +| InvalidAttachment : auths_model.ModelError +| InvalidPlan : auths_model.ModelError +| PlanLimitExceeded : auths_model.ModelError +| InvalidAssurance : auths_model.ModelError +| InvalidTrustAnchor : auths_model.ModelError +| InvalidRegistrySelection : auths_model.ModelError +| InvalidVerifierContext : auths_model.ModelError +| DuplicateObject : auths_model.ModelError +| CollectionLimitExceeded : auths_model.ModelError +| InvalidObservation : auths_model.ModelError +| InvalidObservationRequirement : auths_model.ModelError +| InvalidObserverAnchor : auths_model.ModelError +| InvalidBoundedPolicy : auths_model.ModelError +| InvalidApproval : auths_model.ModelError +| InvalidApprovalRequirement : auths_model.ModelError +| InvalidApproverAnchor : auths_model.ModelError + +/-- [auths_model::VerifierLimits] + Source: 'core/crates/auths-model/src/lib.rs', lines 3612:0-3612:25 + Name pattern: [auths_model::VerifierLimits] + Visibility: public -/ +@[rust_type "auths_model::VerifierLimits"] +structure auths_model.VerifierLimits where + bundle_bytes : Std.Usize + action_bytes : Std.Usize + context_bytes : Std.Usize + grants : Std.Usize + actions : Std.Usize + plan_leaves : Std.Usize + plan_depth : Std.Usize + plan_branching : Std.Usize + evidence : Std.Usize + evidence_bytes : Std.Usize + bindings : Std.Usize + principal_status : Std.Usize + grant_status : Std.Usize + attachments : Std.Usize + attachment_bytes : Std.Usize + signatures : Std.Usize + signature_bytes : Std.Usize + permissions : Std.Usize + audiences : Std.Usize + extensions : Std.Usize + extension_bytes : Std.Usize + body_digests : Std.Usize + binding_evidence : Std.Usize + canonical_body_bytes : Std.Usize + registry_entries : Std.Usize + trust_anchors : Std.Usize + work_units : Std.U64 + approvals : Std.Usize + approver_anchors : Std.Usize + approval_requirements : Std.Usize + +/-- [auths_model::PlanShape] + Source: 'core/crates/auths-model/src/lib.rs', lines 1949:0-1949:20 + Name pattern: [auths_model::PlanShape] + Visibility: public -/ +@[rust_type "auths_model::PlanShape"] +structure auths_model.PlanShape where + leaves : alloc.vec.Vec auths_model.ProofRef + maximum_depth : Std.Usize + +/-- [auths_model::DenialReason] + Source: 'core/crates/auths-model/src/lib.rs', lines 4928:0-4928:21 + Name pattern: [auths_model::DenialReason] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::DenialReason"] +inductive auths_model.DenialReason where +| MalformedProof : auths_model.DenialReason +| NonCanonicalProof : auths_model.DenialReason +| ResourceLimitExceeded : auths_model.DenialReason +| DigestMismatch : auths_model.DenialReason +| DuplicateObject : auths_model.DenialReason +| MissingReference : auths_model.DenialReason +| ReferenceCycle : auths_model.DenialReason +| AmbiguousTerminalGrant : auths_model.DenialReason +| UnusedCriticalEvidence : auths_model.DenialReason +| InvalidSignature : auths_model.DenialReason +| PrincipalMethodMismatch : auths_model.DenialReason +| VerificationMethodMismatch : auths_model.DenialReason +| SignatureSuiteMismatch : auths_model.DenialReason +| UntrustedRoot : auths_model.DenialReason +| BrokenGrantChain : auths_model.DenialReason +| DelegationExpanded : auths_model.DenialReason +| PermissionNotGranted : auths_model.DenialReason +| ActionConstraintMismatch : auths_model.DenialReason +| BudgetCeilingExceeded : auths_model.DenialReason +| AuthorizationPlanInvalid : auths_model.DenialReason +| CompositionRequirementNotMet : auths_model.DenialReason +| PlanActionMismatch : auths_model.DenialReason +| ActionBodyMismatch : auths_model.DenialReason +| AudienceMismatch : auths_model.DenialReason +| ChallengeMismatch : auths_model.DenialReason +| ActionOutsideValidity : auths_model.DenialReason +| PrincipalRevoked : auths_model.DenialReason +| GrantRevoked : auths_model.DenialReason +| StatusSequenceRollback : auths_model.DenialReason +| StatusMethodMismatch : auths_model.DenialReason +| StatusIssuerUntrusted : auths_model.DenialReason +| RegistryManifestMismatch : auths_model.DenialReason +| VerifierConfigurationMismatch : auths_model.DenialReason +| ResourceNamespaceMismatch : auths_model.DenialReason +| CriticalExtensionUnknown : auths_model.DenialReason +| AttachmentMissing : auths_model.DenialReason +| AttachmentDigestMismatch : auths_model.DenialReason +| AttachmentLengthMismatch : auths_model.DenialReason +| DuplicateAttachment : auths_model.DenialReason +| UnusedCriticalAttachment : auths_model.DenialReason +| OpaqueAttachmentNotAllowed : auths_model.DenialReason +| LocalPolicyDenied : auths_model.DenialReason +| ObservationConditionFalse : auths_model.DenialReason +| ObserverInAuthorityChain : auths_model.DenialReason +| ObservationRequirementDropped : auths_model.DenialReason +| ApprovalThresholdNotMet : auths_model.DenialReason + +/-- [auths_model::Requirement] + Source: 'core/crates/auths-model/src/lib.rs', lines 5113:0-5113:20 + Name pattern: [auths_model::Requirement] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::Requirement"] +inductive auths_model.Requirement where +| UnsupportedProtocol : auths_model.Requirement +| UnsupportedPrincipalMethod : auths_model.Requirement +| UnsupportedSignatureSuite : auths_model.Requirement +| UnsupportedEvidenceType : auths_model.Requirement +| UnsupportedStatusMethod : auths_model.Requirement +| UnsupportedProfile : auths_model.Requirement +| UnsupportedProfilePolicy : auths_model.Requirement +| UnsupportedResourceMatcher : auths_model.Requirement +| UnsupportedBudgetAlgebra : auths_model.Requirement +| UnsupportedCriticalExtension : auths_model.Requirement +| UnsupportedAssuranceClaim : auths_model.Requirement +| MissingPrincipalEvidence : auths_model.Requirement +| MissingPrincipalStatus : auths_model.Requirement +| MissingGrantStatus : auths_model.Requirement +| StaleStatus : auths_model.Requirement +| HistoricalStateUnavailable : auths_model.Requirement +| AssuranceRequirementNotMet : auths_model.Requirement +| ExternalFactUnavailable : auths_model.Requirement +| ObservationMissing : auths_model.Requirement +| ObservationActionFactUnavailable : auths_model.Requirement +| ApprovalUnavailable : auths_model.Requirement + +/-- [auths_composition::BranchOutcome] + Source: 'core/crates/auths-composition/src/lib.rs', lines 22:0-31:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive BranchOutcome where +| Authorized : BranchOutcome +| Denied : auths_model.DenialReason → BranchOutcome +| Indeterminate : auths_model.Requirement → BranchOutcome +| StructurallyInvalid : auths_model.DenialReason → BranchOutcome + +/-- [auths_composition::EvaluationEvent] + Source: 'core/crates/auths-composition/src/lib.rs', lines 35:0-49:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive EvaluationEvent where +| Proof : auths_model.ProofRef → BranchOutcome → EvaluationEvent +| Aggregate : + Std.Usize → + Std.U16 → + Std.Usize → + Std.Usize → + BranchOutcome → + EvaluationEvent + +/-- [auths_composition::summary::Summary] + Source: 'core/crates/auths-composition/src/summary.rs', lines 6:0-11:1 -/ +structure summary.Summary where + authorized : Std.Usize + indeterminate : Std.Usize + denial : Option auths_model.DenialReason + requirement : Option auths_model.Requirement + +/-- [auths_composition::evaluate::closure] + Source: 'core/crates/auths-composition/src/lib.rs', lines 84:49-84:55 -/ +@[reducible] +def evaluate.closure (T0 : Type) := Unit + +end auths_composition diff --git a/formal/qualification/aeneas/generated/composition/TypesExternal.lean b/formal/qualification/aeneas/generated/composition/TypesExternal.lean new file mode 100644 index 000000000..d78a7c961 --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/TypesExternal.lean @@ -0,0 +1,14 @@ +-- REVIEWED: bounded ordered-set and consuming-iterator carriers. +-- Only Global allocation and the translated fixed-width ProofRef order are used. +import Aeneas +import Auths.Support.Discriminant +import Auths.Support.PositiveVec +open Aeneas Aeneas.Std +namespace alloc.collections.btree.set +structure BTreeSet (T A : Type) where + values : List T + bound : values.length ≤ Usize.max +structure IntoIter (T A : Type) where + values : List T + bound : values.length ≤ Usize.max +end alloc.collections.btree.set diff --git a/formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean new file mode 100644 index 000000000..960245736 --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean @@ -0,0 +1,29 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_composition]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [alloc::collections::btree::set::BTreeSet] + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 78:0-81:1 + Name pattern: [alloc::collections::btree::set::BTreeSet] + Visibility: public -/ +@[rust_type "alloc::collections::btree::set::BTreeSet"] +axiom alloc.collections.btree.set.BTreeSet (T : Type) (A : Type) : Type + +/-- [alloc::collections::btree::set::IntoIter] + Source: '/rustc/library/alloc/src/collections/btree/set.rs', lines 154:0-157:1 + Name pattern: [alloc::collections::btree::set::IntoIter] + Visibility: public -/ +@[rust_type "alloc::collections::btree::set::IntoIter"] +axiom alloc.collections.btree.set.IntoIter (T : Type) (A : Type) : Type + diff --git a/formal/qualification/aeneas/generated/composition/translation.json b/formal/qualification/aeneas/generated/composition/translation.json new file mode 100644 index 000000000..1757b8c1a --- /dev/null +++ b/formal/qualification/aeneas/generated/composition/translation.json @@ -0,0 +1,1028 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_composition", + "functions": [ + { + "def_id": 191, + "lean_name": "auths_composition.Array.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "core::array::{impl core::cmp::Ord for [T; N]}::cmp", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/array/mod.rs", + "begin_line": 438, + "end_line": 438 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 22, + "lean_name": "auths_composition.U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 300, + "end_line": 300 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 151, + "lean_name": "auths_composition.core.option.Option.Insts.CoreDefaultDefault.default", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "core::option::{impl core::default::Default for core::option::Option}::default", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 2313, + "end_line": 2313 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 23, + "lean_name": "auths_composition.core.result.Result.unwrap_or", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::unwrap_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 1590, + "end_line": 1593 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 7, + "lean_name": "auths_composition.alloc.collections.btree.set.BTreeSetTGlobal.new", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::new", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 344, + "end_line": 344 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 29, + "lean_name": "auths_composition.alloc.collections.btree.set.BTreeSet.insert", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::insert", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 900, + "end_line": 902 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 10, + "lean_name": "auths_composition.alloc.collections.btree.set.BTreeSet.len", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::len", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 1269, + "end_line": 1269 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 13, + "lean_name": "auths_composition.alloc.collections.btree.set.BTreeSet.Insts.CoreIterTraitsCollectIntoIteratorTIntoIter.into_iter", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::{impl core::iter::traits::collect::IntoIterator> for alloc::collections::btree::set::BTreeSet}::into_iter", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 1536, + "end_line": 1536 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "auths_composition.alloc.collections.btree.set.IntoIter.Insts.CoreIterTraitsIteratorIterator.next", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::{impl core::iter::traits::iterator::Iterator for alloc::collections::btree::set::IntoIter}::next", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 1816, + "end_line": 1816 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 30, + "lean_name": "auths_composition.alloc.vec.Vec.is_empty", + "lean_file": "qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "rust_name": "alloc::vec::{alloc::vec::Vec}::is_empty", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/vec/mod.rs", + "begin_line": 3085, + "end_line": 3085 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 154, + "lean_name": "auths_composition.auths_algebra_kernel.generated.threshold_counts", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_algebra_kernel::generated::threshold_counts", + "is_local": false, + "source": { + "file": "core/crates/auths-algebra-kernel/src/generated.rs", + "begin_line": 157, + "end_line": 157 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 194, + "lean_name": "auths_composition.auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 229, + "end_line": 229 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 168, + "lean_name": "auths_composition.auths_model.Digest.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 229, + "end_line": 229 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 190, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef.eq", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::ProofRef}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 166, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::ProofRef}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 127, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::ProofRef}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 167, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpPartialOrdProofRef.partial_cmp", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::ProofRef}::partial_cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "auths_composition.auths_model.AuthorizationPlan.as_ref", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::AuthorizationPlan}::as_ref", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1861, + "end_line": 1861 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 34, + "lean_name": "auths_composition.auths_model.AuthorizationPlan.validate.walk_members_loop", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1887, + "end_line": 1891 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_composition.auths_model.AuthorizationPlan.validate.walk_members" + }, + { + "def_id": 34, + "lean_name": "auths_composition.auths_model.AuthorizationPlan.validate.walk_members", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1880, + "end_line": 1886 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false + }, + { + "def_id": 8, + "lean_name": "auths_composition.auths_model.AuthorizationPlan.validate.walk", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1893, + "end_line": 1899 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false + }, + { + "def_id": 5, + "lean_name": "auths_composition.auths_model.AuthorizationPlan.validate_loop", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::AuthorizationPlan}::validate", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1938, + "end_line": 1940 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_composition.auths_model.AuthorizationPlan.validate" + }, + { + "def_id": 5, + "lean_name": "auths_composition.auths_model.AuthorizationPlan.validate", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::AuthorizationPlan}::validate", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1879, + "end_line": 1879 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 185, + "lean_name": "auths_composition.auths_model.Requirement.code_order", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::Requirement}::code_order", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4997, + "end_line": 4997 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 152, + "lean_name": "auths_composition.auths_model.Requirement.code_precedes", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::Requirement}::code_precedes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4993, + "end_line": 4993 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 186, + "lean_name": "auths_composition.auths_model.DenialReason.code_order", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::DenialReason}::code_order", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4997, + "end_line": 4997 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 153, + "lean_name": "auths_composition.auths_model.DenialReason.code_precedes", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{auths_model::DenialReason}::code_precedes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4993, + "end_line": 4993 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "auths_composition.EvaluationEvent.outcome", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::{auths_composition::EvaluationEvent}::outcome", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 54, + "end_line": 58 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 120, + "lean_name": "auths_composition.evaluate_threshold_counts", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate_threshold_counts", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 65, + "end_line": 71 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "auths_composition.summary.threshold", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::summary::threshold", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/summary.rs", + "begin_line": 50, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 24, + "lean_name": "auths_composition.summary.all", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::summary::all", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/summary.rs", + "begin_line": 40, + "end_line": 48 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 119, + "lean_name": "auths_composition.summary.push", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::summary::push", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/summary.rs", + "begin_line": 13, + "end_line": 38 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 118, + "lean_name": "auths_composition.summary.Summary.Insts.CoreDefaultDefault.default", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::summary::{impl core::default::Default for auths_composition::summary::Summary}::default", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/summary.rs", + "begin_line": 5, + "end_line": 5 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 21, + "lean_name": "auths_composition.observe_aggregate", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::observe_aggregate", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 173, + "end_line": 189 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 18, + "lean_name": "auths_composition.evaluate_members_loop", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate_members", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 119, + "end_line": 122 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_composition.evaluate_members" + }, + { + "def_id": 18, + "lean_name": "auths_composition.evaluate_members", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate_members", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 112, + "end_line": 124 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "auths_composition.evaluate_node", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate_node", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 126, + "end_line": 171 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "auths_composition.evaluate_observed", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate_observed", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 99, + "end_line": 110 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 84, + "end_line": 84 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple.call_once", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 84, + "end_line": 84 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "auths_composition.evaluate", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 79, + "end_line": 85 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 17, + "lean_name": "auths_composition.alloc.collections.btree.set.BTreeSet", + "lean_file": "qualification/aeneas/generated/composition/TypesExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::BTreeSet", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 78, + "end_line": 81 + } + }, + { + "def_id": 20, + "lean_name": "auths_composition.alloc.collections.btree.set.IntoIter", + "lean_file": "qualification/aeneas/generated/composition/TypesExternal_Template.lean", + "rust_name": "alloc::collections::btree::set::IntoIter", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/collections/btree/set.rs", + "begin_line": 154, + "end_line": 157 + } + }, + { + "def_id": 55, + "lean_name": "auths_composition.auths_algebra_kernel.generated.Truth", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_algebra_kernel::generated::Truth", + "is_local": false, + "source": { + "file": "core/crates/auths-algebra-kernel/src/generated.rs", + "begin_line": 11, + "end_line": 11 + } + }, + { + "def_id": 9, + "lean_name": "auths_composition.auths_model.Digest", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::Digest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 230, + "end_line": 230 + } + }, + { + "def_id": 1, + "lean_name": "auths_composition.auths_model.ProofRef", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::ProofRef", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 3, + "lean_name": "auths_composition.auths_model.AuthorizationPlan", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::AuthorizationPlan", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1760, + "end_line": 1760 + } + }, + { + "def_id": 12, + "lean_name": "auths_composition.auths_model.AuthorizationPlanNode", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::AuthorizationPlanNode", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1763, + "end_line": 1763 + } + }, + { + "def_id": 22, + "lean_name": "auths_composition.auths_model.AuthorizationPlanRef", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::AuthorizationPlanRef", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1775, + "end_line": 1775 + } + }, + { + "def_id": 14, + "lean_name": "auths_composition.auths_model.ModelError", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::ModelError", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 5194, + "end_line": 5194 + } + }, + { + "def_id": 4, + "lean_name": "auths_composition.auths_model.VerifierLimits", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::VerifierLimits", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3612, + "end_line": 3612 + } + }, + { + "def_id": 13, + "lean_name": "auths_composition.auths_model.PlanShape", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::PlanShape", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1949, + "end_line": 1949 + } + }, + { + "def_id": 6, + "lean_name": "auths_composition.auths_model.DenialReason", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::DenialReason", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4928, + "end_line": 4928 + } + }, + { + "def_id": 11, + "lean_name": "auths_composition.auths_model.Requirement", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_model::Requirement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 5113, + "end_line": 5113 + } + }, + { + "def_id": 2, + "lean_name": "auths_composition.BranchOutcome", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_composition::BranchOutcome", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 22, + "end_line": 31 + } + }, + { + "def_id": 0, + "lean_name": "auths_composition.EvaluationEvent", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_composition::EvaluationEvent", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 35, + "end_line": 49 + } + }, + { + "def_id": 23, + "lean_name": "auths_composition.summary.Summary", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_composition::summary::Summary", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/summary.rs", + "begin_line": 6, + "end_line": 11 + } + }, + { + "def_id": 7, + "lean_name": "auths_composition.evaluate.closure", + "lean_file": "qualification/aeneas/generated/composition/Types.lean", + "rust_name": "auths_composition::evaluate::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 84, + "end_line": 84 + } + } + ], + "globals": [], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 35, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpPartialEqProofRef", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::ProofRef}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 21, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 25, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::ProofRef}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 24, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 26, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpPartialOrdProofRef", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::ProofRef}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 20, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 17, + "lean_name": "auths_composition.auths_model.ProofRef.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::ProofRef}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "impl_trait_def_id": 5, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + }, + { + "def_id": 0, + "lean_name": "auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnOnceTupleEvaluationEventTuple", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 84, + "end_line": 84 + }, + "impl_trait_def_id": 1, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 1, + "lean_name": "auths_composition.evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple", + "lean_file": "qualification/aeneas/generated/composition/Funs.lean", + "rust_name": "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-composition/src/lib.rs", + "begin_line": 84, + "end_line": 84 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::ops::function::FnMut", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/generated/connections/Funs.lean b/formal/qualification/aeneas/generated/connections/Funs.lean index c9880f4e6..9470b6bdb 100644 --- a/formal/qualification/aeneas/generated/connections/Funs.lean +++ b/formal/qualification/aeneas/generated/connections/Funs.lean @@ -2,6 +2,7 @@ -- [auths_connections]: function definitions import Aeneas import qualification.aeneas.generated.connections.Types +import qualification.aeneas.generated.connections.FunsExternal open Aeneas Aeneas.Std Result ControlFlow Error set_option linter.dupNamespace false set_option linter.hashCommand false @@ -13,17 +14,63 @@ set_option maxHeartbeats 1000000 /- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ set_option maxRecDepth 2048 +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + namespace auths_connections +/-- Trait implementation: [alloc::string::{impl core::cmp::PartialEq for alloc::string::String}] + Source: '/rustc/library/alloc/src/string.rs', lines 350:9-350:18 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +def alloc.string.String.Insts.CoreCmpPartialEqString : core.cmp.PartialEq + String String := { + eq := alloc.string.String.Insts.CoreCmpPartialEqString.eq +} + +/-- Trait implementation: [alloc::string::{impl core::cmp::PartialOrd for alloc::string::String}] + Source: '/rustc/library/alloc/src/string.rs', lines 350:20-350:30 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +impl_def alloc.string.String.Insts.CoreCmpPartialOrdString : + core.cmp.PartialOrd String String := { + partialEqInst := alloc.string.String.Insts.CoreCmpPartialEqString + partial_cmp := alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp + lt := core.cmp.PartialOrd.lt.default + alloc.string.String.Insts.CoreCmpPartialOrdString +} + +/-- Trait implementation: [alloc::string::{impl core::cmp::Eq for alloc::string::String}] + Source: '/rustc/library/alloc/src/string.rs', lines 350:32-350:34 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def alloc.string.String.Insts.CoreCmpEq : core.cmp.Eq String := { + partialEqInst := alloc.string.String.Insts.CoreCmpPartialEqString + assert_fields_are_eq := + alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- Trait implementation: [alloc::string::{impl core::cmp::Ord for alloc::string::String}] + Source: '/rustc/library/alloc/src/string.rs', lines 350:36-350:39 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +def alloc.string.String.Insts.CoreCmpOrd : core.cmp.Ord String := { + eqInst := alloc.string.String.Insts.CoreCmpEq + partialOrdInst := alloc.string.String.Insts.CoreCmpPartialOrdString + cmp := alloc.string.String.Insts.CoreCmpOrd.cmp +} + /-- [auths_connections::kernel::next_generation]: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 29:0-31:1 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 28:0-30:1 Visibility: public -/ def kernel.next_generation (generation : Std.U64) : Result (Option Std.U64) := do ok (U64.checked_add generation 1#u64) /-- [auths_connections::kernel::state_change]: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 36:0-44:1 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 35:0-43:1 Visibility: public -/ def kernel.state_change (current : kernel.Generations) : Result (Option kernel.Generations) := do @@ -33,7 +80,7 @@ def kernel.state_change | some generation => ok (some { current with generation }) /-- [auths_connections::kernel::rotation]: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 49:0-57:1 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 48:0-56:1 Visibility: public -/ def kernel.rotation (current : kernel.Generations) : Result (Option kernel.Generations) := do @@ -44,7 +91,7 @@ def kernel.rotation ok (some { generation, credential_generation := generation }) /-- [auths_connections::kernel::retained_generation]: loop body 0: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 66:4-73:5 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 65:4-72:5 Visibility: public -/ @[rust_loop_body] def kernel.retained_generation_loop.body @@ -73,7 +120,7 @@ def kernel.retained_generation_loop.body else ok (done (found, best)) /-- [auths_connections::kernel::retained_generation]: loop 0: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 66:4-73:5 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 65:4-72:5 Visibility: public -/ @[rust_loop] def kernel.retained_generation_loop @@ -87,7 +134,7 @@ def kernel.retained_generation_loop (found, best, index) /-- [auths_connections::kernel::retained_generation]: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 62:0-75:1 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 61:0-74:1 Visibility: public -/ def kernel.retained_generation (record_generation : Std.U64) (stored : Slice Std.U64) : @@ -101,7 +148,7 @@ def kernel.retained_generation else ok none /-- [auths_connections::kernel::lease_generation]: - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 86:0-101:1 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 85:0-100:1 Visibility: public -/ def kernel.lease_generation (record_generation : Std.U64) (credential_generation : Std.U64) @@ -115,4 +162,595 @@ def kernel.lease_generation then ok o else ok none +/-- [auths_connections::kernel::lower_tail_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 106:0-108:1 -/ +def kernel.lower_tail_valid (byte : Std.U8) : Result Bool := do + if byte >= 97#u8 + then + if byte <= 122#u8 + then ok true + else + if byte >= 48#u8 + then if byte <= 57#u8 + then ok true + else ok (byte = 45#u8) + else ok (byte = 45#u8) + else + if byte >= 48#u8 + then if byte <= 57#u8 + then ok true + else ok (byte = 45#u8) + else ok (byte = 45#u8) + +/-- [auths_connections::kernel::lower_token_valid]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 125:4-133:1 + Visibility: public -/ +@[rust_loop_body] +def kernel.lower_token_valid_loop.body + (value : Slice Std.U8) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len value + if index < i + then + let byte ← Slice.index_usize value index + let b ← kernel.lower_tail_valid byte + if b + then let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + else ok (done true) + +/-- [auths_connections::kernel::lower_token_valid]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 125:4-133:1 + Visibility: public -/ +@[rust_loop] +def kernel.lower_token_valid_loop + (value : Slice Std.U8) (index : Std.Usize) : Result Bool := do + loop + (fun index1 => kernel.lower_token_valid_loop.body value index1) + index + +/-- [auths_connections::kernel::lower_token_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 116:0-133:1 + Visibility: public -/ +def kernel.lower_token_valid + (value : Slice Std.U8) (maximum : Std.Usize) : Result Bool := do + let b ← core.slice.Slice.is_empty value + if b + then ok false + else + let i := Slice.len value + if i > maximum + then ok false + else + let first ← Slice.index_usize value 0#usize + if first < 97#u8 + then ok false + else + if first > 122#u8 + then ok false + else kernel.lower_token_valid_loop value 0#usize + +/-- [auths_connections::kernel::ascii_graphic_valid]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 146:4-154:1 + Visibility: public -/ +@[rust_loop_body] +def kernel.ascii_graphic_valid_loop.body + (value : Slice Std.U8) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len value + if index < i + then + let byte ← Slice.index_usize value index + if byte < 33#u8 + then ok (done false) + else + if byte > 126#u8 + then ok (done false) + else let index1 ← index + 1#usize + ok (cont index1) + else ok (done true) + +/-- [auths_connections::kernel::ascii_graphic_valid]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 146:4-154:1 + Visibility: public -/ +@[rust_loop] +def kernel.ascii_graphic_valid_loop + (value : Slice Std.U8) (index : Std.Usize) : Result Bool := do + loop + (fun index1 => kernel.ascii_graphic_valid_loop.body value index1) + index + +/-- [auths_connections::kernel::ascii_graphic_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 141:0-154:1 + Visibility: public -/ +def kernel.ascii_graphic_valid + (value : Slice Std.U8) (maximum : Std.Usize) : Result Bool := do + let b ← core.slice.Slice.is_empty value + if b + then ok false + else + let i := Slice.len value + if i > maximum + then ok false + else kernel.ascii_graphic_valid_loop value 0#usize + +/-- [auths_connections::kernel::semantic_head_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 160:0-164:1 -/ +def kernel.semantic_head_valid (byte : Std.U8) : Result Bool := do + if byte >= 97#u8 + then + if byte <= 122#u8 + then ok true + else + if byte >= 65#u8 + then + if byte <= 90#u8 + then ok true + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + else + if byte >= 65#u8 + then + if byte <= 90#u8 + then ok true + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + +/-- [auths_connections::kernel::semantic_tail_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 165:0-172:1 -/ +def kernel.semantic_tail_valid (byte : Std.U8) : Result Bool := do + let b ← kernel.semantic_head_valid byte + if b + then ok true + else + if byte = 46#u8 + then ok true + else + if byte = 95#u8 + then ok true + else + if byte = 58#u8 + then ok true + else if byte = 47#u8 + then ok true + else ok (byte = 45#u8) + +/-- [auths_connections::kernel::semantic_id_valid]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 184:4-191:1 + Visibility: public -/ +@[rust_loop_body] +def kernel.semantic_id_valid_loop.body + (value : Slice Std.U8) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len value + if index < i + then + let i1 ← Slice.index_usize value index + let b ← kernel.semantic_tail_valid i1 + if b + then let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + else ok (done true) + +/-- [auths_connections::kernel::semantic_id_valid]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 184:4-191:1 + Visibility: public -/ +@[rust_loop] +def kernel.semantic_id_valid_loop + (value : Slice Std.U8) (index : Std.Usize) : Result Bool := do + loop + (fun index1 => kernel.semantic_id_valid_loop.body value index1) + index + +/-- [auths_connections::kernel::semantic_id_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 176:0-191:1 + Visibility: public -/ +def kernel.semantic_id_valid + (value : Slice Std.U8) (maximum : Std.Usize) : Result Bool := do + let b ← core.slice.Slice.is_empty value + if b + then ok false + else + let i := Slice.len value + if i > maximum + then ok false + else + let i1 ← Slice.index_usize value 0#usize + let b1 ← kernel.semantic_head_valid i1 + if b1 + then kernel.semantic_id_valid_loop value 0#usize + else ok false + +/-- [auths_connections::kernel::recovery_lease]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 202:0-220:1 + Visibility: public -/ +def kernel.recovery_lease + (state : model.ConnectionState) (record_generation : Std.U64) + (requested_generation : Std.U64) : + Result (core.result.Result Unit model.ConnectionRecordError) + := do + match state with + | model.ConnectionState.Active => + if record_generation = 0#u64 + then + ok (core.result.Result.Err model.ConnectionRecordError.InvalidGeneration) + else + if requested_generation = 0#u64 + then + ok (core.result.Result.Err + model.ConnectionRecordError.InvalidGeneration) + else + if requested_generation > record_generation + then + ok (core.result.Result.Err + model.ConnectionRecordError.InvalidGeneration) + else ok (core.result.Result.Ok ()) + | model.ConnectionState.Disabled => + if record_generation = 0#u64 + then + ok (core.result.Result.Err model.ConnectionRecordError.InvalidGeneration) + else + if requested_generation = 0#u64 + then + ok (core.result.Result.Err + model.ConnectionRecordError.InvalidGeneration) + else + if requested_generation > record_generation + then + ok (core.result.Result.Err + model.ConnectionRecordError.InvalidGeneration) + else ok (core.result.Result.Ok ()) + | model.ConnectionState.Revoked => + ok (core.result.Result.Err model.ConnectionRecordError.Revoked) + +/-- [auths_connections::kernel::recovery_binding_requirement]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 237:0-258:1 + Visibility: public -/ +def kernel.recovery_binding_requirement + (current_credential_generation : Std.U64) (operation_generation : Std.U64) + (operation_credential_generation : Std.U64) : + Result kernel.RecoveryBindingRequirement + := do + if current_credential_generation = 0#u64 + then ok kernel.RecoveryBindingRequirement.Refuse + else + if operation_generation = 0#u64 + then ok kernel.RecoveryBindingRequirement.Refuse + else + if operation_credential_generation = 0#u64 + then ok kernel.RecoveryBindingRequirement.Refuse + else + if operation_credential_generation > operation_generation + then ok kernel.RecoveryBindingRequirement.Refuse + else + if operation_generation >= current_credential_generation + then + if operation_credential_generation = current_credential_generation + then ok kernel.RecoveryBindingRequirement.CurrentCommitment + else ok kernel.RecoveryBindingRequirement.Refuse + else ok kernel.RecoveryBindingRequirement.RecordedCommitment + +/-- [auths_connections::kernel::state_transition_allows]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 263:0-282:1 + Visibility: public -/ +def kernel.state_transition_allows + (current : model.ConnectionState) (next : model.ConnectionState) + (previous_time : Std.U64) (proposed_time : Std.U64) : + Result Bool + := do + if proposed_time < previous_time + then ok false + else + match current with + | model.ConnectionState.Active => + match next with + | model.ConnectionState.Active => ok false + | model.ConnectionState.Disabled => ok true + | model.ConnectionState.Revoked => ok true + | model.ConnectionState.Disabled => + match next with + | model.ConnectionState.Active => ok true + | model.ConnectionState.Disabled => ok false + | model.ConnectionState.Revoked => ok true + | model.ConnectionState.Revoked => ok false + +/-- [auths_connections::kernel::record_change_allows]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 287:0-296:1 + Visibility: public -/ +def kernel.record_change_allows + (state : model.ConnectionState) (previous_time : Std.U64) + (proposed_time : Std.U64) : + Result Bool + := do + match state with + | model.ConnectionState.Active => ok (proposed_time >= previous_time) + | model.ConnectionState.Disabled => ok (proposed_time >= previous_time) + | model.ConnectionState.Revoked => ok false + +/-- [auths_connections::kernel::record_times_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 302:0-317:1 + Visibility: public -/ +def kernel.record_times_valid + (state : model.ConnectionState) (created : Std.U64) (updated : Std.U64) + (revoked_at : Option Std.U64) : + Result Bool + := do + if created > updated + then ok false + else + match state with + | model.ConnectionState.Active => + match revoked_at with + | none => ok true + | some _ => ok false + | model.ConnectionState.Disabled => + match revoked_at with + | none => ok true + | some _ => ok false + | model.ConnectionState.Revoked => + match revoked_at with + | none => ok false + | some value => + if created <= value + then ok (value <= updated) + else ok false + +/-- [auths_connections::kernel::strictly_sorted_unique]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 328:4-336:1 + Visibility: public -/ +@[rust_loop_body] +def kernel.strictly_sorted_unique_loop.body + {T : Type} (corecmpOrdInst : core.cmp.Ord T) (values : Slice T) + (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len values + if index < i + then + let i1 ← index - 1#usize + let t ← Slice.index_usize values i1 + let t1 ← Slice.index_usize values index + let b ← corecmpOrdInst.partialOrdInst.lt t t1 + if b + then let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + else ok (done true) + +/-- [auths_connections::kernel::strictly_sorted_unique]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 328:4-336:1 + Visibility: public -/ +@[rust_loop] +def kernel.strictly_sorted_unique_loop + {T : Type} (corecmpOrdInst : core.cmp.Ord T) (values : Slice T) + (index : Std.Usize) : + Result Bool + := do + loop + (fun index1 => kernel.strictly_sorted_unique_loop.body corecmpOrdInst + values index1) + index + +/-- [auths_connections::kernel::strictly_sorted_unique]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 323:0-336:1 + Visibility: public -/ +def kernel.strictly_sorted_unique + {T : Type} (corecmpOrdInst : core.cmp.Ord T) (values : Slice T) : + Result Bool + := do + let b ← core.slice.Slice.is_empty values + if b + then ok true + else kernel.strictly_sorted_unique_loop corecmpOrdInst values 1#usize + +/-- [auths_connections::model::MAX_WORKLOADS] + Source: 'product/runtime/auths-connections/src/model.rs', lines 15:0-15:44 -/ +@[global_simps, irreducible] def model.MAX_WORKLOADS : Std.Usize := 256#usize + +/-- [auths_connections::kernel::workloads_valid]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 347:4-354:1 + Visibility: public -/ +@[rust_loop_body] +def kernel.workloads_valid_loop.body + (values : Slice String) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len values + if index < i + then + let s ← Slice.index_usize values index + let s1 ← alloc.string.String.as_bytes s + let b ← kernel.ascii_graphic_valid s1 128#usize + if b + then let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + else ok (done true) + +/-- [auths_connections::kernel::workloads_valid]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 347:4-354:1 + Visibility: public -/ +@[rust_loop] +def kernel.workloads_valid_loop + (values : Slice String) (index : Std.Usize) : Result Bool := do + loop + (fun index1 => kernel.workloads_valid_loop.body values index1) + index + +/-- [auths_connections::kernel::workloads_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 342:0-354:1 + Visibility: public -/ +def kernel.workloads_valid (values : Slice String) : Result Bool := do + let b ← core.slice.Slice.is_empty values + if b + then ok false + else + let i := Slice.len values + if i > model.MAX_WORKLOADS + then ok false + else + let b1 ← + kernel.strictly_sorted_unique alloc.string.String.Insts.CoreCmpOrd + values + if b1 + then kernel.workloads_valid_loop values 0#usize + else ok false + +/-- [auths_connections::model::{impl core::cmp::Ord for auths_connections::model::SemanticId}::cmp]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 69:27-69:30 + Visibility: public -/ +def model.SemanticId.Insts.CoreCmpOrd.cmp + (self : model.SemanticId) (other : model.SemanticId) : Result Ordering := do + alloc.string.String.Insts.CoreCmpOrd.cmp self other + +/-- [auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}::cmp]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:27-150:30 + Visibility: public -/ +def model.ConnectionProfile.Insts.CoreCmpOrd.cmp + (self : model.ConnectionProfile) (other : model.ConnectionProfile) : + Result Ordering + := do + let o ← model.SemanticId.Insts.CoreCmpOrd.cmp self.id other.id + match o with + | Ordering.lt => ok Ordering.lt + | Ordering.eq => ok (core.cmp.impls.OrdU16.cmp self.version other.version) + | Ordering.gt => ok Ordering.gt + +/-- [auths_connections::model::{impl core::cmp::PartialOrd for auths_connections::model::ConnectionProfile}::partial_cmp]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:43-150:53 + Visibility: public -/ +def + model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile.partial_cmp + (self : model.ConnectionProfile) (other : model.ConnectionProfile) : + Result (Option Ordering) + := do + let o ← model.ConnectionProfile.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- [auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::SemanticId}::eq]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 69:32-69:41 + Visibility: public -/ +def model.SemanticId.Insts.CoreCmpPartialEqSemanticId.eq + (self : model.SemanticId) (other : model.SemanticId) : Result Bool := do + alloc.string.String.Insts.CoreCmpPartialEqString.eq self other + +/-- [auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::ConnectionProfile}::eq]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:32-150:41 + Visibility: public -/ +def model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile.eq + (self : model.ConnectionProfile) (other : model.ConnectionProfile) : + Result Bool + := do + if self.version = other.version + then model.SemanticId.Insts.CoreCmpPartialEqSemanticId.eq self.id other.id + else ok false + +/-- Trait implementation: [auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::ConnectionProfile}] + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:32-150:41 -/ +@[reducible] +def model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile : + core.cmp.PartialEq model.ConnectionProfile model.ConnectionProfile := { + eq := model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile.eq +} + +/-- Trait implementation: [auths_connections::model::{impl core::cmp::PartialOrd for auths_connections::model::ConnectionProfile}] + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:43-150:53 -/ +@[reducible] +impl_def model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile : + core.cmp.PartialOrd model.ConnectionProfile model.ConnectionProfile := { + partialEqInst := + model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile + partial_cmp := + model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile.partial_cmp + lt := core.cmp.PartialOrd.lt.default + model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile +} + +/-- [auths_connections::model::{impl core::cmp::Eq for auths_connections::model::ConnectionProfile}::assert_fields_are_eq]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:23-150:25 + Visibility: public -/ +def model.ConnectionProfile.Insts.CoreCmpEq.assert_fields_are_eq + (self : model.ConnectionProfile) : Result Unit := do + ok () + +/-- Trait implementation: [auths_connections::model::{impl core::cmp::Eq for auths_connections::model::ConnectionProfile}] + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:23-150:25 -/ +@[reducible] +def model.ConnectionProfile.Insts.CoreCmpEq : core.cmp.Eq + model.ConnectionProfile := { + partialEqInst := + model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile + assert_fields_are_eq := + model.ConnectionProfile.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- Trait implementation: [auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}] + Source: 'product/runtime/auths-connections/src/model.rs', lines 150:27-150:30 -/ +@[reducible] +def model.ConnectionProfile.Insts.CoreCmpOrd : core.cmp.Ord + model.ConnectionProfile := { + eqInst := model.ConnectionProfile.Insts.CoreCmpEq + partialOrdInst := + model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile + cmp := model.ConnectionProfile.Insts.CoreCmpOrd.cmp +} + +/-- [auths_connections::model::MAX_PROFILES] + Source: 'product/runtime/auths-connections/src/model.rs', lines 16:0-16:42 -/ +@[global_simps, irreducible] def model.MAX_PROFILES : Std.Usize := 32#usize + +/-- [auths_connections::kernel::profiles_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 359:0-361:1 + Visibility: public -/ +def kernel.profiles_valid + (values : Slice model.ConnectionProfile) : Result Bool := do + let b ← core.slice.Slice.is_empty values + if b + then ok false + else + let i := Slice.len values + if i <= model.MAX_PROFILES + then + kernel.strictly_sorted_unique model.ConnectionProfile.Insts.CoreCmpOrd + values + else ok false + +/-- [auths_connections::kernel::validate_record_shape]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 370:0-388:1 + Visibility: public -/ +def kernel.validate_record_shape + (workloads : Slice String) (profiles : Slice model.ConnectionProfile) + (state : model.ConnectionState) (created : Std.U64) (updated : Std.U64) + (revoked : Option Std.U64) : + Result (core.result.Result Unit model.ConnectionRecordError) + := do + let b ← kernel.workloads_valid workloads + if b + then + let b1 ← kernel.profiles_valid profiles + if b1 + then + let b2 ← kernel.record_times_valid state created updated revoked + if b2 + then ok (core.result.Result.Ok ()) + else + ok (core.result.Result.Err + model.ConnectionRecordError.InvalidTimestamps) + else + ok (core.result.Result.Err model.ConnectionRecordError.InvalidProfiles) + else ok (core.result.Result.Err model.ConnectionRecordError.InvalidWorkloads) + end auths_connections diff --git a/formal/qualification/aeneas/generated/connections/FunsExternal.lean b/formal/qualification/aeneas/generated/connections/FunsExternal.lean new file mode 100644 index 000000000..fab650172 --- /dev/null +++ b/formal/qualification/aeneas/generated/connections/FunsExternal.lean @@ -0,0 +1,20 @@ +-- Reuse the reviewed exact String ordering/UTF-8 models; all Auths bodies remain translated. +import qualification.aeneas.generated.connections.Types +import qualification.aeneas.generated.model.FunsExternal +open Aeneas Aeneas.Std Result +namespace auths_connections +@[trait_default] +def core.cmp.PartialOrd.lt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right +abbrev alloc.string.String.Insts.CoreCmpPartialEqString.eq := + _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq +abbrev alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp := + _root_.alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp +abbrev alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq := + _root_.alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq +abbrev alloc.string.String.Insts.CoreCmpOrd.cmp := + _root_.alloc.string.String.Insts.CoreCmpOrd.cmp +abbrev alloc.string.String.as_bytes := _root_.alloc.string.String.as_bytes +end auths_connections diff --git a/formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean new file mode 100644 index 000000000..ec4f3ce16 --- /dev/null +++ b/formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean @@ -0,0 +1,59 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_connections]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.connections.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open auths_connections + +/-- [alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:9-350:18 + Name pattern: [alloc::string::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::cmp::PartialEq}::eq"] +axiom alloc.string.String.Insts.CoreCmpPartialEqString.eq + : String → String → Result Bool + +/-- [alloc::string::{impl core::cmp::PartialOrd for alloc::string::String}::partial_cmp]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:20-350:30 + Name pattern: [alloc::string::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::cmp::PartialOrd}::partial_cmp"] +axiom alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp + : String → String → Result (Option Ordering) + +/-- [alloc::string::{impl core::cmp::Eq for alloc::string::String}::assert_fields_are_eq]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:32-350:34 + Name pattern: [alloc::string::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::cmp::Eq}::assert_fields_are_eq"] +axiom alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq + : String → Result Unit + +/-- [alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:36-350:39 + Name pattern: [alloc::string::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "alloc::string::{core::cmp::Ord}::cmp"] +axiom alloc.string.String.Insts.CoreCmpOrd.cmp + : String → String → Result Ordering + +/-- [alloc::string::{alloc::string::String}::as_bytes]: + Source: '/rustc/library/alloc/src/string.rs', lines 1454:4-1454:41 + Name pattern: [alloc::string::{alloc::string::String}::as_bytes] + Visibility: public -/ +@[rust_fun "alloc::string::{alloc::string::String}::as_bytes"] +axiom alloc.string.String.as_bytes : String → Result (Slice Std.U8) + diff --git a/formal/qualification/aeneas/generated/connections/Types.lean b/formal/qualification/aeneas/generated/connections/Types.lean index 9c4fc08b3..f5bab4f8d 100644 --- a/formal/qualification/aeneas/generated/connections/Types.lean +++ b/formal/qualification/aeneas/generated/connections/Types.lean @@ -1,6 +1,7 @@ -- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS -- [auths_connections]: type definitions import Aeneas +import Auths.Support.Discriminant open Aeneas Aeneas.Std Result ControlFlow Error set_option linter.dupNamespace false set_option linter.hashCommand false @@ -15,10 +16,68 @@ set_option maxRecDepth 2048 namespace auths_connections /-- [auths_connections::kernel::Generations] - Source: 'product/runtime/auths-connections/src/kernel.rs', lines 19:0-25:1 + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 18:0-24:1 Visibility: public -/ structure kernel.Generations where generation : Std.U64 credential_generation : Std.U64 +/-- [auths_connections::model::ConnectionRecordError] + Source: 'product/runtime/auths-connections/src/model.rs', lines 1000:0-1066:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive model.ConnectionRecordError where +| InvalidProviderKind : model.ConnectionRecordError +| InvalidAlias : model.ConnectionRecordError +| InvalidSemanticId : model.ConnectionRecordError +| InvalidConnectionId : model.ConnectionRecordError +| Randomness : model.ConnectionRecordError +| InvalidProfile : model.ConnectionRecordError +| InvalidDescriptor : model.ConnectionRecordError +| InvalidGeneration : model.ConnectionRecordError +| InvalidState : model.ConnectionRecordError +| Revoked : model.ConnectionRecordError +| InvalidWorkloads : model.ConnectionRecordError +| InvalidProfiles : model.ConnectionRecordError +| InvalidTimestamps : model.ConnectionRecordError +| RecordTooLarge : model.ConnectionRecordError +| InvalidShape : model.ConnectionRecordError +| InvalidSchema : model.ConnectionRecordError +| ObsoleteSchema : model.ConnectionRecordError +| Noncanonical : model.ConnectionRecordError +| TrailingBytes : model.ConnectionRecordError +| Encoding : model.ConnectionRecordError +| Decoding : model.ConnectionRecordError + +/-- [auths_connections::model::ConnectionState] + Source: 'product/runtime/auths-connections/src/model.rs', lines 184:0-193:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive model.ConnectionState where +| Active : model.ConnectionState +| Disabled : model.ConnectionState +| Revoked : model.ConnectionState + +/-- [auths_connections::kernel::RecoveryBindingRequirement] + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 224:0-231:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive kernel.RecoveryBindingRequirement where +| Refuse : kernel.RecoveryBindingRequirement +| RecordedCommitment : kernel.RecoveryBindingRequirement +| CurrentCommitment : kernel.RecoveryBindingRequirement + +/-- [auths_connections::model::SemanticId] + Source: 'product/runtime/auths-connections/src/model.rs', lines 70:0-70:30 + Visibility: public -/ +@[reducible] +def model.SemanticId := String + +/-- [auths_connections::model::ConnectionProfile] + Source: 'product/runtime/auths-connections/src/model.rs', lines 151:0-154:1 + Visibility: public -/ +structure model.ConnectionProfile where + id : model.SemanticId + version : Std.U16 + end auths_connections diff --git a/formal/qualification/aeneas/generated/connections/translation.json b/formal/qualification/aeneas/generated/connections/translation.json index 0116a44a8..1e28afb6b 100644 --- a/formal/qualification/aeneas/generated/connections/translation.json +++ b/formal/qualification/aeneas/generated/connections/translation.json @@ -4,15 +4,100 @@ "crate": "auths_connections", "functions": [ { - "def_id": 0, + "def_id": 48, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpPartialEqString.eq", + "lean_file": "qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 43, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp", + "lean_file": "qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::PartialOrd for alloc::string::String}::partial_cmp", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 42, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::Eq for alloc::string::String}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 36, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 23, + "lean_name": "auths_connections.alloc.string.String.as_bytes", + "lean_file": "qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "rust_name": "alloc::string::{alloc::string::String}::as_bytes", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 1454, + "end_line": 1454 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 9, "lean_name": "auths_connections.kernel.next_generation", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::next_generation", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 29, - "end_line": 31 + "begin_line": 28, + "end_line": 30 }, "is_opaque": false, "can_fail": true, @@ -21,15 +106,15 @@ "reducible": false }, { - "def_id": 1, + "def_id": 10, "lean_name": "auths_connections.kernel.state_change", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::state_change", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 36, - "end_line": 44 + "begin_line": 35, + "end_line": 43 }, "is_opaque": false, "can_fail": true, @@ -38,15 +123,15 @@ "reducible": false }, { - "def_id": 2, + "def_id": 11, "lean_name": "auths_connections.kernel.rotation", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::rotation", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 49, - "end_line": 57 + "begin_line": 48, + "end_line": 56 }, "is_opaque": false, "can_fail": true, @@ -55,15 +140,15 @@ "reducible": false }, { - "def_id": 3, + "def_id": 12, "lean_name": "auths_connections.kernel.retained_generation_loop.body", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::retained_generation", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 66, - "end_line": 73 + "begin_line": 65, + "end_line": 72 }, "is_opaque": false, "can_fail": true, @@ -80,15 +165,15 @@ "parent_lean_name": "auths_connections.kernel.retained_generation" }, { - "def_id": 3, + "def_id": 12, "lean_name": "auths_connections.kernel.retained_generation_loop", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::retained_generation", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 66, - "end_line": 73 + "begin_line": 65, + "end_line": 72 }, "is_opaque": false, "can_fail": true, @@ -105,15 +190,15 @@ "parent_lean_name": "auths_connections.kernel.retained_generation" }, { - "def_id": 3, + "def_id": 12, "lean_name": "auths_connections.kernel.retained_generation", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::retained_generation", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 62, - "end_line": 75 + "begin_line": 61, + "end_line": 74 }, "is_opaque": false, "can_fail": true, @@ -122,38 +207,853 @@ "reducible": false }, { - "def_id": 4, + "def_id": 13, "lean_name": "auths_connections.kernel.lease_generation", "lean_file": "qualification/aeneas/generated/connections/Funs.lean", "rust_name": "auths_connections::kernel::lease_generation", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 86, - "end_line": 101 + "begin_line": 85, + "end_line": 100 }, "is_opaque": false, "can_fail": true, "can_diverge": true, "is_rec": false, "reducible": false - } - ], - "types": [ + }, { - "def_id": 1, - "lean_name": "auths_connections.kernel.Generations", - "lean_file": "qualification/aeneas/generated/connections/Types.lean", - "rust_name": "auths_connections::kernel::Generations", + "def_id": 21, + "lean_name": "auths_connections.kernel.lower_tail_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::lower_tail_valid", "is_local": true, "source": { "file": "product/runtime/auths-connections/src/kernel.rs", - "begin_line": 19, - "end_line": 25 - } - } - ], - "globals": [], - "trait_decls": [], - "trait_impls": [] + "begin_line": 106, + "end_line": 108 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 7, + "lean_name": "auths_connections.kernel.lower_token_valid_loop.body", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::lower_token_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 125, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_connections.kernel.lower_token_valid" + }, + { + "def_id": 7, + "lean_name": "auths_connections.kernel.lower_token_valid_loop", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::lower_token_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 125, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_connections.kernel.lower_token_valid" + }, + { + "def_id": 7, + "lean_name": "auths_connections.kernel.lower_token_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::lower_token_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 116, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 8, + "lean_name": "auths_connections.kernel.ascii_graphic_valid_loop.body", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::ascii_graphic_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 146, + "end_line": 154 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_connections.kernel.ascii_graphic_valid" + }, + { + "def_id": 8, + "lean_name": "auths_connections.kernel.ascii_graphic_valid_loop", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::ascii_graphic_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 146, + "end_line": 154 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_connections.kernel.ascii_graphic_valid" + }, + { + "def_id": 8, + "lean_name": "auths_connections.kernel.ascii_graphic_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::ascii_graphic_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 141, + "end_line": 154 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "auths_connections.kernel.semantic_head_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_head_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 160, + "end_line": 164 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "auths_connections.kernel.semantic_tail_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_tail_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 165, + "end_line": 172 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "auths_connections.kernel.semantic_id_valid_loop.body", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_id_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 184, + "end_line": 191 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_connections.kernel.semantic_id_valid" + }, + { + "def_id": 6, + "lean_name": "auths_connections.kernel.semantic_id_valid_loop", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_id_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 184, + "end_line": 191 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_connections.kernel.semantic_id_valid" + }, + { + "def_id": 6, + "lean_name": "auths_connections.kernel.semantic_id_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_id_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 176, + "end_line": 191 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "auths_connections.kernel.recovery_lease", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::recovery_lease", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 202, + "end_line": 220 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "auths_connections.kernel.recovery_binding_requirement", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::recovery_binding_requirement", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 237, + "end_line": 258 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 5, + "lean_name": "auths_connections.kernel.state_transition_allows", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::state_transition_allows", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 263, + "end_line": 282 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "auths_connections.kernel.record_change_allows", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::record_change_allows", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 287, + "end_line": 296 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "auths_connections.kernel.record_times_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::record_times_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 302, + "end_line": 317 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "auths_connections.kernel.strictly_sorted_unique_loop.body", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::strictly_sorted_unique", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 328, + "end_line": 336 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_connections.kernel.strictly_sorted_unique" + }, + { + "def_id": 0, + "lean_name": "auths_connections.kernel.strictly_sorted_unique_loop", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::strictly_sorted_unique", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 328, + "end_line": 336 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_connections.kernel.strictly_sorted_unique" + }, + { + "def_id": 0, + "lean_name": "auths_connections.kernel.strictly_sorted_unique", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::strictly_sorted_unique", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 323, + "end_line": 336 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "auths_connections.kernel.workloads_valid_loop.body", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::workloads_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 347, + "end_line": 354 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_connections.kernel.workloads_valid" + }, + { + "def_id": 14, + "lean_name": "auths_connections.kernel.workloads_valid_loop", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::workloads_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 347, + "end_line": 354 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_connections.kernel.workloads_valid" + }, + { + "def_id": 14, + "lean_name": "auths_connections.kernel.workloads_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::workloads_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 342, + "end_line": 354 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 46, + "lean_name": "auths_connections.model.SemanticId.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::SemanticId}::cmp", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 69, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 38, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}::cmp", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 45, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile.partial_cmp", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::PartialOrd for auths_connections::model::ConnectionProfile}::partial_cmp", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 51, + "lean_name": "auths_connections.model.SemanticId.Insts.CoreCmpPartialEqSemanticId.eq", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::SemanticId}::eq", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 69, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 49, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile.eq", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::ConnectionProfile}::eq", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 44, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::Eq for auths_connections::model::ConnectionProfile}::assert_fields_are_eq", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 15, + "lean_name": "auths_connections.kernel.profiles_valid", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::profiles_valid", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 359, + "end_line": 361 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "auths_connections.kernel.validate_record_shape", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::kernel::validate_record_shape", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 370, + "end_line": 388 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 5, + "lean_name": "auths_connections.kernel.Generations", + "lean_file": "qualification/aeneas/generated/connections/Types.lean", + "rust_name": "auths_connections::kernel::Generations", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 18, + "end_line": 24 + } + }, + { + "def_id": 3, + "lean_name": "auths_connections.model.ConnectionRecordError", + "lean_file": "qualification/aeneas/generated/connections/Types.lean", + "rust_name": "auths_connections::model::ConnectionRecordError", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 1000, + "end_line": 1066 + } + }, + { + "def_id": 0, + "lean_name": "auths_connections.model.ConnectionState", + "lean_file": "qualification/aeneas/generated/connections/Types.lean", + "rust_name": "auths_connections::model::ConnectionState", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 184, + "end_line": 193 + } + }, + { + "def_id": 4, + "lean_name": "auths_connections.kernel.RecoveryBindingRequirement", + "lean_file": "qualification/aeneas/generated/connections/Types.lean", + "rust_name": "auths_connections::kernel::RecoveryBindingRequirement", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 224, + "end_line": 231 + } + }, + { + "def_id": 11, + "lean_name": "auths_connections.model.SemanticId", + "lean_file": "qualification/aeneas/generated/connections/Types.lean", + "rust_name": "auths_connections::model::SemanticId", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 70, + "end_line": 70 + } + }, + { + "def_id": 7, + "lean_name": "auths_connections.model.ConnectionProfile", + "lean_file": "qualification/aeneas/generated/connections/Types.lean", + "rust_name": "auths_connections::model::ConnectionProfile", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 151, + "end_line": 154 + } + } + ], + "globals": [ + { + "def_id": 0, + "lean_name": "auths_connections.model.MAX_WORKLOADS", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::MAX_WORKLOADS", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 15, + "end_line": 15 + }, + "can_fail": false + }, + { + "def_id": 1, + "lean_name": "auths_connections.model.MAX_PROFILES", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::MAX_PROFILES", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 16, + "end_line": 16 + }, + "can_fail": false + } + ], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 6, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpPartialEqString", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 3, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpPartialOrdString", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "alloc::string::{impl core::cmp::PartialOrd for alloc::string::String}", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "impl_trait_def_id": 1, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 2, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "alloc::string::{impl core::cmp::Eq for alloc::string::String}", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "impl_trait_def_id": 2, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 0, + "lean_name": "auths_connections.alloc.string.String.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "alloc::string::{impl core::cmp::Ord for alloc::string::String}", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + }, + { + "def_id": 7, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpPartialEqConnectionProfile", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::ConnectionProfile}", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 5, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpPartialOrdConnectionProfile", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::PartialOrd for auths_connections::model::ConnectionProfile}", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "impl_trait_def_id": 1, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 4, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::Eq for auths_connections::model::ConnectionProfile}", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "impl_trait_def_id": 2, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 1, + "lean_name": "auths_connections.model.ConnectionProfile.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/connections/Funs.lean", + "rust_name": "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}", + "is_local": true, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 150, + "end_line": 150 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + } + ] } diff --git a/formal/qualification/aeneas/generated/gateway/Funs.lean b/formal/qualification/aeneas/generated/gateway/Funs.lean index 7cd1ea322..800f4ef27 100644 --- a/formal/qualification/aeneas/generated/gateway/Funs.lean +++ b/formal/qualification/aeneas/generated/gateway/Funs.lean @@ -2,6 +2,7 @@ -- [auths_gateway_kernel]: function definitions import Aeneas import qualification.aeneas.generated.gateway.Types +import qualification.aeneas.generated.gateway.FunsExternal open Aeneas Aeneas.Std Result ControlFlow Error set_option linter.dupNamespace false set_option linter.hashCommand false @@ -13,6 +14,9 @@ set_option maxHeartbeats 1000000 /- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ set_option maxRecDepth 2048 +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + namespace auths_gateway_kernel /-- [auths_gateway_kernel::construct::MAX_BODY_BYTES] @@ -1286,6 +1290,774 @@ def construct.construct_credential_read body := (alloc.vec.Vec.new Std.U8) } +/-- [auths_gateway_kernel::construct::field_name_equal]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/construct.rs', lines 1060:4-1063:5 + Visibility: public -/ +@[rust_loop_body] +def construct.field_name_equal_loop.body + (left : Slice Std.U8) (right : Slice Std.U8) (position : Std.Usize) + (equal : Bool) : + Result (ControlFlow (Std.Usize × Bool) Bool) + := do + let i := Slice.len left + if position < i + then + if equal + then + let i1 ← Slice.index_usize left position + let i2 ← Slice.index_usize right position + let position1 ← position + 1#usize + ok (cont (position1, i1 = i2)) + else ok (done false) + else ok (done equal) + +/-- [auths_gateway_kernel::construct::field_name_equal]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/construct.rs', lines 1060:4-1063:5 + Visibility: public -/ +@[rust_loop] +def construct.field_name_equal_loop + (left : Slice Std.U8) (right : Slice Std.U8) (position : Std.Usize) + (equal : Bool) : + Result Bool + := do + loop + (fun (position1, equal1) => construct.field_name_equal_loop.body left right + position1 equal1) + (position, equal) + +/-- [auths_gateway_kernel::construct::field_name_equal]: + Source: 'product/runtime/auths-gateway-kernel/src/construct.rs', lines 1054:0-1065:1 + Visibility: public -/ +def construct.field_name_equal + (left : Slice Std.U8) (right : Slice Std.U8) : Result Bool := do + let i := Slice.len left + let i1 := Slice.len right + if i != i1 + then ok false + else construct.field_name_equal_loop left right 0#usize true + +/-- [auths_gateway_kernel::construct::field_index]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/construct.rs', lines 1073:4-1078:5 + Visibility: public -/ +@[rust_loop_body] +def construct.field_index_loop.body + (names : Slice (alloc.vec.Vec Std.U8)) (wanted : Slice Std.U8) + (position : Std.Usize) (found : Option Std.Usize) : + Result (ControlFlow (Std.Usize × (Option Std.Usize)) (Option Std.Usize)) + := do + let i := Slice.len names + if position < i + then + let b := core.option.Option.is_none found + if b + then + let v ← Slice.index_usize names position + let s := alloc.vec.Vec.deref v + let b1 ← construct.field_name_equal s wanted + let found1 ← if b1 + then ok (some position) + else ok found + let position1 ← position + 1#usize + ok (cont (position1, found1)) + else ok (done found) + else ok (done found) + +/-- [auths_gateway_kernel::construct::field_index]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/construct.rs', lines 1073:4-1078:5 + Visibility: public -/ +@[rust_loop] +def construct.field_index_loop + (names : Slice (alloc.vec.Vec Std.U8)) (wanted : Slice Std.U8) + (position : Std.Usize) (found : Option Std.Usize) : + Result (Option Std.Usize) + := do + loop + (fun (position1, found1) => construct.field_index_loop.body names wanted + position1 found1) + (position, found) + +/-- [auths_gateway_kernel::construct::field_index]: + Source: 'product/runtime/auths-gateway-kernel/src/construct.rs', lines 1070:0-1080:1 + Visibility: public -/ +@[reducible] +def construct.field_index + (names : Slice (alloc.vec.Vec Std.U8)) (wanted : Slice Std.U8) : + Result (Option Std.Usize) + := do + construct.field_index_loop names wanted 0#usize none + +/-- [auths_gateway_kernel::counter_aggregation::counter_equal]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 19:4-26:1 + Visibility: public -/ +@[rust_loop_body] +def counter_aggregation.counter_equal_loop.body + (left : Array Std.U8 32#usize) (right : Array Std.U8 32#usize) + (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + if index < 32#usize + then + let i ← Array.index_usize left index + let i1 ← Array.index_usize right index + if i != i1 + then ok (done false) + else let index1 ← index + 1#usize + ok (cont index1) + else ok (done true) + +/-- [auths_gateway_kernel::counter_aggregation::counter_equal]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 19:4-26:1 + Visibility: public -/ +@[rust_loop] +def counter_aggregation.counter_equal_loop + (left : Array Std.U8 32#usize) (right : Array Std.U8 32#usize) + (index : Std.Usize) : + Result Bool + := do + loop + (fun index1 => counter_aggregation.counter_equal_loop.body left right + index1) + index + +/-- [auths_gateway_kernel::counter_aggregation::counter_equal]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 17:0-26:1 + Visibility: public -/ +@[reducible] +def counter_aggregation.counter_equal + (left : Array Std.U8 32#usize) (right : Array Std.U8 32#usize) : + Result Bool + := do + counter_aggregation.counter_equal_loop left right 0#usize + +/-- [auths_gateway_kernel::counter_aggregation::counter_position]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 32:4-39:1 + Visibility: public -/ +@[rust_loop_body] +def counter_aggregation.counter_position_loop.body + (counters : Slice counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) (index : Std.Usize) : + Result (ControlFlow Std.Usize (Option Std.Usize)) + := do + let i := Slice.len counters + if index < i + then + let cc ← Slice.index_usize counters index + let b ← counter_aggregation.counter_equal cc.key key + if b + then ok (done (some index)) + else let index1 ← index + 1#usize + ok (cont index1) + else ok (done none) + +/-- [auths_gateway_kernel::counter_aggregation::counter_position]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 32:4-39:1 + Visibility: public -/ +@[rust_loop] +def counter_aggregation.counter_position_loop + (counters : Slice counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) (index : Std.Usize) : + Result (Option Std.Usize) + := do + loop + (fun index1 => counter_aggregation.counter_position_loop.body counters key + index1) + index + +/-- [auths_gateway_kernel::counter_aggregation::counter_position]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 30:0-39:1 + Visibility: public -/ +@[reducible] +def counter_aggregation.counter_position + (counters : Slice counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) : + Result (Option Std.Usize) + := do + counter_aggregation.counter_position_loop counters key 0#usize + +/-- [auths_gateway_kernel::counter_aggregation::count_capacity]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 44:0-49:1 + Visibility: public -/ +def counter_aggregation.count_capacity + (counters : Slice counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) : + Result Std.U64 + := do + let o ← counter_aggregation.counter_position counters key + match o with + | none => ok 0#u64 + | some index => let cc ← Slice.index_usize counters index + ok cc.capacity + +/-- [auths_gateway_kernel::counter_aggregation::linked_sum_contribution]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 54:0-65:1 + Visibility: public -/ +def counter_aggregation.linked_sum_contribution + (counts : Slice counter_aggregation.CounterCapacity) + (count_key : Array Std.U8 32#usize) (sum_key : Array Std.U8 32#usize) + (capacity : Std.U64) : + Result counter_aggregation.SumCapacity + := do + let i ← counter_aggregation.count_capacity counts count_key + ok { key := sum_key, capacity, slots := i } + +/-- [auths_gateway_kernel::counter_aggregation::contribute]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 70:0-84:1 + Visibility: public -/ +def counter_aggregation.contribute + (counters : alloc.vec.Vec counter_aggregation.CounterCapacity) + (key : Array Std.U8 32#usize) (capacity : Std.U64) : + Result (alloc.vec.Vec counter_aggregation.CounterCapacity) + := do + let s := alloc.vec.Vec.deref counters + let o ← counter_aggregation.counter_position s key + match o with + | none => + alloc.vec.Vec.push counters ({ key, capacity } : + counter_aggregation.CounterCapacity) + | some index => + let cc ← + alloc.vec.Vec.index (core.slice.index.SliceIndexUsizeSlice + counter_aggregation.CounterCapacity) counters index + if capacity < cc.capacity + then + let (cc1, index_mut_back) ← + alloc.vec.Vec.index_mut (core.slice.index.SliceIndexUsizeSlice + counter_aggregation.CounterCapacity) counters index + ok (index_mut_back { cc1 with capacity }) + else ok counters + +/-- [auths_gateway_kernel::counter_aggregation::aggregate]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 93:4-97:5 + Visibility: public -/ +@[rust_loop_body] +def counter_aggregation.aggregate_loop.body + (contributions : Slice counter_aggregation.CounterCapacity) + (counters : alloc.vec.Vec counter_aggregation.CounterCapacity) + (index : Std.Usize) : + Result (ControlFlow ((alloc.vec.Vec counter_aggregation.CounterCapacity) × + Std.Usize) (alloc.vec.Vec counter_aggregation.CounterCapacity)) + := do + let i := Slice.len contributions + if index < i + then + let contribution ← Slice.index_usize contributions index + let counters1 ← + counter_aggregation.contribute counters contribution.key + contribution.capacity + let index1 ← index + 1#usize + ok (cont (counters1, index1)) + else ok (done counters) + +/-- [auths_gateway_kernel::counter_aggregation::aggregate]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 93:4-97:5 + Visibility: public -/ +@[rust_loop] +def counter_aggregation.aggregate_loop + (contributions : Slice counter_aggregation.CounterCapacity) + (counters : alloc.vec.Vec counter_aggregation.CounterCapacity) + (index : Std.Usize) : + Result (alloc.vec.Vec counter_aggregation.CounterCapacity) + := do + loop + (fun (counters1, index1) => counter_aggregation.aggregate_loop.body + contributions counters1 index1) + (counters, index) + +/-- [auths_gateway_kernel::counter_aggregation::aggregate]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 90:0-99:1 + Visibility: public -/ +@[reducible] +def counter_aggregation.aggregate + (contributions : Slice counter_aggregation.CounterCapacity) : + Result (alloc.vec.Vec counter_aggregation.CounterCapacity) + := do + counter_aggregation.aggregate_loop contributions (alloc.vec.Vec.new + counter_aggregation.CounterCapacity) 0#usize + +/-- [auths_gateway_kernel::counter_aggregation::sum_position]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 236:4-243:1 + Visibility: public -/ +@[rust_loop_body] +def counter_aggregation.sum_position_loop.body + (counters : Slice counter_aggregation.SumCapacity) + (key : Array Std.U8 32#usize) (index : Std.Usize) : + Result (ControlFlow Std.Usize (Option Std.Usize)) + := do + let i := Slice.len counters + if index < i + then + let sc ← Slice.index_usize counters index + let b ← counter_aggregation.counter_equal sc.key key + if b + then ok (done (some index)) + else let index1 ← index + 1#usize + ok (cont index1) + else ok (done none) + +/-- [auths_gateway_kernel::counter_aggregation::sum_position]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 236:4-243:1 + Visibility: public -/ +@[rust_loop] +def counter_aggregation.sum_position_loop + (counters : Slice counter_aggregation.SumCapacity) + (key : Array Std.U8 32#usize) (index : Std.Usize) : + Result (Option Std.Usize) + := do + loop + (fun index1 => counter_aggregation.sum_position_loop.body counters key + index1) + index + +/-- [auths_gateway_kernel::counter_aggregation::sum_position]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 234:0-243:1 + Visibility: public -/ +@[reducible] +def counter_aggregation.sum_position + (counters : Slice counter_aggregation.SumCapacity) + (key : Array Std.U8 32#usize) : + Result (Option Std.Usize) + := do + counter_aggregation.sum_position_loop counters key 0#usize + +/-- [auths_gateway_kernel::counter_aggregation::contribute_sum]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 248:0-267:1 + Visibility: public -/ +def counter_aggregation.contribute_sum + (counters : alloc.vec.Vec counter_aggregation.SumCapacity) + (key : Array Std.U8 32#usize) (capacity : Std.U64) (slots : Std.U64) : + Result (alloc.vec.Vec counter_aggregation.SumCapacity) + := do + let s := alloc.vec.Vec.deref counters + let o ← counter_aggregation.sum_position s key + match o with + | none => + alloc.vec.Vec.push counters ({ key, capacity, slots } : + counter_aggregation.SumCapacity) + | some index => + let sc ← + alloc.vec.Vec.index (core.slice.index.SliceIndexUsizeSlice + counter_aggregation.SumCapacity) counters index + if capacity < sc.capacity + then + let (sc1, index_mut_back) ← + alloc.vec.Vec.index_mut (core.slice.index.SliceIndexUsizeSlice + counter_aggregation.SumCapacity) counters index + ok (index_mut_back { sc1 with capacity }) + else ok counters + +/-- [auths_gateway_kernel::counter_aggregation::aggregate_sum]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 275:4-284:5 + Visibility: public -/ +@[rust_loop_body] +def counter_aggregation.aggregate_sum_loop.body + (contributions : Slice counter_aggregation.SumCapacity) + (counters : alloc.vec.Vec counter_aggregation.SumCapacity) + (index : Std.Usize) : + Result (ControlFlow ((alloc.vec.Vec counter_aggregation.SumCapacity) × + Std.Usize) (alloc.vec.Vec counter_aggregation.SumCapacity)) + := do + let i := Slice.len contributions + if index < i + then + let contribution ← Slice.index_usize contributions index + let counters1 ← + counter_aggregation.contribute_sum counters contribution.key + contribution.capacity contribution.slots + let index1 ← index + 1#usize + ok (cont (counters1, index1)) + else ok (done counters) + +/-- [auths_gateway_kernel::counter_aggregation::aggregate_sum]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 275:4-284:5 + Visibility: public -/ +@[rust_loop] +def counter_aggregation.aggregate_sum_loop + (contributions : Slice counter_aggregation.SumCapacity) + (counters : alloc.vec.Vec counter_aggregation.SumCapacity) + (index : Std.Usize) : + Result (alloc.vec.Vec counter_aggregation.SumCapacity) + := do + loop + (fun (counters1, index1) => counter_aggregation.aggregate_sum_loop.body + contributions counters1 index1) + (counters, index) + +/-- [auths_gateway_kernel::counter_aggregation::aggregate_sum]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 272:0-286:1 + Visibility: public -/ +@[reducible] +def counter_aggregation.aggregate_sum + (contributions : Slice counter_aggregation.SumCapacity) : + Result (alloc.vec.Vec counter_aggregation.SumCapacity) + := do + counter_aggregation.aggregate_sum_loop contributions (alloc.vec.Vec.new + counter_aggregation.SumCapacity) 0#usize + +/-- [auths_gateway_kernel::counter_preimages::append_word]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 6:0-8:1 -/ +def counter_preimages.append_word + (output : alloc.vec.Vec Std.U8) (value : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let a ← lift (core.num.U64.to_be_bytes value) + let s ← lift (Array.to_slice a) + construct.append_bytes output s + +/-- [auths_gateway_kernel::counter_preimages::append_component]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 10:0-14:1 -/ +def counter_preimages.append_component + (output : alloc.vec.Vec Std.U8) (value : Slice Std.U8) : + Result (alloc.vec.Vec Std.U8) + := do + let i := Slice.len value + let r ← U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from i + let length ← core.result.Result.unwrap_or r core.num.U64.MAX + let output1 ← counter_preimages.append_word output length + construct.append_bytes output1 value + +/-- [auths_gateway_kernel::counter_preimages::append_coordinates]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 16:0-19:1 -/ +def counter_preimages.append_coordinates + (output : alloc.vec.Vec Std.U8) (window : Std.U64) (index : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let output1 ← counter_preimages.append_word output window + counter_preimages.append_word output1 index + +/-- [auths_gateway_kernel::counter_preimages::count_counter_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 26:0-38:1 + Visibility: public -/ +def counter_preimages.count_counter_preimage + (namespace1 : Slice Std.U8) (subject : Slice Std.U8) + (evaluator : Slice Std.U8) (window : Std.U64) (index : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let s ← + lift (Array.to_slice + (Array.make 30#usize [ + 97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, + 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 98#u8, 111#u8, 117#u8, 110#u8, + 100#u8, 101#u8, 100#u8, 45#u8, 99#u8, 111#u8, 117#u8, 110#u8, 116#u8, + 47#u8, 50#u8, 0#u8 + ])) + let output ← construct.copy_bytes s + let output1 ← counter_preimages.append_component output namespace1 + let output2 ← counter_preimages.append_component output1 subject + let output3 ← counter_preimages.append_component output2 evaluator + counter_preimages.append_coordinates output3 window index + +/-- [auths_gateway_kernel::counter_preimages::sum_counter_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 43:0-57:1 + Visibility: public -/ +def counter_preimages.sum_counter_preimage + (namespace1 : Slice Std.U8) (subject : Slice Std.U8) + (evaluator : Slice Std.U8) (partition : Slice Std.U8) (window : Std.U64) + (index : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let s ← + lift (Array.to_slice + (Array.make 28#usize [ + 97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, + 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 98#u8, 111#u8, 117#u8, 110#u8, + 100#u8, 101#u8, 100#u8, 45#u8, 115#u8, 117#u8, 109#u8, 47#u8, 49#u8, + 0#u8 + ])) + let output ← construct.copy_bytes s + let output1 ← counter_preimages.append_component output namespace1 + let output2 ← counter_preimages.append_component output1 subject + let output3 ← counter_preimages.append_component output2 evaluator + let output4 ← counter_preimages.append_component output3 partition + counter_preimages.append_coordinates output4 window index + +/-- [auths_gateway_kernel::counter_preimages::slot_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 59:0-62:1 -/ +def counter_preimages.slot_preimage + (domain : Slice Std.U8) (counter : Array Std.U8 32#usize) (slot : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let v ← construct.copy_bytes domain + let s ← lift (Array.to_slice counter) + let output ← construct.append_bytes v s + counter_preimages.append_word output slot + +/-- [auths_gateway_kernel::counter_preimages::count_slot_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 67:0-69:1 + Visibility: public -/ +def counter_preimages.count_slot_preimage + (counter : Array Std.U8 32#usize) (slot : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let s ← + lift (Array.to_slice + (Array.make 35#usize [ + 97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, + 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 98#u8, 111#u8, 117#u8, 110#u8, + 100#u8, 101#u8, 100#u8, 45#u8, 99#u8, 111#u8, 117#u8, 110#u8, 116#u8, + 45#u8, 115#u8, 108#u8, 111#u8, 116#u8, 47#u8, 50#u8, 0#u8 + ])) + counter_preimages.slot_preimage s counter slot + +/-- [auths_gateway_kernel::counter_preimages::sum_slot_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/counter_preimages.rs', lines 74:0-76:1 + Visibility: public -/ +def counter_preimages.sum_slot_preimage + (counter : Array Std.U8 32#usize) (slot : Std.U64) : + Result (alloc.vec.Vec Std.U8) + := do + let s ← + lift (Array.to_slice + (Array.make 33#usize [ + 97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, + 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 98#u8, 111#u8, 117#u8, 110#u8, + 100#u8, 101#u8, 100#u8, 45#u8, 115#u8, 117#u8, 109#u8, 45#u8, 115#u8, + 108#u8, 111#u8, 116#u8, 47#u8, 49#u8, 0#u8 + ])) + counter_preimages.slot_preimage s counter slot + +/-- [auths_gateway_kernel::deadline::intersect_entry_bounds]: + Source: 'product/runtime/auths-gateway-kernel/src/deadline.rs', lines 15:0-24:1 + Visibility: public -/ +def deadline.intersect_entry_bounds + (left : deadline.EntryBound) (right : deadline.EntryBound) : + Result deadline.EntryBound + := do + let o ← lift (core.cmp.impls.OrdU64.cmp left.not_after right.not_after) + match o with + | Ordering.lt => ok left + | Ordering.eq => + if left.inclusive + then ok { left with inclusive := right.inclusive } + else ok left + | Ordering.gt => ok right + +/-- [auths_gateway_kernel::deadline::entry_time_allows]: + Source: 'product/runtime/auths-gateway-kernel/src/deadline.rs', lines 29:0-31:1 + Visibility: public -/ +def deadline.entry_time_allows + (evaluated_at : Std.U64) (now : Std.U64) (bound : deadline.EntryBound) : + Result Bool + := do + if now >= evaluated_at + then + if now < bound.not_after + then ok true + else if now = bound.not_after + then ok bound.inclusive + else ok false + else ok false + +/-- [auths_gateway_kernel::entry_authorization::profile_allowed]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/entry_authorization.rs', lines 32:4-40:1 + Visibility: public -/ +@[rust_loop_body] +def entry_authorization.profile_allowed_loop.body + (allowed : Slice entry_authorization.EntryProfile) + (requested : entry_authorization.EntryProfile) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len allowed + if index < i + then + let profile ← Slice.index_usize allowed index + if profile.version = requested.version + then + let s := alloc.vec.Vec.deref profile.id + let s1 := alloc.vec.Vec.deref requested.id + let b ← construct.field_name_equal s s1 + if b + then ok (done true) + else let index1 ← index + 1#usize + ok (cont index1) + else let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + +/-- [auths_gateway_kernel::entry_authorization::profile_allowed]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/entry_authorization.rs', lines 32:4-40:1 + Visibility: public -/ +@[rust_loop] +def entry_authorization.profile_allowed_loop + (allowed : Slice entry_authorization.EntryProfile) + (requested : entry_authorization.EntryProfile) (index : Std.Usize) : + Result Bool + := do + loop + (fun index1 => entry_authorization.profile_allowed_loop.body allowed + requested index1) + index + +/-- [auths_gateway_kernel::entry_authorization::profile_allowed]: + Source: 'product/runtime/auths-gateway-kernel/src/entry_authorization.rs', lines 30:0-40:1 + Visibility: public -/ +@[reducible] +def entry_authorization.profile_allowed + (allowed : Slice entry_authorization.EntryProfile) + (requested : entry_authorization.EntryProfile) : + Result Bool + := do + entry_authorization.profile_allowed_loop allowed requested 0#usize + +/-- [auths_gateway_kernel::entry_authorization::entry_allows]: + Source: 'product/runtime/auths-gateway-kernel/src/entry_authorization.rs', lines 45:0-60:1 + Visibility: public -/ +def entry_authorization.entry_allows + (state : entry_authorization.EntryState) + (workloads : Slice (alloc.vec.Vec Std.U8)) + (profiles : Slice entry_authorization.EntryProfile) (workload : Slice Std.U8) + (profile : entry_authorization.EntryProfile) : + Result Bool + := do + match state with + | entry_authorization.EntryState.Active => + let o ← construct.field_index workloads workload + match o with + | none => ok false + | some _ => entry_authorization.profile_allowed profiles profile + | entry_authorization.EntryState.Disabled => ok false + | entry_authorization.EntryState.Revoked => ok false + +/-- [auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new]: + Source: 'product/runtime/auths-gateway-kernel/src/frontier.rs', lines 16:4-21:5 + Visibility: public -/ +def frontier.FrontierSearch.new + (bound : Std.U64) : Result frontier.FrontierSearch := do + ok { lower := 0#u64, upper := bound } + +/-- [auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe]: + Source: 'product/runtime/auths-gateway-kernel/src/frontier.rs', lines 26:4-32:5 + Visibility: public -/ +def frontier.FrontierSearch.probe + (self : frontier.FrontierSearch) : Result (Option Std.U64) := do + if self.lower < self.upper + then + let i ← self.upper - self.lower + let i1 ← i / 2#u64 + let i2 ← self.lower + i1 + ok (some i2) + else ok none + +/-- [auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe]: + Source: 'product/runtime/auths-gateway-kernel/src/frontier.rs', lines 37:4-54:5 + Visibility: public -/ +def frontier.FrontierSearch.observe + (self : frontier.FrontierSearch) (occupied : Bool) : + Result frontier.FrontierSearch + := do + let o ← frontier.FrontierSearch.probe self + match o with + | none => ok self + | some middle => + if occupied + then let i ← middle + 1#u64 + ok { self with lower := i } + else ok { self with upper := middle } + +/-- [auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate]: + Source: 'product/runtime/auths-gateway-kernel/src/frontier.rs', lines 59:4-61:5 + Visibility: public -/ +def frontier.FrontierSearch.candidate + (self : frontier.FrontierSearch) : Result Std.U64 := do + ok self.lower + +/-- [auths_gateway_kernel::identity::valid_token]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/identity.rs', lines 17:4-22:5 + Visibility: public -/ +@[rust_loop_body] +def identity.valid_token_loop.body + (value : Slice Std.U8) (position : Std.Usize) (valid : Bool) : + Result (ControlFlow (Std.Usize × Bool) Bool) + := do + let i := Slice.len value + if position < i + then + if valid + then + let byte ← Slice.index_usize value position + let b ← construct.is_alphanumeric byte + let valid1 ← + if b + then ok true + else + if position > 0#usize + then + if byte = 46#u8 + then ok true + else if byte = 95#u8 + then ok true + else ok (byte = 45#u8) + else ok false + let position1 ← position + 1#usize + ok (cont (position1, valid1)) + else ok (done false) + else ok (done valid) + +/-- [auths_gateway_kernel::identity::valid_token]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/identity.rs', lines 17:4-22:5 + Visibility: public -/ +@[rust_loop] +def identity.valid_token_loop + (value : Slice Std.U8) (position : Std.Usize) (valid : Bool) : + Result Bool + := do + loop + (fun (position1, valid1) => identity.valid_token_loop.body value position1 + valid1) + (position, valid) + +/-- [auths_gateway_kernel::identity::valid_token]: + Source: 'product/runtime/auths-gateway-kernel/src/identity.rs', lines 11:0-24:1 + Visibility: public -/ +def identity.valid_token + (value : Slice Std.U8) (maximum : Std.Usize) : Result Bool := do + let b ← core.slice.Slice.is_empty value + if b + then ok false + else + let i := Slice.len value + if i > maximum + then ok false + else identity.valid_token_loop value 0#usize true + +/-- [auths_gateway_kernel::identity::logical_operation_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/identity.rs', lines 30:0-35:1 + Visibility: public -/ +def identity.logical_operation_preimage + (namespace1 : Slice Std.U8) (operation : Slice Std.U8) : + Result (alloc.vec.Vec Std.U8) + := do + let s ← + lift (Array.to_slice + (Array.make 34#usize [ + 97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, + 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 108#u8, 111#u8, 103#u8, 105#u8, + 99#u8, 97#u8, 108#u8, 45#u8, 111#u8, 112#u8, 101#u8, 114#u8, 97#u8, + 116#u8, 105#u8, 111#u8, 110#u8, 47#u8, 49#u8, 0#u8 + ])) + let output ← construct.copy_bytes s + let output1 ← construct.append_bytes output namespace1 + let output2 ← alloc.vec.Vec.push output1 0#u8 + construct.append_bytes output2 operation + +/-- [auths_gateway_kernel::identity::connection_record_preimage]: + Source: 'product/runtime/auths-gateway-kernel/src/identity.rs', lines 41:0-46:1 + Visibility: public -/ +def identity.connection_record_preimage + (provider : Slice Std.U8) (alias1 : Slice Std.U8) : + Result (alloc.vec.Vec Std.U8) + := do + let s ← + lift (Array.to_slice + (Array.make 27#usize [ + 97#u8, 117#u8, 116#u8, 104#u8, 115#u8, 46#u8, 103#u8, 97#u8, 116#u8, + 101#u8, 119#u8, 97#u8, 121#u8, 45#u8, 99#u8, 111#u8, 110#u8, 110#u8, + 101#u8, 99#u8, 116#u8, 105#u8, 111#u8, 110#u8, 47#u8, 49#u8, 0#u8 + ])) + let output ← construct.copy_bytes s + let output1 ← construct.append_bytes output provider + let output2 ← alloc.vec.Vec.push output1 0#u8 + construct.append_bytes output2 alias1 + /-- [auths_gateway_kernel::order::start]: Source: 'product/runtime/auths-gateway-kernel/src/order.rs', lines 387:0-393:1 Visibility: public -/ @@ -2311,6 +3083,252 @@ def recovery.recovery_capability write_is_conditional := false } +/-- [auths_gateway_kernel::reservation_batch::MAX_COUNTERS_PER_KIND] + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 7:0-7:44 + Visibility: public -/ +@[global_simps, irreducible] +def reservation_batch.MAX_COUNTERS_PER_KIND : Std.Usize := 16#usize + +/-- [auths_gateway_kernel::reservation_batch::build_batch]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 54:4-60:5 + Visibility: public -/ +@[rust_loop_body] +def reservation_batch.build_batch_loop0.body + (counts : Slice counter_aggregation.CounterCapacity) + (count_slots : Slice Std.U64) + (entries : alloc.vec.Vec reservation_batch.SlotEntry) (index : Std.Usize) : + Result (ControlFlow ((alloc.vec.Vec reservation_batch.SlotEntry) × + Std.Usize) (alloc.vec.Vec reservation_batch.SlotEntry)) + := do + let i := Slice.len counts + if index < i + then + let cc ← Slice.index_usize counts index + let i1 ← Slice.index_usize count_slots index + let entries1 ← + alloc.vec.Vec.push entries (reservation_batch.SlotEntry.Count cc.key i1) + let index1 ← index + 1#usize + ok (cont (entries1, index1)) + else ok (done entries) + +/-- [auths_gateway_kernel::reservation_batch::build_batch]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 54:4-60:5 + Visibility: public -/ +@[rust_loop] +def reservation_batch.build_batch_loop0 + (counts : Slice counter_aggregation.CounterCapacity) + (count_slots : Slice Std.U64) + (entries : alloc.vec.Vec reservation_batch.SlotEntry) (index : Std.Usize) : + Result (alloc.vec.Vec reservation_batch.SlotEntry) + := do + loop + (fun (entries1, index1) => reservation_batch.build_batch_loop0.body counts + count_slots entries1 index1) + (entries, index) + +/-- [auths_gateway_kernel::reservation_batch::build_batch]: loop body 1: + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 62:4-75:1 + Visibility: public -/ +@[rust_loop_body] +def reservation_batch.build_batch_loop1.body + (sums : Slice counter_aggregation.SumCapacity) (sum_slots : Slice Std.U64) + (totals : Slice Std.U64) (amount : Std.U64) + (entries : alloc.vec.Vec reservation_batch.SlotEntry) (index : Std.Usize) : + Result (ControlFlow ((alloc.vec.Vec reservation_batch.SlotEntry) × + Std.Usize) (Option (alloc.vec.Vec reservation_batch.SlotEntry))) + := do + let i := Slice.len sums + if index < i + then + let i1 ← Slice.index_usize totals index + let o ← lift (U64.checked_add i1 amount) + match o with + | none => ok (done none) + | some cumulative => + let sc ← Slice.index_usize sums index + let i2 ← Slice.index_usize sum_slots index + let entries1 ← + alloc.vec.Vec.push entries (reservation_batch.SlotEntry.Sum sc.key i2 + amount cumulative) + let index1 ← index + 1#usize + ok (cont (entries1, index1)) + else ok (done (some entries)) + +/-- [auths_gateway_kernel::reservation_batch::build_batch]: loop 1: + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 62:4-75:1 + Visibility: public -/ +@[rust_loop] +def reservation_batch.build_batch_loop1 + (sums : Slice counter_aggregation.SumCapacity) (sum_slots : Slice Std.U64) + (totals : Slice Std.U64) (amount : Std.U64) + (entries : alloc.vec.Vec reservation_batch.SlotEntry) (index : Std.Usize) : + Result (Option (alloc.vec.Vec reservation_batch.SlotEntry)) + := do + loop + (fun (entries1, index1) => reservation_batch.build_batch_loop1.body sums + sum_slots totals amount entries1 index1) + (entries, index) + +/-- [auths_gateway_kernel::reservation_batch::build_batch]: + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 33:0-75:1 + Visibility: public -/ +def reservation_batch.build_batch + (claim : Array Std.U8 32#usize) + (counts : Slice counter_aggregation.CounterCapacity) + (count_slots : Slice Std.U64) (sums : Slice counter_aggregation.SumCapacity) + (sum_slots : Slice Std.U64) (totals : Slice Std.U64) (amount : Std.U64) : + Result (Option (alloc.vec.Vec reservation_batch.SlotEntry)) + := do + let i := Slice.len counts + if i > reservation_batch.MAX_COUNTERS_PER_KIND + then ok none + else + let i1 := Slice.len sums + if i1 > reservation_batch.MAX_COUNTERS_PER_KIND + then ok none + else + let i2 := Slice.len counts + let i3 := Slice.len count_slots + if i2 != i3 + then ok none + else + let i4 := Slice.len sums + let i5 := Slice.len sum_slots + if i4 != i5 + then ok none + else + let i6 := Slice.len sums + let i7 := Slice.len totals + if i6 != i7 + then ok none + else + let entries ← + alloc.vec.Vec.push (alloc.vec.Vec.new + reservation_batch.SlotEntry) (reservation_batch.SlotEntry.Claim + claim) + let entries1 ← + reservation_batch.build_batch_loop0 counts count_slots entries + 0#usize + reservation_batch.build_batch_loop1 sums sum_slots totals amount + entries1 0#usize + +/-- [auths_gateway_kernel::reservation_retry::retry_target]: + Source: 'product/runtime/auths-gateway-kernel/src/reservation_retry.rs', lines 24:0-54:1 + Visibility: public -/ +def reservation_retry.retry_target + (index : Std.Usize) (counts : Slice Std.U64) (sums : Slice Std.U64) + (totals_len : Std.Usize) (sum_counters_len : Std.Usize) : + Result reservation_retry.RetryTarget + := do + if index = 0#usize + then ok reservation_retry.RetryTarget.Replay + else + let position ← index - 1#usize + let i := Slice.len counts + if position < i + then + let i1 ← Slice.index_usize counts position + let o ← lift (U64.checked_add i1 1#u64) + match o with + | none => ok reservation_retry.RetryTarget.Corrupt + | some next => ok (reservation_retry.RetryTarget.Count position next) + else + let i1 := Slice.len counts + let position1 ← position - i1 + let i2 := Slice.len sums + if position1 >= i2 + then ok reservation_retry.RetryTarget.Corrupt + else + if position1 >= totals_len + then ok reservation_retry.RetryTarget.Corrupt + else + if position1 >= sum_counters_len + then ok reservation_retry.RetryTarget.Corrupt + else + let read_slot ← Slice.index_usize sums position1 + let o ← lift (U64.checked_add read_slot 1#u64) + match o with + | none => ok reservation_retry.RetryTarget.Corrupt + | some next => + ok (reservation_retry.RetryTarget.Sum position1 read_slot next) + +/-- [auths_gateway_kernel::slot_record::counter_hex_matches]: loop body 0: + Source: 'product/runtime/auths-gateway-kernel/src/slot_record.rs', lines 23:4-33:1 + Visibility: public -/ +@[rust_loop_body] +def slot_record.counter_hex_matches_loop.body + (stored : Slice Std.U8) (counter : Array Std.U8 32#usize) (index : Std.Usize) + : + Result (ControlFlow Std.Usize Bool) + := do + if index < 32#usize + then + let byte ← Array.index_usize counter index + let i ← index * 2#usize + let i1 ← Slice.index_usize stored i + let i2 ← byte / 16#u8 + let i3 ← construct.hex_lower i2 + if i1 != i3 + then ok (done false) + else + let i4 ← i + 1#usize + let i5 ← Slice.index_usize stored i4 + let i6 ← byte % 16#u8 + let i7 ← construct.hex_lower i6 + if i5 != i7 + then ok (done false) + else let index1 ← index + 1#usize + ok (cont index1) + else ok (done true) + +/-- [auths_gateway_kernel::slot_record::counter_hex_matches]: loop 0: + Source: 'product/runtime/auths-gateway-kernel/src/slot_record.rs', lines 23:4-33:1 + Visibility: public -/ +@[rust_loop] +def slot_record.counter_hex_matches_loop + (stored : Slice Std.U8) (counter : Array Std.U8 32#usize) (index : Std.Usize) + : + Result Bool + := do + loop + (fun index1 => slot_record.counter_hex_matches_loop.body stored counter + index1) + index + +/-- [auths_gateway_kernel::slot_record::counter_hex_matches]: + Source: 'product/runtime/auths-gateway-kernel/src/slot_record.rs', lines 18:0-33:1 + Visibility: public -/ +def slot_record.counter_hex_matches + (stored : Slice Std.U8) (counter : Array Std.U8 32#usize) : Result Bool := do + let i := Slice.len stored + if i != 64#usize + then ok false + else slot_record.counter_hex_matches_loop stored counter 0#usize + +/-- [auths_gateway_kernel::slot_record::validate_cumulative]: + Source: 'product/runtime/auths-gateway-kernel/src/slot_record.rs', lines 40:0-56:1 + Visibility: public -/ +def slot_record.validate_cumulative + (schema : Slice Std.U8) (expected_schema : Slice Std.U8) + (counter_hex : Slice Std.U8) (counter : Array Std.U8 32#usize) + (expected_slot : Std.U64) (values : slot_record.SumValues) : + Result (Option Std.U64) + := do + let b ← construct.field_name_equal schema expected_schema + if b + then + let b1 ← slot_record.counter_hex_matches counter_hex counter + if b1 + then + if values.slot != expected_slot + then ok none + else + if values.amount > values.cumulative + then ok none + else ok (some values.cumulative) + else ok none + else ok none + /-- [auths_gateway_kernel::transition::absent]: Source: 'product/runtime/auths-gateway-kernel/src/transition.rs', lines 89:0-91:1 Visibility: public -/ diff --git a/formal/qualification/aeneas/generated/gateway/FunsExternal.lean b/formal/qualification/aeneas/generated/gateway/FunsExternal.lean new file mode 100644 index 000000000..5675c2b51 --- /dev/null +++ b/formal/qualification/aeneas/generated/gateway/FunsExternal.lean @@ -0,0 +1,3 @@ +-- Reuse the reviewed checked usize-to-u64 conversion and Result.unwrap_or models. +import qualification.aeneas.generated.gateway.Types +import qualification.aeneas.generated.standard.CheckedResult diff --git a/formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean new file mode 100644 index 000000000..b35e05eed --- /dev/null +++ b/formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean @@ -0,0 +1,36 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_gateway_kernel]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.gateway.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open auths_gateway_kernel + +/-- [core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 258:12-258:68 + Name pattern: [core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from"] +axiom U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from + : + Std.Usize → Result (core.result.Result Std.U64 + core.num.error.TryFromIntError) + +/-- [core::result::{core::result::Result}::unwrap_or]: + Source: '/rustc/library/core/src/result.rs', lines 1590:4-1593:28 + Name pattern: [core::result::{core::result::Result<@T, @E>}::unwrap_or] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::unwrap_or"] +axiom core.result.Result.unwrap_or + {T : Type} {E : Type} : core.result.Result T E → T → Result T + diff --git a/formal/qualification/aeneas/generated/gateway/Types.lean b/formal/qualification/aeneas/generated/gateway/Types.lean index 2782c58c8..e364be8ad 100644 --- a/formal/qualification/aeneas/generated/gateway/Types.lean +++ b/formal/qualification/aeneas/generated/gateway/Types.lean @@ -147,6 +147,51 @@ inductive construct.ConstructError where | HeaderValue : construct.ConstructError | BodySize : construct.ConstructError +/-- [auths_gateway_kernel::counter_aggregation::CounterCapacity] + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 8:0-13:1 + Visibility: public -/ +structure counter_aggregation.CounterCapacity where + key : Array Std.U8 32#usize + capacity : Std.U64 + +/-- [auths_gateway_kernel::counter_aggregation::SumCapacity] + Source: 'product/runtime/auths-gateway-kernel/src/counter_aggregation.rs', lines 223:0-230:1 + Visibility: public -/ +structure counter_aggregation.SumCapacity where + key : Array Std.U8 32#usize + capacity : Std.U64 + slots : Std.U64 + +/-- [auths_gateway_kernel::deadline::EntryBound] + Source: 'product/runtime/auths-gateway-kernel/src/deadline.rs', lines 6:0-11:1 + Visibility: public -/ +structure deadline.EntryBound where + not_after : Std.U64 + inclusive : Bool + +/-- [auths_gateway_kernel::entry_authorization::EntryState] + Source: 'product/runtime/auths-gateway-kernel/src/entry_authorization.rs', lines 9:0-16:1 + Visibility: public -/ +@[discriminant isize] +inductive entry_authorization.EntryState where +| Active : entry_authorization.EntryState +| Disabled : entry_authorization.EntryState +| Revoked : entry_authorization.EntryState + +/-- [auths_gateway_kernel::entry_authorization::EntryProfile] + Source: 'product/runtime/auths-gateway-kernel/src/entry_authorization.rs', lines 20:0-25:1 + Visibility: public -/ +structure entry_authorization.EntryProfile where + id : alloc.vec.Vec Std.U8 + version : Std.U16 + +/-- [auths_gateway_kernel::frontier::FrontierSearch] + Source: 'product/runtime/auths-gateway-kernel/src/frontier.rs', lines 7:0-10:1 + Visibility: public -/ +structure frontier.FrontierSearch where + lower : Std.U64 + upper : Std.U64 + /-- [auths_gateway_kernel::order::Mode] Source: 'product/runtime/auths-gateway-kernel/src/order.rs', lines 34:0-41:1 Visibility: public -/ @@ -435,6 +480,38 @@ structure recovery.RecoveryCapability where pre_entry_reread : Bool write_is_conditional : Bool +/-- [auths_gateway_kernel::reservation_batch::SlotEntry] + Source: 'product/runtime/auths-gateway-kernel/src/reservation_batch.rs', lines 11:0-23:1 + Visibility: public -/ +@[discriminant isize] +inductive reservation_batch.SlotEntry where +| Claim : Array Std.U8 32#usize → reservation_batch.SlotEntry +| Count : Array Std.U8 32#usize → Std.U64 → reservation_batch.SlotEntry +| Sum : + Array Std.U8 32#usize → + Std.U64 → + Std.U64 → + Std.U64 → + reservation_batch.SlotEntry + +/-- [auths_gateway_kernel::reservation_retry::RetryTarget] + Source: 'product/runtime/auths-gateway-kernel/src/reservation_retry.rs', lines 5:0-18:1 + Visibility: public -/ +@[discriminant isize] +inductive reservation_retry.RetryTarget where +| Replay : reservation_retry.RetryTarget +| Count : Std.Usize → Std.U64 → reservation_retry.RetryTarget +| Sum : Std.Usize → Std.U64 → Std.U64 → reservation_retry.RetryTarget +| Corrupt : reservation_retry.RetryTarget + +/-- [auths_gateway_kernel::slot_record::SumValues] + Source: 'product/runtime/auths-gateway-kernel/src/slot_record.rs', lines 7:0-14:1 + Visibility: public -/ +structure slot_record.SumValues where + slot : Std.U64 + amount : Std.U64 + cumulative : Std.U64 + /-- [auths_gateway_kernel::transition::Stage] Source: 'product/runtime/auths-gateway-kernel/src/transition.rs', lines 19:0-32:1 Visibility: public -/ diff --git a/formal/qualification/aeneas/generated/gateway/translation.json b/formal/qualification/aeneas/generated/gateway/translation.json index fff14d276..68e92f8a2 100644 --- a/formal/qualification/aeneas/generated/gateway/translation.json +++ b/formal/qualification/aeneas/generated/gateway/translation.json @@ -4,7 +4,41 @@ "crate": "auths_gateway_kernel", "functions": [ { - "def_id": 37, + "def_id": 79, + "lean_name": "auths_gateway_kernel.U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/gateway/FunsExternal_Template.lean", + "rust_name": "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 258, + "end_line": 258 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 80, + "lean_name": "auths_gateway_kernel.core.result.Result.unwrap_or", + "lean_file": "qualification/aeneas/generated/gateway/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::unwrap_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 1590, + "end_line": 1593 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 31, "lean_name": "auths_gateway_kernel.construct.append_bytes_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_bytes", @@ -29,7 +63,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_bytes" }, { - "def_id": 37, + "def_id": 31, "lean_name": "auths_gateway_kernel.construct.append_bytes_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_bytes", @@ -54,7 +88,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_bytes" }, { - "def_id": 37, + "def_id": 31, "lean_name": "auths_gateway_kernel.construct.append_bytes", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_bytes", @@ -71,7 +105,7 @@ "reducible": true }, { - "def_id": 18, + "def_id": 30, "lean_name": "auths_gateway_kernel.construct.copy_bytes", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::copy_bytes", @@ -88,7 +122,7 @@ "reducible": false }, { - "def_id": 113, + "def_id": 50, "lean_name": "auths_gateway_kernel.construct.is_alphanumeric", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::is_alphanumeric", @@ -105,7 +139,7 @@ "reducible": false }, { - "def_id": 109, + "def_id": 188, "lean_name": "auths_gateway_kernel.construct.is_path_literal", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::is_path_literal", @@ -122,7 +156,7 @@ "reducible": false }, { - "def_id": 111, + "def_id": 190, "lean_name": "auths_gateway_kernel.construct.is_form_literal", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::is_form_literal", @@ -139,7 +173,7 @@ "reducible": false }, { - "def_id": 114, + "def_id": 192, "lean_name": "auths_gateway_kernel.construct.hex_upper", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::hex_upper", @@ -156,7 +190,7 @@ "reducible": false }, { - "def_id": 115, + "def_id": 74, "lean_name": "auths_gateway_kernel.construct.hex_lower", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::hex_lower", @@ -173,7 +207,7 @@ "reducible": false }, { - "def_id": 110, + "def_id": 189, "lean_name": "auths_gateway_kernel.construct.append_percent", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_percent", @@ -190,7 +224,7 @@ "reducible": false }, { - "def_id": 103, + "def_id": 182, "lean_name": "auths_gateway_kernel.construct.append_path_byte", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_path_byte", @@ -207,7 +241,7 @@ "reducible": false }, { - "def_id": 96, + "def_id": 176, "lean_name": "auths_gateway_kernel.construct.append_path_encoded_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_path_encoded", @@ -232,7 +266,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_path_encoded" }, { - "def_id": 96, + "def_id": 176, "lean_name": "auths_gateway_kernel.construct.append_path_encoded_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_path_encoded", @@ -257,7 +291,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_path_encoded" }, { - "def_id": 96, + "def_id": 176, "lean_name": "auths_gateway_kernel.construct.append_path_encoded", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_path_encoded", @@ -274,7 +308,7 @@ "reducible": true }, { - "def_id": 95, + "def_id": 175, "lean_name": "auths_gateway_kernel.construct.segment_value_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::segment_value_valid", @@ -291,7 +325,7 @@ "reducible": false }, { - "def_id": 82, + "def_id": 159, "lean_name": "auths_gateway_kernel.construct.segment_error", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::segment_error", @@ -308,7 +342,7 @@ "reducible": false }, { - "def_id": 34, + "def_id": 86, "lean_name": "auths_gateway_kernel.construct.path_error_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::path_error", @@ -333,7 +367,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.path_error" }, { - "def_id": 34, + "def_id": 86, "lean_name": "auths_gateway_kernel.construct.path_error_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::path_error", @@ -358,7 +392,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.path_error" }, { - "def_id": 34, + "def_id": 86, "lean_name": "auths_gateway_kernel.construct.path_error", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::path_error", @@ -375,7 +409,7 @@ "reducible": true }, { - "def_id": 84, + "def_id": 161, "lean_name": "auths_gateway_kernel.construct.append_segment", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_segment", @@ -392,7 +426,7 @@ "reducible": false }, { - "def_id": 35, + "def_id": 87, "lean_name": "auths_gateway_kernel.construct.append_segments_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_segments", @@ -417,7 +451,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_segments" }, { - "def_id": 35, + "def_id": 87, "lean_name": "auths_gateway_kernel.construct.append_segments_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_segments", @@ -442,7 +476,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_segments" }, { - "def_id": 35, + "def_id": 87, "lean_name": "auths_gateway_kernel.construct.append_segments", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_segments", @@ -459,7 +493,7 @@ "reducible": true }, { - "def_id": 13, + "def_id": 53, "lean_name": "auths_gateway_kernel.construct.build_url", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::build_url", @@ -476,7 +510,7 @@ "reducible": false }, { - "def_id": 21, + "def_id": 58, "lean_name": "auths_gateway_kernel.construct.fixed_url_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::fixed_url", @@ -501,7 +535,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.fixed_url" }, { - "def_id": 21, + "def_id": 58, "lean_name": "auths_gateway_kernel.construct.fixed_url_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::fixed_url", @@ -526,7 +560,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.fixed_url" }, { - "def_id": 21, + "def_id": 58, "lean_name": "auths_gateway_kernel.construct.fixed_url", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::fixed_url", @@ -543,7 +577,7 @@ "reducible": false }, { - "def_id": 52, + "def_id": 100, "lean_name": "auths_gateway_kernel.construct.copy_header", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::copy_header", @@ -560,7 +594,7 @@ "reducible": false }, { - "def_id": 22, + "def_id": 59, "lean_name": "auths_gateway_kernel.construct.append_version_headers_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_version_headers", @@ -585,7 +619,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_version_headers" }, { - "def_id": 22, + "def_id": 59, "lean_name": "auths_gateway_kernel.construct.append_version_headers_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_version_headers", @@ -610,7 +644,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_version_headers" }, { - "def_id": 22, + "def_id": 59, "lean_name": "auths_gateway_kernel.construct.append_version_headers", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_version_headers", @@ -627,7 +661,7 @@ "reducible": true }, { - "def_id": 106, + "def_id": 185, "lean_name": "auths_gateway_kernel.construct.is_account_byte", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::is_account_byte", @@ -644,7 +678,7 @@ "reducible": false }, { - "def_id": 100, + "def_id": 180, "lean_name": "auths_gateway_kernel.construct.account_bytes_valid_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::account_bytes_valid", @@ -669,7 +703,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.account_bytes_valid" }, { - "def_id": 100, + "def_id": 180, "lean_name": "auths_gateway_kernel.construct.account_bytes_valid_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::account_bytes_valid", @@ -694,7 +728,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.account_bytes_valid" }, { - "def_id": 100, + "def_id": 180, "lean_name": "auths_gateway_kernel.construct.account_bytes_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::account_bytes_valid", @@ -711,7 +745,7 @@ "reducible": true }, { - "def_id": 91, + "def_id": 168, "lean_name": "auths_gateway_kernel.construct.scope_value_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::scope_value_valid", @@ -728,7 +762,7 @@ "reducible": false }, { - "def_id": 47, + "def_id": 97, "lean_name": "auths_gateway_kernel.construct.account_scope_header", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::account_scope_header", @@ -745,7 +779,7 @@ "reducible": false }, { - "def_id": 17, + "def_id": 57, "lean_name": "auths_gateway_kernel.construct.action_headers", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::action_headers", @@ -762,7 +796,7 @@ "reducible": false }, { - "def_id": 112, + "def_id": 191, "lean_name": "auths_gateway_kernel.construct.append_json_byte", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_byte", @@ -779,7 +813,7 @@ "reducible": false }, { - "def_id": 105, + "def_id": 184, "lean_name": "auths_gateway_kernel.construct.append_json_escaped_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_escaped", @@ -804,7 +838,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_json_escaped" }, { - "def_id": 105, + "def_id": 184, "lean_name": "auths_gateway_kernel.construct.append_json_escaped_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_escaped", @@ -829,7 +863,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_json_escaped" }, { - "def_id": 105, + "def_id": 184, "lean_name": "auths_gateway_kernel.construct.append_json_escaped", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_escaped", @@ -846,7 +880,7 @@ "reducible": true }, { - "def_id": 98, + "def_id": 178, "lean_name": "auths_gateway_kernel.construct.append_json_string", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_string", @@ -863,7 +897,7 @@ "reducible": false }, { - "def_id": 99, + "def_id": 179, "lean_name": "auths_gateway_kernel.construct.append_json_argument", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_argument", @@ -880,7 +914,7 @@ "reducible": false }, { - "def_id": 87, + "def_id": 164, "lean_name": "auths_gateway_kernel.construct.json_piece_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::json_piece_valid", @@ -897,7 +931,7 @@ "reducible": false }, { - "def_id": 44, + "def_id": 94, "lean_name": "auths_gateway_kernel.construct.json_pieces_valid_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::json_pieces_valid", @@ -922,7 +956,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.json_pieces_valid" }, { - "def_id": 44, + "def_id": 94, "lean_name": "auths_gateway_kernel.construct.json_pieces_valid_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::json_pieces_valid", @@ -947,7 +981,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.json_pieces_valid" }, { - "def_id": 44, + "def_id": 94, "lean_name": "auths_gateway_kernel.construct.json_pieces_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::json_pieces_valid", @@ -964,7 +998,7 @@ "reducible": true }, { - "def_id": 89, + "def_id": 166, "lean_name": "auths_gateway_kernel.construct.append_json_piece", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_piece", @@ -981,7 +1015,7 @@ "reducible": false }, { - "def_id": 46, + "def_id": 96, "lean_name": "auths_gateway_kernel.construct.append_json_pieces_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_pieces", @@ -1006,7 +1040,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_json_pieces" }, { - "def_id": 46, + "def_id": 96, "lean_name": "auths_gateway_kernel.construct.append_json_pieces_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_pieces", @@ -1031,7 +1065,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_json_pieces" }, { - "def_id": 46, + "def_id": 96, "lean_name": "auths_gateway_kernel.construct.append_json_pieces", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_json_pieces", @@ -1048,7 +1082,7 @@ "reducible": true }, { - "def_id": 104, + "def_id": 183, "lean_name": "auths_gateway_kernel.construct.append_form_byte", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_byte", @@ -1065,7 +1099,7 @@ "reducible": false }, { - "def_id": 97, + "def_id": 177, "lean_name": "auths_gateway_kernel.construct.append_form_encoded_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_encoded", @@ -1090,7 +1124,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_form_encoded" }, { - "def_id": 97, + "def_id": 177, "lean_name": "auths_gateway_kernel.construct.append_form_encoded_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_encoded", @@ -1115,7 +1149,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_form_encoded" }, { - "def_id": 97, + "def_id": 177, "lean_name": "auths_gateway_kernel.construct.append_form_encoded", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_encoded", @@ -1132,7 +1166,7 @@ "reducible": true }, { - "def_id": 86, + "def_id": 163, "lean_name": "auths_gateway_kernel.construct.form_piece_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::form_piece_valid", @@ -1149,7 +1183,7 @@ "reducible": false }, { - "def_id": 43, + "def_id": 93, "lean_name": "auths_gateway_kernel.construct.form_pieces_valid_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::form_pieces_valid", @@ -1174,7 +1208,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.form_pieces_valid" }, { - "def_id": 43, + "def_id": 93, "lean_name": "auths_gateway_kernel.construct.form_pieces_valid_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::form_pieces_valid", @@ -1199,7 +1233,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.form_pieces_valid" }, { - "def_id": 43, + "def_id": 93, "lean_name": "auths_gateway_kernel.construct.form_pieces_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::form_pieces_valid", @@ -1216,7 +1250,7 @@ "reducible": true }, { - "def_id": 88, + "def_id": 165, "lean_name": "auths_gateway_kernel.construct.append_form_piece", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_piece", @@ -1233,7 +1267,7 @@ "reducible": false }, { - "def_id": 45, + "def_id": 95, "lean_name": "auths_gateway_kernel.construct.append_form_pieces_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_pieces", @@ -1258,7 +1292,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_form_pieces" }, { - "def_id": 45, + "def_id": 95, "lean_name": "auths_gateway_kernel.construct.append_form_pieces_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_pieces", @@ -1283,7 +1317,7 @@ "parent_lean_name": "auths_gateway_kernel.construct.append_form_pieces" }, { - "def_id": 45, + "def_id": 95, "lean_name": "auths_gateway_kernel.construct.append_form_pieces", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::append_form_pieces", @@ -1300,7 +1334,7 @@ "reducible": true }, { - "def_id": 16, + "def_id": 56, "lean_name": "auths_gateway_kernel.construct.build_body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::build_body", @@ -1317,7 +1351,7 @@ "reducible": false }, { - "def_id": 1, + "def_id": 22, "lean_name": "auths_gateway_kernel.construct.construct_write", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::construct_write", @@ -1334,7 +1368,7 @@ "reducible": false }, { - "def_id": 2, + "def_id": 23, "lean_name": "auths_gateway_kernel.construct.construct_action_read", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::construct_action_read", @@ -1351,7 +1385,7 @@ "reducible": false }, { - "def_id": 3, + "def_id": 24, "lean_name": "auths_gateway_kernel.construct.construct_credential_read", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::construct_credential_read", @@ -1368,146 +1402,1106 @@ "reducible": false }, { - "def_id": 4, - "lean_name": "auths_gateway_kernel.order.start", + "def_id": 35, + "lean_name": "auths_gateway_kernel.construct.field_name_equal_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::start", + "rust_name": "auths_gateway_kernel::construct::field_name_equal", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 387, - "end_line": 393 + "file": "product/runtime/auths-gateway-kernel/src/construct.rs", + "begin_line": 1060, + "end_line": 1063 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.construct.field_name_equal" }, { - "def_id": 54, - "lean_name": "auths_gateway_kernel.order.go", + "def_id": 35, + "lean_name": "auths_gateway_kernel.construct.field_name_equal_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::go", + "rust_name": "auths_gateway_kernel::construct::field_name_equal", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 397, - "end_line": 406 + "file": "product/runtime/auths-gateway-kernel/src/construct.rs", + "begin_line": 1060, + "end_line": 1063 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.construct.field_name_equal" }, { - "def_id": 53, - "lean_name": "auths_gateway_kernel.order.stop", + "def_id": 35, + "lean_name": "auths_gateway_kernel.construct.field_name_equal", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::stop", + "rust_name": "auths_gateway_kernel::construct::field_name_equal", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 410, - "end_line": 412 + "file": "product/runtime/auths-gateway-kernel/src/construct.rs", + "begin_line": 1054, + "end_line": 1065 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, "reducible": false }, { - "def_id": 23, - "lean_name": "auths_gateway_kernel.order.halt", + "def_id": 21, + "lean_name": "auths_gateway_kernel.construct.field_index_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::halt", + "rust_name": "auths_gateway_kernel::construct::field_index", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 416, - "end_line": 418 + "file": "product/runtime/auths-gateway-kernel/src/construct.rs", + "begin_line": 1073, + "end_line": 1078 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.construct.field_index" }, { - "def_id": 67, - "lean_name": "auths_gateway_kernel.order.not_entered", + "def_id": 21, + "lean_name": "auths_gateway_kernel.construct.field_index_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::not_entered", + "rust_name": "auths_gateway_kernel::construct::field_index", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 422, - "end_line": 428 + "file": "product/runtime/auths-gateway-kernel/src/construct.rs", + "begin_line": 1073, + "end_line": 1078 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.construct.field_index" }, { - "def_id": 60, - "lean_name": "auths_gateway_kernel.order.lease_failed", + "def_id": 21, + "lean_name": "auths_gateway_kernel.construct.field_index", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::lease_failed", + "rust_name": "auths_gateway_kernel::construct::field_index", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 433, - "end_line": 439 + "file": "product/runtime/auths-gateway-kernel/src/construct.rs", + "begin_line": 1070, + "end_line": 1080 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": true }, { - "def_id": 94, - "lean_name": "auths_gateway_kernel.order.after_reads", + "def_id": 130, + "lean_name": "auths_gateway_kernel.counter_aggregation.counter_equal_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::after_reads", + "rust_name": "auths_gateway_kernel::counter_aggregation::counter_equal", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 445, - "end_line": 451 + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 19, + "end_line": 26 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.counter_equal" }, { - "def_id": 93, - "lean_name": "auths_gateway_kernel.order.ceiling_from", + "def_id": 130, + "lean_name": "auths_gateway_kernel.counter_aggregation.counter_equal_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::ceiling_from", + "rust_name": "auths_gateway_kernel::counter_aggregation::counter_equal", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 455, - "end_line": 461 + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 19, + "end_line": 26 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.counter_equal" }, { - "def_id": 107, - "lean_name": "auths_gateway_kernel.order.pre_entry_from", + "def_id": 130, + "lean_name": "auths_gateway_kernel.counter_aggregation.counter_equal", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::pre_entry_from", + "rust_name": "auths_gateway_kernel::counter_aggregation::counter_equal", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 17, + "end_line": 26 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 73, + "lean_name": "auths_gateway_kernel.counter_aggregation.counter_position_loop.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::counter_position", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 32, + "end_line": 39 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.counter_position" + }, + { + "def_id": 73, + "lean_name": "auths_gateway_kernel.counter_aggregation.counter_position_loop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::counter_position", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 32, + "end_line": 39 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.counter_position" + }, + { + "def_id": 73, + "lean_name": "auths_gateway_kernel.counter_aggregation.counter_position", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::counter_position", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 30, + "end_line": 39 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 34, + "lean_name": "auths_gateway_kernel.counter_aggregation.count_capacity", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::count_capacity", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 44, + "end_line": 49 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "auths_gateway_kernel.counter_aggregation.linked_sum_contribution", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::linked_sum_contribution", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 54, + "end_line": 65 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 41, + "lean_name": "auths_gateway_kernel.counter_aggregation.contribute", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::contribute", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 70, + "end_line": 84 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 7, + "lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_loop.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::aggregate", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 93, + "end_line": 97 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.aggregate" + }, + { + "def_id": 7, + "lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_loop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::aggregate", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 93, + "end_line": 97 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.aggregate" + }, + { + "def_id": 7, + "lean_name": "auths_gateway_kernel.counter_aggregation.aggregate", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::aggregate", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 90, + "end_line": 99 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 76, + "lean_name": "auths_gateway_kernel.counter_aggregation.sum_position_loop.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::sum_position", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 236, + "end_line": 243 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.sum_position" + }, + { + "def_id": 76, + "lean_name": "auths_gateway_kernel.counter_aggregation.sum_position_loop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::sum_position", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 236, + "end_line": 243 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.sum_position" + }, + { + "def_id": 76, + "lean_name": "auths_gateway_kernel.counter_aggregation.sum_position", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::sum_position", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 234, + "end_line": 243 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 40, + "lean_name": "auths_gateway_kernel.counter_aggregation.contribute_sum", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::contribute_sum", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 248, + "end_line": 267 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_sum_loop.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::aggregate_sum", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 275, + "end_line": 284 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_sum" + }, + { + "def_id": 6, + "lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_sum_loop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::aggregate_sum", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 275, + "end_line": 284 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_sum" + }, + { + "def_id": 6, + "lean_name": "auths_gateway_kernel.counter_aggregation.aggregate_sum", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::aggregate_sum", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 272, + "end_line": 286 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 81, + "lean_name": "auths_gateway_kernel.counter_preimages.append_word", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::append_word", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 6, + "end_line": 8 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 42, + "lean_name": "auths_gateway_kernel.counter_preimages.append_component", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::append_component", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 10, + "end_line": 14 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 43, + "lean_name": "auths_gateway_kernel.counter_preimages.append_coordinates", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::append_coordinates", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 16, + "end_line": 19 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 8, + "lean_name": "auths_gateway_kernel.counter_preimages.count_counter_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::count_counter_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 26, + "end_line": 38 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 9, + "lean_name": "auths_gateway_kernel.counter_preimages.sum_counter_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::sum_counter_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 43, + "end_line": 57 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 44, + "lean_name": "auths_gateway_kernel.counter_preimages.slot_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::slot_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 59, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 10, + "lean_name": "auths_gateway_kernel.counter_preimages.count_slot_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::count_slot_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 67, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 11, + "lean_name": "auths_gateway_kernel.counter_preimages.sum_slot_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::counter_preimages::sum_slot_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "begin_line": 74, + "end_line": 76 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "auths_gateway_kernel.deadline.intersect_entry_bounds", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::deadline::intersect_entry_bounds", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/deadline.rs", + "begin_line": 15, + "end_line": 24 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "auths_gateway_kernel.deadline.entry_time_allows", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::deadline::entry_time_allows", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/deadline.rs", + "begin_line": 29, + "end_line": 31 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 33, + "lean_name": "auths_gateway_kernel.entry_authorization.profile_allowed_loop.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::entry_authorization::profile_allowed", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "begin_line": 32, + "end_line": 40 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.entry_authorization.profile_allowed" + }, + { + "def_id": 33, + "lean_name": "auths_gateway_kernel.entry_authorization.profile_allowed_loop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::entry_authorization::profile_allowed", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "begin_line": 32, + "end_line": 40 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.entry_authorization.profile_allowed" + }, + { + "def_id": 33, + "lean_name": "auths_gateway_kernel.entry_authorization.profile_allowed", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::entry_authorization::profile_allowed", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "begin_line": 30, + "end_line": 40 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 1, + "lean_name": "auths_gateway_kernel.entry_authorization.entry_allows", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::entry_authorization::entry_allows", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "begin_line": 45, + "end_line": 60 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 12, + "lean_name": "auths_gateway_kernel.frontier.FrontierSearch.new", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/frontier.rs", + "begin_line": 16, + "end_line": 21 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 13, + "lean_name": "auths_gateway_kernel.frontier.FrontierSearch.probe", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/frontier.rs", + "begin_line": 26, + "end_line": 32 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "auths_gateway_kernel.frontier.FrontierSearch.observe", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/frontier.rs", + "begin_line": 37, + "end_line": 54 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 15, + "lean_name": "auths_gateway_kernel.frontier.FrontierSearch.candidate", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/frontier.rs", + "begin_line": 59, + "end_line": 61 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "auths_gateway_kernel.identity.valid_token_loop.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::identity::valid_token", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/identity.rs", + "begin_line": 17, + "end_line": 22 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.identity.valid_token" + }, + { + "def_id": 19, + "lean_name": "auths_gateway_kernel.identity.valid_token_loop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::identity::valid_token", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/identity.rs", + "begin_line": 17, + "end_line": 22 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.identity.valid_token" + }, + { + "def_id": 19, + "lean_name": "auths_gateway_kernel.identity.valid_token", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::identity::valid_token", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/identity.rs", + "begin_line": 11, + "end_line": 24 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "auths_gateway_kernel.identity.logical_operation_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::identity::logical_operation_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/identity.rs", + "begin_line": 30, + "end_line": 35 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "auths_gateway_kernel.identity.connection_record_preimage", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::identity::connection_record_preimage", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/identity.rs", + "begin_line": 41, + "end_line": 46 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 25, + "lean_name": "auths_gateway_kernel.order.start", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::start", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 387, + "end_line": 393 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 102, + "lean_name": "auths_gateway_kernel.order.go", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::go", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 397, + "end_line": 406 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 101, + "lean_name": "auths_gateway_kernel.order.stop", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::stop", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 410, + "end_line": 412 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 60, + "lean_name": "auths_gateway_kernel.order.halt", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::halt", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 416, + "end_line": 418 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 115, + "lean_name": "auths_gateway_kernel.order.not_entered", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::not_entered", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 422, + "end_line": 428 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 108, + "lean_name": "auths_gateway_kernel.order.lease_failed", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::lease_failed", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 433, + "end_line": 439 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 171, + "lean_name": "auths_gateway_kernel.order.after_reads", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::after_reads", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 445, + "end_line": 451 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 170, + "lean_name": "auths_gateway_kernel.order.ceiling_from", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::ceiling_from", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 455, + "end_line": 461 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 186, + "lean_name": "auths_gateway_kernel.order.pre_entry_from", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::order::pre_entry_from", "is_local": true, "source": { "file": "product/runtime/auths-gateway-kernel/src/order.rs", @@ -1521,7 +2515,7 @@ "reducible": false }, { - "def_id": 101, + "def_id": 181, "lean_name": "auths_gateway_kernel.order.after_credentials", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_credentials", @@ -1538,7 +2532,7 @@ "reducible": false }, { - "def_id": 92, + "def_id": 169, "lean_name": "auths_gateway_kernel.order.denied_from", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::denied_from", @@ -1555,7 +2549,7 @@ "reducible": false }, { - "def_id": 61, + "def_id": 109, "lean_name": "auths_gateway_kernel.order.after_prefix", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_prefix", @@ -1572,7 +2566,7 @@ "reducible": false }, { - "def_id": 55, + "def_id": 103, "lean_name": "auths_gateway_kernel.order.after_admission", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_admission", @@ -1589,7 +2583,7 @@ "reducible": false }, { - "def_id": 57, + "def_id": 105, "lean_name": "auths_gateway_kernel.order.pre_claim", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::pre_claim", @@ -1606,7 +2600,7 @@ "reducible": false }, { - "def_id": 56, + "def_id": 104, "lean_name": "auths_gateway_kernel.order.after_claim", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_claim", @@ -1623,7 +2617,7 @@ "reducible": false }, { - "def_id": 58, + "def_id": 106, "lean_name": "auths_gateway_kernel.order.after_account", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_account", @@ -1640,7 +2634,7 @@ "reducible": false }, { - "def_id": 59, + "def_id": 107, "lean_name": "auths_gateway_kernel.order.after_denied", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_denied", @@ -1657,7 +2651,7 @@ "reducible": false }, { - "def_id": 62, + "def_id": 110, "lean_name": "auths_gateway_kernel.order.after_pre_entry", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_pre_entry", @@ -1674,7 +2668,7 @@ "reducible": false }, { - "def_id": 8, + "def_id": 29, "lean_name": "auths_gateway_kernel.ratio.relative_ceiling_admits", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::ratio::relative_ceiling_admits", @@ -1691,7 +2685,7 @@ "reducible": false }, { - "def_id": 63, + "def_id": 111, "lean_name": "auths_gateway_kernel.order.after_ceiling", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_ceiling", @@ -1708,7 +2702,7 @@ "reducible": false }, { - "def_id": 64, + "def_id": 112, "lean_name": "auths_gateway_kernel.order.after_write", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_write", @@ -1725,7 +2719,7 @@ "reducible": false }, { - "def_id": 65, + "def_id": 113, "lean_name": "auths_gateway_kernel.order.after_response", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_response", @@ -1742,7 +2736,7 @@ "reducible": false }, { - "def_id": 66, + "def_id": 114, "lean_name": "auths_gateway_kernel.order.after_read_back", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::after_read_back", @@ -1759,7 +2753,7 @@ "reducible": false }, { - "def_id": 24, + "def_id": 61, "lean_name": "auths_gateway_kernel.order.pre_claim_step", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::pre_claim_step", @@ -1776,7 +2770,7 @@ "reducible": false }, { - "def_id": 25, + "def_id": 62, "lean_name": "auths_gateway_kernel.order.lease_step", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::lease_step", @@ -1793,7 +2787,7 @@ "reducible": false }, { - "def_id": 26, + "def_id": 63, "lean_name": "auths_gateway_kernel.order.entry_step", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::order::entry_step", @@ -1810,32 +2804,234 @@ "reducible": false }, { - "def_id": 5, + "def_id": 26, "lean_name": "auths_gateway_kernel.order.next_step", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::order::next_step", + "rust_name": "auths_gateway_kernel::order::next_step", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/order.rs", + "begin_line": 846, + "end_line": 873 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 28, + "lean_name": "auths_gateway_kernel.ratio.relative_basis", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::ratio::relative_basis", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/ratio.rs", + "begin_line": 16, + "end_line": 27 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 46, + "lean_name": "auths_gateway_kernel.recovery.provider_link", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::recovery::provider_link", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", + "begin_line": 98, + "end_line": 104 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 47, + "lean_name": "auths_gateway_kernel.recovery.recovery_class", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::recovery::recovery_class", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", + "begin_line": 108, + "end_line": 122 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 48, + "lean_name": "auths_gateway_kernel.recovery.unknown_resolution", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::recovery::unknown_resolution", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", + "begin_line": 126, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 18, + "lean_name": "auths_gateway_kernel.recovery.recovery_capability", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::recovery::recovery_capability", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", + "begin_line": 139, + "end_line": 151 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "auths_gateway_kernel.reservation_batch.build_batch_loop0.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::build_batch", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 54, + "end_line": 60 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.reservation_batch.build_batch" + }, + { + "def_id": 4, + "lean_name": "auths_gateway_kernel.reservation_batch.build_batch_loop0", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::build_batch", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 54, + "end_line": 60 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.reservation_batch.build_batch" + }, + { + "def_id": 4, + "lean_name": "auths_gateway_kernel.reservation_batch.build_batch_loop1.body", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::build_batch", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 62, + "end_line": 75 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 1, + "pos": [ + 1 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.reservation_batch.build_batch" + }, + { + "def_id": 4, + "lean_name": "auths_gateway_kernel.reservation_batch.build_batch_loop1", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::build_batch", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 62, + "end_line": 75 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 1, + "pos": [ + 1 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.reservation_batch.build_batch" + }, + { + "def_id": 4, + "lean_name": "auths_gateway_kernel.reservation_batch.build_batch", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::build_batch", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/order.rs", - "begin_line": 846, - "end_line": 873 + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 33, + "end_line": 75 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, "reducible": false }, { - "def_id": 7, - "lean_name": "auths_gateway_kernel.ratio.relative_basis", + "def_id": 5, + "lean_name": "auths_gateway_kernel.reservation_retry.retry_target", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::ratio::relative_basis", + "rust_name": "auths_gateway_kernel::reservation_retry::retry_target", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/ratio.rs", - "begin_line": 16, - "end_line": 27 + "file": "product/runtime/auths-gateway-kernel/src/reservation_retry.rs", + "begin_line": 24, + "end_line": 54 }, "is_opaque": false, "can_fail": true, @@ -1844,75 +3040,91 @@ "reducible": false }, { - "def_id": 9, - "lean_name": "auths_gateway_kernel.recovery.provider_link", + "def_id": 36, + "lean_name": "auths_gateway_kernel.slot_record.counter_hex_matches_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::recovery::provider_link", + "rust_name": "auths_gateway_kernel::slot_record::counter_hex_matches", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", - "begin_line": 98, - "end_line": 104 + "file": "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "begin_line": 23, + "end_line": 33 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_gateway_kernel.slot_record.counter_hex_matches" }, { - "def_id": 10, - "lean_name": "auths_gateway_kernel.recovery.recovery_class", + "def_id": 36, + "lean_name": "auths_gateway_kernel.slot_record.counter_hex_matches_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::recovery::recovery_class", + "rust_name": "auths_gateway_kernel::slot_record::counter_hex_matches", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", - "begin_line": 108, - "end_line": 122 + "file": "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "begin_line": 23, + "end_line": 33 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, - "reducible": false + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_gateway_kernel.slot_record.counter_hex_matches" }, { - "def_id": 11, - "lean_name": "auths_gateway_kernel.recovery.unknown_resolution", + "def_id": 36, + "lean_name": "auths_gateway_kernel.slot_record.counter_hex_matches", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::recovery::unknown_resolution", + "rust_name": "auths_gateway_kernel::slot_record::counter_hex_matches", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", - "begin_line": 126, - "end_line": 133 + "file": "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "begin_line": 18, + "end_line": 33 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, "reducible": false }, { - "def_id": 0, - "lean_name": "auths_gateway_kernel.recovery.recovery_capability", + "def_id": 3, + "lean_name": "auths_gateway_kernel.slot_record.validate_cumulative", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", - "rust_name": "auths_gateway_kernel::recovery::recovery_capability", + "rust_name": "auths_gateway_kernel::slot_record::validate_cumulative", "is_local": true, "source": { - "file": "product/runtime/auths-gateway-kernel/src/recovery.rs", - "begin_line": 139, - "end_line": 151 + "file": "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "begin_line": 40, + "end_line": 56 }, "is_opaque": false, "can_fail": true, - "can_diverge": false, + "can_diverge": true, "is_rec": false, "reducible": false }, { - "def_id": 71, + "def_id": 119, "lean_name": "auths_gateway_kernel.transition.absent", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::absent", @@ -1929,7 +3141,7 @@ "reducible": false }, { - "def_id": 68, + "def_id": 116, "lean_name": "auths_gateway_kernel.transition.same_bytes_from_loop.body", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::same_bytes_from", @@ -1954,7 +3166,7 @@ "parent_lean_name": "auths_gateway_kernel.transition.same_bytes_from" }, { - "def_id": 68, + "def_id": 116, "lean_name": "auths_gateway_kernel.transition.same_bytes_from_loop", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::same_bytes_from", @@ -1979,7 +3191,7 @@ "parent_lean_name": "auths_gateway_kernel.transition.same_bytes_from" }, { - "def_id": 68, + "def_id": 116, "lean_name": "auths_gateway_kernel.transition.same_bytes_from", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::same_bytes_from", @@ -1996,7 +3208,7 @@ "reducible": true }, { - "def_id": 27, + "def_id": 64, "lean_name": "auths_gateway_kernel.transition.same_bytes", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::same_bytes", @@ -2013,7 +3225,7 @@ "reducible": false }, { - "def_id": 70, + "def_id": 118, "lean_name": "auths_gateway_kernel.transition.resolves_unknown", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::resolves_unknown", @@ -2030,7 +3242,7 @@ "reducible": false }, { - "def_id": 80, + "def_id": 128, "lean_name": "auths_gateway_kernel.transition.has_link", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::has_link", @@ -2047,7 +3259,7 @@ "reducible": false }, { - "def_id": 74, + "def_id": 122, "lean_name": "auths_gateway_kernel.transition.refusal_stage", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::refusal_stage", @@ -2064,7 +3276,7 @@ "reducible": false }, { - "def_id": 75, + "def_id": 123, "lean_name": "auths_gateway_kernel.transition.requires_response", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::requires_response", @@ -2081,7 +3293,7 @@ "reducible": false }, { - "def_id": 76, + "def_id": 124, "lean_name": "auths_gateway_kernel.transition.permits_response", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::permits_response", @@ -2098,7 +3310,7 @@ "reducible": false }, { - "def_id": 77, + "def_id": 125, "lean_name": "auths_gateway_kernel.transition.observed_stage", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::observed_stage", @@ -2115,7 +3327,7 @@ "reducible": false }, { - "def_id": 79, + "def_id": 127, "lean_name": "auths_gateway_kernel.transition.provider_stage", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::provider_stage", @@ -2132,7 +3344,7 @@ "reducible": false }, { - "def_id": 78, + "def_id": 126, "lean_name": "auths_gateway_kernel.transition.has_reading", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::has_reading", @@ -2149,7 +3361,7 @@ "reducible": false }, { - "def_id": 33, + "def_id": 70, "lean_name": "auths_gateway_kernel.transition.consistent", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::consistent", @@ -2166,7 +3378,7 @@ "reducible": false }, { - "def_id": 29, + "def_id": 66, "lean_name": "auths_gateway_kernel.transition.stage_transition_allowed", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::stage_transition_allowed", @@ -2183,7 +3395,7 @@ "reducible": false }, { - "def_id": 72, + "def_id": 120, "lean_name": "auths_gateway_kernel.transition.adds_pre_entry", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::adds_pre_entry", @@ -2200,7 +3412,7 @@ "reducible": false }, { - "def_id": 73, + "def_id": 121, "lean_name": "auths_gateway_kernel.transition.adds_response", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::adds_response", @@ -2217,7 +3429,7 @@ "reducible": false }, { - "def_id": 30, + "def_id": 67, "lean_name": "auths_gateway_kernel.transition.checkpoint_valid", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::checkpoint_valid", @@ -2234,7 +3446,7 @@ "reducible": false }, { - "def_id": 31, + "def_id": 68, "lean_name": "auths_gateway_kernel.transition.pre_entry_kept", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::pre_entry_kept", @@ -2251,7 +3463,7 @@ "reducible": false }, { - "def_id": 32, + "def_id": 69, "lean_name": "auths_gateway_kernel.transition.response_kept", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::response_kept", @@ -2268,7 +3480,7 @@ "reducible": false }, { - "def_id": 69, + "def_id": 117, "lean_name": "auths_gateway_kernel.transition.link_equal", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::link_equal", @@ -2285,7 +3497,7 @@ "reducible": false }, { - "def_id": 28, + "def_id": 65, "lean_name": "auths_gateway_kernel.transition.plan_kept", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::plan_kept", @@ -2302,7 +3514,7 @@ "reducible": false }, { - "def_id": 6, + "def_id": 27, "lean_name": "auths_gateway_kernel.transition.valid_transition", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::transition::valid_transition", @@ -2321,7 +3533,7 @@ ], "types": [ { - "def_id": 7, + "def_id": 20, "lean_name": "auths_gateway_kernel.construct.ArgumentValue", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::ArgumentValue", @@ -2333,7 +3545,7 @@ } }, { - "def_id": 20, + "def_id": 30, "lean_name": "auths_gateway_kernel.construct.RequestMethod", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::RequestMethod", @@ -2345,7 +3557,7 @@ } }, { - "def_id": 15, + "def_id": 26, "lean_name": "auths_gateway_kernel.construct.SegmentPlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::SegmentPlan", @@ -2357,7 +3569,7 @@ } }, { - "def_id": 17, + "def_id": 28, "lean_name": "auths_gateway_kernel.construct.Header", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::Header", @@ -2369,7 +3581,7 @@ } }, { - "def_id": 48, + "def_id": 62, "lean_name": "auths_gateway_kernel.construct.ScopeGrammar", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::ScopeGrammar", @@ -2381,7 +3593,7 @@ } }, { - "def_id": 34, + "def_id": 45, "lean_name": "auths_gateway_kernel.construct.AccountScopePlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::AccountScopePlan", @@ -2393,7 +3605,7 @@ } }, { - "def_id": 18, + "def_id": 29, "lean_name": "auths_gateway_kernel.construct.HeaderPlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::HeaderPlan", @@ -2405,7 +3617,7 @@ } }, { - "def_id": 32, + "def_id": 43, "lean_name": "auths_gateway_kernel.construct.JsonPiece", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::JsonPiece", @@ -2417,7 +3629,7 @@ } }, { - "def_id": 33, + "def_id": 44, "lean_name": "auths_gateway_kernel.construct.FormPiece", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::FormPiece", @@ -2429,7 +3641,7 @@ } }, { - "def_id": 16, + "def_id": 27, "lean_name": "auths_gateway_kernel.construct.BodyPlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::BodyPlan", @@ -2441,7 +3653,7 @@ } }, { - "def_id": 6, + "def_id": 19, "lean_name": "auths_gateway_kernel.construct.WritePlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::WritePlan", @@ -2453,7 +3665,7 @@ } }, { - "def_id": 21, + "def_id": 31, "lean_name": "auths_gateway_kernel.construct.ActionReadPlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::ActionReadPlan", @@ -2465,7 +3677,7 @@ } }, { - "def_id": 22, + "def_id": 32, "lean_name": "auths_gateway_kernel.construct.CredentialReadPlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::CredentialReadPlan", @@ -2477,7 +3689,7 @@ } }, { - "def_id": 9, + "def_id": 22, "lean_name": "auths_gateway_kernel.construct.BuiltRequest", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::BuiltRequest", @@ -2489,7 +3701,7 @@ } }, { - "def_id": 10, + "def_id": 23, "lean_name": "auths_gateway_kernel.construct.ConstructError", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::construct::ConstructError", @@ -2501,7 +3713,79 @@ } }, { - "def_id": 35, + "def_id": 6, + "lean_name": "auths_gateway_kernel.counter_aggregation.CounterCapacity", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::CounterCapacity", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 8, + "end_line": 13 + } + }, + { + "def_id": 7, + "lean_name": "auths_gateway_kernel.counter_aggregation.SumCapacity", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::counter_aggregation::SumCapacity", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "begin_line": 223, + "end_line": 230 + } + }, + { + "def_id": 11, + "lean_name": "auths_gateway_kernel.deadline.EntryBound", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::deadline::EntryBound", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/deadline.rs", + "begin_line": 6, + "end_line": 11 + } + }, + { + "def_id": 3, + "lean_name": "auths_gateway_kernel.entry_authorization.EntryState", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::entry_authorization::EntryState", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "begin_line": 9, + "end_line": 16 + } + }, + { + "def_id": 4, + "lean_name": "auths_gateway_kernel.entry_authorization.EntryProfile", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::entry_authorization::EntryProfile", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "begin_line": 20, + "end_line": 25 + } + }, + { + "def_id": 0, + "lean_name": "auths_gateway_kernel.frontier.FrontierSearch", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::frontier::FrontierSearch", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/frontier.rs", + "begin_line": 7, + "end_line": 10 + } + }, + { + "def_id": 46, "lean_name": "auths_gateway_kernel.order.Mode", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::Mode", @@ -2513,7 +3797,7 @@ } }, { - "def_id": 23, + "def_id": 33, "lean_name": "auths_gateway_kernel.order.SubmitPlan", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::SubmitPlan", @@ -2525,7 +3809,7 @@ } }, { - "def_id": 25, + "def_id": 35, "lean_name": "auths_gateway_kernel.order.Phase", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::Phase", @@ -2537,7 +3821,7 @@ } }, { - "def_id": 24, + "def_id": 34, "lean_name": "auths_gateway_kernel.order.SubmitState", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::SubmitState", @@ -2549,7 +3833,7 @@ } }, { - "def_id": 36, + "def_id": 47, "lean_name": "auths_gateway_kernel.order.Verification", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::Verification", @@ -2561,7 +3845,7 @@ } }, { - "def_id": 37, + "def_id": 48, "lean_name": "auths_gateway_kernel.order.ClaimResult", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::ClaimResult", @@ -2573,7 +3857,7 @@ } }, { - "def_id": 38, + "def_id": 49, "lean_name": "auths_gateway_kernel.order.AccountResult", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::AccountResult", @@ -2585,7 +3869,7 @@ } }, { - "def_id": 39, + "def_id": 50, "lean_name": "auths_gateway_kernel.order.DeniedResult", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::DeniedResult", @@ -2597,7 +3881,7 @@ } }, { - "def_id": 40, + "def_id": 51, "lean_name": "auths_gateway_kernel.order.PreEntryResult", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::PreEntryResult", @@ -2609,7 +3893,7 @@ } }, { - "def_id": 41, + "def_id": 52, "lean_name": "auths_gateway_kernel.order.CeilingRead", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::CeilingRead", @@ -2621,7 +3905,7 @@ } }, { - "def_id": 42, + "def_id": 53, "lean_name": "auths_gateway_kernel.order.WriteResult", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::WriteResult", @@ -2633,7 +3917,7 @@ } }, { - "def_id": 43, + "def_id": 54, "lean_name": "auths_gateway_kernel.order.ResponseRecord", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::ResponseRecord", @@ -2645,7 +3929,7 @@ } }, { - "def_id": 26, + "def_id": 36, "lean_name": "auths_gateway_kernel.order.SubmitEvent", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::SubmitEvent", @@ -2657,7 +3941,7 @@ } }, { - "def_id": 46, + "def_id": 57, "lean_name": "auths_gateway_kernel.order.Refusal", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::Refusal", @@ -2669,7 +3953,7 @@ } }, { - "def_id": 45, + "def_id": 56, "lean_name": "auths_gateway_kernel.order.Stop", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::Stop", @@ -2681,7 +3965,7 @@ } }, { - "def_id": 44, + "def_id": 55, "lean_name": "auths_gateway_kernel.order.SubmitAction", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::SubmitAction", @@ -2693,7 +3977,7 @@ } }, { - "def_id": 27, + "def_id": 37, "lean_name": "auths_gateway_kernel.order.SubmitDecision", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::order::SubmitDecision", @@ -2705,7 +3989,7 @@ } }, { - "def_id": 2, + "def_id": 15, "lean_name": "auths_gateway_kernel.recovery.StateObservation", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::StateObservation", @@ -2717,7 +4001,7 @@ } }, { - "def_id": 31, + "def_id": 42, "lean_name": "auths_gateway_kernel.recovery.IdempotencyKind", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::IdempotencyKind", @@ -2729,7 +4013,7 @@ } }, { - "def_id": 5, + "def_id": 18, "lean_name": "auths_gateway_kernel.recovery.LostClaimReentry", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::LostClaimReentry", @@ -2741,7 +4025,7 @@ } }, { - "def_id": 0, + "def_id": 13, "lean_name": "auths_gateway_kernel.recovery.RecoveryDeclarations", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::RecoveryDeclarations", @@ -2753,7 +4037,7 @@ } }, { - "def_id": 3, + "def_id": 16, "lean_name": "auths_gateway_kernel.recovery.RecoveryClass", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::RecoveryClass", @@ -2765,7 +4049,7 @@ } }, { - "def_id": 4, + "def_id": 17, "lean_name": "auths_gateway_kernel.recovery.UnknownResolution", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::UnknownResolution", @@ -2777,7 +4061,7 @@ } }, { - "def_id": 1, + "def_id": 14, "lean_name": "auths_gateway_kernel.recovery.RecoveryCapability", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::recovery::RecoveryCapability", @@ -2789,7 +4073,43 @@ } }, { - "def_id": 29, + "def_id": 9, + "lean_name": "auths_gateway_kernel.reservation_batch.SlotEntry", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::SlotEntry", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 11, + "end_line": 23 + } + }, + { + "def_id": 10, + "lean_name": "auths_gateway_kernel.reservation_retry.RetryTarget", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::reservation_retry::RetryTarget", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_retry.rs", + "begin_line": 5, + "end_line": 18 + } + }, + { + "def_id": 8, + "lean_name": "auths_gateway_kernel.slot_record.SumValues", + "lean_file": "qualification/aeneas/generated/gateway/Types.lean", + "rust_name": "auths_gateway_kernel::slot_record::SumValues", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "begin_line": 7, + "end_line": 14 + } + }, + { + "def_id": 39, "lean_name": "auths_gateway_kernel.transition.Stage", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::transition::Stage", @@ -2801,7 +4121,7 @@ } }, { - "def_id": 47, + "def_id": 58, "lean_name": "auths_gateway_kernel.transition.Reading", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::transition::Reading", @@ -2813,7 +4133,7 @@ } }, { - "def_id": 30, + "def_id": 40, "lean_name": "auths_gateway_kernel.transition.Link", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::transition::Link", @@ -2825,7 +4145,7 @@ } }, { - "def_id": 28, + "def_id": 38, "lean_name": "auths_gateway_kernel.transition.AttemptView", "lean_file": "qualification/aeneas/generated/gateway/Types.lean", "rust_name": "auths_gateway_kernel::transition::AttemptView", @@ -2839,7 +4159,7 @@ ], "globals": [ { - "def_id": 3, + "def_id": 5, "lean_name": "auths_gateway_kernel.construct.MAX_BODY_BYTES", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::MAX_BODY_BYTES", @@ -2852,7 +4172,7 @@ "can_fail": false }, { - "def_id": 4, + "def_id": 12, "lean_name": "auths_gateway_kernel.construct.MAX_SEGMENT_VALUE_BYTES", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::MAX_SEGMENT_VALUE_BYTES", @@ -2865,7 +4185,7 @@ "can_fail": false }, { - "def_id": 2, + "def_id": 4, "lean_name": "auths_gateway_kernel.construct.MAX_PATH_BYTES", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::construct::MAX_PATH_BYTES", @@ -2878,7 +4198,7 @@ "can_fail": false }, { - "def_id": 0, + "def_id": 1, "lean_name": "auths_gateway_kernel.ratio.BASIS_POINTS_PER_WHOLE", "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", "rust_name": "auths_gateway_kernel::ratio::BASIS_POINTS_PER_WHOLE", @@ -2889,6 +4209,19 @@ "end_line": 10 }, "can_fail": false + }, + { + "def_id": 0, + "lean_name": "auths_gateway_kernel.reservation_batch.MAX_COUNTERS_PER_KIND", + "lean_file": "qualification/aeneas/generated/gateway/Funs.lean", + "rust_name": "auths_gateway_kernel::reservation_batch::MAX_COUNTERS_PER_KIND", + "is_local": true, + "source": { + "file": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "begin_line": 7, + "end_line": 7 + }, + "can_fail": false } ], "trait_decls": [], diff --git a/formal/qualification/aeneas/generated/model/Funs.lean b/formal/qualification/aeneas/generated/model/Funs.lean index 26b83de77..27a8f390b 100644 --- a/formal/qualification/aeneas/generated/model/Funs.lean +++ b/formal/qualification/aeneas/generated/model/Funs.lean @@ -29,13 +29,13 @@ def Slice.Insts.CoreCmpPartialEqSlice {T : Type} {U : Type} (cmpPartialEqInst : } /-- [auths_model::byte_slices_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 124:0-126:1 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 113:0-115:1 -/ def byte_slices_equal (left : Slice Std.U8) (right : Slice Std.U8) : Result Bool := do core.slice.cmp.PartialEqSlice.eq core.cmp.PartialEqU8 left right /-- [auths_model::principal_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 201:0-203:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 183:0-185:1 Visibility: public -/ def principal_id_equal (left : PrincipalId) (right : PrincipalId) : Result Bool := do @@ -372,7 +372,7 @@ def bounded.BoundedSet.len ok (alloc.vec.Vec.len self) /-- [auths_model::{auths_model::Digest}::as_bytes]: - Source: 'core/crates/auths-model/src/lib.rs', lines 259:4-261:5 + Source: 'core/crates/auths-model/src/lib.rs', lines 241:4-243:5 Visibility: public -/ def Digest.as_bytes (self : Digest) : Result (Array Std.U8 32#usize) := do ok self @@ -403,15 +403,142 @@ def bounded_policy.bounded_policy_link_accepts | some parent_digest1 => bounded_policy.digest_equal child_link1 parent_digest1 +/-- [auths_model::identifier::forbidden_three_byte_prefix]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 9:0-21:1 -/ +def identifier.forbidden_three_byte_prefix + (first : Std.U8) (second : Std.U8) (third : Std.U8) : Result Bool := do + if first = 225#u8 + then if second = 154#u8 + then ok (third = 128#u8) + else ok false + else + if first = 226#u8 + then + if second = 128#u8 + then + let b ← + if 128#u8 <= third + then if third <= 138#u8 + then ok true + else ok false + else ok false + if b + then ok true + else + if third = 168#u8 + then ok true + else if third = 169#u8 + then ok true + else ok (third = 175#u8) + else if second = 129#u8 + then ok (third = 159#u8) + else ok false + else + if first = 227#u8 + then if second = 128#u8 + then ok (third = 128#u8) + else ok false + else ok false + +/-- [auths_model::identifier::forbidden_identifier_at]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 23:0-42:1 -/ +def identifier.forbidden_identifier_at + (input : Slice Std.U8) (position : Std.Usize) : Result Bool := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok false + | some byte => + if byte <= 32#u8 + then ok true + else + if byte = 127#u8 + then ok true + else + let i := Slice.len input + let i1 ← i - position + if i1 < 2#usize + then ok false + else + let i2 ← position + 1#usize + let second ← Slice.index_usize input i2 + if byte = 194#u8 + then + if 128#u8 <= second + then if second <= 160#u8 + then ok true + else ok false + else ok false + else + let i3 := Slice.len input + let i4 ← i3 - position + if i4 < 3#usize + then ok false + else + let i5 ← position + 2#usize + let i6 ← Slice.index_usize input i5 + identifier.forbidden_three_byte_prefix byte second i6 + +/-- [auths_model::identifier::contains_forbidden_identifier]: loop body 0: + Source: 'core/crates/auths-model/src/identifier.rs', lines 46:4-53:1 -/ +@[rust_loop_body] +def identifier.contains_forbidden_identifier_loop.body + (input : Slice Std.U8) (position : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len input + if position < i + then + let b ← identifier.forbidden_identifier_at input position + if b + then ok (done true) + else let position1 ← position + 1#usize + ok (cont position1) + else ok (done false) + +/-- [auths_model::identifier::contains_forbidden_identifier]: loop 0: + Source: 'core/crates/auths-model/src/identifier.rs', lines 46:4-53:1 -/ +@[rust_loop] +def identifier.contains_forbidden_identifier_loop + (input : Slice Std.U8) (position : Std.Usize) : Result Bool := do + loop + (fun position1 => identifier.contains_forbidden_identifier_loop.body input + position1) + position + +/-- [auths_model::identifier::contains_forbidden_identifier]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 44:0-53:1 -/ +@[reducible] +def identifier.contains_forbidden_identifier + (input : Slice Std.U8) : Result Bool := do + identifier.contains_forbidden_identifier_loop input 0#usize + +/-- [auths_model::identifier::bounded_identifier_valid]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 55:0-57:1 -/ +def identifier.bounded_identifier_valid + (value : Str) (maximum : Std.Usize) : Result Bool := do + let b ← core.str.Str.is_empty value + if b + then ok false + else + let i ← core.str.Str.len value + if i <= maximum + then + let s ← core.str.Str.as_bytes value + let b1 ← identifier.contains_forbidden_identifier s + ok (¬ b1) + else ok false + /-- [auths_model::{impl core::cmp::PartialEq for auths_model::Audience}::eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:35-130:44 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 Visibility: public -/ def Audience.Insts.CoreCmpPartialEqAudience.eq (self : Audience) (other : Audience) : Result Bool := do alloc.string.String.Insts.CoreCmpPartialEqString.eq self other /-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::Audience}] - Source: 'core/crates/auths-model/src/lib.rs', lines 130:35-130:44 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 -/ @[reducible] def Audience.Insts.CoreCmpPartialEqAudience : core.cmp.PartialEq Audience Audience := { @@ -419,14 +546,14 @@ def Audience.Insts.CoreCmpPartialEqAudience : core.cmp.PartialEq Audience } /-- [auths_model::{impl core::cmp::Eq for auths_model::Audience}::assert_fields_are_eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:31-130:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:31-119:33 Visibility: public -/ def Audience.Insts.CoreCmpEq.assert_fields_are_eq (self : Audience) : Result Unit := do ok () /-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::Audience}] - Source: 'core/crates/auths-model/src/lib.rs', lines 130:31-130:33 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 119:31-119:33 -/ @[reducible] def Audience.Insts.CoreCmpEq : core.cmp.Eq Audience := { partialEqInst := Audience.Insts.CoreCmpPartialEqAudience @@ -434,28 +561,28 @@ def Audience.Insts.CoreCmpEq : core.cmp.Eq Audience := { } /-- [auths_model::{impl core::cmp::PartialEq for auths_model::CapabilityId}::eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:35-130:44 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 Visibility: public -/ def CapabilityId.Insts.CoreCmpPartialEqCapabilityId.eq (self : CapabilityId) (other : CapabilityId) : Result Bool := do alloc.string.String.Insts.CoreCmpPartialEqString.eq self other /-- [auths_model::{impl core::cmp::PartialEq for auths_model::ResourceId}::eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:35-130:44 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 Visibility: public -/ def ResourceId.Insts.CoreCmpPartialEqResourceId.eq (self : ResourceId) (other : ResourceId) : Result Bool := do alloc.string.String.Insts.CoreCmpPartialEqString.eq self other /-- [auths_model::{impl core::cmp::Ord for auths_model::Audience}::cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:46-130:49 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 Visibility: public -/ def Audience.Insts.CoreCmpOrd.cmp (self : Audience) (other : Audience) : Result Ordering := do alloc.string.String.Insts.CoreCmpOrd.cmp self other /-- [auths_model::{impl core::cmp::PartialOrd for auths_model::Audience}::partial_cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:51-130:61 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:51-119:61 Visibility: public -/ def Audience.Insts.CoreCmpPartialOrdAudience.partial_cmp (self : Audience) (other : Audience) : Result (Option Ordering) := do @@ -463,7 +590,7 @@ def Audience.Insts.CoreCmpPartialOrdAudience.partial_cmp ok (some o) /-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::Audience}] - Source: 'core/crates/auths-model/src/lib.rs', lines 130:51-130:61 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 119:51-119:61 -/ @[reducible] def Audience.Insts.CoreCmpPartialOrdAudience : core.cmp.PartialOrd Audience Audience := { @@ -472,7 +599,7 @@ def Audience.Insts.CoreCmpPartialOrdAudience : core.cmp.PartialOrd Audience } /-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::Audience}] - Source: 'core/crates/auths-model/src/lib.rs', lines 130:46-130:49 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 -/ @[reducible] def Audience.Insts.CoreCmpOrd : core.cmp.Ord Audience := { eqInst := Audience.Insts.CoreCmpEq @@ -481,42 +608,42 @@ def Audience.Insts.CoreCmpOrd : core.cmp.Ord Audience := { } /-- [auths_model::{impl core::cmp::Ord for auths_model::CapabilityId}::cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:46-130:49 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 Visibility: public -/ def CapabilityId.Insts.CoreCmpOrd.cmp (self : CapabilityId) (other : CapabilityId) : Result Ordering := do alloc.string.String.Insts.CoreCmpOrd.cmp self other /-- [auths_model::{impl core::cmp::Ord for auths_model::ResourceId}::cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 130:46-130:49 + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 Visibility: public -/ def ResourceId.Insts.CoreCmpOrd.cmp (self : ResourceId) (other : ResourceId) : Result Ordering := do alloc.string.String.Insts.CoreCmpOrd.cmp self other /-- [auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 247:33-247:42 + Source: 'core/crates/auths-model/src/lib.rs', lines 229:33-229:42 Visibility: public -/ def Digest.Insts.CoreCmpPartialEqDigest.eq (self : Digest) (other : Digest) : Result Bool := do core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 self other /-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::Digest}] - Source: 'core/crates/auths-model/src/lib.rs', lines 247:33-247:42 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 229:33-229:42 -/ @[reducible] def Digest.Insts.CoreCmpPartialEqDigest : core.cmp.PartialEq Digest Digest := { eq := Digest.Insts.CoreCmpPartialEqDigest.eq } /-- [auths_model::{impl core::cmp::Eq for auths_model::Digest}::assert_fields_are_eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 247:29-247:31 + Source: 'core/crates/auths-model/src/lib.rs', lines 229:29-229:31 Visibility: public -/ def Digest.Insts.CoreCmpEq.assert_fields_are_eq (self : Digest) : Result Unit := do ok () /-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::Digest}] - Source: 'core/crates/auths-model/src/lib.rs', lines 247:29-247:31 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 229:29-229:31 -/ @[reducible] def Digest.Insts.CoreCmpEq : core.cmp.Eq Digest := { partialEqInst := Digest.Insts.CoreCmpPartialEqDigest @@ -524,14 +651,14 @@ def Digest.Insts.CoreCmpEq : core.cmp.Eq Digest := { } /-- [auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 247:44-247:47 + Source: 'core/crates/auths-model/src/lib.rs', lines 229:44-229:47 Visibility: public -/ def Digest.Insts.CoreCmpOrd.cmp (self : Digest) (other : Digest) : Result Ordering := do Array.Insts.CoreCmpOrd.cmp core.cmp.OrdU8 self other /-- [auths_model::{impl core::cmp::PartialOrd for auths_model::Digest}::partial_cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 247:49-247:59 + Source: 'core/crates/auths-model/src/lib.rs', lines 229:49-229:59 Visibility: public -/ def Digest.Insts.CoreCmpPartialOrdDigest.partial_cmp (self : Digest) (other : Digest) : Result (Option Ordering) := do @@ -539,7 +666,7 @@ def Digest.Insts.CoreCmpPartialOrdDigest.partial_cmp ok (some o) /-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::Digest}] - Source: 'core/crates/auths-model/src/lib.rs', lines 247:49-247:59 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 229:49-229:59 -/ @[reducible] def Digest.Insts.CoreCmpPartialOrdDigest : core.cmp.PartialOrd Digest Digest := { @@ -548,7 +675,7 @@ def Digest.Insts.CoreCmpPartialOrdDigest : core.cmp.PartialOrd Digest Digest } /-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::Digest}] - Source: 'core/crates/auths-model/src/lib.rs', lines 247:44-247:47 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 229:44-229:47 -/ @[reducible] def Digest.Insts.CoreCmpOrd : core.cmp.Ord Digest := { eqInst := Digest.Insts.CoreCmpEq @@ -557,13 +684,13 @@ def Digest.Insts.CoreCmpOrd : core.cmp.Ord Digest := { } /-- [auths_model::{auths_model::GrantId}::as_bytes]: - Source: 'core/crates/auths-model/src/lib.rs', lines 286:12-288:13 + Source: 'core/crates/auths-model/src/lib.rs', lines 268:12-270:13 Visibility: public -/ def GrantId.as_bytes (self : GrantId) : Result (Array Std.U8 32#usize) := do Digest.as_bytes self /-- [auths_model::inclusive_window_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 423:0-430:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 405:0-412:1 Visibility: public -/ def inclusive_window_contains (parent_start : Std.U64) (parent_end : Std.U64) (child_start : Std.U64) @@ -575,7 +702,7 @@ def inclusive_window_contains else ok false /-- [auths_model::validity_window_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 435:0-442:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 417:0-424:1 Visibility: public -/ def validity_window_contains (parent : ValidityWindow) (child : ValidityWindow) : Result Bool := do @@ -586,7 +713,7 @@ def validity_window_contains inclusive_window_contains i i1 i2 i3 /-- [auths_model::profile_ref_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 478:0-480:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 460:0-462:1 Visibility: public -/ def profile_ref_equal (left : ProfileRef) (right : ProfileRef) : Result Bool := do @@ -600,7 +727,7 @@ def profile_ref_equal else ok false /-- [auths_model::profile_slice_contains]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 487:4-494:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 469:4-476:1 Visibility: public -/ @[rust_loop_body] def profile_slice_contains_loop.body @@ -619,7 +746,7 @@ def profile_slice_contains_loop.body else ok (done false) /-- [auths_model::profile_slice_contains]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 487:4-494:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 469:4-476:1 Visibility: public -/ @[rust_loop] def profile_slice_contains_loop @@ -631,7 +758,7 @@ def profile_slice_contains_loop index /-- [auths_model::profile_slice_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 485:0-494:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 467:0-476:1 Visibility: public -/ @[reducible] def profile_slice_contains @@ -639,7 +766,7 @@ def profile_slice_contains profile_slice_contains_loop profiles profile 0#usize /-- [auths_model::assurance_policy_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 499:0-501:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 481:0-483:1 Visibility: public -/ def assurance_policy_id_equal (left : AssurancePolicyId) (right : AssurancePolicyId) : Result Bool := do @@ -648,7 +775,7 @@ def assurance_policy_id_equal byte_slices_equal s s1 /-- [auths_model::grant_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 506:0-508:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 488:0-490:1 Visibility: public -/ def grant_id_equal (left : GrantId) (right : GrantId) : Result Bool := do let a ← GrantId.as_bytes left @@ -658,7 +785,7 @@ def grant_id_equal (left : GrantId) (right : GrantId) : Result Bool := do byte_slices_equal s s1 /-- [auths_model::optional_grant_id_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 513:0-519:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 495:0-501:1 Visibility: public -/ def optional_grant_id_equal (left : Option GrantId) (right : Option GrantId) : Result Bool := do @@ -672,7 +799,7 @@ def optional_grant_id_equal | some right1 => grant_id_equal left1 right1 /-- [auths_model::{impl core::cmp::PartialEq for auths_model::Permission}::eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 521:27-521:36 + Source: 'core/crates/auths-model/src/lib.rs', lines 503:27-503:36 Visibility: public -/ def Permission.Insts.CoreCmpPartialEqPermission.eq (self : Permission) (other : Permission) : Result Bool := do @@ -685,7 +812,7 @@ def Permission.Insts.CoreCmpPartialEqPermission.eq else ok false /-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::Permission}] - Source: 'core/crates/auths-model/src/lib.rs', lines 521:27-521:36 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 503:27-503:36 -/ @[reducible] def Permission.Insts.CoreCmpPartialEqPermission : core.cmp.PartialEq Permission Permission := { @@ -693,14 +820,14 @@ def Permission.Insts.CoreCmpPartialEqPermission : core.cmp.PartialEq Permission } /-- [auths_model::{impl core::cmp::Eq for auths_model::Permission}::assert_fields_are_eq]: - Source: 'core/crates/auths-model/src/lib.rs', lines 521:23-521:25 + Source: 'core/crates/auths-model/src/lib.rs', lines 503:23-503:25 Visibility: public -/ def Permission.Insts.CoreCmpEq.assert_fields_are_eq (self : Permission) : Result Unit := do ok () /-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::Permission}] - Source: 'core/crates/auths-model/src/lib.rs', lines 521:23-521:25 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 503:23-503:25 -/ @[reducible] def Permission.Insts.CoreCmpEq : core.cmp.Eq Permission := { partialEqInst := Permission.Insts.CoreCmpPartialEqPermission @@ -708,7 +835,7 @@ def Permission.Insts.CoreCmpEq : core.cmp.Eq Permission := { } /-- [auths_model::{impl core::cmp::Ord for auths_model::Permission}::cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 521:38-521:41 + Source: 'core/crates/auths-model/src/lib.rs', lines 503:38-503:41 Visibility: public -/ def Permission.Insts.CoreCmpOrd.cmp (self : Permission) (other : Permission) : Result Ordering := do @@ -719,7 +846,7 @@ def Permission.Insts.CoreCmpOrd.cmp | Ordering.gt => ok Ordering.gt /-- [auths_model::{impl core::cmp::PartialOrd for auths_model::Permission}::partial_cmp]: - Source: 'core/crates/auths-model/src/lib.rs', lines 521:43-521:53 + Source: 'core/crates/auths-model/src/lib.rs', lines 503:43-503:53 Visibility: public -/ def Permission.Insts.CoreCmpPartialOrdPermission.partial_cmp (self : Permission) (other : Permission) : Result (Option Ordering) := do @@ -727,7 +854,7 @@ def Permission.Insts.CoreCmpPartialOrdPermission.partial_cmp ok (some o) /-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::Permission}] - Source: 'core/crates/auths-model/src/lib.rs', lines 521:43-521:53 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 503:43-503:53 -/ @[reducible] def Permission.Insts.CoreCmpPartialOrdPermission : core.cmp.PartialOrd Permission Permission := { @@ -736,7 +863,7 @@ def Permission.Insts.CoreCmpPartialOrdPermission : core.cmp.PartialOrd } /-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::Permission}] - Source: 'core/crates/auths-model/src/lib.rs', lines 521:38-521:41 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 503:38-503:41 -/ @[reducible] def Permission.Insts.CoreCmpOrd : core.cmp.Ord Permission := { eqInst := Permission.Insts.CoreCmpEq @@ -745,7 +872,7 @@ def Permission.Insts.CoreCmpOrd : core.cmp.Ord Permission := { } /-- [auths_model::permissions_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 547:0-550:1 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 529:0-532:1 -/ def permissions_equal (left : Permission) (right : Permission) : Result Bool := do let s := left.capability @@ -763,7 +890,7 @@ def permissions_equal else ok false /-- [auths_model::permission_set_contains]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 592:4-599:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 574:4-581:1 Visibility: public -/ @[rust_loop_body] def permission_set_contains_loop.body @@ -783,7 +910,7 @@ def permission_set_contains_loop.body else ok (done false) /-- [auths_model::permission_set_contains]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 592:4-599:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 574:4-581:1 Visibility: public -/ @[rust_loop] def permission_set_contains_loop @@ -796,7 +923,7 @@ def permission_set_contains_loop (set, index) /-- [auths_model::permission_set_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 590:0-599:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 572:0-581:1 Visibility: public -/ @[reducible] def permission_set_contains @@ -804,7 +931,7 @@ def permission_set_contains permission_set_contains_loop set permission 0#usize /-- [auths_model::permission_set_is_subset]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 606:4-613:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 588:4-595:1 Visibility: public -/ @[rust_loop_body] def permission_set_is_subset_loop.body @@ -825,7 +952,7 @@ def permission_set_is_subset_loop.body else ok (done true) /-- [auths_model::permission_set_is_subset]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 606:4-613:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 588:4-595:1 Visibility: public -/ @[rust_loop] def permission_set_is_subset_loop @@ -838,7 +965,7 @@ def permission_set_is_subset_loop (child, child_index) /-- [auths_model::permission_set_is_subset]: - Source: 'core/crates/auths-model/src/lib.rs', lines 604:0-613:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 586:0-595:1 Visibility: public -/ @[reducible] def permission_set_is_subset @@ -846,14 +973,14 @@ def permission_set_is_subset permission_set_is_subset_loop child parent 0#usize /-- [auths_model::audiences_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 618:0-620:1 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 600:0-602:1 -/ def audiences_equal (left : Audience) (right : Audience) : Result Bool := do let s ← alloc.string.String.as_bytes left let s1 ← alloc.string.String.as_bytes right byte_slices_equal s s1 /-- [auths_model::audience_set_contains]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 659:4-666:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 641:4-648:1 Visibility: public -/ @[rust_loop_body] def audience_set_contains_loop.body @@ -873,7 +1000,7 @@ def audience_set_contains_loop.body else ok (done false) /-- [auths_model::audience_set_contains]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 659:4-666:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 641:4-648:1 Visibility: public -/ @[rust_loop] def audience_set_contains_loop @@ -886,7 +1013,7 @@ def audience_set_contains_loop (set, index) /-- [auths_model::audience_set_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 657:0-666:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 639:0-648:1 Visibility: public -/ @[reducible] def audience_set_contains @@ -894,7 +1021,7 @@ def audience_set_contains audience_set_contains_loop set audience 0#usize /-- [auths_model::audience_set_is_subset]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 673:4-680:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 655:4-662:1 Visibility: public -/ @[rust_loop_body] def audience_set_is_subset_loop.body @@ -915,7 +1042,7 @@ def audience_set_is_subset_loop.body else ok (done true) /-- [auths_model::audience_set_is_subset]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 673:4-680:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 655:4-662:1 Visibility: public -/ @[rust_loop] def audience_set_is_subset_loop @@ -928,7 +1055,7 @@ def audience_set_is_subset_loop (child, child_index) /-- [auths_model::audience_set_is_subset]: - Source: 'core/crates/auths-model/src/lib.rs', lines 671:0-680:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 653:0-662:1 Visibility: public -/ @[reducible] def audience_set_is_subset @@ -936,14 +1063,14 @@ def audience_set_is_subset audience_set_is_subset_loop child parent 0#usize /-- [auths_model::digests_equal]: - Source: 'core/crates/auths-model/src/lib.rs', lines 686:0-688:1 -/ + Source: 'core/crates/auths-model/src/lib.rs', lines 668:0-670:1 -/ def digests_equal (left : Digest) (right : Digest) : Result Bool := do let s ← core.array.Array.as_slice left let s1 ← core.array.Array.as_slice right byte_slices_equal s s1 /-- [auths_model::body_digest_set_contains]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 730:4-737:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 712:4-719:1 Visibility: public -/ @[rust_loop_body] def body_digest_set_contains_loop.body @@ -963,7 +1090,7 @@ def body_digest_set_contains_loop.body else ok (done false) /-- [auths_model::body_digest_set_contains]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 730:4-737:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 712:4-719:1 Visibility: public -/ @[rust_loop] def body_digest_set_contains_loop @@ -976,7 +1103,7 @@ def body_digest_set_contains_loop (set, index) /-- [auths_model::body_digest_set_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 728:0-737:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 710:0-719:1 Visibility: public -/ @[reducible] def body_digest_set_contains @@ -984,7 +1111,7 @@ def body_digest_set_contains body_digest_set_contains_loop set digest 0#usize /-- [auths_model::body_digest_set_is_subset]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 744:4-751:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 726:4-733:1 Visibility: public -/ @[rust_loop_body] def body_digest_set_is_subset_loop.body @@ -1005,7 +1132,7 @@ def body_digest_set_is_subset_loop.body else ok (done true) /-- [auths_model::body_digest_set_is_subset]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 744:4-751:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 726:4-733:1 Visibility: public -/ @[rust_loop] def body_digest_set_is_subset_loop @@ -1018,7 +1145,7 @@ def body_digest_set_is_subset_loop (child, child_index) /-- [auths_model::body_digest_set_is_subset]: - Source: 'core/crates/auths-model/src/lib.rs', lines 742:0-751:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 724:0-733:1 Visibility: public -/ @[reducible] def body_digest_set_is_subset @@ -1026,7 +1153,7 @@ def body_digest_set_is_subset body_digest_set_is_subset_loop child parent 0#usize /-- [auths_model::body_digest_set_only_contains]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 762:4-769:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 744:4-751:1 Visibility: public -/ @[rust_loop_body] def body_digest_set_only_contains_loop.body @@ -1046,7 +1173,7 @@ def body_digest_set_only_contains_loop.body else ok (done true) /-- [auths_model::body_digest_set_only_contains]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 762:4-769:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 744:4-751:1 Visibility: public -/ @[rust_loop] def body_digest_set_only_contains_loop @@ -1059,7 +1186,7 @@ def body_digest_set_only_contains_loop (set, index) /-- [auths_model::body_digest_set_only_contains]: - Source: 'core/crates/auths-model/src/lib.rs', lines 760:0-769:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 742:0-751:1 Visibility: public -/ @[reducible] def body_digest_set_only_contains @@ -1067,7 +1194,7 @@ def body_digest_set_only_contains body_digest_set_only_contains_loop set digest 0#usize /-- [auths_model::action_constraint_allows]: - Source: 'core/crates/auths-model/src/lib.rs', lines 816:0-822:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 798:0-804:1 Visibility: public -/ def action_constraint_allows (constraint : ActionConstraint) (digest : Digest) : Result Bool := do @@ -1078,7 +1205,7 @@ def action_constraint_allows body_digest_set_contains allowed digest /-- [auths_model::action_constraint_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 827:0-847:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 809:0-829:1 Visibility: public -/ def action_constraint_attenuates (child : ActionConstraint) (parent : ActionConstraint) : Result Bool := do @@ -1099,7 +1226,7 @@ def action_constraint_attenuates body_digest_set_is_subset child1 parent1 /-- [auths_model::budget_ceiling_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 886:0-889:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 868:0-871:1 Visibility: public -/ def budget_ceiling_attenuates (child : BudgetCeiling) (parent : BudgetCeiling) : Result Bool := do @@ -1113,21 +1240,21 @@ def budget_ceiling_attenuates else ok false /-- [auths_model::{auths_model::BudgetCeiling}::attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 872:4-874:5 + Source: 'core/crates/auths-model/src/lib.rs', lines 854:4-856:5 Visibility: public -/ def BudgetCeiling.attenuates (self : BudgetCeiling) (parent : BudgetCeiling) : Result Bool := do budget_ceiling_attenuates self parent /-- [auths_model::{auths_model::BudgetCeiling}::covers]: - Source: 'core/crates/auths-model/src/lib.rs', lines 878:4-880:5 + Source: 'core/crates/auths-model/src/lib.rs', lines 860:4-862:5 Visibility: public -/ def BudgetCeiling.covers (self : BudgetCeiling) (requested : BudgetCeiling) : Result Bool := do BudgetCeiling.attenuates requested self /-- [auths_model::optional_budget_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 896:0-905:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 878:0-887:1 Visibility: public -/ def optional_budget_attenuates (child : Option BudgetCeiling) (parent : Option BudgetCeiling) : @@ -1141,7 +1268,7 @@ def optional_budget_attenuates | some child1 => BudgetCeiling.attenuates child1 parent1 /-- [auths_model::optional_budget_covers]: - Source: 'core/crates/auths-model/src/lib.rs', lines 917:0-926:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 899:0-908:1 Visibility: public -/ def optional_budget_covers (ceiling : Option BudgetCeiling) (requested : Option BudgetCeiling) : @@ -1155,7 +1282,7 @@ def optional_budget_covers | some requested1 => BudgetCeiling.covers ceiling1 requested1 /-- [auths_model::budget_ceiling_covers_action]: - Source: 'core/crates/auths-model/src/lib.rs', lines 964:0-974:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 946:0-956:1 Visibility: public -/ def budget_ceiling_covers_action (ceiling : Option BudgetCeiling) (requested : Option BudgetCeiling) @@ -1171,7 +1298,7 @@ def budget_ceiling_covers_action | some _ => optional_budget_covers ceiling requested /-- [auths_model::status_policy_attenuates]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1026:0-1044:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1008:0-1026:1 Visibility: public -/ def status_policy_attenuates (child : StatusPolicy) (parent : StatusPolicy) : Result Bool := do @@ -1189,7 +1316,7 @@ def status_policy_attenuates else ok false /-- [auths_model::critical_extension_find]: loop body 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 1134:4-1141:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1116:4-1123:1 Visibility: public -/ @[rust_loop_body] def critical_extension_find_loop.body @@ -1214,7 +1341,7 @@ def critical_extension_find_loop.body else ok (done none) /-- [auths_model::critical_extension_find]: loop 0: - Source: 'core/crates/auths-model/src/lib.rs', lines 1134:4-1141:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1116:4-1123:1 Visibility: public -/ @[rust_loop] def critical_extension_find_loop @@ -1227,7 +1354,7 @@ def critical_extension_find_loop (extensions, id, index) /-- [auths_model::critical_extension_find]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1129:0-1141:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1111:0-1123:1 Visibility: public -/ @[reducible] def critical_extension_find @@ -1237,21 +1364,21 @@ def critical_extension_find critical_extension_find_loop extensions id 0#usize /-- [auths_model::critical_extension_entries]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1146:0-1148:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1128:0-1130:1 Visibility: public -/ def critical_extension_entries (extensions : CriticalExtensions) : Result (Slice CriticalExtension) := do ok (alloc.vec.Vec.deref extensions) /-- [auths_model::critical_extension_id]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1153:0-1155:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1135:0-1137:1 Visibility: public -/ def critical_extension_id (extension : CriticalExtension) : Result ExtensionId := do ok extension.id /-- [auths_model::critical_extension_payload]: - Source: 'core/crates/auths-model/src/lib.rs', lines 1160:0-1162:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1142:0-1144:1 Visibility: public -/ def critical_extension_payload (extension : CriticalExtension) : Result (Slice Std.U8) := do diff --git a/formal/qualification/aeneas/generated/model/FunsExternal.lean b/formal/qualification/aeneas/generated/model/FunsExternal.lean index 317499a64..8db3e0a02 100644 --- a/formal/qualification/aeneas/generated/model/FunsExternal.lean +++ b/formal/qualification/aeneas/generated/model/FunsExternal.lean @@ -26,6 +26,28 @@ match ordering with | Ordering.eq => compareLists cmpOrdInst leftTail rightTail | ordering => ok ordering +-- Public views expose the existing model for downstream proofs. Every +-- equation below reduces to the original private implementation. +def Array.Insts.CoreCmpOrd.compareValues {T : Type} (order : core.cmp.Ord T) + (left right : List T) : Result Ordering := compareLists order left right + +theorem Array.Insts.CoreCmpOrd.compareValues_nil_nil {T : Type} (order : core.cmp.Ord T) : + compareValues order [] [] = ok .eq := rfl + +theorem Array.Insts.CoreCmpOrd.compareValues_nil_cons {T : Type} (order : core.cmp.Ord T) + (head : T) (tail : List T) : compareValues order [] (head :: tail) = ok .lt := rfl + +theorem Array.Insts.CoreCmpOrd.compareValues_cons_nil {T : Type} (order : core.cmp.Ord T) + (head : T) (tail : List T) : compareValues order (head :: tail) [] = ok .gt := rfl + +theorem Array.Insts.CoreCmpOrd.compareValues_cons_cons {T : Type} (order : core.cmp.Ord T) + (left right : T) (leftTail rightTail : List T) : + compareValues order (left :: leftTail) (right :: rightTail) = + (do let ordering ← order.cmp left right + match ordering with + | .eq => compareValues order leftTail rightTail + | ordering => ok ordering) := rfl + @[rust_fun "core::array::{core::cmp::Ord<[@T; @N]>}::cmp"] def Array.Insts.CoreCmpOrd.cmp {T : Type} {N : Std.Usize} (cmpOrdInst : core.cmp.Ord T) @@ -43,9 +65,31 @@ def alloc.string.String.Insts.CoreCmpOrd.cmp (left right : String) : Result Ordering := ok (compare left right) + +-- String implements a total order; PartialOrd returns that same comparison. +@[rust_fun "alloc::string::{core::cmp::PartialOrd}::partial_cmp"] +def alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp + (left right : String) : Result (Option Ordering) := ok (some (compare left right)) + +-- Eq's marker method has no runtime observation or state change. +@[rust_fun "alloc::string::{core::cmp::Eq}::assert_fields_are_eq"] +def alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq (_ : String) : Result Unit := ok () + @[rust_fun "alloc::string::{alloc::string::String}::as_bytes"] def alloc.string.String.as_bytes (value : String) : Result (Slice Std.U8) := if h : value.toByteArray.size ≤ U32.max then ok (Aeneas.Std.toStr value h) else fail .panic + +@[rust_fun "core::str::{str}::len"] +def core.str.Str.len (value : Str) : Result Std.Usize := +ok (Slice.len value) + +@[rust_fun "core::str::{str}::is_empty"] +def core.str.Str.is_empty (value : Str) : Result Bool := +ok value.val.isEmpty + +@[rust_fun "core::str::{str}::as_bytes"] +def core.str.Str.as_bytes (value : Str) : Result (Slice Std.U8) := +ok value diff --git a/formal/qualification/aeneas/generated/model/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/model/FunsExternal_Template.lean index f824aa56a..89c317145 100644 --- a/formal/qualification/aeneas/generated/model/FunsExternal_Template.lean +++ b/formal/qualification/aeneas/generated/model/FunsExternal_Template.lean @@ -24,6 +24,27 @@ axiom Array.Insts.CoreCmpOrd.cmp {T : Type} {N : Std.Usize} (cmpOrdInst : core.cmp.Ord T) : Array T N → Array T N → Result Ordering +/-- [core::str::{str}::len]: + Source: '/rustc/library/core/src/str/mod.rs', lines 153:4-153:36 + Name pattern: [core::str::{str}::len] + Visibility: public -/ +@[rust_fun "core::str::{str}::len"] +axiom core.str.Str.len : Str → Result Std.Usize + +/-- [core::str::{str}::is_empty]: + Source: '/rustc/library/core/src/str/mod.rs', lines 173:4-173:40 + Name pattern: [core::str::{str}::is_empty] + Visibility: public -/ +@[rust_fun "core::str::{str}::is_empty"] +axiom core.str.Str.is_empty : Str → Result Bool + +/-- [core::str::{str}::as_bytes]: + Source: '/rustc/library/core/src/str/mod.rs', lines 498:4-498:41 + Name pattern: [core::str::{str}::as_bytes] + Visibility: public -/ +@[rust_fun "core::str::{str}::as_bytes"] +axiom core.str.Str.as_bytes : Str → Result (Slice Std.U8) + /-- [alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq]: Source: '/rustc/library/alloc/src/string.rs', lines 350:9-350:18 Name pattern: [alloc::string::{core::cmp::PartialEq}::eq] diff --git a/formal/qualification/aeneas/generated/model/Types.lean b/formal/qualification/aeneas/generated/model/Types.lean index 32a0d1757..8dcfaee1a 100644 --- a/formal/qualification/aeneas/generated/model/Types.lean +++ b/formal/qualification/aeneas/generated/model/Types.lean @@ -15,7 +15,7 @@ set_option maxRecDepth 2048 namespace auths_model /-- [auths_model::PrincipalId] - Source: 'core/crates/auths-model/src/lib.rs', lines 162:0-162:31 + Source: 'core/crates/auths-model/src/lib.rs', lines 154:0-154:31 Visibility: public -/ @[reducible] def PrincipalId := String @@ -63,130 +63,130 @@ structure approval.ApprovalCounts where def bounded.BoundedSet (T : Type) (MAX : Std.Usize) := alloc.vec.Vec T /-- [auths_model::Digest] - Source: 'core/crates/auths-model/src/lib.rs', lines 248:0-248:28 + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:28 Visibility: public -/ @[reducible] def Digest := Array Std.U8 32#usize /-- [auths_model::Audience] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def Audience := String /-- [auths_model::CapabilityId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def CapabilityId := String /-- [auths_model::ResourceId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def ResourceId := String /-- [auths_model::BudgetAlgebraId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def BudgetAlgebraId := String /-- [auths_model::StatusMethodId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def StatusMethodId := String /-- [auths_model::ExtensionId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def ExtensionId := String /-- [auths_model::AssurancePolicyId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def AssurancePolicyId := String /-- [auths_model::ProfileId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def ProfileId := String /-- [auths_model::observation::FactName] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def observation.FactName := String /-- [auths_model::observation::ObserverAnchorId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def observation.ObserverAnchorId := String /-- [auths_model::observation::ObservationSchemaId] - Source: 'core/crates/auths-model/src/lib.rs', lines 131:8-131:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 Visibility: public -/ @[reducible] def observation.ObservationSchemaId := String /-- [auths_model::GrantId] - Source: 'core/crates/auths-model/src/lib.rs', lines 267:8-267:33 + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 Visibility: public -/ @[reducible] def GrantId := Digest /-- [auths_model::Timestamp] - Source: 'core/crates/auths-model/src/lib.rs', lines 357:0-357:26 + Source: 'core/crates/auths-model/src/lib.rs', lines 339:0-339:26 Visibility: public -/ @[reducible] def Timestamp := Std.U64 /-- [auths_model::ValidityWindow] - Source: 'core/crates/auths-model/src/lib.rs', lines 372:0-375:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 354:0-357:1 Visibility: public -/ structure ValidityWindow where not_before : Timestamp expires_at : Timestamp /-- [auths_model::ProfileRef] - Source: 'core/crates/auths-model/src/lib.rs', lines 445:0-448:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 427:0-430:1 Visibility: public -/ structure ProfileRef where id : ProfileId version : Std.U16 /-- [auths_model::Permission] - Source: 'core/crates/auths-model/src/lib.rs', lines 522:0-525:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 504:0-507:1 Visibility: public -/ structure Permission where capability : CapabilityId resource : ResourceId /-- [auths_model::PermissionSet] - Source: 'core/crates/auths-model/src/lib.rs', lines 553:0-553:71 + Source: 'core/crates/auths-model/src/lib.rs', lines 535:0-535:71 Visibility: public -/ @[reducible] def PermissionSet := bounded.BoundedSet Permission 1024#usize /-- [auths_model::AudienceSet] - Source: 'core/crates/auths-model/src/lib.rs', lines 616:0-616:65 + Source: 'core/crates/auths-model/src/lib.rs', lines 598:0-598:65 Visibility: public -/ @[reducible] def AudienceSet := bounded.BoundedSet Audience 256#usize /-- [auths_model::BodyDigestSet] - Source: 'core/crates/auths-model/src/lib.rs', lines 684:0-684:68 + Source: 'core/crates/auths-model/src/lib.rs', lines 666:0-666:68 Visibility: public -/ @[reducible] def BodyDigestSet := bounded.BoundedSet Digest 256#usize /-- [auths_model::ActionConstraint] - Source: 'core/crates/auths-model/src/lib.rs', lines 773:0-780:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 755:0-762:1 Visibility: public -/ @[discriminant isize] inductive ActionConstraint where @@ -195,14 +195,14 @@ inductive ActionConstraint where | AllowedBodyDigests : BodyDigestSet → ActionConstraint /-- [auths_model::BudgetCeiling] - Source: 'core/crates/auths-model/src/lib.rs', lines 850:0-853:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 832:0-835:1 Visibility: public -/ structure BudgetCeiling where algebra : BudgetAlgebraId value : Std.U64 /-- [auths_model::ProfileBudgetExpression] - Source: 'core/crates/auths-model/src/lib.rs', lines 945:0-951:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 927:0-933:1 Visibility: public -/ @[discriminant isize] inductive ProfileBudgetExpression where @@ -210,13 +210,13 @@ inductive ProfileBudgetExpression where | Inexpressible : ProfileBudgetExpression /-- [auths_model::FreshnessLimit] - Source: 'core/crates/auths-model/src/lib.rs', lines 978:0-978:31 + Source: 'core/crates/auths-model/src/lib.rs', lines 960:0-960:31 Visibility: public -/ @[reducible] def FreshnessLimit := Std.U64 /-- [auths_model::StatusPolicy] - Source: 'core/crates/auths-model/src/lib.rs', lines 1003:0-1013:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 985:0-995:1 Visibility: public -/ @[discriminant isize] inductive StatusPolicy where @@ -224,14 +224,14 @@ inductive StatusPolicy where | SnapshotRequired : StatusMethodId → FreshnessLimit → StatusPolicy /-- [auths_model::CriticalExtension] - Source: 'core/crates/auths-model/src/lib.rs', lines 1047:0-1050:1 + Source: 'core/crates/auths-model/src/lib.rs', lines 1029:0-1032:1 Visibility: public -/ structure CriticalExtension where id : ExtensionId bytes : alloc.vec.Vec Std.U8 /-- [auths_model::CriticalExtensions] - Source: 'core/crates/auths-model/src/lib.rs', lines 1078:0-1078:54 + Source: 'core/crates/auths-model/src/lib.rs', lines 1060:0-1060:54 Visibility: public -/ @[reducible] def CriticalExtensions := alloc.vec.Vec CriticalExtension diff --git a/formal/qualification/aeneas/generated/model/translation.json b/formal/qualification/aeneas/generated/model/translation.json index a26a3fc1e..a0ab0cdef 100644 --- a/formal/qualification/aeneas/generated/model/translation.json +++ b/formal/qualification/aeneas/generated/model/translation.json @@ -4,7 +4,7 @@ "crate": "auths_model", "functions": [ { - "def_id": 96, + "def_id": 104, "lean_name": "auths_model.Array.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", "rust_name": "core::array::{impl core::cmp::Ord for [T; N]}::cmp", @@ -21,7 +21,58 @@ "reducible": false }, { - "def_id": 120, + "def_id": 42, + "lean_name": "auths_model.core.str.Str.len", + "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::len", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 153, + "end_line": 153 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 41, + "lean_name": "auths_model.core.str.Str.is_empty", + "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::is_empty", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 173, + "end_line": 173 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 43, + "lean_name": "auths_model.core.str.Str.as_bytes", + "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::as_bytes", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 498, + "end_line": 498 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 128, "lean_name": "auths_model.alloc.string.String.Insts.CoreCmpPartialEqString.eq", "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", "rust_name": "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", @@ -38,7 +89,7 @@ "reducible": false }, { - "def_id": 93, + "def_id": 101, "lean_name": "auths_model.alloc.string.String.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", "rust_name": "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", @@ -55,7 +106,7 @@ "reducible": false }, { - "def_id": 46, + "def_id": 51, "lean_name": "auths_model.alloc.string.String.as_bytes", "lean_file": "qualification/aeneas/generated/model/FunsExternal_Template.lean", "rust_name": "alloc::string::{alloc::string::String}::as_bytes", @@ -72,15 +123,15 @@ "reducible": false }, { - "def_id": 47, + "def_id": 52, "lean_name": "auths_model.byte_slices_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::byte_slices_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 124, - "end_line": 126 + "begin_line": 113, + "end_line": 115 }, "is_opaque": false, "can_fail": true, @@ -89,15 +140,15 @@ "reducible": false }, { - "def_id": 20, + "def_id": 21, "lean_name": "auths_model.principal_id_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::principal_id_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 201, - "end_line": 203 + "begin_line": 183, + "end_line": 185 }, "is_opaque": false, "can_fail": true, @@ -106,7 +157,7 @@ "reducible": false }, { - "def_id": 58, + "def_id": 63, "lean_name": "auths_model.approval.approver_verdict_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approver_verdict", @@ -131,7 +182,7 @@ "parent_lean_name": "auths_model.approval.approver_verdict" }, { - "def_id": 58, + "def_id": 63, "lean_name": "auths_model.approval.approver_verdict_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approver_verdict", @@ -156,7 +207,7 @@ "parent_lean_name": "auths_model.approval.approver_verdict" }, { - "def_id": 58, + "def_id": 63, "lean_name": "auths_model.approval.approver_verdict", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approver_verdict", @@ -173,7 +224,7 @@ "reducible": true }, { - "def_id": 38, + "def_id": 39, "lean_name": "auths_model.approval.approval_counts_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_counts", @@ -198,7 +249,7 @@ "parent_lean_name": "auths_model.approval.approval_counts" }, { - "def_id": 38, + "def_id": 39, "lean_name": "auths_model.approval.approval_counts_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_counts", @@ -223,7 +274,7 @@ "parent_lean_name": "auths_model.approval.approval_counts" }, { - "def_id": 38, + "def_id": 39, "lean_name": "auths_model.approval.approval_counts", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_counts", @@ -240,7 +291,7 @@ "reducible": false }, { - "def_id": 113, + "def_id": 121, "lean_name": "auths_model.approval.principal_ids_contain_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::principal_ids_contain", @@ -265,7 +316,7 @@ "parent_lean_name": "auths_model.approval.principal_ids_contain" }, { - "def_id": 113, + "def_id": 121, "lean_name": "auths_model.approval.principal_ids_contain_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::principal_ids_contain", @@ -290,7 +341,7 @@ "parent_lean_name": "auths_model.approval.principal_ids_contain" }, { - "def_id": 113, + "def_id": 121, "lean_name": "auths_model.approval.principal_ids_contain", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::principal_ids_contain", @@ -307,7 +358,7 @@ "reducible": true }, { - "def_id": 104, + "def_id": 112, "lean_name": "auths_model.approval.principal_ids_subset_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::principal_ids_subset", @@ -332,7 +383,7 @@ "parent_lean_name": "auths_model.approval.principal_ids_subset" }, { - "def_id": 104, + "def_id": 112, "lean_name": "auths_model.approval.principal_ids_subset_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::principal_ids_subset", @@ -357,7 +408,7 @@ "parent_lean_name": "auths_model.approval.principal_ids_subset" }, { - "def_id": 104, + "def_id": 112, "lean_name": "auths_model.approval.principal_ids_subset", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::principal_ids_subset", @@ -374,7 +425,7 @@ "reducible": true }, { - "def_id": 76, + "def_id": 82, "lean_name": "auths_model.approval.approval_requirement_covers", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirement_covers", @@ -391,7 +442,7 @@ "reducible": false }, { - "def_id": 59, + "def_id": 64, "lean_name": "auths_model.approval.approval_requirement_retained_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirement_retained", @@ -416,7 +467,7 @@ "parent_lean_name": "auths_model.approval.approval_requirement_retained" }, { - "def_id": 59, + "def_id": 64, "lean_name": "auths_model.approval.approval_requirement_retained_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirement_retained", @@ -441,7 +492,7 @@ "parent_lean_name": "auths_model.approval.approval_requirement_retained" }, { - "def_id": 59, + "def_id": 64, "lean_name": "auths_model.approval.approval_requirement_retained", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirement_retained", @@ -458,7 +509,7 @@ "reducible": true }, { - "def_id": 39, + "def_id": 40, "lean_name": "auths_model.approval.approval_requirements_attenuate_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirements_attenuate", @@ -483,7 +534,7 @@ "parent_lean_name": "auths_model.approval.approval_requirements_attenuate" }, { - "def_id": 39, + "def_id": 40, "lean_name": "auths_model.approval.approval_requirements_attenuate_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirements_attenuate", @@ -508,7 +559,7 @@ "parent_lean_name": "auths_model.approval.approval_requirements_attenuate" }, { - "def_id": 39, + "def_id": 40, "lean_name": "auths_model.approval.approval_requirements_attenuate", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::approval::approval_requirements_attenuate", @@ -525,7 +576,7 @@ "reducible": true }, { - "def_id": 41, + "def_id": 46, "lean_name": "auths_model.bounded.BoundedSet.as_slice", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::bounded::{auths_model::bounded::BoundedSet}::as_slice", @@ -542,7 +593,7 @@ "reducible": false }, { - "def_id": 40, + "def_id": 45, "lean_name": "auths_model.bounded.BoundedSet.len", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::bounded::{auths_model::bounded::BoundedSet}::len", @@ -559,15 +610,15 @@ "reducible": false }, { - "def_id": 74, + "def_id": 80, "lean_name": "auths_model.Digest.as_bytes", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{auths_model::Digest}::as_bytes", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 259, - "end_line": 261 + "begin_line": 241, + "end_line": 243 }, "is_opaque": false, "can_fail": true, @@ -576,7 +627,7 @@ "reducible": false }, { - "def_id": 57, + "def_id": 62, "lean_name": "auths_model.bounded_policy.digest_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::bounded_policy::digest_equal", @@ -593,7 +644,7 @@ "reducible": false }, { - "def_id": 37, + "def_id": 38, "lean_name": "auths_model.bounded_policy.bounded_policy_link_accepts", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::bounded_policy::bounded_policy_link_accepts", @@ -610,15 +661,133 @@ "reducible": false }, { - "def_id": 106, + "def_id": 84, + "lean_name": "auths_model.identifier.forbidden_three_byte_prefix", + "lean_file": "qualification/aeneas/generated/model/Funs.lean", + "rust_name": "auths_model::identifier::forbidden_three_byte_prefix", + "is_local": true, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 9, + "end_line": 21 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 65, + "lean_name": "auths_model.identifier.forbidden_identifier_at", + "lean_file": "qualification/aeneas/generated/model/Funs.lean", + "rust_name": "auths_model::identifier::forbidden_identifier_at", + "is_local": true, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 23, + "end_line": 42 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 44, + "lean_name": "auths_model.identifier.contains_forbidden_identifier_loop.body", + "lean_file": "qualification/aeneas/generated/model/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": true, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 46, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_model.identifier.contains_forbidden_identifier" + }, + { + "def_id": 44, + "lean_name": "auths_model.identifier.contains_forbidden_identifier_loop", + "lean_file": "qualification/aeneas/generated/model/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": true, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 46, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_model.identifier.contains_forbidden_identifier" + }, + { + "def_id": 44, + "lean_name": "auths_model.identifier.contains_forbidden_identifier", + "lean_file": "qualification/aeneas/generated/model/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": true, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 44, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 0, + "lean_name": "auths_model.identifier.bounded_identifier_valid", + "lean_file": "qualification/aeneas/generated/model/Funs.lean", + "rust_name": "auths_model::identifier::bounded_identifier_valid", + "is_local": true, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 55, + "end_line": 57 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 114, "lean_name": "auths_model.Audience.Insts.CoreCmpPartialEqAudience.eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Audience}::eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -627,15 +796,15 @@ "reducible": false }, { - "def_id": 91, + "def_id": 99, "lean_name": "auths_model.Audience.Insts.CoreCmpEq.assert_fields_are_eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Audience}::assert_fields_are_eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -644,15 +813,15 @@ "reducible": false }, { - "def_id": 114, + "def_id": 122, "lean_name": "auths_model.CapabilityId.Insts.CoreCmpPartialEqCapabilityId.eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::CapabilityId}::eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -661,15 +830,15 @@ "reducible": false }, { - "def_id": 115, + "def_id": 123, "lean_name": "auths_model.ResourceId.Insts.CoreCmpPartialEqResourceId.eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::ResourceId}::eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -678,15 +847,15 @@ "reducible": false }, { - "def_id": 64, + "def_id": 70, "lean_name": "auths_model.Audience.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Audience}::cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -695,15 +864,15 @@ "reducible": false }, { - "def_id": 92, + "def_id": 100, "lean_name": "auths_model.Audience.Insts.CoreCmpPartialOrdAudience.partial_cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Audience}::partial_cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -712,15 +881,15 @@ "reducible": false }, { - "def_id": 89, + "def_id": 97, "lean_name": "auths_model.CapabilityId.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::CapabilityId}::cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -729,15 +898,15 @@ "reducible": false }, { - "def_id": 90, + "def_id": 98, "lean_name": "auths_model.ResourceId.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::ResourceId}::cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "is_opaque": false, "can_fail": true, @@ -746,15 +915,15 @@ "reducible": false }, { - "def_id": 107, + "def_id": 115, "lean_name": "auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "is_opaque": false, "can_fail": true, @@ -763,15 +932,15 @@ "reducible": false }, { - "def_id": 94, + "def_id": 102, "lean_name": "auths_model.Digest.Insts.CoreCmpEq.assert_fields_are_eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Digest}::assert_fields_are_eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "is_opaque": false, "can_fail": true, @@ -780,15 +949,15 @@ "reducible": false }, { - "def_id": 65, + "def_id": 71, "lean_name": "auths_model.Digest.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "is_opaque": false, "can_fail": true, @@ -797,15 +966,15 @@ "reducible": false }, { - "def_id": 95, + "def_id": 103, "lean_name": "auths_model.Digest.Insts.CoreCmpPartialOrdDigest.partial_cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Digest}::partial_cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "is_opaque": false, "can_fail": true, @@ -814,15 +983,15 @@ "reducible": false }, { - "def_id": 53, + "def_id": 58, "lean_name": "auths_model.GrantId.as_bytes", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{auths_model::GrantId}::as_bytes", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 286, - "end_line": 288 + "begin_line": 268, + "end_line": 270 }, "is_opaque": false, "can_fail": true, @@ -831,15 +1000,15 @@ "reducible": false }, { - "def_id": 0, + "def_id": 1, "lean_name": "auths_model.inclusive_window_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::inclusive_window_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 423, - "end_line": 430 + "begin_line": 405, + "end_line": 412 }, "is_opaque": false, "can_fail": true, @@ -848,15 +1017,15 @@ "reducible": false }, { - "def_id": 1, + "def_id": 2, "lean_name": "auths_model.validity_window_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::validity_window_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 435, - "end_line": 442 + "begin_line": 417, + "end_line": 424 }, "is_opaque": false, "can_fail": true, @@ -865,15 +1034,15 @@ "reducible": false }, { - "def_id": 24, + "def_id": 25, "lean_name": "auths_model.profile_ref_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::profile_ref_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 478, - "end_line": 480 + "begin_line": 460, + "end_line": 462 }, "is_opaque": false, "can_fail": true, @@ -882,15 +1051,15 @@ "reducible": false }, { - "def_id": 23, + "def_id": 24, "lean_name": "auths_model.profile_slice_contains_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::profile_slice_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 487, - "end_line": 494 + "begin_line": 469, + "end_line": 476 }, "is_opaque": false, "can_fail": true, @@ -907,15 +1076,15 @@ "parent_lean_name": "auths_model.profile_slice_contains" }, { - "def_id": 23, + "def_id": 24, "lean_name": "auths_model.profile_slice_contains_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::profile_slice_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 487, - "end_line": 494 + "begin_line": 469, + "end_line": 476 }, "is_opaque": false, "can_fail": true, @@ -932,15 +1101,15 @@ "parent_lean_name": "auths_model.profile_slice_contains" }, { - "def_id": 23, + "def_id": 24, "lean_name": "auths_model.profile_slice_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::profile_slice_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 485, - "end_line": 494 + "begin_line": 467, + "end_line": 476 }, "is_opaque": false, "can_fail": true, @@ -949,15 +1118,15 @@ "reducible": true }, { - "def_id": 19, + "def_id": 20, "lean_name": "auths_model.assurance_policy_id_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::assurance_policy_id_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 499, - "end_line": 501 + "begin_line": 481, + "end_line": 483 }, "is_opaque": false, "can_fail": true, @@ -966,15 +1135,15 @@ "reducible": false }, { - "def_id": 21, + "def_id": 22, "lean_name": "auths_model.grant_id_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::grant_id_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 506, - "end_line": 508 + "begin_line": 488, + "end_line": 490 }, "is_opaque": false, "can_fail": true, @@ -983,15 +1152,15 @@ "reducible": false }, { - "def_id": 22, + "def_id": 23, "lean_name": "auths_model.optional_grant_id_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::optional_grant_id_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 513, - "end_line": 519 + "begin_line": 495, + "end_line": 501 }, "is_opaque": false, "can_fail": true, @@ -1000,15 +1169,15 @@ "reducible": false }, { - "def_id": 105, + "def_id": 113, "lean_name": "auths_model.Permission.Insts.CoreCmpPartialEqPermission.eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Permission}::eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "is_opaque": false, "can_fail": true, @@ -1017,15 +1186,15 @@ "reducible": false }, { - "def_id": 87, + "def_id": 95, "lean_name": "auths_model.Permission.Insts.CoreCmpEq.assert_fields_are_eq", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Permission}::assert_fields_are_eq", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "is_opaque": false, "can_fail": true, @@ -1034,15 +1203,15 @@ "reducible": false }, { - "def_id": 63, + "def_id": 69, "lean_name": "auths_model.Permission.Insts.CoreCmpOrd.cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Permission}::cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "is_opaque": false, "can_fail": true, @@ -1051,15 +1220,15 @@ "reducible": false }, { - "def_id": 88, + "def_id": 96, "lean_name": "auths_model.Permission.Insts.CoreCmpPartialOrdPermission.partial_cmp", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Permission}::partial_cmp", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "is_opaque": false, "can_fail": true, @@ -1068,15 +1237,15 @@ "reducible": false }, { - "def_id": 42, + "def_id": 47, "lean_name": "auths_model.permissions_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permissions_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 547, - "end_line": 550 + "begin_line": 529, + "end_line": 532 }, "is_opaque": false, "can_fail": true, @@ -1085,15 +1254,15 @@ "reducible": false }, { - "def_id": 2, + "def_id": 3, "lean_name": "auths_model.permission_set_contains_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permission_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 592, - "end_line": 599 + "begin_line": 574, + "end_line": 581 }, "is_opaque": false, "can_fail": true, @@ -1110,15 +1279,15 @@ "parent_lean_name": "auths_model.permission_set_contains" }, { - "def_id": 2, + "def_id": 3, "lean_name": "auths_model.permission_set_contains_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permission_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 592, - "end_line": 599 + "begin_line": 574, + "end_line": 581 }, "is_opaque": false, "can_fail": true, @@ -1135,15 +1304,15 @@ "parent_lean_name": "auths_model.permission_set_contains" }, { - "def_id": 2, + "def_id": 3, "lean_name": "auths_model.permission_set_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permission_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 590, - "end_line": 599 + "begin_line": 572, + "end_line": 581 }, "is_opaque": false, "can_fail": true, @@ -1152,15 +1321,15 @@ "reducible": true }, { - "def_id": 3, + "def_id": 4, "lean_name": "auths_model.permission_set_is_subset_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permission_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 606, - "end_line": 613 + "begin_line": 588, + "end_line": 595 }, "is_opaque": false, "can_fail": true, @@ -1177,15 +1346,15 @@ "parent_lean_name": "auths_model.permission_set_is_subset" }, { - "def_id": 3, + "def_id": 4, "lean_name": "auths_model.permission_set_is_subset_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permission_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 606, - "end_line": 613 + "begin_line": 588, + "end_line": 595 }, "is_opaque": false, "can_fail": true, @@ -1202,15 +1371,15 @@ "parent_lean_name": "auths_model.permission_set_is_subset" }, { - "def_id": 3, + "def_id": 4, "lean_name": "auths_model.permission_set_is_subset", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::permission_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 604, - "end_line": 613 + "begin_line": 586, + "end_line": 595 }, "is_opaque": false, "can_fail": true, @@ -1219,15 +1388,15 @@ "reducible": true }, { - "def_id": 43, + "def_id": 48, "lean_name": "auths_model.audiences_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audiences_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 618, - "end_line": 620 + "begin_line": 600, + "end_line": 602 }, "is_opaque": false, "can_fail": true, @@ -1236,15 +1405,15 @@ "reducible": false }, { - "def_id": 4, + "def_id": 5, "lean_name": "auths_model.audience_set_contains_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audience_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 659, - "end_line": 666 + "begin_line": 641, + "end_line": 648 }, "is_opaque": false, "can_fail": true, @@ -1261,15 +1430,15 @@ "parent_lean_name": "auths_model.audience_set_contains" }, { - "def_id": 4, + "def_id": 5, "lean_name": "auths_model.audience_set_contains_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audience_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 659, - "end_line": 666 + "begin_line": 641, + "end_line": 648 }, "is_opaque": false, "can_fail": true, @@ -1286,15 +1455,15 @@ "parent_lean_name": "auths_model.audience_set_contains" }, { - "def_id": 4, + "def_id": 5, "lean_name": "auths_model.audience_set_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audience_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 657, - "end_line": 666 + "begin_line": 639, + "end_line": 648 }, "is_opaque": false, "can_fail": true, @@ -1303,15 +1472,15 @@ "reducible": true }, { - "def_id": 5, + "def_id": 6, "lean_name": "auths_model.audience_set_is_subset_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audience_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 673, - "end_line": 680 + "begin_line": 655, + "end_line": 662 }, "is_opaque": false, "can_fail": true, @@ -1328,15 +1497,15 @@ "parent_lean_name": "auths_model.audience_set_is_subset" }, { - "def_id": 5, + "def_id": 6, "lean_name": "auths_model.audience_set_is_subset_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audience_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 673, - "end_line": 680 + "begin_line": 655, + "end_line": 662 }, "is_opaque": false, "can_fail": true, @@ -1353,15 +1522,15 @@ "parent_lean_name": "auths_model.audience_set_is_subset" }, { - "def_id": 5, + "def_id": 6, "lean_name": "auths_model.audience_set_is_subset", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::audience_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 671, - "end_line": 680 + "begin_line": 653, + "end_line": 662 }, "is_opaque": false, "can_fail": true, @@ -1370,15 +1539,15 @@ "reducible": true }, { - "def_id": 44, + "def_id": 49, "lean_name": "auths_model.digests_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::digests_equal", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 686, - "end_line": 688 + "begin_line": 668, + "end_line": 670 }, "is_opaque": false, "can_fail": true, @@ -1387,15 +1556,15 @@ "reducible": false }, { - "def_id": 6, + "def_id": 7, "lean_name": "auths_model.body_digest_set_contains_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 730, - "end_line": 737 + "begin_line": 712, + "end_line": 719 }, "is_opaque": false, "can_fail": true, @@ -1412,15 +1581,15 @@ "parent_lean_name": "auths_model.body_digest_set_contains" }, { - "def_id": 6, + "def_id": 7, "lean_name": "auths_model.body_digest_set_contains_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 730, - "end_line": 737 + "begin_line": 712, + "end_line": 719 }, "is_opaque": false, "can_fail": true, @@ -1437,15 +1606,15 @@ "parent_lean_name": "auths_model.body_digest_set_contains" }, { - "def_id": 6, + "def_id": 7, "lean_name": "auths_model.body_digest_set_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 728, - "end_line": 737 + "begin_line": 710, + "end_line": 719 }, "is_opaque": false, "can_fail": true, @@ -1454,15 +1623,15 @@ "reducible": true }, { - "def_id": 7, + "def_id": 8, "lean_name": "auths_model.body_digest_set_is_subset_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 744, - "end_line": 751 + "begin_line": 726, + "end_line": 733 }, "is_opaque": false, "can_fail": true, @@ -1479,15 +1648,15 @@ "parent_lean_name": "auths_model.body_digest_set_is_subset" }, { - "def_id": 7, + "def_id": 8, "lean_name": "auths_model.body_digest_set_is_subset_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 744, - "end_line": 751 + "begin_line": 726, + "end_line": 733 }, "is_opaque": false, "can_fail": true, @@ -1504,15 +1673,15 @@ "parent_lean_name": "auths_model.body_digest_set_is_subset" }, { - "def_id": 7, + "def_id": 8, "lean_name": "auths_model.body_digest_set_is_subset", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_is_subset", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 742, - "end_line": 751 + "begin_line": 724, + "end_line": 733 }, "is_opaque": false, "can_fail": true, @@ -1521,15 +1690,15 @@ "reducible": true }, { - "def_id": 45, + "def_id": 50, "lean_name": "auths_model.body_digest_set_only_contains_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_only_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 762, - "end_line": 769 + "begin_line": 744, + "end_line": 751 }, "is_opaque": false, "can_fail": true, @@ -1546,15 +1715,15 @@ "parent_lean_name": "auths_model.body_digest_set_only_contains" }, { - "def_id": 45, + "def_id": 50, "lean_name": "auths_model.body_digest_set_only_contains_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_only_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 762, - "end_line": 769 + "begin_line": 744, + "end_line": 751 }, "is_opaque": false, "can_fail": true, @@ -1571,15 +1740,15 @@ "parent_lean_name": "auths_model.body_digest_set_only_contains" }, { - "def_id": 45, + "def_id": 50, "lean_name": "auths_model.body_digest_set_only_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::body_digest_set_only_contains", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 760, - "end_line": 769 + "begin_line": 742, + "end_line": 751 }, "is_opaque": false, "can_fail": true, @@ -1588,15 +1757,15 @@ "reducible": true }, { - "def_id": 8, + "def_id": 9, "lean_name": "auths_model.action_constraint_allows", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::action_constraint_allows", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 816, - "end_line": 822 + "begin_line": 798, + "end_line": 804 }, "is_opaque": false, "can_fail": true, @@ -1605,15 +1774,15 @@ "reducible": false }, { - "def_id": 9, + "def_id": 10, "lean_name": "auths_model.action_constraint_attenuates", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::action_constraint_attenuates", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 827, - "end_line": 847 + "begin_line": 809, + "end_line": 829 }, "is_opaque": false, "can_fail": true, @@ -1622,15 +1791,15 @@ "reducible": false }, { - "def_id": 10, + "def_id": 11, "lean_name": "auths_model.budget_ceiling_attenuates", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::budget_ceiling_attenuates", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 886, - "end_line": 889 + "begin_line": 868, + "end_line": 871 }, "is_opaque": false, "can_fail": true, @@ -1639,15 +1808,15 @@ "reducible": false }, { - "def_id": 48, + "def_id": 53, "lean_name": "auths_model.BudgetCeiling.attenuates", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{auths_model::BudgetCeiling}::attenuates", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 872, - "end_line": 874 + "begin_line": 854, + "end_line": 856 }, "is_opaque": false, "can_fail": true, @@ -1656,15 +1825,15 @@ "reducible": false }, { - "def_id": 49, + "def_id": 54, "lean_name": "auths_model.BudgetCeiling.covers", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::{auths_model::BudgetCeiling}::covers", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 878, - "end_line": 880 + "begin_line": 860, + "end_line": 862 }, "is_opaque": false, "can_fail": true, @@ -1673,15 +1842,15 @@ "reducible": false }, { - "def_id": 11, + "def_id": 12, "lean_name": "auths_model.optional_budget_attenuates", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::optional_budget_attenuates", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 896, - "end_line": 905 + "begin_line": 878, + "end_line": 887 }, "is_opaque": false, "can_fail": true, @@ -1690,15 +1859,15 @@ "reducible": false }, { - "def_id": 12, + "def_id": 13, "lean_name": "auths_model.optional_budget_covers", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::optional_budget_covers", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 917, - "end_line": 926 + "begin_line": 899, + "end_line": 908 }, "is_opaque": false, "can_fail": true, @@ -1707,15 +1876,15 @@ "reducible": false }, { - "def_id": 13, + "def_id": 14, "lean_name": "auths_model.budget_ceiling_covers_action", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::budget_ceiling_covers_action", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 964, - "end_line": 974 + "begin_line": 946, + "end_line": 956 }, "is_opaque": false, "can_fail": true, @@ -1724,15 +1893,15 @@ "reducible": false }, { - "def_id": 14, + "def_id": 15, "lean_name": "auths_model.status_policy_attenuates", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::status_policy_attenuates", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1026, - "end_line": 1044 + "begin_line": 1008, + "end_line": 1026 }, "is_opaque": false, "can_fail": true, @@ -1741,15 +1910,15 @@ "reducible": false }, { - "def_id": 18, + "def_id": 19, "lean_name": "auths_model.critical_extension_find_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::critical_extension_find", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1134, - "end_line": 1141 + "begin_line": 1116, + "end_line": 1123 }, "is_opaque": false, "can_fail": true, @@ -1766,15 +1935,15 @@ "parent_lean_name": "auths_model.critical_extension_find" }, { - "def_id": 18, + "def_id": 19, "lean_name": "auths_model.critical_extension_find_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::critical_extension_find", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1134, - "end_line": 1141 + "begin_line": 1116, + "end_line": 1123 }, "is_opaque": false, "can_fail": true, @@ -1791,15 +1960,15 @@ "parent_lean_name": "auths_model.critical_extension_find" }, { - "def_id": 18, + "def_id": 19, "lean_name": "auths_model.critical_extension_find", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::critical_extension_find", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1129, - "end_line": 1141 + "begin_line": 1111, + "end_line": 1123 }, "is_opaque": false, "can_fail": true, @@ -1808,15 +1977,15 @@ "reducible": true }, { - "def_id": 15, + "def_id": 16, "lean_name": "auths_model.critical_extension_entries", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::critical_extension_entries", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1146, - "end_line": 1148 + "begin_line": 1128, + "end_line": 1130 }, "is_opaque": false, "can_fail": true, @@ -1825,15 +1994,15 @@ "reducible": false }, { - "def_id": 16, + "def_id": 17, "lean_name": "auths_model.critical_extension_id", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::critical_extension_id", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1153, - "end_line": 1155 + "begin_line": 1135, + "end_line": 1137 }, "is_opaque": false, "can_fail": true, @@ -1842,15 +2011,15 @@ "reducible": false }, { - "def_id": 17, + "def_id": 18, "lean_name": "auths_model.critical_extension_payload", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::critical_extension_payload", "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1160, - "end_line": 1162 + "begin_line": 1142, + "end_line": 1144 }, "is_opaque": false, "can_fail": true, @@ -1859,7 +2028,7 @@ "reducible": false }, { - "def_id": 27, + "def_id": 28, "lean_name": "auths_model.observation.fact_name_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::fact_name_equal", @@ -1876,7 +2045,7 @@ "reducible": false }, { - "def_id": 25, + "def_id": 26, "lean_name": "auths_model.observation.observation_fresh", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_fresh", @@ -1893,7 +2062,7 @@ "reducible": false }, { - "def_id": 26, + "def_id": 27, "lean_name": "auths_model.observation.observation_subject_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_subject_equal", @@ -1910,7 +2079,7 @@ "reducible": false }, { - "def_id": 28, + "def_id": 29, "lean_name": "auths_model.observation.fact_value_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::fact_value_equal", @@ -1927,7 +2096,7 @@ "reducible": false }, { - "def_id": 29, + "def_id": 30, "lean_name": "auths_model.observation.uint_range_contains", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::uint_range_contains", @@ -1944,7 +2113,7 @@ "reducible": false }, { - "def_id": 30, + "def_id": 31, "lean_name": "auths_model.observation.member_values_contain_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::member_values_contain", @@ -1969,7 +2138,7 @@ "parent_lean_name": "auths_model.observation.member_values_contain" }, { - "def_id": 30, + "def_id": 31, "lean_name": "auths_model.observation.member_values_contain_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::member_values_contain", @@ -1994,7 +2163,7 @@ "parent_lean_name": "auths_model.observation.member_values_contain" }, { - "def_id": 30, + "def_id": 31, "lean_name": "auths_model.observation.member_values_contain", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::member_values_contain", @@ -2011,7 +2180,7 @@ "reducible": true }, { - "def_id": 31, + "def_id": 32, "lean_name": "auths_model.observation.observation_fact_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_fact", @@ -2036,7 +2205,7 @@ "parent_lean_name": "auths_model.observation.observation_fact" }, { - "def_id": 31, + "def_id": 32, "lean_name": "auths_model.observation.observation_fact_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_fact", @@ -2061,7 +2230,7 @@ "parent_lean_name": "auths_model.observation.observation_fact" }, { - "def_id": 31, + "def_id": 32, "lean_name": "auths_model.observation.observation_fact", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_fact", @@ -2078,7 +2247,7 @@ "reducible": true }, { - "def_id": 32, + "def_id": 33, "lean_name": "auths_model.observation.condition_value_holds", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::condition_value_holds", @@ -2095,7 +2264,7 @@ "reducible": false }, { - "def_id": 33, + "def_id": 34, "lean_name": "auths_model.observation.observation_condition_holds", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_condition_holds", @@ -2112,7 +2281,7 @@ "reducible": false }, { - "def_id": 34, + "def_id": 35, "lean_name": "auths_model.observation.observation_conditions_hold_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_hold", @@ -2137,7 +2306,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_hold" }, { - "def_id": 34, + "def_id": 35, "lean_name": "auths_model.observation.observation_conditions_hold_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_hold", @@ -2162,7 +2331,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_hold" }, { - "def_id": 34, + "def_id": 35, "lean_name": "auths_model.observation.observation_conditions_hold", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_hold", @@ -2179,7 +2348,7 @@ "reducible": false }, { - "def_id": 35, + "def_id": 36, "lean_name": "auths_model.observation.requirement_verdict", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::requirement_verdict", @@ -2196,7 +2365,7 @@ "reducible": false }, { - "def_id": 138, + "def_id": 146, "lean_name": "auths_model.observation.observer_anchor_id_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observer_anchor_id_equal", @@ -2213,7 +2382,7 @@ "reducible": false }, { - "def_id": 139, + "def_id": 147, "lean_name": "auths_model.observation.observation_schema_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_schema_equal", @@ -2230,7 +2399,7 @@ "reducible": false }, { - "def_id": 140, + "def_id": 148, "lean_name": "auths_model.observation.requirement_subject_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::requirement_subject_equal", @@ -2247,7 +2416,7 @@ "reducible": false }, { - "def_id": 145, + "def_id": 153, "lean_name": "auths_model.observation.member_values_equal_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::member_values_equal", @@ -2272,7 +2441,7 @@ "parent_lean_name": "auths_model.observation.member_values_equal" }, { - "def_id": 145, + "def_id": 153, "lean_name": "auths_model.observation.member_values_equal_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::member_values_equal", @@ -2297,7 +2466,7 @@ "parent_lean_name": "auths_model.observation.member_values_equal" }, { - "def_id": 145, + "def_id": 153, "lean_name": "auths_model.observation.member_values_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::member_values_equal", @@ -2314,7 +2483,7 @@ "reducible": false }, { - "def_id": 144, + "def_id": 152, "lean_name": "auths_model.observation.condition_test_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::condition_test_equal", @@ -2331,7 +2500,7 @@ "reducible": false }, { - "def_id": 141, + "def_id": 149, "lean_name": "auths_model.observation.observation_condition_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_condition_equal", @@ -2348,7 +2517,7 @@ "reducible": false }, { - "def_id": 142, + "def_id": 150, "lean_name": "auths_model.observation.observation_conditions_contain_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_contain", @@ -2373,7 +2542,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_contain" }, { - "def_id": 142, + "def_id": 150, "lean_name": "auths_model.observation.observation_conditions_contain_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_contain", @@ -2398,7 +2567,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_contain" }, { - "def_id": 142, + "def_id": 150, "lean_name": "auths_model.observation.observation_conditions_contain", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_contain", @@ -2415,7 +2584,7 @@ "reducible": true }, { - "def_id": 112, + "def_id": 120, "lean_name": "auths_model.observation.observation_conditions_include_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_include", @@ -2440,7 +2609,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_include" }, { - "def_id": 112, + "def_id": 120, "lean_name": "auths_model.observation.observation_conditions_include_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_include", @@ -2465,7 +2634,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_include" }, { - "def_id": 112, + "def_id": 120, "lean_name": "auths_model.observation.observation_conditions_include", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_include", @@ -2482,7 +2651,7 @@ "reducible": true }, { - "def_id": 111, + "def_id": 119, "lean_name": "auths_model.observation.observation_conditions_equal_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_equal", @@ -2507,7 +2676,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_equal" }, { - "def_id": 111, + "def_id": 119, "lean_name": "auths_model.observation.observation_conditions_equal_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_equal", @@ -2532,7 +2701,7 @@ "parent_lean_name": "auths_model.observation.observation_conditions_equal" }, { - "def_id": 111, + "def_id": 119, "lean_name": "auths_model.observation.observation_conditions_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_conditions_equal", @@ -2549,7 +2718,7 @@ "reducible": false }, { - "def_id": 110, + "def_id": 118, "lean_name": "auths_model.observation.observation_requirement_same_target", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_same_target", @@ -2566,7 +2735,7 @@ "reducible": false }, { - "def_id": 102, + "def_id": 110, "lean_name": "auths_model.observation.observation_requirement_equal", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_equal", @@ -2583,7 +2752,7 @@ "reducible": false }, { - "def_id": 103, + "def_id": 111, "lean_name": "auths_model.observation.observation_requirement_narrows", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_narrows", @@ -2600,7 +2769,7 @@ "reducible": false }, { - "def_id": 75, + "def_id": 81, "lean_name": "auths_model.observation.observation_requirement_covers", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_covers", @@ -2617,7 +2786,7 @@ "reducible": false }, { - "def_id": 55, + "def_id": 60, "lean_name": "auths_model.observation.observation_requirement_retained_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_retained", @@ -2642,7 +2811,7 @@ "parent_lean_name": "auths_model.observation.observation_requirement_retained" }, { - "def_id": 55, + "def_id": 60, "lean_name": "auths_model.observation.observation_requirement_retained_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_retained", @@ -2667,7 +2836,7 @@ "parent_lean_name": "auths_model.observation.observation_requirement_retained" }, { - "def_id": 55, + "def_id": 60, "lean_name": "auths_model.observation.observation_requirement_retained", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirement_retained", @@ -2684,7 +2853,7 @@ "reducible": true }, { - "def_id": 36, + "def_id": 37, "lean_name": "auths_model.observation.observation_requirements_attenuate_loop.body", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirements_attenuate", @@ -2709,7 +2878,7 @@ "parent_lean_name": "auths_model.observation.observation_requirements_attenuate" }, { - "def_id": 36, + "def_id": 37, "lean_name": "auths_model.observation.observation_requirements_attenuate_loop", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirements_attenuate", @@ -2734,7 +2903,7 @@ "parent_lean_name": "auths_model.observation.observation_requirements_attenuate" }, { - "def_id": 36, + "def_id": 37, "lean_name": "auths_model.observation.observation_requirements_attenuate", "lean_file": "qualification/aeneas/generated/model/Funs.lean", "rust_name": "auths_model::observation::observation_requirements_attenuate", @@ -2760,8 +2929,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 162, - "end_line": 162 + "begin_line": 154, + "end_line": 154 } }, { @@ -2844,8 +3013,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 248, - "end_line": 248 + "begin_line": 230, + "end_line": 230 } }, { @@ -2856,8 +3025,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2868,8 +3037,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2880,8 +3049,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2892,8 +3061,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2904,8 +3073,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2916,8 +3085,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2928,8 +3097,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2940,8 +3109,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2952,8 +3121,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2964,8 +3133,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2976,8 +3145,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 131, - "end_line": 131 + "begin_line": 120, + "end_line": 120 } }, { @@ -2988,8 +3157,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 267, - "end_line": 267 + "begin_line": 249, + "end_line": 249 } }, { @@ -3000,8 +3169,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 357, - "end_line": 357 + "begin_line": 339, + "end_line": 339 } }, { @@ -3012,8 +3181,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 372, - "end_line": 375 + "begin_line": 354, + "end_line": 357 } }, { @@ -3024,8 +3193,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 445, - "end_line": 448 + "begin_line": 427, + "end_line": 430 } }, { @@ -3036,8 +3205,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 522, - "end_line": 525 + "begin_line": 504, + "end_line": 507 } }, { @@ -3048,8 +3217,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 553, - "end_line": 553 + "begin_line": 535, + "end_line": 535 } }, { @@ -3060,8 +3229,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 616, - "end_line": 616 + "begin_line": 598, + "end_line": 598 } }, { @@ -3072,8 +3241,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 684, - "end_line": 684 + "begin_line": 666, + "end_line": 666 } }, { @@ -3084,8 +3253,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 773, - "end_line": 780 + "begin_line": 755, + "end_line": 762 } }, { @@ -3096,8 +3265,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 850, - "end_line": 853 + "begin_line": 832, + "end_line": 835 } }, { @@ -3108,8 +3277,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 945, - "end_line": 951 + "begin_line": 927, + "end_line": 933 } }, { @@ -3120,8 +3289,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 978, - "end_line": 978 + "begin_line": 960, + "end_line": 960 } }, { @@ -3132,8 +3301,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1003, - "end_line": 1013 + "begin_line": 985, + "end_line": 995 } }, { @@ -3144,8 +3313,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1047, - "end_line": 1050 + "begin_line": 1029, + "end_line": 1032 } }, { @@ -3156,8 +3325,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 1078, - "end_line": 1078 + "begin_line": 1060, + "end_line": 1060 } }, { @@ -3343,8 +3512,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "impl_trait_def_id": 5, "impl_trait_rust_name": "core::cmp::PartialEq", @@ -3358,8 +3527,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "impl_trait_def_id": 2, "impl_trait_rust_name": "core::cmp::Eq", @@ -3373,8 +3542,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "impl_trait_def_id": 3, "impl_trait_rust_name": "core::cmp::PartialOrd", @@ -3388,8 +3557,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 130, - "end_line": 130 + "begin_line": 119, + "end_line": 119 }, "impl_trait_def_id": 0, "impl_trait_rust_name": "core::cmp::Ord", @@ -3403,8 +3572,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "impl_trait_def_id": 5, "impl_trait_rust_name": "core::cmp::PartialEq", @@ -3418,8 +3587,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "impl_trait_def_id": 2, "impl_trait_rust_name": "core::cmp::Eq", @@ -3433,8 +3602,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "impl_trait_def_id": 3, "impl_trait_rust_name": "core::cmp::PartialOrd", @@ -3448,8 +3617,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 247, - "end_line": 247 + "begin_line": 229, + "end_line": 229 }, "impl_trait_def_id": 0, "impl_trait_rust_name": "core::cmp::Ord", @@ -3463,8 +3632,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "impl_trait_def_id": 5, "impl_trait_rust_name": "core::cmp::PartialEq", @@ -3478,8 +3647,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "impl_trait_def_id": 2, "impl_trait_rust_name": "core::cmp::Eq", @@ -3493,8 +3662,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "impl_trait_def_id": 3, "impl_trait_rust_name": "core::cmp::PartialOrd", @@ -3508,8 +3677,8 @@ "is_local": true, "source": { "file": "core/crates/auths-model/src/lib.rs", - "begin_line": 521, - "end_line": 521 + "begin_line": 503, + "end_line": 503 }, "impl_trait_def_id": 0, "impl_trait_rust_name": "core::cmp::Ord", diff --git a/formal/qualification/aeneas/generated/p256/Funs.lean b/formal/qualification/aeneas/generated/p256/Funs.lean new file mode 100644 index 000000000..6b72ec79a --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/Funs.lean @@ -0,0 +1,220 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: function definitions +import Aeneas +import qualification.aeneas.generated.p256.Types +import qualification.aeneas.generated.p256.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +variable [primitive : Auths.Crypto.P256Primitives] + +namespace AuthsNativeP256 + +/-- [auths_signature_core::P256_KEY_LEN] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 14:0-14:31 -/ +@[global_simps, irreducible] def P256_KEY_LEN : Std.Usize := 33#usize + +/-- [auths_signature_core::p256_key_encoding_is_canonical]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 42:0-47:1 -/ +def p256_key_encoding_is_canonical (encoded : Slice Std.U8) : Result Bool := do + let i ← core.qualified_p256_fun_decls_20 encoded + if i != P256_KEY_LEN + then ok false + else + let i1 ← Slice.index_usize encoded 0#usize + if i1 = 2#u8 + then ok true + else ok (i1 = 3#u8) + +/-- [auths_signature_core::P256_HALF_ORDER] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 50:0-53:2 -/ +@[global_simps, irreducible] +def P256_HALF_ORDER : Array Std.U8 32#usize := + Array.make 32#usize [ + 127#u8, 255#u8, 255#u8, 255#u8, 128#u8, 0#u8, 0#u8, 0#u8, 127#u8, 255#u8, + 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 222#u8, 115#u8, 125#u8, + 86#u8, 211#u8, 139#u8, 207#u8, 66#u8, 121#u8, 220#u8, 229#u8, 97#u8, + 126#u8, 49#u8, 146#u8, 168#u8 + ] + +/-- [auths_signature_core::p256_signature_is_low_s]: loop 0: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 1:0-69:1 -/ +@[rust_loop] +def p256_signature_is_low_s_loop + (encoded : Array Std.U8 64#usize) (index : Std.Usize) : Result Bool := do + if index < 32#usize + then + let i ← 32#usize + index + let value ← Array.index_usize encoded i + let bound ← Array.index_usize P256_HALF_ORDER index + if value < bound + then ok true + else + if value > bound + then ok false + else + let index1 ← index + 1#usize + p256_signature_is_low_s_loop encoded index1 + else ok true +partial_fixpoint + +/-- [auths_signature_core::p256_signature_is_low_s]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 55:0-69:1 -/ +@[reducible] +def p256_signature_is_low_s + (encoded : Array Std.U8 64#usize) : Result Bool := do + p256_signature_is_low_s_loop encoded 0#usize + +/-- [auths_signature_core::decode_p256_point]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 330:0-332:1 -/ +def decode_p256_point + (bytes : Slice Std.U8) : Result core.qualified_p256_type_decls_13 := do + let qptd1 ← ecdsa.qualified_p256_fun_decls_29 bytes + core.qualified_p256_fun_decls_30 qptd1 + +/-- [auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::decode]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 306:4-308:5 -/ +def NativeP256.Insts.Auths_signature_coreP256Primitive.decode + (bytes : Slice Std.U8) : Result core.qualified_p256_type_decls_13 := do + decode_p256_point bytes + +/-- [auths_signature_core::decode_p256_key_with]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 320:0-328:1 -/ +def decode_p256_key_with + (bytes : Slice Std.U8) : Result core.qualified_p256_type_decls_3 := do + let b ← p256_key_encoding_is_canonical bytes + if b + then + let qptd1 ← + NativeP256.Insts.Auths_signature_coreP256Primitive.decode bytes + match qptd1 with + | core.qualified_p256_type_decls_13.None => + ok (core.qualified_p256_type_decls_3.Err P256Error.InvalidKey) + | core.qualified_p256_type_decls_13.Some key => + ok (core.qualified_p256_type_decls_3.Ok key) + else ok (core.qualified_p256_type_decls_3.Err P256Error.InvalidKey) + +/-- [auths_signature_core::decode_p256_key]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 334:0-336:1 -/ +def decode_p256_key + (bytes : Slice Std.U8) : Result core.qualified_p256_type_decls_3 := do + decode_p256_key_with bytes + +/-- [auths_signature_core::validate_p256_key]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 286:0-291:1 + Visibility: public -/ +def validate_p256_key + (verification_key : Slice Std.U8) : + Result core.qualified_p256_type_decls_0 + := do + let qptd3 ← decode_p256_key verification_key + match qptd3 with + | core.qualified_p256_type_decls_3.Ok _ => + ok (core.qualified_p256_type_decls_0.Ok ()) + | core.qualified_p256_type_decls_3.Err reason => + ok (core.qualified_p256_type_decls_0.Err reason) + +/-- [auths_signature_core::parse_p256_signature]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 338:0-340:1 -/ +def parse_p256_signature + (bytes : Array Std.U8 64#usize) : + Result core.qualified_p256_type_decls_12 + := do + let s ← lift (Array.to_slice bytes) + let qptd1 ← ecdsa.qualified_p256_fun_decls_23 s + core.qualified_p256_fun_decls_24 qptd1 + +/-- [auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::parse]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 309:4-311:5 -/ +def NativeP256.Insts.Auths_signature_coreP256Primitive.parse + (bytes : Array Std.U8 64#usize) : + Result core.qualified_p256_type_decls_12 + := do + parse_p256_signature bytes + +/-- [auths_signature_core::verify_p256_equation]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 342:0-344:1 -/ +def verify_p256_equation + (key : ecdsa.qualified_p256_type_decls_4) (message : Slice Std.U8) + (signature : ecdsa.qualified_p256_type_decls_11) : + Result Bool + := do + let qptd1 ← + ecdsa.qualified_p256_type_decls_4.Insts.SignatureVerifierVerifierqualified_p256_type_decls_11.verify + key message signature + core.qualified_p256_fun_decls_27 qptd1 + +/-- [auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::verify]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 312:4-314:5 -/ +def NativeP256.Insts.Auths_signature_coreP256Primitive.verify + (key : ecdsa.qualified_p256_type_decls_4) (message : Slice Std.U8) + (signature : ecdsa.qualified_p256_type_decls_11) : + Result Bool + := do + verify_p256_equation key message signature + +/-- [auths_signature_core::verify_p256_sha256_with]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 346:0-369:1 -/ +def verify_p256_sha256_with + (bytes : Slice Std.U8) (message : Slice Std.U8) (signature : Slice Std.U8) : + Result core.qualified_p256_type_decls_0 + := do + let qptd3 ← decode_p256_key_with bytes + let qptd6 ← + core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch qptd3 + match qptd6 with + | core.qualified_p256_type_decls_6.Continue val => + let qptd9 ← + SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into signature + match qptd9 with + | core.qualified_p256_type_decls_9.Ok signature1 => + let qptd1 ← + NativeP256.Insts.Auths_signature_coreP256Primitive.parse signature1 + match qptd1 with + | core.qualified_p256_type_decls_12.None => + ok (core.qualified_p256_type_decls_0.Err + P256Error.InvalidSignatureEncoding) + | core.qualified_p256_type_decls_12.Some parsed => + let b ← p256_signature_is_low_s signature1 + if b + then + let b1 ← + NativeP256.Insts.Auths_signature_coreP256Primitive.verify val + message parsed + if b1 + then ok (core.qualified_p256_type_decls_0.Ok ()) + else + ok (core.qualified_p256_type_decls_0.Err + P256Error.VerificationFailed) + else + ok (core.qualified_p256_type_decls_0.Err + P256Error.VerificationFailed) + | core.qualified_p256_type_decls_9.Err _ => + ok (core.qualified_p256_type_decls_0.Err + P256Error.InvalidSignatureEncoding) + | core.qualified_p256_type_decls_6.Break residual => + core.qualified_p256_type_decls_0.Insts.CoreOpsTry_traitFromResidualqualified_p256_type_decls_7.from_residual + residual + +/-- [auths_signature_core::verify_p256_sha256]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 381:0-387:1 + Visibility: public -/ +def verify_p256_sha256 + (verification_key : Slice Std.U8) (message : Slice Std.U8) + (signature : Slice Std.U8) : + Result core.qualified_p256_type_decls_0 + := do + verify_p256_sha256_with verification_key message signature + +end AuthsNativeP256 diff --git a/formal/qualification/aeneas/generated/p256/FunsExternal.lean b/formal/qualification/aeneas/generated/p256/FunsExternal.lean new file mode 100644 index 000000000..827ae579b --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/FunsExternal.lean @@ -0,0 +1,53 @@ +-- REVIEWED TRANSPARENT STANDARD MATCHES AND EXPLICIT FOREIGN PROJECTIONS. +import qualification.aeneas.generated.p256.Types +open Aeneas Aeneas.Std Result +namespace AuthsNativeP256 +variable [P : Auths.Crypto.P256Primitives] + +def SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into (bytes : Slice Std.U8) : + Result core.qualified_p256_type_decls_9 := + if sized : bytes.val.length = 64 then + ok (.Ok ⟨bytes.val, by scalar_tac⟩) + else ok (.Err ()) + +def core.qualified_p256_fun_decls_27 (value : core.qualified_p256_type_decls_16) : Result Bool := + ok (match value with | .Ok _ => true | .Err _ => false) + +def core.qualified_p256_fun_decls_30 (value : core.qualified_p256_type_decls_17) : + Result core.qualified_p256_type_decls_13 := + ok (match value with | .Ok key => .Some key | .Err _ => .None) + +def core.qualified_p256_fun_decls_24 (value : core.qualified_p256_type_decls_14) : + Result core.qualified_p256_type_decls_12 := + ok (match value with | .Ok signature => .Some signature | .Err _ => .None) + + +def core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch + (value : core.qualified_p256_type_decls_3) : Result core.qualified_p256_type_decls_6 := + ok (match value with | .Ok key => .Continue key | .Err reason => .Break (.Err reason)) + +def core.qualified_p256_type_decls_0.Insts.CoreOpsTry_traitFromResidualqualified_p256_type_decls_7.from_residual + (residual : core.qualified_p256_type_decls_7) : Result core.qualified_p256_type_decls_0 := + match residual with + | .Ok impossible => nomatch impossible + | .Err reason => ok (.Err reason) + +def core.qualified_p256_fun_decls_20 (bytes : Slice Std.U8) : Result Std.Usize := ok (Slice.len bytes) + +def ecdsa.qualified_p256_fun_decls_23 (bytes : Slice Std.U8) : + Result core.qualified_p256_type_decls_14 := do + let value ← P.parse bytes + ok (match value with | .Ok signature => .Ok signature | .Err reason => .Err reason) + +def ecdsa.qualified_p256_fun_decls_29 (bytes : Slice Std.U8) : + Result core.qualified_p256_type_decls_17 := do + let value ← P.decode bytes + ok (match value with | .Ok key => .Ok key | .Err reason => .Err reason) + +def ecdsa.qualified_p256_type_decls_4.Insts.SignatureVerifierVerifierqualified_p256_type_decls_11.verify + (key : ecdsa.qualified_p256_type_decls_4) (message : Slice Std.U8) + (signature : ecdsa.qualified_p256_type_decls_11) : Result core.qualified_p256_type_decls_16 := do + let value ← P.verify key message signature + ok (match value with | .Ok valueUnit => .Ok valueUnit | .Err reason => .Err reason) + +end AuthsNativeP256 diff --git a/formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean new file mode 100644 index 000000000..3ec0b348d --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean @@ -0,0 +1,107 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.p256.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open AuthsNativeP256 + +/-- [core::qualified_p256_fun_decls_7]: + Source: '/rustc/library/core/src/convert/mod.rs', lines 818:4-818:44 + Name pattern: [core::qualified_p256_fun_decls_7] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_7"] +axiom SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into + : Slice Std.U8 → Result core.qualified_p256_type_decls_9 + +/-- [core::qualified_p256_fun_decls_27]: + Source: '/rustc/library/core/src/result.rs', lines 593:4-593:37 + Name pattern: [core::qualified_p256_fun_decls_27] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_27"] +axiom core.qualified_p256_fun_decls_27 + : core.qualified_p256_type_decls_16 → Result Bool + +/-- [core::qualified_p256_fun_decls_30]: + Source: '/rustc/library/core/src/result.rs', lines 708:4-711:28 + Name pattern: [core::qualified_p256_fun_decls_30] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_30"] +axiom core.qualified_p256_fun_decls_30 + : + core.qualified_p256_type_decls_17 → Result + core.qualified_p256_type_decls_13 + +/-- [core::qualified_p256_fun_decls_24]: + Source: '/rustc/library/core/src/result.rs', lines 708:4-711:28 + Name pattern: [core::qualified_p256_fun_decls_24] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_24"] +axiom core.qualified_p256_fun_decls_24 + : + core.qualified_p256_type_decls_14 → Result + core.qualified_p256_type_decls_12 + +/-- [core::qualified_p256_fun_decls_5]: + Source: '/rustc/library/core/src/result.rs', lines 2177:4-2177:64 + Name pattern: [core::qualified_p256_fun_decls_5] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_5"] +axiom core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch + : + core.qualified_p256_type_decls_3 → Result core.qualified_p256_type_decls_6 + +/-- [core::qualified_p256_fun_decls_6]: + Source: '/rustc/library/core/src/result.rs', lines 2192:4-2192:70 + Name pattern: [core::qualified_p256_fun_decls_6] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_6"] +axiom + core.qualified_p256_type_decls_0.Insts.CoreOpsTry_traitFromResidualqualified_p256_type_decls_7.from_residual + : + core.qualified_p256_type_decls_7 → Result core.qualified_p256_type_decls_0 + +/-- [core::qualified_p256_fun_decls_20]: + Source: '/rustc/library/core/src/slice/mod.rs', lines 116:4-116:36 + Name pattern: [core::qualified_p256_fun_decls_20] + Visibility: public -/ +@[rust_fun "core::qualified_p256_fun_decls_20"] +axiom core.qualified_p256_fun_decls_20 : Slice Std.U8 → Result Std.Usize + +/-- [ecdsa::qualified_p256_fun_decls_23]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/lib.rs', lines 224:4-224:51 + Name pattern: [ecdsa::qualified_p256_fun_decls_23] + Visibility: public -/ +@[rust_fun "ecdsa::qualified_p256_fun_decls_23"] +axiom ecdsa.qualified_p256_fun_decls_23 + : Slice Std.U8 → Result core.qualified_p256_type_decls_14 + +/-- [ecdsa::qualified_p256_fun_decls_29]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/verifying.rs', lines 92:4-92:56 + Name pattern: [ecdsa::qualified_p256_fun_decls_29] + Visibility: public -/ +@[rust_fun "ecdsa::qualified_p256_fun_decls_29"] +axiom ecdsa.qualified_p256_fun_decls_29 + : Slice Std.U8 → Result core.qualified_p256_type_decls_17 + +/-- [ecdsa::qualified_p256_fun_decls_26]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/verifying.rs', lines 175:4-175:72 + Name pattern: [ecdsa::qualified_p256_fun_decls_26] + Visibility: public -/ +@[rust_fun "ecdsa::qualified_p256_fun_decls_26"] +axiom + ecdsa.qualified_p256_type_decls_4.Insts.SignatureVerifierVerifierqualified_p256_type_decls_11.verify + : + ecdsa.qualified_p256_type_decls_4 → Slice Std.U8 → + ecdsa.qualified_p256_type_decls_11 → Result + core.qualified_p256_type_decls_16 + diff --git a/formal/qualification/aeneas/generated/p256/Types.lean b/formal/qualification/aeneas/generated/p256/Types.lean new file mode 100644 index 000000000..666ab55b5 --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/Types.lean @@ -0,0 +1,126 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: type definitions +import Aeneas +import Auths.Support.Discriminant +import qualification.aeneas.generated.p256.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace AuthsNativeP256 + +variable [primitive : Auths.Crypto.P256Primitives] + +/-- [core::qualified_p256_type_decls_9] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_9] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_9"] +inductive core.qualified_p256_type_decls_9 where +| Ok : Array Std.U8 64#usize → core.qualified_p256_type_decls_9 +| Err : core.array.TryFromSliceError → core.qualified_p256_type_decls_9 + +/-- [auths_signature_core::P256Error] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 151:0-159:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive P256Error where +| InvalidKey : P256Error +| InvalidSignatureEncoding : P256Error +| VerificationFailed : P256Error + +/-- [core::qualified_p256_type_decls_7] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_7] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_7"] +inductive core.qualified_p256_type_decls_7 where +| Ok : core.convert.Infallible → core.qualified_p256_type_decls_7 +| Err : P256Error → core.qualified_p256_type_decls_7 + +/-- [core::qualified_p256_type_decls_6] + Source: '/rustc/library/core/src/ops/control_flow.rs', lines 89:0-89:31 + Name pattern: [core::qualified_p256_type_decls_6] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_6"] +inductive core.qualified_p256_type_decls_6 where +| Continue : + ecdsa.qualified_p256_type_decls_4 → + core.qualified_p256_type_decls_6 +| Break : core.qualified_p256_type_decls_7 → core.qualified_p256_type_decls_6 + +/-- [core::qualified_p256_type_decls_13] + Source: '/rustc/library/core/src/option.rs', lines 597:0-597:18 + Name pattern: [core::qualified_p256_type_decls_13] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_13"] +inductive core.qualified_p256_type_decls_13 where +| None : core.qualified_p256_type_decls_13 +| Some : + ecdsa.qualified_p256_type_decls_4 → + core.qualified_p256_type_decls_13 + +/-- [core::qualified_p256_type_decls_12] + Source: '/rustc/library/core/src/option.rs', lines 597:0-597:18 + Name pattern: [core::qualified_p256_type_decls_12] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_12"] +inductive core.qualified_p256_type_decls_12 where +| None : core.qualified_p256_type_decls_12 +| Some : + ecdsa.qualified_p256_type_decls_11 → + core.qualified_p256_type_decls_12 + +/-- [core::qualified_p256_type_decls_3] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_3] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_3"] +inductive core.qualified_p256_type_decls_3 where +| Ok : ecdsa.qualified_p256_type_decls_4 → core.qualified_p256_type_decls_3 +| Err : P256Error → core.qualified_p256_type_decls_3 + +/-- [core::qualified_p256_type_decls_17] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_17] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_17"] +inductive core.qualified_p256_type_decls_17 where +| Ok : ecdsa.qualified_p256_type_decls_4 → core.qualified_p256_type_decls_17 +| Err : signature.error.Error → core.qualified_p256_type_decls_17 + +/-- [core::qualified_p256_type_decls_14] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_14] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_14"] +inductive core.qualified_p256_type_decls_14 where +| Ok : ecdsa.qualified_p256_type_decls_11 → core.qualified_p256_type_decls_14 +| Err : signature.error.Error → core.qualified_p256_type_decls_14 + +/-- [core::qualified_p256_type_decls_0] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_0] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_0"] +inductive core.qualified_p256_type_decls_0 where +| Ok : Unit → core.qualified_p256_type_decls_0 +| Err : P256Error → core.qualified_p256_type_decls_0 + +/-- [core::qualified_p256_type_decls_16] + Source: '/rustc/library/core/src/result.rs', lines 557:0-557:21 + Name pattern: [core::qualified_p256_type_decls_16] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "core::qualified_p256_type_decls_16"] +inductive core.qualified_p256_type_decls_16 where +| Ok : Unit → core.qualified_p256_type_decls_16 +| Err : signature.error.Error → core.qualified_p256_type_decls_16 + +end AuthsNativeP256 diff --git a/formal/qualification/aeneas/generated/p256/TypesExternal.lean b/formal/qualification/aeneas/generated/p256/TypesExternal.lean new file mode 100644 index 000000000..c0aa9a656 --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/TypesExternal.lean @@ -0,0 +1,7 @@ +-- REVIEWED EXPLICIT FOREIGN TYPES. NO GLOBAL INSTANCE OR AXIOM. +import Auths.Crypto.P256Primitives +namespace AuthsNativeP256 +abbrev ecdsa.qualified_p256_type_decls_4 [P : Auths.Crypto.P256Primitives] := P.Key +abbrev ecdsa.qualified_p256_type_decls_11 [P : Auths.Crypto.P256Primitives] := P.Signature +abbrev signature.error.Error [P : Auths.Crypto.P256Primitives] := P.Error +end AuthsNativeP256 diff --git a/formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean new file mode 100644 index 000000000..919dbf6f2 --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean @@ -0,0 +1,36 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [ecdsa::qualified_p256_type_decls_4] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/verifying.rs', lines 78:0-78:26 + Name pattern: [ecdsa::qualified_p256_type_decls_4] + Visibility: public -/ +@[rust_type "ecdsa::qualified_p256_type_decls_4"] +axiom ecdsa.qualified_p256_type_decls_4 : Type + +/-- [ecdsa::qualified_p256_type_decls_11] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/lib.rs', lines 198:0-198:35 + Name pattern: [ecdsa::qualified_p256_type_decls_11] + Visibility: public -/ +@[rust_type "ecdsa::qualified_p256_type_decls_11"] +axiom ecdsa.qualified_p256_type_decls_11 : Type + +/-- [signature::error::Error] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/signature-2.2.0/src/error.rs', lines 26:0-26:16 + Name pattern: [signature::error::Error] + Visibility: public -/ +@[rust_type "signature::error::Error"] +axiom signature.error.Error : Type + diff --git a/formal/qualification/aeneas/generated/p256/name-normalization.json b/formal/qualification/aeneas/generated/p256/name-normalization.json new file mode 100644 index 000000000..827c3793e --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/name-normalization.json @@ -0,0 +1,2800 @@ +{ + "schema": "auths-proof-foreign-name-normalization/v1", + "declarations": [ + { + "declaration_group": "type_decls", + "declaration_id": 0, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 379 + }, + { + "Deduplicated": 387 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_0", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 3, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + }, + { + "Deduplicated": 387 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_3", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 4, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "verifying", + 0 + ] + }, + { + "Ident": [ + "VerifyingKey", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_4", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 3, + "beg": { + "line": 78, + "col": 0 + }, + "end": { + "line": 78, + "col": 26 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 6, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "ops", + 0 + ] + }, + { + "Ident": [ + "control_flow", + 0 + ] + }, + { + "Ident": [ + "ControlFlow", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 588 + }, + { + "Deduplicated": 482 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_6", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 6, + "beg": { + "line": 89, + "col": 0 + }, + "end": { + "line": 89, + "col": 31 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 7, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 587 + }, + { + "Deduplicated": 387 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_7", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 9, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 597 + }, + { + "Deduplicated": 605 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_9", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 11, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "Signature", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_11", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 198, + "col": 0 + }, + "end": { + "line": 198, + "col": 35 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 12, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "option", + 0 + ] + }, + { + "Ident": [ + "Option", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 620 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_12", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 10, + "beg": { + "line": 597, + "col": 0 + }, + "end": { + "line": 597, + "col": 18 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 13, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "option", + 0 + ] + }, + { + "Ident": [ + "Option", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_13", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 10, + "beg": { + "line": 597, + "col": 0 + }, + "end": { + "line": 597, + "col": 18 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 14, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 620 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_14", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 16, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 379 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_16", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 17, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_type_decls_17", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 2, + "original_name": [ + { + "Ident": [ + "auths_signature_core", + 0 + ] + }, + { + "Ident": [ + "verify_p256_sha256_with", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 412 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "auths_signature_core", + 0 + ] + }, + { + "Ident": [ + "verify_p256_sha256_with", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 0, + "beg": { + "line": 346, + "col": 0 + }, + "end": { + "line": 369, + "col": 1 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 4, + "original_name": [ + { + "Ident": [ + "auths_signature_core", + 0 + ] + }, + { + "Ident": [ + "decode_p256_key_with", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 412 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "auths_signature_core", + 0 + ] + }, + { + "Ident": [ + "decode_p256_key_with", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 0, + "beg": { + "line": 320, + "col": 0 + }, + "end": { + "line": 328, + "col": 1 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 5, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Impl": { + "Trait": 0 + } + }, + { + "Ident": [ + "branch", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + }, + { + "Deduplicated": 387 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_5", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 2177, + "col": 4 + }, + "end": { + "line": 2177, + "col": 64 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 6, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Impl": { + "Trait": 4 + } + }, + { + "Ident": [ + "from_residual", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 379 + }, + { + "Deduplicated": 387 + }, + { + "Deduplicated": 387 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_6", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 2192, + "col": 4 + }, + "end": { + "line": 2192, + "col": 70 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 7, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "convert", + 0 + ] + }, + { + "Impl": { + "Trait": 5 + } + }, + { + "Ident": [ + "try_into", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 752 + }, + { + "Deduplicated": 597 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_7", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 8, + "beg": { + "line": 818, + "col": 4 + }, + "end": { + "line": 818, + "col": 44 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 13, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Impl": { + "Trait": 1 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + }, + { + "Deduplicated": 387 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_13", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 14, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "verifying", + 0 + ] + }, + { + "Ident": [ + "VerifyingKey", + 0 + ] + }, + { + "Impl": { + "Trait": 2 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_14", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 3, + "beg": { + "line": 78, + "col": 0 + }, + "end": { + "line": 78, + "col": 26 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 15, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "ops", + 0 + ] + }, + { + "Ident": [ + "control_flow", + 0 + ] + }, + { + "Ident": [ + "ControlFlow", + 0 + ] + }, + { + "Impl": { + "Trait": 3 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 588 + }, + { + "Deduplicated": 482 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_15", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 6, + "beg": { + "line": 89, + "col": 0 + }, + "end": { + "line": 89, + "col": 31 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 17, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "option", + 0 + ] + }, + { + "Ident": [ + "Option", + 0 + ] + }, + { + "Impl": { + "Trait": 7 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 620 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_17", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 10, + "beg": { + "line": 597, + "col": 0 + }, + "end": { + "line": 597, + "col": 18 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 18, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "Signature", + 0 + ] + }, + { + "Impl": { + "Trait": 8 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_18", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 198, + "col": 0 + }, + "end": { + "line": 198, + "col": 35 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 20, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "slice", + 0 + ] + }, + { + "Impl": { + "Ty": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "Deduplicated": 357 + }, + "kind": "InherentImplBlock" + } + } + }, + { + "Ident": [ + "len", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 356 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_20", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 13, + "beg": { + "line": 116, + "col": 4 + }, + "end": { + "line": 116, + "col": 36 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 22, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "option", + 0 + ] + }, + { + "Ident": [ + "Option", + 0 + ] + }, + { + "Impl": { + "Trait": 9 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_22", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 10, + "beg": { + "line": 597, + "col": 0 + }, + "end": { + "line": 597, + "col": 18 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 23, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Impl": { + "Ty": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "Deduplicated": 620 + }, + "kind": "InherentImplBlock" + } + } + }, + { + "Ident": [ + "from_slice", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_23", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 224, + "col": 4 + }, + "end": { + "line": 224, + "col": 51 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 24, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Impl": { + "Ty": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "Deduplicated": 1144 + }, + "kind": "InherentImplBlock" + } + } + }, + { + "Ident": [ + "ok", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 620 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_24", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 708, + "col": 4 + }, + "end": { + "line": 711, + "col": 28 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 26, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "verifying", + 0 + ] + }, + { + "Impl": { + "Trait": 12 + } + }, + { + "Ident": [ + "verify", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_26", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 3, + "beg": { + "line": 175, + "col": 4 + }, + "end": { + "line": 175, + "col": 72 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 27, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Impl": { + "Ty": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "Deduplicated": 1261 + }, + "kind": "InherentImplBlock" + } + } + }, + { + "Ident": [ + "is_ok", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 379 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_27", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 593, + "col": 4 + }, + "end": { + "line": 593, + "col": 37 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 29, + "original_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "verifying", + 0 + ] + }, + { + "Impl": { + "Ty": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "Deduplicated": 482 + }, + "kind": "InherentImplBlock" + } + } + }, + { + "Ident": [ + "from_sec1_bytes", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 481 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "ecdsa", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_29", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 3, + "beg": { + "line": 92, + "col": 4 + }, + "end": { + "line": 92, + "col": 56 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 30, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Impl": { + "Ty": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "Deduplicated": 1338 + }, + "kind": "InherentImplBlock" + } + } + }, + { + "Ident": [ + "ok", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_30", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 708, + "col": 4 + }, + "end": { + "line": 711, + "col": 28 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 31, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Impl": { + "Trait": 11 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 620 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_31", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 32, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Impl": { + "Trait": 13 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 379 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_32", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 33, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "result", + 0 + ] + }, + { + "Ident": [ + "Result", + 0 + ] + }, + { + "Impl": { + "Trait": 14 + } + }, + { + "Ident": [ + "drop_glue", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 482 + }, + { + "Deduplicated": 1143 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_p256_fun_decls_33", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 1, + "beg": { + "line": 557, + "col": 0 + }, + "end": { + "line": 557, + "col": 21 + } + }, + "generated_from_span": null + } + } + ], + "preserved": [ + "Auths base source names", + "all function bodies", + "signatures", + "generics", + "layouts", + "source spans", + "call and type IDs" + ], + "canonicalization": "pinned-charon-pretty-print-v1", + "original_canonical_llbc_sha256": "4b4065ffe0f0b8303f2adf674479c257b399ac560c003eaefe53ba8621314bd1", + "normalized_canonical_llbc_sha256": "08ea87d6e324c485a9e33d156914ae16e945e89a19ef37834761961eff4c5378" +} diff --git a/formal/qualification/aeneas/generated/p256/translation.json b/formal/qualification/aeneas/generated/p256/translation.json new file mode 100644 index 000000000..a737a84c9 --- /dev/null +++ b/formal/qualification/aeneas/generated/p256/translation.json @@ -0,0 +1,623 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_signature_core", + "functions": [ + { + "def_id": 7, + "lean_name": "AuthsNativeP256.SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_7", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/mod.rs", + "begin_line": 818, + "end_line": 818 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 27, + "lean_name": "AuthsNativeP256.core.qualified_p256_fun_decls_27", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_27", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 593, + "end_line": 593 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 30, + "lean_name": "AuthsNativeP256.core.qualified_p256_fun_decls_30", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_30", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 708, + "end_line": 711 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 24, + "lean_name": "AuthsNativeP256.core.qualified_p256_fun_decls_24", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_24", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 708, + "end_line": 711 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 5, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_5", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 2177, + "end_line": 2177 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_0.Insts.CoreOpsTry_traitFromResidualqualified_p256_type_decls_7.from_residual", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_6", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 2192, + "end_line": 2192 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "AuthsNativeP256.core.qualified_p256_fun_decls_20", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "core::qualified_p256_fun_decls_20", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/slice/mod.rs", + "begin_line": 116, + "end_line": 116 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 23, + "lean_name": "AuthsNativeP256.ecdsa.qualified_p256_fun_decls_23", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "ecdsa::qualified_p256_fun_decls_23", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/lib.rs", + "begin_line": 224, + "end_line": 224 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 29, + "lean_name": "AuthsNativeP256.ecdsa.qualified_p256_fun_decls_29", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "ecdsa::qualified_p256_fun_decls_29", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/verifying.rs", + "begin_line": 92, + "end_line": 92 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 26, + "lean_name": "AuthsNativeP256.ecdsa.qualified_p256_type_decls_4.Insts.SignatureVerifierVerifierqualified_p256_type_decls_11.verify", + "lean_file": "qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "rust_name": "ecdsa::qualified_p256_fun_decls_26", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/verifying.rs", + "begin_line": 175, + "end_line": 175 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 11, + "lean_name": "AuthsNativeP256.p256_key_encoding_is_canonical", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::p256_key_encoding_is_canonical", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 42, + "end_line": 47 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 9, + "lean_name": "AuthsNativeP256.p256_signature_is_low_s_loop", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::p256_signature_is_low_s", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 1, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsNativeP256.p256_signature_is_low_s" + }, + { + "def_id": 9, + "lean_name": "AuthsNativeP256.p256_signature_is_low_s", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::p256_signature_is_low_s", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 55, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 21, + "lean_name": "AuthsNativeP256.decode_p256_point", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::decode_p256_point", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 330, + "end_line": 332 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 12, + "lean_name": "AuthsNativeP256.NativeP256.Insts.Auths_signature_coreP256Primitive.decode", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::decode", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 306, + "end_line": 308 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "AuthsNativeP256.decode_p256_key_with", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::decode_p256_key_with", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 320, + "end_line": 328 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "AuthsNativeP256.decode_p256_key", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::decode_p256_key", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 334, + "end_line": 336 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "AuthsNativeP256.validate_p256_key", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::validate_p256_key", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 286, + "end_line": 291 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "AuthsNativeP256.parse_p256_signature", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::parse_p256_signature", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 338, + "end_line": 340 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 8, + "lean_name": "AuthsNativeP256.NativeP256.Insts.Auths_signature_coreP256Primitive.parse", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::parse", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 309, + "end_line": 311 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "AuthsNativeP256.verify_p256_equation", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::verify_p256_equation", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 342, + "end_line": 344 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 10, + "lean_name": "AuthsNativeP256.NativeP256.Insts.Auths_signature_coreP256Primitive.verify", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::verify", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 312, + "end_line": 314 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "AuthsNativeP256.verify_p256_sha256_with", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::verify_p256_sha256_with", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 346, + "end_line": 369 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "AuthsNativeP256.verify_p256_sha256", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::verify_p256_sha256", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 381, + "end_line": 387 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 4, + "lean_name": "AuthsNativeP256.ecdsa.qualified_p256_type_decls_4", + "lean_file": "qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "rust_name": "ecdsa::qualified_p256_type_decls_4", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/verifying.rs", + "begin_line": 78, + "end_line": 78 + } + }, + { + "def_id": 11, + "lean_name": "AuthsNativeP256.ecdsa.qualified_p256_type_decls_11", + "lean_file": "qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "rust_name": "ecdsa::qualified_p256_type_decls_11", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ecdsa-0.16.9/src/lib.rs", + "begin_line": 198, + "end_line": 198 + } + }, + { + "def_id": 15, + "lean_name": "AuthsNativeP256.signature.error.Error", + "lean_file": "qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "rust_name": "signature::error::Error", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/signature-2.2.0/src/error.rs", + "begin_line": 26, + "end_line": 26 + } + }, + { + "def_id": 9, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_9", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_9", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + }, + { + "def_id": 1, + "lean_name": "AuthsNativeP256.P256Error", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "auths_signature_core::P256Error", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 151, + "end_line": 159 + } + }, + { + "def_id": 7, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_7", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_7", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + }, + { + "def_id": 6, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_6", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_6", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/ops/control_flow.rs", + "begin_line": 89, + "end_line": 89 + } + }, + { + "def_id": 13, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_13", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_13", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 597, + "end_line": 597 + } + }, + { + "def_id": 12, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_12", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_12", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 597, + "end_line": 597 + } + }, + { + "def_id": 3, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_3", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_3", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + }, + { + "def_id": 17, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_17", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_17", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + }, + { + "def_id": 14, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_14", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_14", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + }, + { + "def_id": 0, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_0", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_0", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + }, + { + "def_id": 16, + "lean_name": "AuthsNativeP256.core.qualified_p256_type_decls_16", + "lean_file": "qualification/aeneas/generated/p256/Types.lean", + "rust_name": "core::qualified_p256_type_decls_16", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 557, + "end_line": 557 + } + } + ], + "globals": [ + { + "def_id": 1, + "lean_name": "AuthsNativeP256.P256_KEY_LEN", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::P256_KEY_LEN", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 14, + "end_line": 14 + }, + "can_fail": false + }, + { + "def_id": 0, + "lean_name": "AuthsNativeP256.P256_HALF_ORDER", + "lean_file": "qualification/aeneas/generated/p256/Funs.lean", + "rust_name": "auths_signature_core::P256_HALF_ORDER", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 50, + "end_line": 53 + }, + "can_fail": false + } + ], + "trait_decls": [], + "trait_impls": [] +} diff --git a/formal/qualification/aeneas/generated/profile_construction/Funs.lean b/formal/qualification/aeneas/generated/profile_construction/Funs.lean new file mode 100644 index 000000000..fc326788b --- /dev/null +++ b/formal/qualification/aeneas/generated/profile_construction/Funs.lean @@ -0,0 +1,340 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_profile_construction]: function definitions +import Aeneas +import qualification.aeneas.generated.profile_construction.Types +import qualification.aeneas.generated.profile_construction.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +namespace auths_profile_construction + +/-- [auths_connections::kernel::lower_tail_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 106:0-106:37 + Name pattern: [auths_connections::kernel::lower_tail_valid] -/ +@[rust_fun "auths_connections::kernel::lower_tail_valid"] +def auths_connections.kernel.lower_tail_valid + (byte : Std.U8) : Result Bool := do + if byte >= 97#u8 + then + if byte <= 122#u8 + then ok true + else + if byte >= 48#u8 + then if byte <= 57#u8 + then ok true + else ok (byte = 45#u8) + else ok (byte = 45#u8) + else + if byte >= 48#u8 + then if byte <= 57#u8 + then ok true + else ok (byte = 45#u8) + else ok (byte = 45#u8) + +/-- [auths_connections::kernel::lower_token_valid]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 125:4-133:1 + Name pattern: [auths_connections::kernel::lower_token_valid] + Visibility: public -/ +@[rust_loop_body, rust_fun "auths_connections::kernel::lower_token_valid"] +def auths_connections.kernel.lower_token_valid_loop.body + (value : Slice Std.U8) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len value + if index < i + then + let byte ← Slice.index_usize value index + let b ← auths_connections.kernel.lower_tail_valid byte + if b + then let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + else ok (done true) + +/-- [auths_connections::kernel::lower_token_valid]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 125:4-133:1 + Name pattern: [auths_connections::kernel::lower_token_valid] + Visibility: public -/ +@[rust_loop, rust_fun "auths_connections::kernel::lower_token_valid"] +def auths_connections.kernel.lower_token_valid_loop + (value : Slice Std.U8) (index : Std.Usize) : Result Bool := do + loop + (fun index1 => auths_connections.kernel.lower_token_valid_loop.body value + index1) + index + +/-- [auths_connections::kernel::lower_token_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 116:0-116:62 + Name pattern: [auths_connections::kernel::lower_token_valid] + Visibility: public -/ +@[rust_fun "auths_connections::kernel::lower_token_valid"] +def auths_connections.kernel.lower_token_valid + (value : Slice Std.U8) (maximum : Std.Usize) : Result Bool := do + let b ← core.slice.Slice.is_empty value + if b + then ok false + else + let i := Slice.len value + if i > maximum + then ok false + else + let first ← Slice.index_usize value 0#usize + if first < 97#u8 + then ok false + else + if first > 122#u8 + then ok false + else auths_connections.kernel.lower_token_valid_loop value 0#usize + +/-- [auths_connections::kernel::semantic_head_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 160:0-160:40 + Name pattern: [auths_connections::kernel::semantic_head_valid] -/ +@[rust_fun "auths_connections::kernel::semantic_head_valid"] +def auths_connections.kernel.semantic_head_valid + (byte : Std.U8) : Result Bool := do + if byte >= 97#u8 + then + if byte <= 122#u8 + then ok true + else + if byte >= 65#u8 + then + if byte <= 90#u8 + then ok true + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + else + if byte >= 65#u8 + then + if byte <= 90#u8 + then ok true + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + else if byte >= 48#u8 + then ok (byte <= 57#u8) + else ok false + +/-- [auths_connections::kernel::semantic_tail_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 165:0-165:40 + Name pattern: [auths_connections::kernel::semantic_tail_valid] -/ +@[rust_fun "auths_connections::kernel::semantic_tail_valid"] +def auths_connections.kernel.semantic_tail_valid + (byte : Std.U8) : Result Bool := do + let b ← auths_connections.kernel.semantic_head_valid byte + if b + then ok true + else + if byte = 46#u8 + then ok true + else + if byte = 95#u8 + then ok true + else + if byte = 58#u8 + then ok true + else if byte = 47#u8 + then ok true + else ok (byte = 45#u8) + +/-- [auths_connections::kernel::semantic_id_valid]: loop body 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 184:4-191:1 + Name pattern: [auths_connections::kernel::semantic_id_valid] + Visibility: public -/ +@[rust_loop_body, rust_fun "auths_connections::kernel::semantic_id_valid"] +def auths_connections.kernel.semantic_id_valid_loop.body + (value : Slice Std.U8) (index : Std.Usize) : + Result (ControlFlow Std.Usize Bool) + := do + let i := Slice.len value + if index < i + then + let i1 ← Slice.index_usize value index + let b ← auths_connections.kernel.semantic_tail_valid i1 + if b + then let index1 ← index + 1#usize + ok (cont index1) + else ok (done false) + else ok (done true) + +/-- [auths_connections::kernel::semantic_id_valid]: loop 0: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 184:4-191:1 + Name pattern: [auths_connections::kernel::semantic_id_valid] + Visibility: public -/ +@[rust_loop, rust_fun "auths_connections::kernel::semantic_id_valid"] +def auths_connections.kernel.semantic_id_valid_loop + (value : Slice Std.U8) (index : Std.Usize) : Result Bool := do + loop + (fun index1 => auths_connections.kernel.semantic_id_valid_loop.body value + index1) + index + +/-- [auths_connections::kernel::semantic_id_valid]: + Source: 'product/runtime/auths-connections/src/kernel.rs', lines 176:0-176:62 + Name pattern: [auths_connections::kernel::semantic_id_valid] + Visibility: public -/ +@[rust_fun "auths_connections::kernel::semantic_id_valid"] +def auths_connections.kernel.semantic_id_valid + (value : Slice Std.U8) (maximum : Std.Usize) : Result Bool := do + let b ← core.slice.Slice.is_empty value + if b + then ok false + else + let i := Slice.len value + if i > maximum + then ok false + else + let i1 ← Slice.index_usize value 0#usize + let b1 ← auths_connections.kernel.semantic_head_valid i1 + if b1 + then auths_connections.kernel.semantic_id_valid_loop value 0#usize + else ok false + +/-- [auths_connections::model::is_lower_token]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 1068:0-1068:54 + Name pattern: [auths_connections::model::is_lower_token] -/ +@[rust_fun "auths_connections::model::is_lower_token"] +def auths_connections.model.is_lower_token + (value : Str) (maximum : Std.Usize) : Result Bool := do + let s ← core.str.Str.as_bytes value + auths_connections.kernel.lower_token_valid s maximum + +/-- [auths_connections::model::{auths_connections::model::ProviderKind}::parse]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 28:4-28:81 + Name pattern: [auths_connections::model::{auths_connections::model::ProviderKind}::parse] + Visibility: public -/ +@[rust_fun + "auths_connections::model::{auths_connections::model::ProviderKind}::parse"] +def auths_connections.model.ProviderKind.parse + {T0 : Type} (coreconvertIntoT0StringInst : core.convert.Into T0 String) + (value : T0) : + Result (core.result.Result auths_connections.model.ProviderKind + auths_connections.model.ConnectionRecordError) + := do + let value1 ← coreconvertIntoT0StringInst.into value + let s ← alloc.string.String.Insts.CoreOpsDerefDerefStr.deref value1 + let b ← auths_connections.model.is_lower_token s 64#usize + if b + then ok (core.result.Result.Ok value1) + else + ok (core.result.Result.Err + auths_connections.model.ConnectionRecordError.InvalidProviderKind) + +/-- [auths_connections::model::{auths_connections::model::ConnectionAlias}::parse]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 53:4-53:81 + Name pattern: [auths_connections::model::{auths_connections::model::ConnectionAlias}::parse] + Visibility: public -/ +@[rust_fun + "auths_connections::model::{auths_connections::model::ConnectionAlias}::parse"] +def auths_connections.model.ConnectionAlias.parse + {T0 : Type} (coreconvertIntoT0StringInst : core.convert.Into T0 String) + (value : T0) : + Result (core.result.Result auths_connections.model.ConnectionAlias + auths_connections.model.ConnectionRecordError) + := do + let value1 ← coreconvertIntoT0StringInst.into value + let s ← alloc.string.String.Insts.CoreOpsDerefDerefStr.deref value1 + let b ← auths_connections.model.is_lower_token s 64#usize + if b + then ok (core.result.Result.Ok value1) + else + ok (core.result.Result.Err + auths_connections.model.ConnectionRecordError.InvalidAlias) + +/-- [auths_connections::model::{auths_connections::model::SemanticId}::parse]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 78:4-78:81 + Name pattern: [auths_connections::model::{auths_connections::model::SemanticId}::parse] + Visibility: public -/ +@[rust_fun + "auths_connections::model::{auths_connections::model::SemanticId}::parse"] +def auths_connections.model.SemanticId.parse + {T0 : Type} (coreconvertIntoT0StringInst : core.convert.Into T0 String) + (value : T0) : + Result (core.result.Result auths_connections.model.SemanticId + auths_connections.model.ConnectionRecordError) + := do + let value1 ← coreconvertIntoT0StringInst.into value + let s ← alloc.string.String.as_bytes value1 + let valid ← auths_connections.kernel.semantic_id_valid s 128#usize + if valid + then ok (core.result.Result.Ok value1) + else + ok (core.result.Result.Err + auths_connections.model.ConnectionRecordError.InvalidSemanticId) + +/-- [auths_connections::model::{auths_connections::model::ConnectionProfile}::new]: + Source: 'product/runtime/auths-connections/src/model.rs', lines 162:4-162:83 + Name pattern: [auths_connections::model::{auths_connections::model::ConnectionProfile}::new] + Visibility: public -/ +@[rust_fun + "auths_connections::model::{auths_connections::model::ConnectionProfile}::new"] +def auths_connections.model.ConnectionProfile.new + (id : auths_connections.model.SemanticId) (version : Std.U16) : + Result (core.result.Result auths_connections.model.ConnectionProfile + auths_connections.model.ConnectionRecordError) + := do + if version = 0#u16 + then + ok (core.result.Result.Err + auths_connections.model.ConnectionRecordError.InvalidProfile) + else ok (core.result.Result.Ok { id, version }) + +/-- [auths_profile_construction::construct]: + Source: 'formal/qualification/aeneas/entrypoints/profile_construction.rs', lines 5:0-10:1 + Visibility: public -/ +def construct + (id : auths_connections.model.SemanticId) (version : Std.U16) : + Result (core.result.Result auths_connections.model.ConnectionProfile + auths_connections.model.ConnectionRecordError) + := do + auths_connections.model.ConnectionProfile.new id version + +/-- [auths_profile_construction::parse_provider]: + Source: 'formal/qualification/aeneas/entrypoints/profile_construction.rs', lines 13:0-17:1 + Visibility: public -/ +def parse_provider + (value : String) : + Result (core.result.Result auths_connections.model.ProviderKind + auths_connections.model.ConnectionRecordError) + := do + auths_connections.model.ProviderKind.parse (core.convert.IntoFrom + (core.convert.FromSame String)) value + +/-- [auths_profile_construction::parse_alias]: + Source: 'formal/qualification/aeneas/entrypoints/profile_construction.rs', lines 20:0-24:1 + Visibility: public -/ +def parse_alias + (value : String) : + Result (core.result.Result auths_connections.model.ConnectionAlias + auths_connections.model.ConnectionRecordError) + := do + auths_connections.model.ConnectionAlias.parse (core.convert.IntoFrom + (core.convert.FromSame String)) value + +/-- [auths_profile_construction::parse_semantic]: + Source: 'formal/qualification/aeneas/entrypoints/profile_construction.rs', lines 27:0-31:1 + Visibility: public -/ +def parse_semantic + (value : String) : + Result (core.result.Result auths_connections.model.SemanticId + auths_connections.model.ConnectionRecordError) + := do + auths_connections.model.SemanticId.parse (core.convert.IntoFrom + (core.convert.FromSame String)) value + +end auths_profile_construction diff --git a/formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean b/formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean new file mode 100644 index 000000000..eb9f58ea4 --- /dev/null +++ b/formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean @@ -0,0 +1,9 @@ +-- Reuse only the existing reviewed UTF-8/String projections; no Auths body is modeled. +import qualification.aeneas.generated.profile_construction.Types +import qualification.aeneas.generated.codec.FunsExternal +namespace auths_profile_construction +abbrev core.str.Str.as_bytes := _root_.core.str.Str.as_bytes +abbrev alloc.string.String.as_bytes := _root_.alloc.string.String.as_bytes +abbrev alloc.string.String.Insts.CoreOpsDerefDerefStr.deref := + _root_.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref +end auths_profile_construction diff --git a/formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean new file mode 100644 index 000000000..a20894893 --- /dev/null +++ b/formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean @@ -0,0 +1,40 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_profile_construction]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.profile_construction.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open auths_profile_construction + +/-- [core::str::{str}::as_bytes]: + Source: '/rustc/library/core/src/str/mod.rs', lines 498:4-498:41 + Name pattern: [core::str::{str}::as_bytes] + Visibility: public -/ +@[rust_fun "core::str::{str}::as_bytes"] +axiom core.str.Str.as_bytes : Str → Result (Slice Std.U8) + +/-- [alloc::string::{alloc::string::String}::as_bytes]: + Source: '/rustc/library/alloc/src/string.rs', lines 1454:4-1454:41 + Name pattern: [alloc::string::{alloc::string::String}::as_bytes] + Visibility: public -/ +@[rust_fun "alloc::string::{alloc::string::String}::as_bytes"] +axiom alloc.string.String.as_bytes : String → Result (Slice Std.U8) + +/-- [alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref]: + Source: '/rustc/library/alloc/src/string.rs', lines 2835:4-2835:27 + Name pattern: [alloc::string::{core::ops::deref::Deref}::deref] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::ops::deref::Deref}::deref"] +axiom alloc.string.String.Insts.CoreOpsDerefDerefStr.deref + : String → Result Str + diff --git a/formal/qualification/aeneas/generated/profile_construction/Types.lean b/formal/qualification/aeneas/generated/profile_construction/Types.lean new file mode 100644 index 000000000..341f1abc5 --- /dev/null +++ b/formal/qualification/aeneas/generated/profile_construction/Types.lean @@ -0,0 +1,76 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_profile_construction]: type definitions +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace auths_profile_construction + +/-- [auths_connections::model::ProviderKind] + Source: 'product/runtime/auths-connections/src/model.rs', lines 20:0-20:23 + Name pattern: [auths_connections::model::ProviderKind] + Visibility: public -/ +@[reducible, rust_type "auths_connections::model::ProviderKind"] +def auths_connections.model.ProviderKind := String + +/-- [auths_connections::model::ConnectionRecordError] + Source: 'product/runtime/auths-connections/src/model.rs', lines 1000:0-1000:30 + Name pattern: [auths_connections::model::ConnectionRecordError] + Visibility: public -/ +@[discriminant isize, rust_type + "auths_connections::model::ConnectionRecordError"] +inductive auths_connections.model.ConnectionRecordError where +| InvalidProviderKind : auths_connections.model.ConnectionRecordError +| InvalidAlias : auths_connections.model.ConnectionRecordError +| InvalidSemanticId : auths_connections.model.ConnectionRecordError +| InvalidConnectionId : auths_connections.model.ConnectionRecordError +| Randomness : auths_connections.model.ConnectionRecordError +| InvalidProfile : auths_connections.model.ConnectionRecordError +| InvalidDescriptor : auths_connections.model.ConnectionRecordError +| InvalidGeneration : auths_connections.model.ConnectionRecordError +| InvalidState : auths_connections.model.ConnectionRecordError +| Revoked : auths_connections.model.ConnectionRecordError +| InvalidWorkloads : auths_connections.model.ConnectionRecordError +| InvalidProfiles : auths_connections.model.ConnectionRecordError +| InvalidTimestamps : auths_connections.model.ConnectionRecordError +| RecordTooLarge : auths_connections.model.ConnectionRecordError +| InvalidShape : auths_connections.model.ConnectionRecordError +| InvalidSchema : auths_connections.model.ConnectionRecordError +| ObsoleteSchema : auths_connections.model.ConnectionRecordError +| Noncanonical : auths_connections.model.ConnectionRecordError +| TrailingBytes : auths_connections.model.ConnectionRecordError +| Encoding : auths_connections.model.ConnectionRecordError +| Decoding : auths_connections.model.ConnectionRecordError + +/-- [auths_connections::model::ConnectionAlias] + Source: 'product/runtime/auths-connections/src/model.rs', lines 45:0-45:26 + Name pattern: [auths_connections::model::ConnectionAlias] + Visibility: public -/ +@[reducible, rust_type "auths_connections::model::ConnectionAlias"] +def auths_connections.model.ConnectionAlias := String + +/-- [auths_connections::model::SemanticId] + Source: 'product/runtime/auths-connections/src/model.rs', lines 70:0-70:21 + Name pattern: [auths_connections::model::SemanticId] + Visibility: public -/ +@[reducible, rust_type "auths_connections::model::SemanticId"] +def auths_connections.model.SemanticId := String + +/-- [auths_connections::model::ConnectionProfile] + Source: 'product/runtime/auths-connections/src/model.rs', lines 151:0-151:28 + Name pattern: [auths_connections::model::ConnectionProfile] + Visibility: public -/ +@[rust_type "auths_connections::model::ConnectionProfile"] +structure auths_connections.model.ConnectionProfile where + id : auths_connections.model.SemanticId + version : Std.U16 + +end auths_profile_construction diff --git a/formal/qualification/aeneas/generated/profile_construction/translation.json b/formal/qualification/aeneas/generated/profile_construction/translation.json new file mode 100644 index 000000000..709256e71 --- /dev/null +++ b/formal/qualification/aeneas/generated/profile_construction/translation.json @@ -0,0 +1,461 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_profile_construction", + "functions": [ + { + "def_id": 16, + "lean_name": "auths_profile_construction.core.str.Str.as_bytes", + "lean_file": "qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::as_bytes", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 498, + "end_line": 498 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "auths_profile_construction.alloc.string.String.as_bytes", + "lean_file": "qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "rust_name": "alloc::string::{alloc::string::String}::as_bytes", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 1454, + "end_line": 1454 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 9, + "lean_name": "auths_profile_construction.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref", + "lean_file": "qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 2835, + "end_line": 2835 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 22, + "lean_name": "auths_profile_construction.auths_connections.kernel.lower_tail_valid", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::lower_tail_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 106, + "end_line": 106 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "auths_profile_construction.auths_connections.kernel.lower_token_valid_loop.body", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::lower_token_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 125, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_profile_construction.auths_connections.kernel.lower_token_valid" + }, + { + "def_id": 17, + "lean_name": "auths_profile_construction.auths_connections.kernel.lower_token_valid_loop", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::lower_token_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 125, + "end_line": 133 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_profile_construction.auths_connections.kernel.lower_token_valid" + }, + { + "def_id": 17, + "lean_name": "auths_profile_construction.auths_connections.kernel.lower_token_valid", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::lower_token_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 116, + "end_line": 116 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "auths_profile_construction.auths_connections.kernel.semantic_head_valid", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_head_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 160, + "end_line": 160 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 21, + "lean_name": "auths_profile_construction.auths_connections.kernel.semantic_tail_valid", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_tail_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 165, + "end_line": 165 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 15, + "lean_name": "auths_profile_construction.auths_connections.kernel.semantic_id_valid_loop.body", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_id_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 184, + "end_line": 191 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": true + }, + "parent_lean_name": "auths_profile_construction.auths_connections.kernel.semantic_id_valid" + }, + { + "def_id": 15, + "lean_name": "auths_profile_construction.auths_connections.kernel.semantic_id_valid_loop", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_id_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 184, + "end_line": 191 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_profile_construction.auths_connections.kernel.semantic_id_valid" + }, + { + "def_id": 15, + "lean_name": "auths_profile_construction.auths_connections.kernel.semantic_id_valid", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::kernel::semantic_id_valid", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/kernel.rs", + "begin_line": 176, + "end_line": 176 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 10, + "lean_name": "auths_profile_construction.auths_connections.model.is_lower_token", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::model::is_lower_token", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 1068, + "end_line": 1068 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 5, + "lean_name": "auths_profile_construction.auths_connections.model.ProviderKind.parse", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::model::{auths_connections::model::ProviderKind}::parse", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 28, + "end_line": 28 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "auths_profile_construction.auths_connections.model.ConnectionAlias.parse", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::model::{auths_connections::model::ConnectionAlias}::parse", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 53, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 7, + "lean_name": "auths_profile_construction.auths_connections.model.SemanticId.parse", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::model::{auths_connections::model::SemanticId}::parse", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 78, + "end_line": 78 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "auths_profile_construction.auths_connections.model.ConnectionProfile.new", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_connections::model::{auths_connections::model::ConnectionProfile}::new", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 162, + "end_line": 162 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "auths_profile_construction.construct", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_profile_construction::construct", + "is_local": true, + "source": { + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "begin_line": 5, + "end_line": 10 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "auths_profile_construction.parse_provider", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_profile_construction::parse_provider", + "is_local": true, + "source": { + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "begin_line": 13, + "end_line": 17 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "auths_profile_construction.parse_alias", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_profile_construction::parse_alias", + "is_local": true, + "source": { + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "begin_line": 20, + "end_line": 24 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "auths_profile_construction.parse_semantic", + "lean_file": "qualification/aeneas/generated/profile_construction/Funs.lean", + "rust_name": "auths_profile_construction::parse_semantic", + "is_local": true, + "source": { + "file": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "begin_line": 27, + "end_line": 31 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 5, + "lean_name": "auths_profile_construction.auths_connections.model.ProviderKind", + "lean_file": "qualification/aeneas/generated/profile_construction/Types.lean", + "rust_name": "auths_connections::model::ProviderKind", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 20, + "end_line": 20 + } + }, + { + "def_id": 3, + "lean_name": "auths_profile_construction.auths_connections.model.ConnectionRecordError", + "lean_file": "qualification/aeneas/generated/profile_construction/Types.lean", + "rust_name": "auths_connections::model::ConnectionRecordError", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 1000, + "end_line": 1000 + } + }, + { + "def_id": 6, + "lean_name": "auths_profile_construction.auths_connections.model.ConnectionAlias", + "lean_file": "qualification/aeneas/generated/profile_construction/Types.lean", + "rust_name": "auths_connections::model::ConnectionAlias", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 45, + "end_line": 45 + } + }, + { + "def_id": 0, + "lean_name": "auths_profile_construction.auths_connections.model.SemanticId", + "lean_file": "qualification/aeneas/generated/profile_construction/Types.lean", + "rust_name": "auths_connections::model::SemanticId", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 70, + "end_line": 70 + } + }, + { + "def_id": 2, + "lean_name": "auths_profile_construction.auths_connections.model.ConnectionProfile", + "lean_file": "qualification/aeneas/generated/profile_construction/Types.lean", + "rust_name": "auths_connections::model::ConnectionProfile", + "is_local": false, + "source": { + "file": "product/runtime/auths-connections/src/model.rs", + "begin_line": 151, + "end_line": 151 + } + } + ], + "globals": [], + "trait_decls": [], + "trait_impls": [] +} diff --git a/formal/qualification/aeneas/generated/scope_codec/Funs.lean b/formal/qualification/aeneas/generated/scope_codec/Funs.lean new file mode 100644 index 000000000..b29f3a189 --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/Funs.lean @@ -0,0 +1,1295 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: function definitions +import Aeneas +import qualification.aeneas.generated.scope_codec.Types +import qualification.aeneas.generated.scope_codec.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +namespace AuthsScopeCodec + +/-- [auths_model::identifier::forbidden_three_byte_prefix]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 9:0-9:72 + Name pattern: [auths_model::identifier::forbidden_three_byte_prefix] -/ +@[rust_fun "auths_model::identifier::forbidden_three_byte_prefix"] +def auths_model.identifier.forbidden_three_byte_prefix + (first : Std.U8) (second : Std.U8) (third : Std.U8) : Result Bool := do + if first = 225#u8 + then if second = 154#u8 + then ok (third = 128#u8) + else ok false + else + if first = 226#u8 + then + if second = 128#u8 + then + let b ← + if 128#u8 <= third + then if third <= 138#u8 + then ok true + else ok false + else ok false + if b + then ok true + else + if third = 168#u8 + then ok true + else if third = 169#u8 + then ok true + else ok (third = 175#u8) + else if second = 129#u8 + then ok (third = 159#u8) + else ok false + else + if first = 227#u8 + then if second = 128#u8 + then ok (third = 128#u8) + else ok false + else ok false + +/-- [auths_model::identifier::forbidden_identifier_at]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 23:0-23:65 + Name pattern: [auths_model::identifier::forbidden_identifier_at] -/ +@[rust_fun "auths_model::identifier::forbidden_identifier_at"] +def auths_model.identifier.forbidden_identifier_at + (input : Slice Std.U8) (position : Std.Usize) : Result Bool := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok false + | some byte => + if byte <= 32#u8 + then ok true + else + if byte = 127#u8 + then ok true + else + let i := Slice.len input + let i1 ← i - position + if i1 < 2#usize + then ok false + else + let i2 ← position + 1#usize + let second ← Slice.index_usize input i2 + if byte = 194#u8 + then + if 128#u8 <= second + then if second <= 160#u8 + then ok true + else ok false + else ok false + else + let i3 := Slice.len input + let i4 ← i3 - position + if i4 < 3#usize + then ok false + else + let i5 ← position + 2#usize + let i6 ← Slice.index_usize input i5 + auths_model.identifier.forbidden_three_byte_prefix byte second i6 + +/-- [auths_model::identifier::contains_forbidden_identifier]: loop 0: + Source: 'core/crates/auths-model/src/identifier.rs', lines 46:4-53:1 + Name pattern: [auths_model::identifier::contains_forbidden_identifier] -/ +@[rust_loop, rust_fun "auths_model::identifier::contains_forbidden_identifier"] +def auths_model.identifier.contains_forbidden_identifier_loop + (input : Slice Std.U8) (position : Std.Usize) : Result Bool := do + let i := Slice.len input + if position < i + then + let b ← auths_model.identifier.forbidden_identifier_at input position + if b + then ok true + else + let position1 ← position + 1#usize + auths_model.identifier.contains_forbidden_identifier_loop input position1 + else ok false +partial_fixpoint + +/-- [auths_model::identifier::contains_forbidden_identifier]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 44:0-44:54 + Name pattern: [auths_model::identifier::contains_forbidden_identifier] -/ +@[reducible, rust_fun "auths_model::identifier::contains_forbidden_identifier"] +def auths_model.identifier.contains_forbidden_identifier + (input : Slice Std.U8) : Result Bool := do + auths_model.identifier.contains_forbidden_identifier_loop input 0#usize + +/-- [auths_model::identifier::bounded_identifier_valid]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 55:0-55:75 + Name pattern: [auths_model::identifier::bounded_identifier_valid] -/ +@[rust_fun "auths_model::identifier::bounded_identifier_valid"] +def auths_model.identifier.bounded_identifier_valid + (value : Str) (maximum : Std.Usize) : Result Bool := do + let b ← core.str.Str.is_empty value + if b + then ok false + else + let i ← core.str.Str.len value + if i <= maximum + then + let s ← core.str.Str.as_bytes value + let b1 ← auths_model.identifier.contains_forbidden_identifier s + ok (¬ b1) + else ok false + +/-- [auths_model::identifier::principal_scheme_byte_valid]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 63:0-63:48 + Name pattern: [auths_model::identifier::principal_scheme_byte_valid] -/ +@[rust_fun "auths_model::identifier::principal_scheme_byte_valid"] +def auths_model.identifier.principal_scheme_byte_valid + (byte : Std.U8) : Result Bool := do + if 97#u8 <= byte + then + if byte <= 122#u8 + then ok true + else + if 48#u8 <= byte + then + if byte <= 57#u8 + then ok true + else + if byte = 43#u8 + then ok true + else if byte = 45#u8 + then ok true + else ok (byte = 46#u8) + else + if byte = 43#u8 + then ok true + else if byte = 45#u8 + then ok true + else ok (byte = 46#u8) + else + if 48#u8 <= byte + then + if byte <= 57#u8 + then ok true + else + if byte = 43#u8 + then ok true + else if byte = 45#u8 + then ok true + else ok (byte = 46#u8) + else + if byte = 43#u8 + then ok true + else if byte = 45#u8 + then ok true + else ok (byte = 46#u8) + +/-- [auths_model::identifier::principal_scheme_valid]: loop 0: + Source: 'core/crates/auths-model/src/identifier.rs', lines 81:4-89:5 + Name pattern: [auths_model::identifier::principal_scheme_valid] -/ +@[rust_loop, rust_fun "auths_model::identifier::principal_scheme_valid"] +def auths_model.identifier.principal_scheme_valid_loop + (bytes : Slice Std.U8) (position : Std.Usize) (valid : Bool) (found : Bool) : + Result (Std.Usize × Bool × Bool) + := do + let i := Slice.len bytes + if position < i + then + if valid + then + if found + then ok (position, true, true) + else + let byte ← Slice.index_usize bytes position + let (valid1, found1) ← + if byte = 58#u8 + then ok (true, true) + else + do + let valid2 ← + auths_model.identifier.principal_scheme_byte_valid byte + ok (valid2, false) + let position1 ← position + 1#usize + auths_model.identifier.principal_scheme_valid_loop bytes position1 + valid1 found1 + else ok (position, false, found) + else ok (position, valid, found) +partial_fixpoint + +/-- [auths_model::identifier::principal_scheme_valid]: + Source: 'core/crates/auths-model/src/identifier.rs', lines 73:0-73:57 + Name pattern: [auths_model::identifier::principal_scheme_valid] -/ +@[rust_fun "auths_model::identifier::principal_scheme_valid"] +def auths_model.identifier.principal_scheme_valid + (value : Str) : Result Bool := do + let bytes ← core.str.Str.as_bytes value + let i := Slice.len bytes + if i < 3#usize + then ok false + else + let i1 ← Slice.index_usize bytes 0#usize + if 97#u8 <= i1 + then + if i1 <= 122#u8 + then + let (position, valid, found) ← + auths_model.identifier.principal_scheme_valid_loop bytes 1#usize true + false + if valid + then + if found + then let i2 := Slice.len bytes + ok (position < i2) + else ok false + else ok false + else ok false + else ok false + +/-- [auths_model::HARD_MAX_TRUST_ANCHORS] + Source: 'core/crates/auths-model/src/lib.rs', lines 75:0-75:39 + Name pattern: [auths_model::HARD_MAX_TRUST_ANCHORS] + Visibility: public -/ +@[global_simps, irreducible, rust_const "auths_model::HARD_MAX_TRUST_ANCHORS"] +def auths_model.HARD_MAX_TRUST_ANCHORS : Std.Usize := 1024#usize + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq + (self : auths_model.TrustAnchorId) (other : auths_model.TrustAnchorId) : + Result Bool + := do + alloc.string.String.Insts.CoreCmpPartialEqString.eq self other + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +def auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId : + core.cmp.PartialEq auths_model.TrustAnchorId auths_model.TrustAnchorId := { + eq := auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq +} + +/-- [auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}::assert_fields_are_eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:31-119:33 + Name pattern: [auths_model::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::Eq}::assert_fields_are_eq"] +def auths_model.TrustAnchorId.Insts.CoreCmpEq.assert_fields_are_eq + (self : auths_model.TrustAnchorId) : Result Unit := do + ok () + +/-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:31-119:33 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def auths_model.TrustAnchorId.Insts.CoreCmpEq : core.cmp.Eq + auths_model.TrustAnchorId := { + partialEqInst := + auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId + assert_fields_are_eq := + auths_model.TrustAnchorId.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- [auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp + (self : auths_model.TrustAnchorId) (other : auths_model.TrustAnchorId) : + Result Ordering + := do + alloc.string.String.Insts.CoreCmpOrd.cmp self other + +/-- [auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}::partial_cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:51-119:61 + Name pattern: [auths_model::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialOrd}::partial_cmp"] +def auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId.partial_cmp + (self : auths_model.TrustAnchorId) (other : auths_model.TrustAnchorId) : + Result (Option Ordering) + := do + let o ← auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:51-119:61 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +def auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId : + core.cmp.PartialOrd auths_model.TrustAnchorId auths_model.TrustAnchorId := { + partialEqInst := + auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId + partial_cmp := + auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId.partial_cmp +} + +/-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +def auths_model.TrustAnchorId.Insts.CoreCmpOrd : core.cmp.Ord + auths_model.TrustAnchorId := { + eqInst := auths_model.TrustAnchorId.Insts.CoreCmpEq + partialOrdInst := + auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId + cmp := auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp +} + +/-- [auths_model::{auths_model::StatusMethodId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::StatusMethodId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusMethodId}::parse"] +def auths_model.StatusMethodId.parse + (value : Str) : + Result (core.result.Result auths_model.StatusMethodId auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 128#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidRegistryId) + +/-- [auths_model::{auths_model::TrustAnchorId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 131:12-131:65 + Name pattern: [auths_model::{auths_model::TrustAnchorId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::TrustAnchorId}::parse"] +def auths_model.TrustAnchorId.parse + (value : Str) : + Result (core.result.Result auths_model.TrustAnchorId auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 128#usize + if b + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidRegistryId) + +/-- [auths_model::{auths_model::PrincipalId}::parse]: + Source: 'core/crates/auths-model/src/lib.rs', lines 164:4-164:57 + Name pattern: [auths_model::{auths_model::PrincipalId}::parse] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalId}::parse"] +def auths_model.PrincipalId.parse + (value : Str) : + Result (core.result.Result auths_model.PrincipalId auths_model.ModelError) + := do + let b ← auths_model.identifier.bounded_identifier_valid value 512#usize + if b + then + let b1 ← auths_model.identifier.principal_scheme_valid value + if b1 + then + let s ← alloc.string.String.Insts.CoreConvertFromShared0Str.from value + ok (core.result.Result.Ok s) + else ok (core.result.Result.Err auths_model.ModelError.InvalidPrincipal) + else ok (core.result.Result.Err auths_model.ModelError.InvalidPrincipal) + +/-- [auths_model::{auths_model::StatusScopeAnchors}::new]: loop 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 2327:8-2330:9 + Name pattern: [auths_model::{auths_model::StatusScopeAnchors}::new] + Visibility: public -/ +@[rust_loop, rust_fun "auths_model::{auths_model::StatusScopeAnchors}::new"] +def auths_model.StatusScopeAnchors.new_loop + (anchors : alloc.vec.Vec auths_model.TrustAnchorId) (position : Std.Usize) + (repeated : Bool) : + Result Bool + := do + let i := alloc.vec.Vec.len anchors + if position < i + then + if repeated + then ok true + else + let i1 ← position - 1#usize + let tai ← + alloc.vec.Vec.index (core.slice.index.SliceIndexUsizeSlice + auths_model.TrustAnchorId) anchors i1 + let tai1 ← + alloc.vec.Vec.index (core.slice.index.SliceIndexUsizeSlice + auths_model.TrustAnchorId) anchors position + let repeated1 ← + auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq tai + tai1 + let position1 ← position + 1#usize + auths_model.StatusScopeAnchors.new_loop anchors position1 repeated1 + else ok repeated +partial_fixpoint + +/-- [auths_model::{auths_model::StatusScopeAnchors}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2320:4-2320:75 + Name pattern: [auths_model::{auths_model::StatusScopeAnchors}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusScopeAnchors}::new"] +def auths_model.StatusScopeAnchors.new + (anchors : alloc.vec.Vec auths_model.TrustAnchorId) : + Result (core.result.Result auths_model.StatusScopeAnchors + auths_model.ModelError) + := do + let b ← alloc.vec.Vec.is_empty Global anchors + if b + then ok (core.result.Result.Err auths_model.ModelError.InvalidStatusSnapshot) + else + let i := alloc.vec.Vec.len anchors + if i > auths_model.HARD_MAX_TRUST_ANCHORS + then + ok (core.result.Result.Err auths_model.ModelError.InvalidStatusSnapshot) + else + let (s, deref_mut_back) ← lift (alloc.vec.Vec.deref_mut anchors) + let s1 ← + alloc.slice.Slice.sort auths_model.TrustAnchorId.Insts.CoreCmpOrd s + let anchors1 := deref_mut_back s1 + let repeated ← + auths_model.StatusScopeAnchors.new_loop anchors1 1#usize false + let r ← + if repeated + then + ok (core.result.Result.Err + auths_model.ModelError.InvalidStatusSnapshot) + else ok (core.result.Result.Ok anchors1) + if repeated + then ok r + else ok r + +/-- [auths_model::{auths_model::StatusTrustRule}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2455:4-2460:13 + Name pattern: [auths_model::{auths_model::StatusTrustRule}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusTrustRule}::new"] +def auths_model.StatusTrustRule.new + (method : auths_model.StatusMethodId) (issuer : auths_model.PrincipalId) + (sequence_floor : Std.U64) (scope : auths_model.StatusScope) : + Result auths_model.StatusTrustRule + := do + ok { method, issuer, sequence_floor, scope } + +/-- [auths_model::{auths_model::VerifierLimits}::get]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3808:4-3808:53 + Name pattern: [auths_model::{auths_model::VerifierLimits}::get] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::VerifierLimits}::get"] +def auths_model.VerifierLimits.get + (self : auths_model.VerifierLimits) (kind : auths_model.LimitKind) : + Result Std.Usize + := do + match kind with + | auths_model.LimitKind.BundleBytes => ok self.bundle_bytes + | auths_model.LimitKind.ActionBytes => ok self.action_bytes + | auths_model.LimitKind.ContextBytes => ok self.context_bytes + | auths_model.LimitKind.Grants => ok self.grants + | auths_model.LimitKind.Actions => ok self.actions + | auths_model.LimitKind.PlanLeaves => ok self.plan_leaves + | auths_model.LimitKind.PlanDepth => ok self.plan_depth + | auths_model.LimitKind.PlanBranching => ok self.plan_branching + | auths_model.LimitKind.EvidenceObjects => ok self.evidence + | auths_model.LimitKind.EvidenceBytes => ok self.evidence_bytes + | auths_model.LimitKind.ControlBindings => ok self.bindings + | auths_model.LimitKind.PrincipalStatusStatements => ok self.principal_status + | auths_model.LimitKind.GrantStatusStatements => ok self.grant_status + | auths_model.LimitKind.Attachments => ok self.attachments + | auths_model.LimitKind.AttachmentBytes => ok self.attachment_bytes + | auths_model.LimitKind.Signatures => ok self.signatures + | auths_model.LimitKind.SignatureBytes => ok self.signature_bytes + | auths_model.LimitKind.Permissions => ok self.permissions + | auths_model.LimitKind.Audiences => ok self.audiences + | auths_model.LimitKind.CriticalExtensions => ok self.extensions + | auths_model.LimitKind.CriticalExtensionBytes => ok self.extension_bytes + | auths_model.LimitKind.AllowedBodyDigests => ok self.body_digests + | auths_model.LimitKind.BindingEvidence => ok self.binding_evidence + | auths_model.LimitKind.CanonicalBodyBytes => ok self.canonical_body_bytes + | auths_model.LimitKind.RegistryEntries => ok self.registry_entries + | auths_model.LimitKind.TrustAnchors => ok self.trust_anchors + | auths_model.LimitKind.Approvals => ok self.approvals + | auths_model.LimitKind.ApproverAnchors => ok self.approver_anchors + | auths_model.LimitKind.ApprovalRequirements => ok self.approval_requirements + +/-- [auths_codec::cbor::malformed]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 14:0-16:1 -/ +def cbor.malformed {T : Type} (_error : T) : Result cbor.Error := do + ok () + +/-- [auths_codec::cbor::read_tail]: loop 0: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 46:4-62:1 -/ +@[rust_loop] +def cbor.read_tail_loop + (input : Slice Std.U8) (position : Std.Usize) (remaining : Std.U8) + (value : Std.U64) : + Result (core.result.Result (Std.U64 × Std.Usize) cbor.Error) + := do + if remaining > 0#u8 + then + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok (core.result.Result.Err ()) + | some byte => + let o1 ← lift (U64.checked_mul value 256#u64) + match o1 with + | none => ok (core.result.Result.Err ()) + | some shifted => + let i ← lift (core.convert.num.FromU64U8.from byte) + let o2 ← lift (U64.checked_add shifted i) + match o2 with + | none => ok (core.result.Result.Err ()) + | some value1 => + let position1 ← position + 1#usize + let remaining1 ← remaining - 1#u8 + cbor.read_tail_loop input position1 remaining1 value1 + else ok (core.result.Result.Ok (value, position)) +partial_fixpoint + +/-- [auths_codec::cbor::read_tail]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 40:0-62:1 -/ +@[reducible] +def cbor.read_tail + (input : Slice Std.U8) (position : Std.Usize) (remaining : Std.U8) + (value : Std.U64) : + Result (core.result.Result (Std.U64 × Std.Usize) cbor.Error) + := do + cbor.read_tail_loop input position remaining value + +/-- [auths_codec::cbor::read_head]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 68:0-92:1 -/ +def cbor.read_head + (input : Slice Std.U8) (position : Std.Usize) : + Result (core.result.Result cbor.Head cbor.Error) + := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) input + position + match o with + | none => ok (core.result.Result.Err ()) + | some first => + let additional ← first % 32#u8 + let start ← position + 1#usize + if additional < 24#u8 + then + let argument ← lift (core.convert.num.FromU64U8.from additional) + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next := start }) + else + match additional with + | 24#uscalar => + let r ← cbor.read_tail input start 1#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | 25#uscalar => + let r ← cbor.read_tail input start 2#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | 26#uscalar => + let r ← cbor.read_tail input start 4#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | 27#uscalar => + let r ← cbor.read_tail input start 8#u8 0#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let (argument, next) := val + let i ← first / 32#u8 + ok (core.result.Result.Ok { major := i, argument, next }) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + cbor.Head (core.convert.FromSame cbor.Error) residual + | _ => ok (core.result.Result.Err ()) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 158:4-165:5 -/ +def cbor.Decoder.head + (self : cbor.Decoder) (major : Std.U8) : + Result ((core.result.Result Std.U64 cbor.Error) × cbor.Decoder) + := do + let r ← cbor.read_head self.input self.position + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + if val.major != major + then ok (core.result.Result.Err (), self) + else + ok (core.result.Result.Ok val.argument, + { self with position := val.next }) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.U64 (core.convert.FromSame cbor.Error) residual + ok (r1, self) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 167:4-173:5 -/ +def cbor.Decoder.collection + (self : cbor.Decoder) (major : Std.U8) : + Result ((core.result.Result (Option Std.U64) cbor.Error) × cbor.Decoder) + := do + let o ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice Std.U8) + self.input self.position + let i ← major <<< 5#i32 + let i1 ← lift (i ||| 31#u8) + let b ← + core.option.Option.Insts.CoreCmpPartialEqOption.eq + (core.cmp.PartialEqShared core.cmp.PartialEqU8) o (some i1) + if b + then + let i2 ← self.position + 1#usize + ok (core.result.Result.Ok none, { self with position := i2 }) + else + let (r, self1) ← cbor.Decoder.head self major + let r1 ← + core.result.Result.map (BuiltinFnOnce Std.U64 (Option Std.U64)) r + (core.option.Option.Some) + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 175:4-177:5 -/ +def cbor.Decoder.map + (self : cbor.Decoder) : + Result ((core.result.Result (Option Std.U64) cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.collection self 5#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 179:4-181:5 -/ +def cbor.Decoder.array + (self : cbor.Decoder) : + Result ((core.result.Result (Option Std.U64) cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.collection self 4#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 183:4-185:5 -/ +def cbor.Decoder.u64 + (self : cbor.Decoder) : + Result ((core.result.Result Std.U64 cbor.Error) × cbor.Decoder) + := do + cbor.Decoder.head self 0#u8 + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 195:4-197:5 -/ +def cbor.Decoder.u8 + (self : cbor.Decoder) : + Result ((core.result.Result Std.U8 cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.u64 self + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + cbor.Error) r1 (cbor.malformed) + ok (r2, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.U8 (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 199:4-205:5 -/ +def cbor.Decoder.payload + (self : cbor.Decoder) (major : Std.U8) : + Result ((core.result.Result (Slice Std.U8) cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.head self major + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce core.num.error.TryFromIntError + cbor.Error) r1 (cbor.malformed) + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let o ← lift (Usize.checked_add self1.position val1) + let r3 ← core.option.Option.ok_or o () + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let o1 ← + core.slice.Slice.get (core.slice.index.SliceIndexRangeUsizeSlice + Std.U8) self1.input { start := self1.position, «end» := val2 } + let r4 ← core.option.Option.ok_or o1 () + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val3 => + ok (core.result.Result.Ok val3, { self1 with position := val2 }) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r5, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r4 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r4, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r3, self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (Slice Std.U8) (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str]: + Source: 'core/crates/auths-codec/src/cbor.rs', lines 211:4-216:5 -/ +def cbor.Decoder.str + (self : cbor.Decoder) : + Result ((core.result.Result Str cbor.Error) × cbor.Decoder) + := do + let (r, self1) ← cbor.Decoder.payload self 3#u8 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← core.str.converts.from_utf8 val + match r1 with + | core.result.Result.Ok value => ok (core.result.Result.Ok value, self1) + | core.result.Result.Err _ => ok (core.result.Result.Err (), self1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Str (core.convert.FromSame cbor.Error) residual + ok (r1, self1) + +/-- [auths_codec::decode::decode_error]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 40:0-42:1 -/ +def decode.decode_error {T : Type} (_error : T) : Result error.CodecError := do + ok error.CodecError.Malformed + +/-- [auths_codec::decode::map]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 44:0-50:1 -/ +def decode.map + (decoder : cbor.Decoder) (expected : Std.U64) : + Result ((core.result.Result Unit error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.map decoder + let o ← core.result.Result.unwrap_or r none + let b ← + core.option.Option.Insts.CoreCmpPartialEqOption.eq core.cmp.PartialEqU64 o + (some expected) + if b + then ok (core.result.Result.Ok (), decoder1) + else ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + +/-- [auths_codec::error::limit_error]: + Source: 'core/crates/auths-codec/src/error.rs', lines 23:0-25:1 -/ +def error.limit_error + (_error : core.num.error.TryFromIntError) : Result error.CodecError := do + ok error.CodecError.LimitExceeded + +/-- [auths_codec::decode::array]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 52:0-60:1 -/ +def decode.array + (decoder : cbor.Decoder) (maximum : Std.Usize) : + Result ((core.result.Result Std.Usize error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.array decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r2 ← core.option.Option.ok_or val error.CodecError.Malformed + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let r3 ← Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from val1 + let r4 ← + core.result.Result.map_err (BuiltinFnOnce + core.num.error.TryFromIntError error.CodecError) r3 + (error.limit_error) + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val2 => + if val2 > maximum + then + ok (core.result.Result.Err error.CodecError.LimitExceeded, decoder1) + else ok (core.result.Result.Ok val2, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.Usize (core.convert.FromSame error.CodecError) residual + ok (r5, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.Usize (core.convert.FromSame error.CodecError) residual + ok (r3, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Std.Usize (core.convert.FromSame error.CodecError) residual + ok (r2, decoder1) + +/-- [auths_codec::decode::key]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 70:0-76:1 -/ +def decode.key + (decoder : cbor.Decoder) (expected : Std.U8) : + Result ((core.result.Result Unit error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.u8 decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + if val = expected + then ok (core.result.Result.Ok (), decoder1) + else ok (core.result.Result.Err error.CodecError.NonCanonical, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame error.CodecError) residual + ok (r2, decoder1) + +/-- [auths_codec::decode::text]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 78:0-83:1 -/ +def decode.text + (decoder : cbor.Decoder) : + Result ((core.result.Result Str error.CodecError) × cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.str decoder + match r with + | core.result.Result.Ok value => ok (core.result.Result.Ok value, decoder1) + | core.result.Result.Err _ => + ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + +/-- [auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}::from]: + Source: 'core/crates/auths-codec/src/error.rs', lines 28:4-30:5 + Visibility: public -/ +def error.CodecError.Insts.CoreConvertFromModelError.from + (model_error : auths_model.ModelError) : Result error.CodecError := do + ok (error.CodecError.Model model_error) + +/-- Trait implementation: [auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}] + Source: 'core/crates/auths-codec/src/error.rs', lines 27:0-31:1 -/ +@[reducible] +def error.CodecError.Insts.CoreConvertFromModelError : core.convert.From + error.CodecError auths_model.ModelError := { + «from» := error.CodecError.Insts.CoreConvertFromModelError.from +} + +/-- [auths_codec::decode::status_scope_anchor]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1110:0-1112:1 -/ +def decode.status_scope_anchor + (decoder : cbor.Decoder) : + Result ((core.result.Result auths_model.TrustAnchorId error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← decode.text decoder + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← auths_model.TrustAnchorId.parse val + let r2 ← + core.result.Result.map_err (BuiltinFnOnce auths_model.ModelError + error.CodecError) r1 + (error.CodecError.Insts.CoreConvertFromModelError.from) + ok (r2, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.TrustAnchorId (core.convert.FromSame error.CodecError) + residual + ok (r1, decoder1) + +/-- [auths_codec::decode::status_scope]: loop 0: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1093:12-1099:13 -/ +@[rust_loop] +def decode.status_scope_loop + (decoder : cbor.Decoder) (length : Std.Usize) + (anchors : alloc.vec.Vec auths_model.TrustAnchorId) (position : Std.Usize) + (failure : Option error.CodecError) : + Result ((Slice Std.U8) × Std.Usize × (alloc.vec.Vec + auths_model.TrustAnchorId) × (Option error.CodecError)) + := do + if position < length + then + let b := core.option.Option.is_none failure + if b + then + let (r, decoder1) ← decode.status_scope_anchor decoder + let (anchors1, failure1) ← + match r with + | core.result.Result.Ok anchor => + do + let anchors2 ← alloc.vec.Vec.push anchors anchor + ok (anchors2, failure) + | core.result.Result.Err error => ok (anchors, some error) + let position1 ← position + 1#usize + decode.status_scope_loop decoder1 length anchors1 position1 failure1 + else ok (decoder.input, decoder.position, anchors, failure) + else ok (decoder.input, decoder.position, anchors, failure) +partial_fixpoint + +/-- [auths_codec::decode::status_scope]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1072:0-1108:1 -/ +def decode.status_scope + (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) : + Result ((core.result.Result auths_model.StatusScope error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← cbor.Decoder.map decoder + let r1 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error error.CodecError) r + (decode.decode_error) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r2 ← core.option.Option.ok_or val error.CodecError.Malformed + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let ri ← core.ops.range.RangeInclusive.new 1#u64 2#u64 + let b ← + core.ops.range.RangeInclusive.contains core.cmp.PartialOrdU64 + core.cmp.PartialOrdU64 core.cmp.PartialOrdU64 ri val1 + if b + then + let (r3, decoder2) ← decode.key decoder1 0#u8 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r3 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r4, decoder3) ← cbor.Decoder.u8 decoder2 + let r5 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error + error.CodecError) r4 (decode.decode_error) + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val2 => + match val2 with + | 0#uscalar => + match val1 with + | 1#uscalar => + ok (core.result.Result.Ok auths_model.StatusScope.OwnAnchor, + decoder3) + | _ => + ok (core.result.Result.Err error.CodecError.Malformed, + decoder3) + | 1#uscalar => + match val1 with + | 2#uscalar => + let (r6, decoder4) ← decode.key decoder3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r6 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let i ← + auths_model.VerifierLimits.get limits + auths_model.LimitKind.TrustAnchors + let (r7, decoder5) ← decode.array decoder4 i + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r7 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val3 => + let anchors := + alloc.vec.Vec.with_capacity auths_model.TrustAnchorId + val3 + let (s, i1, anchors1, failure) ← + decode.status_scope_loop decoder5 val3 anchors 0#usize + none + match failure with + | none => + let r8 ← auths_model.StatusScopeAnchors.new anchors1 + let cf6 ← core.result.Result.Insts.CoreOpsTry.branch r8 + match cf6 with + | core.ops.control_flow.ControlFlow.Continue val4 => + ok (core.result.Result.Ok + (auths_model.StatusScope.Anchors val4), + { input := s, position := i1 }) + | core.ops.control_flow.ControlFlow.Break residual => + let r9 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope + error.CodecError.Insts.CoreConvertFromModelError + residual + ok (r9, { input := s, position := i1 }) + | some error => + ok (core.result.Result.Err error, + { input := s, position := i1 }) + | core.ops.control_flow.ControlFlow.Break residual => + let r8 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope (core.convert.FromSame + error.CodecError) residual + ok (r8, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r7 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope (core.convert.FromSame + error.CodecError) residual + ok (r7, decoder4) + | _ => + ok (core.result.Result.Err error.CodecError.Malformed, + decoder3) + | 2#uscalar => + match val1 with + | 1#uscalar => + ok (core.result.Result.Ok auths_model.StatusScope.AnyAnchor, + decoder3) + | _ => + ok (core.result.Result.Err error.CodecError.Malformed, + decoder3) + | _ => + ok (core.result.Result.Err error.CodecError.Malformed, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope (core.convert.FromSame + error.CodecError) residual + ok (r6, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r4 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope (core.convert.FromSame error.CodecError) + residual + ok (r4, decoder2) + else ok (core.result.Result.Err error.CodecError.Malformed, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope (core.convert.FromSame error.CodecError) + residual + ok (r3, decoder1) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusScope (core.convert.FromSame error.CodecError) + residual + ok (r2, decoder1) + +/-- [auths_codec::decode::status_trust_rule]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1053:0-1067:1 -/ +def decode.status_trust_rule + (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) : + Result ((core.result.Result auths_model.StatusTrustRule error.CodecError) × + cbor.Decoder) + := do + let (r, decoder1) ← decode.map decoder 4#u64 + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r1, decoder2) ← decode.key decoder1 0#u8 + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r2, decoder3) ← decode.text decoder2 + let cf2 ← core.result.Result.Insts.CoreOpsTry.branch r2 + match cf2 with + | core.ops.control_flow.ControlFlow.Continue val => + let r3 ← auths_model.StatusMethodId.parse val + let r4 ← + core.result.Result.map_err (BuiltinFnOnce auths_model.ModelError + error.CodecError) r3 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf3 ← core.result.Result.Insts.CoreOpsTry.branch r4 + match cf3 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let (r5, decoder4) ← decode.key decoder3 1#u8 + let cf4 ← core.result.Result.Insts.CoreOpsTry.branch r5 + match cf4 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r6, decoder5) ← decode.text decoder4 + let cf5 ← core.result.Result.Insts.CoreOpsTry.branch r6 + match cf5 with + | core.ops.control_flow.ControlFlow.Continue val2 => + let r7 ← auths_model.PrincipalId.parse val2 + let r8 ← + core.result.Result.map_err (BuiltinFnOnce + auths_model.ModelError error.CodecError) r7 + (error.CodecError.Insts.CoreConvertFromModelError.from) + let cf6 ← core.result.Result.Insts.CoreOpsTry.branch r8 + match cf6 with + | core.ops.control_flow.ControlFlow.Continue val3 => + let (r9, decoder6) ← decode.key decoder5 2#u8 + let cf7 ← core.result.Result.Insts.CoreOpsTry.branch r9 + match cf7 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r10, decoder7) ← cbor.Decoder.u64 decoder6 + let r11 ← + core.result.Result.map_err (BuiltinFnOnce cbor.Error + error.CodecError) r10 (decode.decode_error) + let cf8 ← core.result.Result.Insts.CoreOpsTry.branch r11 + match cf8 with + | core.ops.control_flow.ControlFlow.Continue val4 => + let (r12, decoder8) ← decode.key decoder7 3#u8 + let cf9 ← core.result.Result.Insts.CoreOpsTry.branch r12 + match cf9 with + | core.ops.control_flow.ControlFlow.Continue _ => + let (r13, decoder9) ← + decode.status_scope decoder8 limits + let cf10 ← + core.result.Result.Insts.CoreOpsTry.branch r13 + match cf10 with + | core.ops.control_flow.ControlFlow.Continue val5 => + let str ← + auths_model.StatusTrustRule.new val1 val3 val4 val5 + ok (core.result.Result.Ok str, decoder9) + | core.ops.control_flow.ControlFlow.Break residual => + let r14 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r14, decoder9) + | core.ops.control_flow.ControlFlow.Break residual => + let r13 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r13, decoder8) + | core.ops.control_flow.ControlFlow.Break residual => + let r12 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r12, decoder7) + | core.ops.control_flow.ControlFlow.Break residual => + let r10 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r10, decoder6) + | core.ops.control_flow.ControlFlow.Break residual => + let r9 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r9, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r7 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r7, decoder5) + | core.ops.control_flow.ControlFlow.Break residual => + let r6 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r6, decoder4) + | core.ops.control_flow.ControlFlow.Break residual => + let r5 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r5, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r3 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame + error.CodecError) residual + ok (r3, decoder3) + | core.ops.control_flow.ControlFlow.Break residual => + let r2 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame error.CodecError) + residual + ok (r2, decoder2) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.StatusTrustRule (core.convert.FromSame error.CodecError) + residual + ok (r1, decoder1) + +/-- [auths_codec::decode::status_trust]: loop 0: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1040:4-1046:5 -/ +@[rust_loop] +def decode.status_trust_loop + (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) + (length : Std.Usize) (rules : alloc.vec.Vec auths_model.StatusTrustRule) + (position : Std.Usize) (failure : Option error.CodecError) : + Result ((Slice Std.U8) × Std.Usize × (alloc.vec.Vec + auths_model.StatusTrustRule) × (Option error.CodecError)) + := do + if position < length + then + let b := core.option.Option.is_none failure + if b + then + let (r, decoder1) ← decode.status_trust_rule decoder limits + let (rules1, failure1) ← + match r with + | core.result.Result.Ok rule => + do + let rules2 ← alloc.vec.Vec.push rules rule + ok (rules2, failure) + | core.result.Result.Err error => ok (rules, some error) + let position1 ← position + 1#usize + decode.status_trust_loop decoder1 limits length rules1 position1 failure1 + else ok (decoder.input, decoder.position, rules, failure) + else ok (decoder.input, decoder.position, rules, failure) +partial_fixpoint + +/-- [auths_codec::decode::status_trust]: + Source: 'core/crates/auths-codec/src/decode.rs', lines 1032:0-1051:1 -/ +def decode.status_trust + (decoder : cbor.Decoder) (limits : auths_model.VerifierLimits) : + Result ((core.result.Result (alloc.vec.Vec auths_model.StatusTrustRule) + error.CodecError) × cbor.Decoder) + := do + let i ← + auths_model.VerifierLimits.get limits auths_model.LimitKind.RegistryEntries + let (r, decoder1) ← decode.array decoder i + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let rules := alloc.vec.Vec.with_capacity auths_model.StatusTrustRule val + let (s, i1, rules1, failure) ← + decode.status_trust_loop decoder1 limits val rules 0#usize none + match failure with + | none => ok (core.result.Result.Ok rules1, { input := s, position := i1 }) + | some error => + ok (core.result.Result.Err error, { input := s, position := i1 }) + | core.ops.control_flow.ControlFlow.Break residual => + let r1 ← + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + (alloc.vec.Vec auths_model.StatusTrustRule) (core.convert.FromSame + error.CodecError) residual + ok (r1, decoder1) + +end AuthsScopeCodec diff --git a/formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean b/formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean new file mode 100644 index 000000000..6f1f2c378 --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean @@ -0,0 +1,38 @@ +import qualification.aeneas.generated.scope_codec.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsScopeCodec +abbrev Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from := _root_.Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from +abbrev U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from := _root_.U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from +abbrev core.option.Option.Some := @_root_.core.option.Option.Some +abbrev core.option.Option.ok_or := @_root_.core.option.Option.ok_or +abbrev core.option.Option.Insts.CoreCmpPartialEqOption.eq := @_root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq +abbrev core.result.Result.map := @_root_.core.result.Result.map +abbrev core.result.Result.map_err := @_root_.core.result.Result.map_err +abbrev core.str.converts.from_utf8 := _root_.core.str.converts.from_utf8 +abbrev core.str.Str.len := _root_.core.str.Str.len +abbrev core.str.Str.is_empty := _root_.core.str.Str.is_empty +abbrev core.str.Str.as_bytes := _root_.core.str.Str.as_bytes +abbrev alloc.string.String.Insts.CoreCmpPartialEqString.eq := _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq +abbrev alloc.string.String.Insts.CoreCmpOrd.cmp := _root_.alloc.string.String.Insts.CoreCmpOrd.cmp +abbrev alloc.string.String.Insts.CoreConvertFromShared0Str.from := _root_.alloc.string.String.Insts.CoreConvertFromShared0Str.from +abbrev alloc.vec.Vec.is_empty := @_root_.alloc.vec.Vec.is_empty + +def identityKey {T : Type} : core.ops.function.FnMut Unit T T := { + FnOnceInst := { call_once := fun _ value => ok value } + call_mut := fun _ value => ok (value, ()) +} + +/-- Ordinary sorting delegates to the previously reviewed stable key-sort + model using a pure, stateless identity key. String comparison laws and + totality are earned separately for the actual native Ord dictionary. -/ +def alloc.slice.Slice.sort {T : Type} (order : core.cmp.Ord T) (values : Slice T) : Result (Slice T) := + _root_.alloc.slice.Slice.sort_by_key identityKey order values () + +def core.ops.range.RangeInclusive.contains {Idx U : Type} + (_indexOrder : core.cmp.PartialOrd Idx Idx) (lowerOrder : core.cmp.PartialOrd Idx U) + (upperOrder : core.cmp.PartialOrd U Idx) (range : core.ops.range.RangeInclusive Idx) (item : U) : Result Bool := do + let lower ← lowerOrder.le range.start item + if lower then upperOrder.le item range.end else ok false +abbrev core.result.Result.unwrap_or := @_root_.core.result.Result.unwrap_or +end AuthsScopeCodec diff --git a/formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean new file mode 100644 index 000000000..93c7959df --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean @@ -0,0 +1,173 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.scope_codec.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open AuthsScopeCodec + +/-- [core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 258:12-258:68 + Name pattern: [core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::ptr_try_from_impls::{core::convert::TryFrom}::try_from"] +axiom Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from + : + Std.U64 → Result (core.result.Result Std.Usize + core.num.error.TryFromIntError) + +/-- [core::convert::num::{impl core::convert::TryFrom for u8}::try_from]: + Source: '/rustc/library/core/src/convert/num.rs', lines 300:12-300:64 + Name pattern: [core::convert::num::{core::convert::TryFrom}::try_from] + Visibility: public -/ +@[rust_fun + "core::convert::num::{core::convert::TryFrom}::try_from"] +axiom U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from + : + Std.U64 → Result (core.result.Result Std.U8 core.num.error.TryFromIntError) + +/-- [core::ops::range::{core::ops::range::RangeInclusive}::contains]: + Source: '/rustc/library/core/src/ops/range.rs', lines 522:4-525:44 + Name pattern: [core::ops::range::{core::ops::range::RangeInclusive<@Idx>}::contains] + Visibility: public -/ +@[rust_fun + "core::ops::range::{core::ops::range::RangeInclusive<@Idx>}::contains"] +axiom core.ops.range.RangeInclusive.contains + {Idx : Type} {U : Type} (cmpPartialOrdInst : core.cmp.PartialOrd Idx Idx) + (cmpPartialOrdInst1 : core.cmp.PartialOrd Idx U) (cmpPartialOrdInst2 : + core.cmp.PartialOrd U Idx) : + core.ops.range.RangeInclusive Idx → U → Result Bool + +/-- [core::option::Option::Some]: + Source: '/rustc/library/core/src/option.rs', lines 605:4-605:8 + Name pattern: [core::option::Option::Some] -/ +@[rust_fun "core::option::Option::Some"] +axiom core.option.Option.Some {T : Type} : T → Result (Option T) + +/-- [core::option::{core::option::Option}::ok_or]: + Source: '/rustc/library/core/src/option.rs', lines 1334:4-1334:73 + Name pattern: [core::option::{core::option::Option<@T>}::ok_or] + Visibility: public -/ +@[rust_fun "core::option::{core::option::Option<@T>}::ok_or"] +axiom core.option.Option.ok_or + {T : Type} {E : Type} : Option T → E → Result (core.result.Result T E) + +/-- [core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq]: + Source: '/rustc/library/core/src/option.rs', lines 2440:4-2440:38 + Name pattern: [core::option::{core::cmp::PartialEq, core::option::Option<@T>>}::eq] + Visibility: public -/ +@[rust_fun + "core::option::{core::cmp::PartialEq, core::option::Option<@T>>}::eq"] +axiom core.option.Option.Insts.CoreCmpPartialEqOption.eq + {T : Type} (cmpPartialEqInst : core.cmp.PartialEq T T) : + Option T → Option T → Result Bool + +/-- [core::result::{core::result::Result}::map]: + Source: '/rustc/library/core/src/result.rs', lines 831:4-833:53 + Name pattern: [core::result::{core::result::Result<@T, @E>}::map] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::map"] +axiom core.result.Result.map + {T : Type} {E : Type} {U : Type} {F : Type} (opsfunctionFnOnceFTupleTUInst : + core.ops.function.FnOnce F T U) : + core.result.Result T E → F → Result (core.result.Result U E) + +/-- [core::result::{core::result::Result}::map_err]: + Source: '/rustc/library/core/src/result.rs', lines 962:4-964:53 + Name pattern: [core::result::{core::result::Result<@T, @E>}::map_err] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::map_err"] +axiom core.result.Result.map_err + {T : Type} {E : Type} {F : Type} {O : Type} (opsfunctionFnOnceOTupleEFInst : + core.ops.function.FnOnce O E F) : + core.result.Result T E → O → Result (core.result.Result T F) + +/-- [core::result::{core::result::Result}::unwrap_or]: + Source: '/rustc/library/core/src/result.rs', lines 1590:4-1593:28 + Name pattern: [core::result::{core::result::Result<@T, @E>}::unwrap_or] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::unwrap_or"] +axiom core.result.Result.unwrap_or + {T : Type} {E : Type} : core.result.Result T E → T → Result T + +/-- [core::str::converts::from_utf8]: + Source: '/rustc/library/core/src/str/converts.rs', lines 89:0-89:59 + Name pattern: [core::str::converts::from_utf8] + Visibility: public -/ +@[rust_fun "core::str::converts::from_utf8"] +axiom core.str.converts.from_utf8 + : Slice Std.U8 → Result (core.result.Result Str core.str.error.Utf8Error) + +/-- [core::str::{str}::len]: + Source: '/rustc/library/core/src/str/mod.rs', lines 153:4-153:36 + Name pattern: [core::str::{str}::len] + Visibility: public -/ +@[rust_fun "core::str::{str}::len"] +axiom core.str.Str.len : Str → Result Std.Usize + +/-- [core::str::{str}::is_empty]: + Source: '/rustc/library/core/src/str/mod.rs', lines 173:4-173:40 + Name pattern: [core::str::{str}::is_empty] + Visibility: public -/ +@[rust_fun "core::str::{str}::is_empty"] +axiom core.str.Str.is_empty : Str → Result Bool + +/-- [core::str::{str}::as_bytes]: + Source: '/rustc/library/core/src/str/mod.rs', lines 498:4-498:41 + Name pattern: [core::str::{str}::as_bytes] + Visibility: public -/ +@[rust_fun "core::str::{str}::as_bytes"] +axiom core.str.Str.as_bytes : Str → Result (Slice Std.U8) + +/-- [alloc::slice::{[T]}::sort]: + Source: '/rustc/library/alloc/src/slice.rs', lines 131:4-133:15 + Name pattern: [alloc::slice::{[@T]}::sort] + Visibility: public -/ +@[rust_fun "alloc::slice::{[@T]}::sort"] +axiom alloc.slice.Slice.sort + {T : Type} (corecmpOrdInst : core.cmp.Ord T) : Slice T → Result (Slice T) + +/-- [alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:9-350:18 + Name pattern: [alloc::string::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::cmp::PartialEq}::eq"] +axiom alloc.string.String.Insts.CoreCmpPartialEqString.eq + : String → String → Result Bool + +/-- [alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:36-350:39 + Name pattern: [alloc::string::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "alloc::string::{core::cmp::Ord}::cmp"] +axiom alloc.string.String.Insts.CoreCmpOrd.cmp + : String → String → Result Ordering + +/-- [alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from]: + Source: '/rustc/library/alloc/src/string.rs', lines 3126:4-3126:30 + Name pattern: [alloc::string::{core::convert::From}::from] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::convert::From}::from"] +axiom alloc.string.String.Insts.CoreConvertFromShared0Str.from + : Str → Result String + +/-- [alloc::vec::{alloc::vec::Vec}::is_empty]: + Source: '/rustc/library/alloc/src/vec/mod.rs', lines 3085:4-3085:40 + Name pattern: [alloc::vec::{alloc::vec::Vec<@T>}::is_empty] + Visibility: public -/ +@[rust_fun "alloc::vec::{alloc::vec::Vec<@T>}::is_empty"] +axiom alloc.vec.Vec.is_empty + {T : Type} (A : Type) : alloc.vec.Vec T → Result Bool + diff --git a/formal/qualification/aeneas/generated/scope_codec/Types.lean b/formal/qualification/aeneas/generated/scope_codec/Types.lean new file mode 100644 index 000000000..6c11019a1 --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/Types.lean @@ -0,0 +1,220 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: type definitions +import Aeneas +import Auths.Support.Discriminant +import qualification.aeneas.generated.scope_codec.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace AuthsScopeCodec + +/-- [auths_model::TrustAnchorId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::TrustAnchorId] + Visibility: public -/ +@[reducible, rust_type "auths_model::TrustAnchorId"] +def auths_model.TrustAnchorId := String + +/-- [auths_model::StatusMethodId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::StatusMethodId] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusMethodId"] +def auths_model.StatusMethodId := String + +/-- [auths_model::ModelError] + Source: 'core/crates/auths-model/src/lib.rs', lines 5194:0-5194:19 + Name pattern: [auths_model::ModelError] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::ModelError"] +inductive auths_model.ModelError where +| UnsupportedProtocol : auths_model.ModelError +| InvalidBundleHeader : auths_model.ModelError +| InvalidPrincipal : auths_model.ModelError +| InvalidVerificationMethod : auths_model.ModelError +| InvalidProfile : auths_model.ModelError +| InvalidCapability : auths_model.ModelError +| InvalidResource : auths_model.ModelError +| InvalidAudience : auths_model.ModelError +| InvalidAudienceSet : auths_model.ModelError +| DuplicateAudience : auths_model.ModelError +| InvalidMediaType : auths_model.ModelError +| InvalidRegistryId : auths_model.ModelError +| InvalidExtensionId : auths_model.ModelError +| InvalidValidity : auths_model.ModelError +| InvalidPermissionSet : auths_model.ModelError +| DuplicatePermission : auths_model.ModelError +| InvalidActionConstraint : auths_model.ModelError +| DuplicateBodyDigest : auths_model.ModelError +| InvalidCanonicalAction : auths_model.ModelError +| InvalidExtension : auths_model.ModelError +| DuplicateExtension : auths_model.ModelError +| InvalidSignature : auths_model.ModelError +| InvalidEvidence : auths_model.ModelError +| InvalidEvidenceBinding : auths_model.ModelError +| InvalidStatus : auths_model.ModelError +| InvalidStatusSnapshot : auths_model.ModelError +| InvalidAttachment : auths_model.ModelError +| InvalidPlan : auths_model.ModelError +| PlanLimitExceeded : auths_model.ModelError +| InvalidAssurance : auths_model.ModelError +| InvalidTrustAnchor : auths_model.ModelError +| InvalidRegistrySelection : auths_model.ModelError +| InvalidVerifierContext : auths_model.ModelError +| DuplicateObject : auths_model.ModelError +| CollectionLimitExceeded : auths_model.ModelError +| InvalidObservation : auths_model.ModelError +| InvalidObservationRequirement : auths_model.ModelError +| InvalidObserverAnchor : auths_model.ModelError +| InvalidBoundedPolicy : auths_model.ModelError +| InvalidApproval : auths_model.ModelError +| InvalidApprovalRequirement : auths_model.ModelError +| InvalidApproverAnchor : auths_model.ModelError + +/-- [auths_model::PrincipalId] + Source: 'core/crates/auths-model/src/lib.rs', lines 154:0-154:22 + Name pattern: [auths_model::PrincipalId] + Visibility: public -/ +@[reducible, rust_type "auths_model::PrincipalId"] +def auths_model.PrincipalId := String + +/-- [auths_model::StatusScopeAnchors] + Source: 'core/crates/auths-model/src/lib.rs', lines 2311:0-2311:29 + Name pattern: [auths_model::StatusScopeAnchors] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusScopeAnchors"] +def auths_model.StatusScopeAnchors := alloc.vec.Vec auths_model.TrustAnchorId + +/-- [auths_model::StatusScope] + Source: 'core/crates/auths-model/src/lib.rs', lines 2358:0-2358:20 + Name pattern: [auths_model::StatusScope] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::StatusScope"] +inductive auths_model.StatusScope where +| OwnAnchor : auths_model.StatusScope +| Anchors : auths_model.StatusScopeAnchors → auths_model.StatusScope +| AnyAnchor : auths_model.StatusScope + +/-- [auths_model::StatusTrustRule] + Source: 'core/crates/auths-model/src/lib.rs', lines 2445:0-2445:26 + Name pattern: [auths_model::StatusTrustRule] + Visibility: public -/ +@[rust_type "auths_model::StatusTrustRule"] +structure auths_model.StatusTrustRule where + method : auths_model.StatusMethodId + issuer : auths_model.PrincipalId + sequence_floor : Std.U64 + scope : auths_model.StatusScope + +/-- [auths_model::VerifierLimits] + Source: 'core/crates/auths-model/src/lib.rs', lines 3612:0-3612:25 + Name pattern: [auths_model::VerifierLimits] + Visibility: public -/ +@[rust_type "auths_model::VerifierLimits"] +structure auths_model.VerifierLimits where + bundle_bytes : Std.Usize + action_bytes : Std.Usize + context_bytes : Std.Usize + grants : Std.Usize + actions : Std.Usize + plan_leaves : Std.Usize + plan_depth : Std.Usize + plan_branching : Std.Usize + evidence : Std.Usize + evidence_bytes : Std.Usize + bindings : Std.Usize + principal_status : Std.Usize + grant_status : Std.Usize + attachments : Std.Usize + attachment_bytes : Std.Usize + signatures : Std.Usize + signature_bytes : Std.Usize + permissions : Std.Usize + audiences : Std.Usize + extensions : Std.Usize + extension_bytes : Std.Usize + body_digests : Std.Usize + binding_evidence : Std.Usize + canonical_body_bytes : Std.Usize + registry_entries : Std.Usize + trust_anchors : Std.Usize + work_units : Std.U64 + approvals : Std.Usize + approver_anchors : Std.Usize + approval_requirements : Std.Usize + +/-- [auths_model::LimitKind] + Source: 'core/crates/auths-model/src/lib.rs', lines 3647:0-3647:18 + Name pattern: [auths_model::LimitKind] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::LimitKind"] +inductive auths_model.LimitKind where +| BundleBytes : auths_model.LimitKind +| ActionBytes : auths_model.LimitKind +| ContextBytes : auths_model.LimitKind +| Grants : auths_model.LimitKind +| Actions : auths_model.LimitKind +| PlanLeaves : auths_model.LimitKind +| PlanDepth : auths_model.LimitKind +| PlanBranching : auths_model.LimitKind +| EvidenceObjects : auths_model.LimitKind +| EvidenceBytes : auths_model.LimitKind +| ControlBindings : auths_model.LimitKind +| PrincipalStatusStatements : auths_model.LimitKind +| GrantStatusStatements : auths_model.LimitKind +| Attachments : auths_model.LimitKind +| AttachmentBytes : auths_model.LimitKind +| Signatures : auths_model.LimitKind +| SignatureBytes : auths_model.LimitKind +| Permissions : auths_model.LimitKind +| Audiences : auths_model.LimitKind +| CriticalExtensions : auths_model.LimitKind +| CriticalExtensionBytes : auths_model.LimitKind +| AllowedBodyDigests : auths_model.LimitKind +| BindingEvidence : auths_model.LimitKind +| CanonicalBodyBytes : auths_model.LimitKind +| RegistryEntries : auths_model.LimitKind +| TrustAnchors : auths_model.LimitKind +| Approvals : auths_model.LimitKind +| ApproverAnchors : auths_model.LimitKind +| ApprovalRequirements : auths_model.LimitKind + +/-- [auths_codec::cbor::Error] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 12:0-12:24 -/ +@[reducible] +def cbor.Error := Unit + +/-- [auths_codec::cbor::Head] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 33:0-37:1 -/ +structure cbor.Head where + major : Std.U8 + argument : Std.U64 + next : Std.Usize + +/-- [auths_codec::cbor::Decoder] + Source: 'core/crates/auths-codec/src/cbor.rs', lines 137:0-140:1 -/ +structure cbor.Decoder where + input : Slice Std.U8 + position : Std.Usize + +/-- [auths_codec::error::CodecError] + Source: 'core/crates/auths-codec/src/error.rs', lines 8:0-21:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive error.CodecError where +| LimitExceeded : error.CodecError +| Malformed : error.CodecError +| NonCanonical : error.CodecError +| DigestMismatch : error.CodecError +| DuplicateObject : error.CodecError +| Model : auths_model.ModelError → error.CodecError + +end AuthsScopeCodec diff --git a/formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean b/formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean new file mode 100644 index 000000000..9d2aa9246 --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean @@ -0,0 +1 @@ +import qualification.aeneas.generated.codec.TypesExternal diff --git a/formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean new file mode 100644 index 000000000..e8c6c5753 --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean @@ -0,0 +1,22 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [core::str::error::Utf8Error] + Source: '/rustc/library/core/src/str/error.rs', lines 47:0-47:20 + Name pattern: [core::str::error::Utf8Error] + Visibility: public -/ +@[rust_type "core::str::error::Utf8Error"] +axiom core.str.error.Utf8Error : Type + diff --git a/formal/qualification/aeneas/generated/scope_codec/translation.json b/formal/qualification/aeneas/generated/scope_codec/translation.json new file mode 100644 index 000000000..4f8ee76ab --- /dev/null +++ b/formal/qualification/aeneas/generated/scope_codec/translation.json @@ -0,0 +1,1372 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_codec", + "functions": [ + { + "def_id": 13, + "lean_name": "AuthsScopeCodec.Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 258, + "end_line": 258 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 104, + "lean_name": "AuthsScopeCodec.U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::convert::num::{impl core::convert::TryFrom for u8}::try_from", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/num.rs", + "begin_line": 300, + "end_line": 300 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 44, + "lean_name": "AuthsScopeCodec.core.ops.range.RangeInclusive.contains", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::ops::range::{core::ops::range::RangeInclusive}::contains", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/ops/range.rs", + "begin_line": 522, + "end_line": 525 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 50, + "lean_name": "AuthsScopeCodec.core.option.Option.Some", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::option::Option::Some", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 605, + "end_line": 605 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 12, + "lean_name": "AuthsScopeCodec.core.option.Option.ok_or", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::option::{core::option::Option}::ok_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 1334, + "end_line": 1334 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 34, + "lean_name": "AuthsScopeCodec.core.option.Option.Insts.CoreCmpPartialEqOption.eq", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 2440, + "end_line": 2440 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 49, + "lean_name": "AuthsScopeCodec.core.result.Result.map", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::map", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 831, + "end_line": 833 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 10, + "lean_name": "AuthsScopeCodec.core.result.Result.map_err", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::map_err", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 962, + "end_line": 964 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 33, + "lean_name": "AuthsScopeCodec.core.result.Result.unwrap_or", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::unwrap_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 1590, + "end_line": 1593 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 59, + "lean_name": "AuthsScopeCodec.core.str.converts.from_utf8", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::str::converts::from_utf8", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/converts.rs", + "begin_line": 89, + "end_line": 89 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 61, + "lean_name": "AuthsScopeCodec.core.str.Str.len", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::len", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 153, + "end_line": 153 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 60, + "lean_name": "AuthsScopeCodec.core.str.Str.is_empty", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::is_empty", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 173, + "end_line": 173 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 62, + "lean_name": "AuthsScopeCodec.core.str.Str.as_bytes", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "core::str::{str}::as_bytes", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/mod.rs", + "begin_line": 498, + "end_line": 498 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 89, + "lean_name": "AuthsScopeCodec.alloc.slice.Slice.sort", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "alloc::slice::{[T]}::sort", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/slice.rs", + "begin_line": 131, + "end_line": 133 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 116, + "lean_name": "AuthsScopeCodec.alloc.string.String.Insts.CoreCmpPartialEqString.eq", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 131, + "lean_name": "AuthsScopeCodec.alloc.string.String.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 38, + "lean_name": "AuthsScopeCodec.alloc.string.String.Insts.CoreConvertFromShared0Str.from", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 3126, + "end_line": 3126 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 86, + "lean_name": "AuthsScopeCodec.alloc.vec.Vec.is_empty", + "lean_file": "qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "rust_name": "alloc::vec::{alloc::vec::Vec}::is_empty", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/vec/mod.rs", + "begin_line": 3085, + "end_line": 3085 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 123, + "lean_name": "AuthsScopeCodec.auths_model.identifier.forbidden_three_byte_prefix", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::forbidden_three_byte_prefix", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 9, + "end_line": 9 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 106, + "lean_name": "AuthsScopeCodec.auths_model.identifier.forbidden_identifier_at", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::forbidden_identifier_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 23, + "end_line": 23 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 63, + "lean_name": "AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier_loop", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 46, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier" + }, + { + "def_id": 63, + "lean_name": "AuthsScopeCodec.auths_model.identifier.contains_forbidden_identifier", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::contains_forbidden_identifier", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 44, + "end_line": 44 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 37, + "lean_name": "AuthsScopeCodec.auths_model.identifier.bounded_identifier_valid", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::bounded_identifier_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 55, + "end_line": 55 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 65, + "lean_name": "AuthsScopeCodec.auths_model.identifier.principal_scheme_byte_valid", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::principal_scheme_byte_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 63, + "end_line": 63 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 41, + "lean_name": "AuthsScopeCodec.auths_model.identifier.principal_scheme_valid_loop", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::principal_scheme_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 81, + "end_line": 89 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsScopeCodec.auths_model.identifier.principal_scheme_valid" + }, + { + "def_id": 41, + "lean_name": "AuthsScopeCodec.auths_model.identifier.principal_scheme_valid", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::identifier::principal_scheme_valid", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/identifier.rs", + "begin_line": 73, + "end_line": 73 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 91, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 129, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 115, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 130, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId.partial_cmp", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}::partial_cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 21, + "lean_name": "AuthsScopeCodec.auths_model.StatusMethodId.parse", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusMethodId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 85, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.parse", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::TrustAnchorId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 131, + "end_line": 131 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 23, + "lean_name": "AuthsScopeCodec.auths_model.PrincipalId.parse", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalId}::parse", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 164, + "end_line": 164 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 46, + "lean_name": "AuthsScopeCodec.auths_model.StatusScopeAnchors.new_loop", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusScopeAnchors}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2327, + "end_line": 2330 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsScopeCodec.auths_model.StatusScopeAnchors.new" + }, + { + "def_id": 46, + "lean_name": "AuthsScopeCodec.auths_model.StatusScopeAnchors.new", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusScopeAnchors}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2320, + "end_line": 2320 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 26, + "lean_name": "AuthsScopeCodec.auths_model.StatusTrustRule.new", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusTrustRule}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2455, + "end_line": 2460 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "AuthsScopeCodec.auths_model.VerifierLimits.get", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{auths_model::VerifierLimits}::get", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3808, + "end_line": 3808 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 57, + "lean_name": "AuthsScopeCodec.cbor.malformed", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::malformed", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 14, + "end_line": 16 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 109, + "lean_name": "AuthsScopeCodec.cbor.read_tail_loop", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 46, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsScopeCodec.cbor.read_tail" + }, + { + "def_id": 109, + "lean_name": "AuthsScopeCodec.cbor.read_tail", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_tail", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 40, + "end_line": 62 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 66, + "lean_name": "AuthsScopeCodec.cbor.read_head", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::read_head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 68, + "end_line": 92 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 43, + "lean_name": "AuthsScopeCodec.cbor.Decoder.head", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 158, + "end_line": 165 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 30, + "lean_name": "AuthsScopeCodec.cbor.Decoder.collection", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 167, + "end_line": 173 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 32, + "lean_name": "AuthsScopeCodec.cbor.Decoder.map", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 175, + "end_line": 177 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 9, + "lean_name": "AuthsScopeCodec.cbor.Decoder.array", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 179, + "end_line": 181 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 24, + "lean_name": "AuthsScopeCodec.cbor.Decoder.u64", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 183, + "end_line": 185 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 35, + "lean_name": "AuthsScopeCodec.cbor.Decoder.u8", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 195, + "end_line": 197 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 58, + "lean_name": "AuthsScopeCodec.cbor.Decoder.payload", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 199, + "end_line": 205 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 36, + "lean_name": "AuthsScopeCodec.cbor.Decoder.str", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 211, + "end_line": 216 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 11, + "lean_name": "AuthsScopeCodec.decode.decode_error", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::decode_error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 40, + "end_line": 42 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 18, + "lean_name": "AuthsScopeCodec.decode.map", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::map", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 44, + "end_line": 50 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "AuthsScopeCodec.error.limit_error", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::error::limit_error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 23, + "end_line": 25 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "AuthsScopeCodec.decode.array", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::array", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 52, + "end_line": 60 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "AuthsScopeCodec.decode.key", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::key", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 70, + "end_line": 76 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "AuthsScopeCodec.decode.text", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::text", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 78, + "end_line": 83 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 22, + "lean_name": "AuthsScopeCodec.error.CodecError.Insts.CoreConvertFromModelError.from", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}::from", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 28, + "end_line": 30 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 45, + "lean_name": "AuthsScopeCodec.decode.status_scope_anchor", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::status_scope_anchor", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1110, + "end_line": 1112 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 25, + "lean_name": "AuthsScopeCodec.decode.status_scope_loop", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::status_scope", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1093, + "end_line": 1099 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsScopeCodec.decode.status_scope" + }, + { + "def_id": 25, + "lean_name": "AuthsScopeCodec.decode.status_scope", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::status_scope", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1072, + "end_line": 1108 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 7, + "lean_name": "AuthsScopeCodec.decode.status_trust_rule", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::status_trust_rule", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1053, + "end_line": 1067 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "AuthsScopeCodec.decode.status_trust_loop", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::status_trust", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1040, + "end_line": 1046 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsScopeCodec.decode.status_trust" + }, + { + "def_id": 0, + "lean_name": "AuthsScopeCodec.decode.status_trust", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::decode::status_trust", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/decode.rs", + "begin_line": 1032, + "end_line": 1051 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 23, + "lean_name": "AuthsScopeCodec.core.str.error.Utf8Error", + "lean_file": "qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean", + "rust_name": "core::str::error::Utf8Error", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/str/error.rs", + "begin_line": 47, + "end_line": 47 + } + }, + { + "def_id": 21, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::TrustAnchorId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 11, + "lean_name": "AuthsScopeCodec.auths_model.StatusMethodId", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::StatusMethodId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 14, + "lean_name": "AuthsScopeCodec.auths_model.ModelError", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::ModelError", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 5194, + "end_line": 5194 + } + }, + { + "def_id": 12, + "lean_name": "AuthsScopeCodec.auths_model.PrincipalId", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::PrincipalId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 154, + "end_line": 154 + } + }, + { + "def_id": 18, + "lean_name": "AuthsScopeCodec.auths_model.StatusScopeAnchors", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::StatusScopeAnchors", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2311, + "end_line": 2311 + } + }, + { + "def_id": 13, + "lean_name": "AuthsScopeCodec.auths_model.StatusScope", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::StatusScope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2358, + "end_line": 2358 + } + }, + { + "def_id": 4, + "lean_name": "AuthsScopeCodec.auths_model.StatusTrustRule", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::StatusTrustRule", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2445, + "end_line": 2445 + } + }, + { + "def_id": 1, + "lean_name": "AuthsScopeCodec.auths_model.VerifierLimits", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::VerifierLimits", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3612, + "end_line": 3612 + } + }, + { + "def_id": 9, + "lean_name": "AuthsScopeCodec.auths_model.LimitKind", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_model::LimitKind", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3647, + "end_line": 3647 + } + }, + { + "def_id": 15, + "lean_name": "AuthsScopeCodec.cbor.Error", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_codec::cbor::Error", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 12, + "end_line": 12 + } + }, + { + "def_id": 24, + "lean_name": "AuthsScopeCodec.cbor.Head", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_codec::cbor::Head", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 33, + "end_line": 37 + } + }, + { + "def_id": 0, + "lean_name": "AuthsScopeCodec.cbor.Decoder", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_codec::cbor::Decoder", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/cbor.rs", + "begin_line": 137, + "end_line": 140 + } + }, + { + "def_id": 6, + "lean_name": "AuthsScopeCodec.error.CodecError", + "lean_file": "qualification/aeneas/generated/scope_codec/Types.lean", + "rust_name": "auths_codec::error::CodecError", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 8, + "end_line": 21 + } + } + ], + "globals": [ + { + "def_id": 4, + "lean_name": "AuthsScopeCodec.auths_model.HARD_MAX_TRUST_ANCHORS", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::HARD_MAX_TRUST_ANCHORS", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 75, + "end_line": 75 + }, + "can_fail": false + } + ], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 32, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 7, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 37, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 15, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 38, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 8, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 30, + "lean_name": "AuthsScopeCodec.auths_model.TrustAnchorId.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 10, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + }, + { + "def_id": 10, + "lean_name": "AuthsScopeCodec.error.CodecError.Insts.CoreConvertFromModelError", + "lean_file": "qualification/aeneas/generated/scope_codec/Funs.lean", + "rust_name": "auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/error.rs", + "begin_line": 27, + "end_line": 31 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::convert::From", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/generated/sha256/Funs.lean b/formal/qualification/aeneas/generated/sha256/Funs.lean new file mode 100644 index 000000000..ba5985ad1 --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/Funs.lean @@ -0,0 +1,43 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: function definitions +import Aeneas +import qualification.aeneas.generated.sha256.Types +import qualification.aeneas.generated.sha256.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +variable [primitive : Auths.Crypto.Sha256Primitives] + +namespace AuthsNativeSha256 + +/-- [auths_model::{auths_model::Digest}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 236:4-236:45 + Name pattern: [auths_model::{auths_model::Digest}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Digest}::new"] +def auths_model.Digest.new + (bytes : Array Std.U8 32#usize) : Result auths_model.Digest := do + ok bytes + +/-- [auths_codec::hash::raw_sha256]: + Source: 'core/crates/auths-codec/src/hash.rs', lines 51:0-53:1 -/ +def hash.raw_sha256 (value : Slice Std.U8) : Result auths_model.Digest := do + let qstd1 ← + digest.qualified_sha256_type_decls_11.Insts.DigestDigestDigest.digest value + let a ← + generic_array.qualified_sha256_type_decls_1.Insts.CoreConvertIntoArrayU832.into + qstd1 + auths_model.Digest.new a + +end AuthsNativeSha256 diff --git a/formal/qualification/aeneas/generated/sha256/FunsExternal.lean b/formal/qualification/aeneas/generated/sha256/FunsExternal.lean new file mode 100644 index 000000000..12b19f9b1 --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/FunsExternal.lean @@ -0,0 +1,11 @@ +-- Exact selected foreign calls are explicit implementation projections. +import qualification.aeneas.generated.sha256.Types +open Aeneas Aeneas.Std Result + +def generic_array.qualified_sha256_type_decls_1.Insts.CoreConvertIntoArrayU832.into + [P : Auths.Crypto.Sha256Primitives] (value : generic_array.qualified_sha256_type_decls_1) : + Result (Array Std.U8 32#usize) := P.intoBytes value + +def digest.qualified_sha256_type_decls_11.Insts.DigestDigestDigest.digest + [P : Auths.Crypto.Sha256Primitives] (value : Slice Std.U8) : + Result generic_array.qualified_sha256_type_decls_1 := P.digest value diff --git a/formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean new file mode 100644 index 000000000..3c794290f --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean @@ -0,0 +1,36 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.sha256.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open AuthsNativeSha256 + +/-- [core::qualified_sha256_fun_decls_2]: + Source: '/rustc/library/core/src/convert/mod.rs', lines 777:4-777:22 + Name pattern: [core::qualified_sha256_fun_decls_2] + Visibility: public -/ +@[rust_fun "core::qualified_sha256_fun_decls_2"] +axiom + generic_array.qualified_sha256_type_decls_1.Insts.CoreConvertIntoArrayU832.into + : + generic_array.qualified_sha256_type_decls_1 → Result (Array Std.U8 + 32#usize) + +/-- [digest::qualified_sha256_fun_decls_1]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/digest-0.10.7/src/digest.rs', lines 124:4-124:53 + Name pattern: [digest::qualified_sha256_fun_decls_1] + Visibility: public -/ +@[rust_fun "digest::qualified_sha256_fun_decls_1"] +axiom digest.qualified_sha256_type_decls_11.Insts.DigestDigestDigest.digest + : Slice Std.U8 → Result generic_array.qualified_sha256_type_decls_1 + diff --git a/formal/qualification/aeneas/generated/sha256/Types.lean b/formal/qualification/aeneas/generated/sha256/Types.lean new file mode 100644 index 000000000..bf6f93ee2 --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/Types.lean @@ -0,0 +1,25 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: type definitions +import Aeneas +import qualification.aeneas.generated.sha256.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace AuthsNativeSha256 + +/-- [auths_model::Digest] + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:17 + Name pattern: [auths_model::Digest] + Visibility: public -/ +@[reducible, rust_type "auths_model::Digest"] +def auths_model.Digest := Array Std.U8 32#usize + +end AuthsNativeSha256 diff --git a/formal/qualification/aeneas/generated/sha256/TypesExternal.lean b/formal/qualification/aeneas/generated/sha256/TypesExternal.lean new file mode 100644 index 000000000..f7330e5db --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/TypesExternal.lean @@ -0,0 +1,3 @@ +-- Explicit foreign output type, without a global instance or axiom. +import Auths.Crypto.Sha256Primitives +abbrev generic_array.qualified_sha256_type_decls_1 [P : Auths.Crypto.Sha256Primitives] := P.Output diff --git a/formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean new file mode 100644 index 000000000..8f35c90d3 --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean @@ -0,0 +1,22 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_codec]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [generic_array::qualified_sha256_type_decls_1] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/generic-array-0.14.7/src/lib.rs', lines 179:0-179:45 + Name pattern: [generic_array::qualified_sha256_type_decls_1] + Visibility: public -/ +@[rust_type "generic_array::qualified_sha256_type_decls_1"] +axiom generic_array.qualified_sha256_type_decls_1 : Type + diff --git a/formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json b/formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json new file mode 100644 index 000000000..62df7a196 --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json @@ -0,0 +1,902 @@ +{ + "schema": "auths-proof-foreign-name-normalization/v1", + "declarations": [ + { + "declaration_group": "type_decls", + "declaration_id": 1, + "original_name": [ + { + "Ident": [ + "generic_array", + 0 + ] + }, + { + "Ident": [ + "GenericArray", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 462 + }, + { + "Deduplicated": 674 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "generic_array", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_1", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 3, + "beg": { + "line": 179, + "col": 0 + }, + "end": { + "line": 179, + "col": 45 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 2, + "original_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "uint", + 0 + ] + }, + { + "Ident": [ + "UInt", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 673 + }, + { + "Deduplicated": 669 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_2", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 148, + "col": 0 + }, + "end": { + "line": 148, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 3, + "original_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "uint", + 0 + ] + }, + { + "Ident": [ + "UInt", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 672 + }, + { + "Deduplicated": 669 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_3", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 148, + "col": 0 + }, + "end": { + "line": 148, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 4, + "original_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "uint", + 0 + ] + }, + { + "Ident": [ + "UInt", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 671 + }, + { + "Deduplicated": 669 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_4", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 148, + "col": 0 + }, + "end": { + "line": 148, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 5, + "original_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "uint", + 0 + ] + }, + { + "Ident": [ + "UInt", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 670 + }, + { + "Deduplicated": 669 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_5", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 148, + "col": 0 + }, + "end": { + "line": 148, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 6, + "original_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "uint", + 0 + ] + }, + { + "Ident": [ + "UInt", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 667 + }, + { + "Deduplicated": 669 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_6", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 148, + "col": 0 + }, + "end": { + "line": 148, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 7, + "original_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "uint", + 0 + ] + }, + { + "Ident": [ + "UInt", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 661 + }, + { + "Deduplicated": 666 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "typenum", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_7", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 4, + "beg": { + "line": 148, + "col": 0 + }, + "end": { + "line": 148, + "col": 21 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 11, + "original_name": [ + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Ident": [ + "core_api", + 0 + ] + }, + { + "Ident": [ + "wrapper", + 0 + ] + }, + { + "Ident": [ + "CoreWrapper", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 1123 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_11", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 9, + "beg": { + "line": 24, + "col": 0 + }, + "end": { + "line": 24, + "col": 25 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "type_decls", + "declaration_id": 12, + "original_name": [ + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Ident": [ + "core_api", + 0 + ] + }, + { + "Ident": [ + "ct_variable", + 0 + ] + }, + { + "Ident": [ + "CtVariableCoreWrapper", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 1119 + }, + { + "Deduplicated": 674 + }, + { + "Deduplicated": 1122 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_type_decls_12", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 11, + "beg": { + "line": 25, + "col": 0 + }, + "end": { + "line": 25, + "col": 55 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 1, + "original_name": [ + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Impl": { + "Trait": 0 + } + }, + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 1124 + }, + { + "Deduplicated": 1125 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "digest", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_fun_decls_1", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 7, + "beg": { + "line": 124, + "col": 4 + }, + "end": { + "line": 124, + "col": 53 + } + }, + "generated_from_span": null + } + }, + { + "declaration_group": "fun_decls", + "declaration_id": 2, + "original_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "convert", + 0 + ] + }, + { + "Impl": { + "Trait": 1 + } + }, + { + "Ident": [ + "into", + 0 + ] + }, + { + "Instantiated": { + "params": { + "regions": [], + "types": [], + "const_generics": [], + "trait_clauses": [], + "regions_outlive": [], + "types_outlive": [], + "trait_type_constraints": [] + }, + "skip_binder": { + "regions": [], + "types": [ + { + "Deduplicated": 675 + }, + { + "Deduplicated": 479 + } + ], + "const_generics": [], + "trait_refs": [] + }, + "kind": "Other" + } + } + ], + "normalized_name": [ + { + "Ident": [ + "core", + 0 + ] + }, + { + "Ident": [ + "qualified_sha256_fun_decls_2", + 0 + ] + } + ], + "source_span": { + "data": { + "file_id": 14, + "beg": { + "line": 777, + "col": 4 + }, + "end": { + "line": 777, + "col": 22 + } + }, + "generated_from_span": null + } + } + ], + "preserved": [ + "Auths names", + "all function bodies", + "signatures", + "generics", + "layouts", + "source spans", + "call and type IDs" + ], + "canonicalization": "pinned-charon-pretty-print-v1", + "original_canonical_llbc_sha256": "5de57b55ce33f7dea7fd66299a0fb2cfe177e8c891e68cbad7bffd0bae695ce8", + "normalized_canonical_llbc_sha256": "4d9397664e59db4f8454a934e134df0621ee215f66cf77e3dee7d6749d07fad7" +} diff --git a/formal/qualification/aeneas/generated/sha256/translation.json b/formal/qualification/aeneas/generated/sha256/translation.json new file mode 100644 index 000000000..a74b45291 --- /dev/null +++ b/formal/qualification/aeneas/generated/sha256/translation.json @@ -0,0 +1,104 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_codec", + "functions": [ + { + "def_id": 2, + "lean_name": "AuthsNativeSha256.generic_array.qualified_sha256_type_decls_1.Insts.CoreConvertIntoArrayU832.into", + "lean_file": "qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + "rust_name": "core::qualified_sha256_fun_decls_2", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/convert/mod.rs", + "begin_line": 777, + "end_line": 777 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "AuthsNativeSha256.digest.qualified_sha256_type_decls_11.Insts.DigestDigestDigest.digest", + "lean_file": "qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + "rust_name": "digest::qualified_sha256_fun_decls_1", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/digest-0.10.7/src/digest.rs", + "begin_line": 124, + "end_line": 124 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "AuthsNativeSha256.auths_model.Digest.new", + "lean_file": "qualification/aeneas/generated/sha256/Funs.lean", + "rust_name": "auths_model::{auths_model::Digest}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 236, + "end_line": 236 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "AuthsNativeSha256.hash.raw_sha256", + "lean_file": "qualification/aeneas/generated/sha256/Funs.lean", + "rust_name": "auths_codec::hash::raw_sha256", + "is_local": true, + "source": { + "file": "core/crates/auths-codec/src/hash.rs", + "begin_line": 51, + "end_line": 53 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 1, + "lean_name": "AuthsNativeSha256.generic_array.qualified_sha256_type_decls_1", + "lean_file": "qualification/aeneas/generated/sha256/TypesExternal_Template.lean", + "rust_name": "generic_array::qualified_sha256_type_decls_1", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/generic-array-0.14.7/src/lib.rs", + "begin_line": 179, + "end_line": 179 + } + }, + { + "def_id": 0, + "lean_name": "AuthsNativeSha256.auths_model.Digest", + "lean_file": "qualification/aeneas/generated/sha256/Types.lean", + "rust_name": "auths_model::Digest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 230, + "end_line": 230 + } + } + ], + "globals": [], + "trait_decls": [], + "trait_impls": [] +} diff --git a/formal/qualification/aeneas/generated/signature/Funs.lean b/formal/qualification/aeneas/generated/signature/Funs.lean new file mode 100644 index 000000000..024baf399 --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/Funs.lean @@ -0,0 +1,537 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: function definitions +import Aeneas +import qualification.aeneas.generated.signature.Types +import qualification.aeneas.generated.signature.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +variable [primitives : Auths.Crypto.Ed25519Primitives] + +namespace auths_signature_core + +/-- [auths_signature_core::P256_KEY_LEN] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 14:0-14:31 -/ +@[global_simps, irreducible] def P256_KEY_LEN : Std.Usize := 33#usize + +/-- [auths_signature_core::ed25519_point_encoding_is_canonical]: loop 0: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 27:4-30:5 -/ +@[rust_loop] +def ed25519_point_encoding_is_canonical_loop + (iter : core.ops.range.Range Std.Usize) (encoded : Array Std.U8 32#usize) + (all_max : Bool) (all_zero : Bool) : + Result (Bool × Bool) + := do + let (o, iter1) ← + core.iter.range.IteratorRange.next core.iter.range.StepUsize iter + match o with + | none => ok (all_max, all_zero) + | some index => + let i ← Array.index_usize encoded index + ed25519_point_encoding_is_canonical_loop iter1 encoded (all_max && (i = + 255#u8)) (all_zero && (i = 0#u8)) +partial_fixpoint + +/-- [auths_signature_core::ed25519_point_encoding_is_canonical]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 17:0-39:1 -/ +def ed25519_point_encoding_is_canonical + (encoded : Array Std.U8 32#usize) : Result Bool := do + let i ← Array.index_usize encoded 31#usize + let top ← lift (i &&& 127#u8) + let (all_max, all_zero) ← + ed25519_point_encoding_is_canonical_loop + { start := 1#usize, «end» := 31#usize } encoded (top = 127#u8) (top = + 0#u8) + if all_max + then + let i1 ← Array.index_usize encoded 0#usize + if i1 >= 237#u8 + then ok false + else + let i2 ← Array.index_usize encoded 31#usize + let i3 ← lift (i2 &&& 128#u8) + if i3 != 0#u8 + then + if all_zero + then + if i1 = 1#u8 + then ok false + else if i1 = 236#u8 + then ok false + else ok true + else if i1 = 236#u8 + then ok false + else ok true + else ok true + else + let i1 ← Array.index_usize encoded 31#usize + let i2 ← lift (i1 &&& 128#u8) + if i2 != 0#u8 + then + if all_zero + then + let i3 ← Array.index_usize encoded 0#usize + if i3 = 1#u8 + then ok false + else ok true + else ok true + else ok true + +/-- [auths_signature_core::p256_key_encoding_is_canonical]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 42:0-47:1 -/ +def p256_key_encoding_is_canonical (encoded : Slice Std.U8) : Result Bool := do + let i := Slice.len encoded + if i != P256_KEY_LEN + then ok false + else + let i1 ← Slice.index_usize encoded 0#usize + if i1 = 2#u8 + then ok true + else ok (i1 = 3#u8) + +/-- [auths_signature_core::P256_HALF_ORDER] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 50:0-53:2 -/ +@[global_simps, irreducible] +def P256_HALF_ORDER : Array Std.U8 32#usize := + Array.make 32#usize [ + 127#u8, 255#u8, 255#u8, 255#u8, 128#u8, 0#u8, 0#u8, 0#u8, 127#u8, 255#u8, + 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 222#u8, 115#u8, 125#u8, + 86#u8, 211#u8, 139#u8, 207#u8, 66#u8, 121#u8, 220#u8, 229#u8, 97#u8, + 126#u8, 49#u8, 146#u8, 168#u8 + ] + +/-- [auths_signature_core::p256_signature_is_low_s]: loop 0: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 1:0-69:1 -/ +@[rust_loop] +def p256_signature_is_low_s_loop + (encoded : Array Std.U8 64#usize) (index : Std.Usize) : Result Bool := do + if index < 32#usize + then + let i ← 32#usize + index + let value ← Array.index_usize encoded i + let bound ← Array.index_usize P256_HALF_ORDER index + if value < bound + then ok true + else + if value > bound + then ok false + else + let index1 ← index + 1#usize + p256_signature_is_low_s_loop encoded index1 + else ok true +partial_fixpoint + +/-- [auths_signature_core::p256_signature_is_low_s]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 55:0-69:1 -/ +@[reducible] +def p256_signature_is_low_s + (encoded : Array Std.U8 64#usize) : Result Bool := do + p256_signature_is_low_s_loop encoded 0#usize + +/-- [auths_signature_core::ed25519_same_coordinate]: loop 0: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 76:4-83:1 -/ +@[rust_loop] +def ed25519_same_coordinate_loop + (encoded : Array Std.U8 32#usize) (expected : Array Std.U8 32#usize) + (index : Std.Usize) : + Result Bool + := do + if index < 31#usize + then + let i ← Array.index_usize encoded index + let i1 ← Array.index_usize expected index + if i != i1 + then ok false + else + let index1 ← index + 1#usize + ed25519_same_coordinate_loop encoded expected index1 + else ok true +partial_fixpoint + +/-- [auths_signature_core::ed25519_same_coordinate]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 71:0-83:1 -/ +def ed25519_same_coordinate + (encoded : Array Std.U8 32#usize) (expected : Array Std.U8 32#usize) : + Result Bool + := do + let i ← Array.index_usize encoded 31#usize + let i1 ← lift (i &&& 127#u8) + let i2 ← Array.index_usize expected 31#usize + let i3 ← lift (i2 &&& 127#u8) + if i1 != i3 + then ok false + else ed25519_same_coordinate_loop encoded expected 0#usize + +/-- [auths_signature_core::ED25519_WEAK_ZERO] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 85:0-88:2 -/ +@[global_simps, irreducible] +def ED25519_WEAK_ZERO : Array Std.U8 32#usize := Array.repeat 32#usize 0#u8 + +/-- [auths_signature_core::ED25519_WEAK_ONE] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 90:0-93:2 -/ +@[global_simps, irreducible] +def ED25519_WEAK_ONE : Array Std.U8 32#usize := + Array.make 32#usize [ + 1#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, + 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, + 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8 + ] + +/-- [auths_signature_core::ED25519_WEAK_MINUS_ONE] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 95:0-98:2 -/ +@[global_simps, irreducible] +def ED25519_WEAK_MINUS_ONE : Array Std.U8 32#usize := + Array.make 32#usize [ + 236#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, + 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, + 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, 255#u8, + 255#u8, 255#u8, 255#u8, 255#u8, 127#u8 + ] + +/-- [auths_signature_core::ED25519_WEAK_ORDER_EIGHT_A] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 100:0-103:2 -/ +@[global_simps, irreducible] +def ED25519_WEAK_ORDER_EIGHT_A : Array Std.U8 32#usize := + Array.make 32#usize [ + 199#u8, 23#u8, 106#u8, 112#u8, 61#u8, 77#u8, 216#u8, 79#u8, 186#u8, 60#u8, + 11#u8, 118#u8, 13#u8, 16#u8, 103#u8, 15#u8, 42#u8, 32#u8, 83#u8, 250#u8, + 44#u8, 57#u8, 204#u8, 198#u8, 78#u8, 199#u8, 253#u8, 119#u8, 146#u8, + 172#u8, 3#u8, 122#u8 + ] + +/-- [auths_signature_core::ED25519_WEAK_ORDER_EIGHT_B] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 105:0-108:2 -/ +@[global_simps, irreducible] +def ED25519_WEAK_ORDER_EIGHT_B : Array Std.U8 32#usize := + Array.make 32#usize [ + 38#u8, 232#u8, 149#u8, 143#u8, 194#u8, 178#u8, 39#u8, 176#u8, 69#u8, + 195#u8, 244#u8, 137#u8, 242#u8, 239#u8, 152#u8, 240#u8, 213#u8, 223#u8, + 172#u8, 5#u8, 211#u8, 198#u8, 51#u8, 57#u8, 177#u8, 56#u8, 2#u8, 136#u8, + 109#u8, 83#u8, 252#u8, 5#u8 + ] + +/-- [auths_signature_core::ed25519_has_small_order_coordinate]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 110:0-116:1 -/ +def ed25519_has_small_order_coordinate + (encoded : Array Std.U8 32#usize) : Result Bool := do + let b ← ed25519_same_coordinate encoded ED25519_WEAK_ZERO + if b + then ok true + else + let b1 ← ed25519_same_coordinate encoded ED25519_WEAK_ONE + if b1 + then ok true + else + let b2 ← ed25519_same_coordinate encoded ED25519_WEAK_MINUS_ONE + if b2 + then ok true + else + let b3 ← ed25519_same_coordinate encoded ED25519_WEAK_ORDER_EIGHT_A + if b3 + then ok true + else ed25519_same_coordinate encoded ED25519_WEAK_ORDER_EIGHT_B + +/-- [auths_signature_core::ed25519_signature_r_is_allowed]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 118:0-124:1 -/ +def ed25519_signature_r_is_allowed + (encoded : Array Std.U8 64#usize) : Result Bool := do + let s ← + core.array.Array.index (core.ops.index.IndexSlice + (core.slice.index.SliceIndexRangeToUsizeSlice Std.U8)) encoded + { «end» := 32#usize } + let r ← core.array.TryFromSharedArraySlice.try_from 32#usize s + match r with + | core.result.Result.Ok r1 => + let b ← ed25519_point_encoding_is_canonical r1 + if b + then let b1 ← ed25519_has_small_order_coordinate r1 + ok (¬ b1) + else ok false + | core.result.Result.Err _ => ok false + +/-- [auths_signature_core::decode_ed25519_point]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 203:0-205:1 -/ +def decode_ed25519_point + (bytes : Array Std.U8 32#usize) : + Result (Option ed25519_dalek.verifying.VerifyingKey) + := do + let r ← ed25519_dalek.verifying.VerifyingKey.from_bytes bytes + core.result.Result.ok r + +/-- [auths_signature_core::decode_ed25519_key::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::decode_ed25519_key::closure}::call_once]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 212:35-212:74 -/ +def + decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once + (c : decode_ed25519_key.closure) (tupled_args : Array Std.U8 32#usize) : + Result (Option ed25519_dalek.verifying.VerifyingKey) + := do + decode_ed25519_point tupled_args + +/-- Trait implementation: [auths_signature_core::decode_ed25519_key::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::decode_ed25519_key::closure}] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 212:35-212:74 -/ +@[reducible] +def + decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + : core.ops.function.FnOnce decode_ed25519_key.closure (Array Std.U8 32#usize) + (Option ed25519_dalek.verifying.VerifyingKey) := { + call_once := + decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once +} + +/-- [auths_signature_core::ed25519_key_encoding]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 182:0-190:1 -/ +def ed25519_key_encoding + (bytes : Slice Std.U8) : + Result (core.result.Result (Array Std.U8 32#usize) Ed25519Error) + := do + let r ← core.array.TryFromSharedArraySlice.try_from 32#usize bytes + match r with + | core.result.Result.Ok bytes1 => + let b ← ed25519_point_encoding_is_canonical bytes1 + if b + then ok (core.result.Result.Ok bytes1) + else ok (core.result.Result.Err Ed25519Error.InvalidKey) + | core.result.Result.Err _ => + ok (core.result.Result.Err Ed25519Error.InvalidKey) + +/-- [auths_signature_core::decode_ed25519_key_with]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 192:0-201:1 -/ +def decode_ed25519_key_with + {K : Type} {D : Type} (coreopsfunctionFnOnceDTupleShared0ArrayU832OptionInst + : core.ops.function.FnOnce D (Array Std.U8 32#usize) (Option K)) + (bytes : Slice Std.U8) (decode : D) : + Result (core.result.Result K Ed25519Error) + := do + let r ← ed25519_key_encoding bytes + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let o ← + coreopsfunctionFnOnceDTupleShared0ArrayU832OptionInst.call_once decode + val + match o with + | none => ok (core.result.Result.Err Ed25519Error.InvalidKey) + | some key => ok (core.result.Result.Ok key) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + K (core.convert.FromSame Ed25519Error) residual + +/-- [auths_signature_core::decode_ed25519_key]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 211:0-213:1 -/ +def decode_ed25519_key + (bytes : Slice Std.U8) : + Result (core.result.Result ed25519_dalek.verifying.VerifyingKey Ed25519Error) + := do + decode_ed25519_key_with + decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + bytes () + +/-- [auths_signature_core::validate_ed25519_key::{impl core::ops::function::FnOnce<(ed25519_dalek::verifying::VerifyingKey,), ()> for auths_signature_core::validate_ed25519_key::closure}::call_once]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 179:45-179:51 -/ +def + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple.call_once + (c : validate_ed25519_key.closure) + (tupled_args : ed25519_dalek.verifying.VerifyingKey) : + Result Unit + := do + ok () + +/-- Trait implementation: [auths_signature_core::validate_ed25519_key::{impl core::ops::function::FnOnce<(ed25519_dalek::verifying::VerifyingKey,), ()> for auths_signature_core::validate_ed25519_key::closure}] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 179:45-179:51 -/ +@[reducible] +def + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple + : core.ops.function.FnOnce validate_ed25519_key.closure + ed25519_dalek.verifying.VerifyingKey Unit := { + call_once := + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple.call_once +} + +/-- [auths_signature_core::validate_ed25519_key]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 178:0-180:1 + Visibility: public -/ +def validate_ed25519_key + (verification_key : Slice Std.U8) : + Result (core.result.Result Unit Ed25519Error) + := do + let r ← decode_ed25519_key verification_key + core.result.Result.map + validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple + r () + +/-- [auths_signature_core::verify_ed25519_with]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 215:0-242:1 -/ +def verify_ed25519_with + {K : Type} {D : Type} {V : Type} + (coreopsfunctionFnOnceDTupleShared0ArrayU832OptionInst : + core.ops.function.FnOnce D (Array Std.U8 32#usize) (Option K)) + (coreopsfunctionFnOnceVTupleShared0KShared1SliceU8Shared2ArrayU864BoolInst : + core.ops.function.FnOnce V (K × (Slice Std.U8) × (Array Std.U8 64#usize)) + Bool) (bytes : Slice Std.U8) (message : Slice Std.U8) + (signature : Slice Std.U8) (decode : D) (verify : V) : + Result (core.result.Result Unit Ed25519Error) + := do + let r ← ed25519_key_encoding bytes + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let o ← + coreopsfunctionFnOnceDTupleShared0ArrayU832OptionInst.call_once decode + val + match o with + | none => ok (core.result.Result.Err Ed25519Error.InvalidKey) + | some key => + let r1 ← core.array.TryFromSharedArraySlice.try_from 64#usize signature + match r1 with + | core.result.Result.Ok signature1 => + let b ← ed25519_has_small_order_coordinate val + if b + then ok (core.result.Result.Err Ed25519Error.VerificationFailed) + else + let b1 ← ed25519_signature_r_is_allowed signature1 + if b1 + then + let b2 ← + coreopsfunctionFnOnceVTupleShared0KShared1SliceU8Shared2ArrayU864BoolInst.call_once + verify (key, message, signature1) + if b2 + then ok (core.result.Result.Ok ()) + else ok (core.result.Result.Err Ed25519Error.VerificationFailed) + else ok (core.result.Result.Err Ed25519Error.VerificationFailed) + | core.result.Result.Err _ => + ok (core.result.Result.Err Ed25519Error.InvalidSignatureEncoding) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame Ed25519Error) residual + +/-- [auths_signature_core::verify_ed25519_equation]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 244:0-247:1 -/ +def verify_ed25519_equation + (key : ed25519_dalek.verifying.VerifyingKey) (message : Slice Std.U8) + (signature : Array Std.U8 64#usize) : + Result Bool + := do + let s ← ed25519.Signature.from_bytes signature + let r ← ed25519_dalek.verifying.VerifyingKey.verify_strict key message s + core.result.Result.is_ok r + +/-- [auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ ed25519_dalek::verifying::VerifyingKey, &'_ [u8], &'_ [u8; 64usize]), bool> for auths_signature_core::verify_ed25519::closure#1}::call_once]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 271:8-271:82 -/ +def + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool.call_once + (c : verify_ed25519.closure_1) + (tupled_args : (ed25519_dalek.verifying.VerifyingKey × (Slice Std.U8) × + (Array Std.U8 64#usize))) : + Result Bool + := do + let (key, message, signature) := tupled_args + verify_ed25519_equation key message signature + +/-- Trait implementation: [auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ ed25519_dalek::verifying::VerifyingKey, &'_ [u8], &'_ [u8; 64usize]), bool> for auths_signature_core::verify_ed25519::closure#1}] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 271:8-271:82 -/ +@[reducible] +def + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool + : core.ops.function.FnOnce verify_ed25519.closure_1 + (ed25519_dalek.verifying.VerifyingKey × (Slice Std.U8) × (Array Std.U8 + 64#usize)) Bool := { + call_once := + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool.call_once +} + +/-- [auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::verify_ed25519::closure}::call_once]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 270:8-270:47 -/ +def + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once + (c : verify_ed25519.closure) (tupled_args : Array Std.U8 32#usize) : + Result (Option ed25519_dalek.verifying.VerifyingKey) + := do + decode_ed25519_point tupled_args + +/-- Trait implementation: [auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::verify_ed25519::closure}] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 270:8-270:47 -/ +@[reducible] +def + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + : core.ops.function.FnOnce verify_ed25519.closure (Array Std.U8 32#usize) + (Option ed25519_dalek.verifying.VerifyingKey) := { + call_once := + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once +} + +/-- [auths_signature_core::verify_ed25519]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 261:0-273:1 + Visibility: public -/ +def verify_ed25519 + (verification_key : Slice Std.U8) (message : Slice Std.U8) + (signature : Slice Std.U8) : + Result (core.result.Result Unit Ed25519Error) + := do + verify_ed25519_with + verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey + verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool + verification_key message signature () () + +/-- [auths_signature_core::decode_p256_key_with]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 320:0-328:1 -/ +def decode_p256_key_with + {T : Type} {Clause0_Key : Type} {Clause0_Signature : Type} (P256PrimitiveInst + : P256Primitive T Clause0_Key Clause0_Signature) (bytes : Slice Std.U8) : + Result (core.result.Result Clause0_Key P256Error) + := do + let b ← p256_key_encoding_is_canonical bytes + if b + then + let o ← P256PrimitiveInst.decode bytes + match o with + | none => ok (core.result.Result.Err P256Error.InvalidKey) + | some key => ok (core.result.Result.Ok key) + else ok (core.result.Result.Err P256Error.InvalidKey) + +/-- [auths_signature_core::verify_p256_sha256_with]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 346:0-369:1 -/ +def verify_p256_sha256_with + {T : Type} {Clause0_Key : Type} {Clause0_Signature : Type} (P256PrimitiveInst + : P256Primitive T Clause0_Key Clause0_Signature) (bytes : Slice Std.U8) + (message : Slice Std.U8) (signature : Slice Std.U8) : + Result (core.result.Result Unit P256Error) + := do + let r ← decode_p256_key_with P256PrimitiveInst bytes + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let r1 ← + core.array.TryFromArrayCopySlice.try_from 64#usize core.marker.CopyU8 + signature + match r1 with + | core.result.Result.Ok signature1 => + let o ← P256PrimitiveInst.parse signature1 + match o with + | none => ok (core.result.Result.Err P256Error.InvalidSignatureEncoding) + | some parsed => + let b ← p256_signature_is_low_s signature1 + if b + then + let b1 ← P256PrimitiveInst.verify val message parsed + if b1 + then ok (core.result.Result.Ok ()) + else ok (core.result.Result.Err P256Error.VerificationFailed) + else ok (core.result.Result.Err P256Error.VerificationFailed) + | core.result.Result.Err _ => + ok (core.result.Result.Err P256Error.InvalidSignatureEncoding) + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + Unit (core.convert.FromSame P256Error) residual + +end auths_signature_core diff --git a/formal/qualification/aeneas/generated/signature/FunsExternal.lean b/formal/qualification/aeneas/generated/signature/FunsExternal.lean new file mode 100644 index 000000000..cb3a16683 --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/FunsExternal.lean @@ -0,0 +1,21 @@ +-- REVIEWED TRANSPARENT STANDARD RESULT MODEL AND EXPLICIT FOREIGN INTERFACE. +import qualification.aeneas.generated.signature.Types +import qualification.aeneas.generated.codec.FunsExternal + +open Aeneas Aeneas.Std Result + +def core.result.Result.ok {T E : Type} (value : core.result.Result T E) : Result (Option T) := + Aeneas.Std.Result.ok (match value with | .Ok value => some value | .Err _ => none) + +def ed25519.Signature.from_bytes [P : Auths.Crypto.Ed25519Primitives] + (bytes : Array Std.U8 64#usize) : Result ed25519.Signature := P.signatureFromBytes bytes + +def ed25519_dalek.verifying.VerifyingKey.from_bytes [P : Auths.Crypto.Ed25519Primitives] + (bytes : Array Std.U8 32#usize) : + Result (core.result.Result ed25519_dalek.verifying.VerifyingKey signature.error.Error) := + P.decode bytes + +def ed25519_dalek.verifying.VerifyingKey.verify_strict [P : Auths.Crypto.Ed25519Primitives] + (key : ed25519_dalek.verifying.VerifyingKey) (message : Slice Std.U8) + (encodedSignature : ed25519.Signature) : Result (core.result.Result Unit signature.error.Error) := + P.verifyStrict key message encodedSignature diff --git a/formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean new file mode 100644 index 000000000..5c6f6276a --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean @@ -0,0 +1,65 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.signature.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open auths_signature_core + +/-- [core::result::{core::result::Result}::ok]: + Source: '/rustc/library/core/src/result.rs', lines 708:4-711:28 + Name pattern: [core::result::{core::result::Result<@T, @E>}::ok] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::ok"] +axiom core.result.Result.ok + {T : Type} {E : Type} : core.result.Result T E → Result (Option T) + +/-- [core::result::{core::result::Result}::map]: + Source: '/rustc/library/core/src/result.rs', lines 831:4-833:53 + Name pattern: [core::result::{core::result::Result<@T, @E>}::map] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::map"] +axiom core.result.Result.map + {T : Type} {E : Type} {U : Type} {F : Type} (opsfunctionFnOnceFTupleTUInst : + core.ops.function.FnOnce F T U) : + core.result.Result T E → F → Result (core.result.Result U E) + +/-- [ed25519::{ed25519::Signature}::from_bytes]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-2.2.3/src/lib.rs', lines 313:4-313:53 + Name pattern: [ed25519::{ed25519::Signature}::from_bytes] + Visibility: public -/ +@[rust_fun "ed25519::{ed25519::Signature}::from_bytes"] +axiom ed25519.Signature.from_bytes + : Array Std.U8 64#usize → Result ed25519.Signature + +/-- [ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::from_bytes]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-dalek-2.2.0/src/verifying.rs', lines 165:4-165:94 + Name pattern: [ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::from_bytes] + Visibility: public -/ +@[rust_fun + "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::from_bytes"] +axiom ed25519_dalek.verifying.VerifyingKey.from_bytes + : + Array Std.U8 32#usize → Result (core.result.Result + ed25519_dalek.verifying.VerifyingKey signature.error.Error) + +/-- [ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::verify_strict]: + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-dalek-2.2.0/src/verifying.rs', lines 357:4-361:35 + Name pattern: [ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::verify_strict] + Visibility: public -/ +@[rust_fun + "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::verify_strict"] +axiom ed25519_dalek.verifying.VerifyingKey.verify_strict + : + ed25519_dalek.verifying.VerifyingKey → Slice Std.U8 → ed25519.Signature + → Result (core.result.Result Unit signature.error.Error) + diff --git a/formal/qualification/aeneas/generated/signature/Types.lean b/formal/qualification/aeneas/generated/signature/Types.lean new file mode 100644 index 000000000..5133fa7bd --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/Types.lean @@ -0,0 +1,65 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: type definitions +import Aeneas +import Auths.Support.Discriminant +import qualification.aeneas.generated.signature.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace auths_signature_core + +/-- [auths_signature_core::Ed25519Error] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 128:0-135:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive Ed25519Error where +| InvalidKey : Ed25519Error +| InvalidSignatureEncoding : Ed25519Error +| VerificationFailed : Ed25519Error + +/-- [auths_signature_core::P256Error] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 151:0-159:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive P256Error where +| InvalidKey : P256Error +| InvalidSignatureEncoding : P256Error +| VerificationFailed : P256Error + +/-- [auths_signature_core::decode_ed25519_key::closure] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 212:35-212:74 -/ +@[reducible] +def decode_ed25519_key.closure := Unit + +/-- [auths_signature_core::validate_ed25519_key::closure] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 179:45-179:51 -/ +@[reducible] +def validate_ed25519_key.closure := Unit + +/-- [auths_signature_core::verify_ed25519::closure#1] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 271:8-271:82 -/ +@[reducible] +def verify_ed25519.closure_1 := Unit + +/-- [auths_signature_core::verify_ed25519::closure] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 270:8-270:47 -/ +@[reducible] +def verify_ed25519.closure := Unit + +/-- Trait declaration: [auths_signature_core::P256Primitive] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 295:0-301:1 -/ +structure P256Primitive (Self : Type) (Self_Key : Type) (Self_Signature : Type) + where + decode : Slice Std.U8 → Result (Option Self_Key) + parse : Array Std.U8 64#usize → Result (Option Self_Signature) + verify : Self_Key → Slice Std.U8 → Self_Signature → Result Bool + +end auths_signature_core diff --git a/formal/qualification/aeneas/generated/signature/TypesExternal.lean b/formal/qualification/aeneas/generated/signature/TypesExternal.lean new file mode 100644 index 000000000..84812a9a1 --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/TypesExternal.lean @@ -0,0 +1,6 @@ +-- REVIEWED FOREIGN TYPE INTERFACE. NO GLOBAL INSTANCE OR AXIOM. +import Auths.Crypto.NativePrimitives + +abbrev ed25519.Signature [P : Auths.Crypto.Ed25519Primitives] := P.Signature +abbrev ed25519_dalek.verifying.VerifyingKey [P : Auths.Crypto.Ed25519Primitives] := P.Key +abbrev signature.error.Error [P : Auths.Crypto.Ed25519Primitives] := P.Error diff --git a/formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean new file mode 100644 index 000000000..f3fcfc183 --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean @@ -0,0 +1,36 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature_core]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [ed25519::Signature] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-2.2.3/src/lib.rs', lines 303:0-303:20 + Name pattern: [ed25519::Signature] + Visibility: public -/ +@[rust_type "ed25519::Signature"] +axiom ed25519.Signature : Type + +/-- [ed25519_dalek::verifying::VerifyingKey] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-dalek-2.2.0/src/verifying.rs', lines 63:0-63:23 + Name pattern: [ed25519_dalek::verifying::VerifyingKey] + Visibility: public -/ +@[rust_type "ed25519_dalek::verifying::VerifyingKey"] +axiom ed25519_dalek.verifying.VerifyingKey : Type + +/-- [signature::error::Error] + Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/signature-2.2.0/src/error.rs', lines 26:0-26:16 + Name pattern: [signature::error::Error] + Visibility: public -/ +@[rust_type "signature::error::Error"] +axiom signature.error.Error : Type + diff --git a/formal/qualification/aeneas/generated/signature/translation.json b/formal/qualification/aeneas/generated/signature/translation.json new file mode 100644 index 000000000..9c48a0b9f --- /dev/null +++ b/formal/qualification/aeneas/generated/signature/translation.json @@ -0,0 +1,786 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_signature_core", + "functions": [ + { + "def_id": 38, + "lean_name": "auths_signature_core.core.result.Result.ok", + "lean_file": "qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::ok", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 708, + "end_line": 711 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 5, + "lean_name": "auths_signature_core.core.result.Result.map", + "lean_file": "qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::map", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 831, + "end_line": 833 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 39, + "lean_name": "auths_signature_core.ed25519.Signature.from_bytes", + "lean_file": "qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "rust_name": "ed25519::{ed25519::Signature}::from_bytes", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-2.2.3/src/lib.rs", + "begin_line": 313, + "end_line": 313 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 37, + "lean_name": "auths_signature_core.ed25519_dalek.verifying.VerifyingKey.from_bytes", + "lean_file": "qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "rust_name": "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::from_bytes", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-dalek-2.2.0/src/verifying.rs", + "begin_line": 165, + "end_line": 165 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 40, + "lean_name": "auths_signature_core.ed25519_dalek.verifying.VerifyingKey.verify_strict", + "lean_file": "qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "rust_name": "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::verify_strict", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-dalek-2.2.0/src/verifying.rs", + "begin_line": 357, + "end_line": 361 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 28, + "lean_name": "auths_signature_core.ed25519_point_encoding_is_canonical_loop", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_point_encoding_is_canonical", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 27, + "end_line": 30 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_signature_core.ed25519_point_encoding_is_canonical" + }, + { + "def_id": 28, + "lean_name": "auths_signature_core.ed25519_point_encoding_is_canonical", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_point_encoding_is_canonical", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 17, + "end_line": 39 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "auths_signature_core.p256_key_encoding_is_canonical", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::p256_key_encoding_is_canonical", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 42, + "end_line": 47 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 10, + "lean_name": "auths_signature_core.p256_signature_is_low_s_loop", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::p256_signature_is_low_s", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 1, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_signature_core.p256_signature_is_low_s" + }, + { + "def_id": 10, + "lean_name": "auths_signature_core.p256_signature_is_low_s", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::p256_signature_is_low_s", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 55, + "end_line": 69 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 30, + "lean_name": "auths_signature_core.ed25519_same_coordinate_loop", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_same_coordinate", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 76, + "end_line": 83 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "auths_signature_core.ed25519_same_coordinate" + }, + { + "def_id": 30, + "lean_name": "auths_signature_core.ed25519_same_coordinate", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_same_coordinate", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 71, + "end_line": 83 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "auths_signature_core.ed25519_has_small_order_coordinate", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_has_small_order_coordinate", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 110, + "end_line": 116 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 15, + "lean_name": "auths_signature_core.ed25519_signature_r_is_allowed", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_signature_r_is_allowed", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 118, + "end_line": 124 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 26, + "lean_name": "auths_signature_core.decode_ed25519_point", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::decode_ed25519_point", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 203, + "end_line": 205 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 32, + "lean_name": "auths_signature_core.decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::decode_ed25519_key::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::decode_ed25519_key::closure}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 212, + "end_line": 212 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 13, + "lean_name": "auths_signature_core.ed25519_key_encoding", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ed25519_key_encoding", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 182, + "end_line": 190 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "auths_signature_core.decode_ed25519_key_with", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::decode_ed25519_key_with", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 192, + "end_line": 201 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 4, + "lean_name": "auths_signature_core.decode_ed25519_key", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::decode_ed25519_key", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 211, + "end_line": 213 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "auths_signature_core.validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple.call_once", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::validate_ed25519_key::{impl core::ops::function::FnOnce<(ed25519_dalek::verifying::VerifyingKey,), ()> for auths_signature_core::validate_ed25519_key::closure}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 179, + "end_line": 179 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "auths_signature_core.validate_ed25519_key", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::validate_ed25519_key", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 178, + "end_line": 180 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "auths_signature_core.verify_ed25519_with", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519_with", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 215, + "end_line": 242 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 27, + "lean_name": "auths_signature_core.verify_ed25519_equation", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519_equation", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 244, + "end_line": 247 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 12, + "lean_name": "auths_signature_core.verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool.call_once", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ ed25519_dalek::verifying::VerifyingKey, &'_ [u8], &'_ [u8; 64usize]), bool> for auths_signature_core::verify_ed25519::closure#1}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 271, + "end_line": 271 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 11, + "lean_name": "auths_signature_core.verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey.call_once", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::verify_ed25519::closure}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 270, + "end_line": 270 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "auths_signature_core.verify_ed25519", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 261, + "end_line": 273 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "auths_signature_core.decode_p256_key_with", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::decode_p256_key_with", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 320, + "end_line": 328 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "auths_signature_core.verify_p256_sha256_with", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_p256_sha256_with", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 346, + "end_line": 369 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 15, + "lean_name": "auths_signature_core.ed25519.Signature", + "lean_file": "qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "rust_name": "ed25519::Signature", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-2.2.3/src/lib.rs", + "begin_line": 303, + "end_line": 303 + } + }, + { + "def_id": 4, + "lean_name": "auths_signature_core.ed25519_dalek.verifying.VerifyingKey", + "lean_file": "qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "rust_name": "ed25519_dalek::verifying::VerifyingKey", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ed25519-dalek-2.2.0/src/verifying.rs", + "begin_line": 63, + "end_line": 63 + } + }, + { + "def_id": 14, + "lean_name": "auths_signature_core.signature.error.Error", + "lean_file": "qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "rust_name": "signature::error::Error", + "is_local": false, + "source": { + "file": "/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/signature-2.2.0/src/error.rs", + "begin_line": 26, + "end_line": 26 + } + }, + { + "def_id": 1, + "lean_name": "auths_signature_core.Ed25519Error", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::Ed25519Error", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 128, + "end_line": 135 + } + }, + { + "def_id": 7, + "lean_name": "auths_signature_core.P256Error", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::P256Error", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 151, + "end_line": 159 + } + }, + { + "def_id": 12, + "lean_name": "auths_signature_core.decode_ed25519_key.closure", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::decode_ed25519_key::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 212, + "end_line": 212 + } + }, + { + "def_id": 6, + "lean_name": "auths_signature_core.validate_ed25519_key.closure", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::validate_ed25519_key::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 179, + "end_line": 179 + } + }, + { + "def_id": 5, + "lean_name": "auths_signature_core.verify_ed25519.closure_1", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::verify_ed25519::closure#1", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 271, + "end_line": 271 + } + }, + { + "def_id": 2, + "lean_name": "auths_signature_core.verify_ed25519.closure", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::verify_ed25519::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 270, + "end_line": 270 + } + } + ], + "globals": [ + { + "def_id": 6, + "lean_name": "auths_signature_core.P256_KEY_LEN", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::P256_KEY_LEN", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 14, + "end_line": 14 + }, + "can_fail": false + }, + { + "def_id": 0, + "lean_name": "auths_signature_core.P256_HALF_ORDER", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::P256_HALF_ORDER", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 50, + "end_line": 53 + }, + "can_fail": false + }, + { + "def_id": 12, + "lean_name": "auths_signature_core.ED25519_WEAK_ZERO", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ED25519_WEAK_ZERO", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 85, + "end_line": 88 + }, + "can_fail": false + }, + { + "def_id": 13, + "lean_name": "auths_signature_core.ED25519_WEAK_ONE", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ED25519_WEAK_ONE", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 90, + "end_line": 93 + }, + "can_fail": false + }, + { + "def_id": 14, + "lean_name": "auths_signature_core.ED25519_WEAK_MINUS_ONE", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ED25519_WEAK_MINUS_ONE", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 95, + "end_line": 98 + }, + "can_fail": false + }, + { + "def_id": 15, + "lean_name": "auths_signature_core.ED25519_WEAK_ORDER_EIGHT_A", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ED25519_WEAK_ORDER_EIGHT_A", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 100, + "end_line": 103 + }, + "can_fail": false + }, + { + "def_id": 16, + "lean_name": "auths_signature_core.ED25519_WEAK_ORDER_EIGHT_B", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::ED25519_WEAK_ORDER_EIGHT_B", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 105, + "end_line": 108 + }, + "can_fail": false + } + ], + "trait_decls": [ + { + "def_id": 2, + "lean_name": "auths_signature_core.P256Primitive", + "lean_file": "qualification/aeneas/generated/signature/Types.lean", + "rust_name": "auths_signature_core::P256Primitive", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 295, + "end_line": 301 + } + } + ], + "trait_impls": [ + { + "def_id": 14, + "lean_name": "auths_signature_core.decode_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::decode_ed25519_key::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::decode_ed25519_key::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 212, + "end_line": 212 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 2, + "lean_name": "auths_signature_core.validate_ed25519_key.closure.Insts.CoreOpsFunctionFnOnceTupleVerifyingKeyTuple", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::validate_ed25519_key::{impl core::ops::function::FnOnce<(ed25519_dalek::verifying::VerifyingKey,), ()> for auths_signature_core::validate_ed25519_key::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 179, + "end_line": 179 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 1, + "lean_name": "auths_signature_core.verify_ed25519.closure_1.Insts.CoreOpsFunctionFnOnceTupleSharedVerifyingKeySharedSliceU8SharedArrayU864Bool", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ ed25519_dalek::verifying::VerifyingKey, &'_ [u8], &'_ [u8; 64usize]), bool> for auths_signature_core::verify_ed25519::closure#1}", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 271, + "end_line": 271 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 0, + "lean_name": "auths_signature_core.verify_ed25519.closure.Insts.CoreOpsFunctionFnOnceTupleSharedArrayU832OptionVerifyingKey", + "lean_file": "qualification/aeneas/generated/signature/Funs.lean", + "rust_name": "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::verify_ed25519::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 270, + "end_line": 270 + }, + "impl_trait_def_id": 0, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/generated/standard/CheckedResult.lean b/formal/qualification/aeneas/generated/standard/CheckedResult.lean new file mode 100644 index 000000000..95fcfd626 --- /dev/null +++ b/formal/qualification/aeneas/generated/standard/CheckedResult.lean @@ -0,0 +1,9 @@ +-- Exact checked conversion and Result projection shared by translation units. +import Aeneas +open Aeneas Aeneas.Std Result + +def U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from (value : Std.Usize) := + core.num.tryFromUScalar .U64 value + +def core.result.Result.unwrap_or {T E : Type} (value : core.result.Result T E) (fallback : T) : + Result T := ok (match value with | .Ok value => value | .Err _ => fallback) diff --git a/formal/qualification/aeneas/generated/status_selection/Funs.lean b/formal/qualification/aeneas/generated/status_selection/Funs.lean new file mode 100644 index 000000000..2d525a98c --- /dev/null +++ b/formal/qualification/aeneas/generated/status_selection/Funs.lean @@ -0,0 +1,1509 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_registries]: function definitions +import Aeneas +import qualification.aeneas.generated.status_selection.Types +import qualification.aeneas.generated.status_selection.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +namespace AuthsStatusSelection + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq + (self : auths_model.TrustAnchorId) (other : auths_model.TrustAnchorId) : + Result Bool + := do + alloc.string.String.Insts.CoreCmpPartialEqString.eq self other + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId : + core.cmp.PartialEq auths_model.TrustAnchorId auths_model.TrustAnchorId := { + eq := auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId +} + +/-- [auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}::assert_fields_are_eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:31-119:33 + Name pattern: [auths_model::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::Eq}::assert_fields_are_eq"] +def auths_model.TrustAnchorId.Insts.CoreCmpEq.assert_fields_are_eq + (self : auths_model.TrustAnchorId) : Result Unit := do + ok () + +/-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:31-119:33 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def auths_model.TrustAnchorId.Insts.CoreCmpEq : core.cmp.Eq + auths_model.TrustAnchorId := { + partialEqInst := + auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId + assert_fields_are_eq := + auths_model.TrustAnchorId.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::StatusMethodId}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq + (self : auths_model.StatusMethodId) (other : auths_model.StatusMethodId) : + Result Bool + := do + alloc.string.String.Insts.CoreCmpPartialEqString.eq self other + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::StatusMethodId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:35-119:44 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId : + core.cmp.PartialEq auths_model.StatusMethodId auths_model.StatusMethodId := { + eq := auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId +} + +/-- [auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp + (self : auths_model.TrustAnchorId) (other : auths_model.TrustAnchorId) : + Result Ordering + := do + alloc.string.String.Insts.CoreCmpOrd.cmp self other + +/-- [auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}::partial_cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 119:51-119:61 + Name pattern: [auths_model::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialOrd}::partial_cmp"] +def auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId.partial_cmp + (self : auths_model.TrustAnchorId) (other : auths_model.TrustAnchorId) : + Result (Option Ordering) + := do + let o ← auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:51-119:61 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +impl_def auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId : + core.cmp.PartialOrd auths_model.TrustAnchorId auths_model.TrustAnchorId := { + partialEqInst := + auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId + partial_cmp := + auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId.partial_cmp + lt := core.cmp.PartialOrd.lt.default + auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId + gt := core.cmp.PartialOrd.gt.default + auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId +} + +/-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 119:46-119:49 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +impl_def auths_model.TrustAnchorId.Insts.CoreCmpOrd : core.cmp.Ord + auths_model.TrustAnchorId := { + eqInst := auths_model.TrustAnchorId.Insts.CoreCmpEq + partialOrdInst := + auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId + cmp := auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp + min := core.cmp.Ord.min.trait_default + auths_model.TrustAnchorId.Insts.CoreCmpOrd +} + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalId}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 153:27-153:36 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq + (self : auths_model.PrincipalId) (other : auths_model.PrincipalId) : + Result Bool + := do + alloc.string.String.Insts.CoreCmpPartialEqString.eq self other + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalId}] + Source: 'core/crates/auths-model/src/lib.rs', lines 153:27-153:36 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId : + core.cmp.PartialEq auths_model.PrincipalId auths_model.PrincipalId := { + eq := auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId +} + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 229:33-229:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq + (self : auths_model.Digest) (other : auths_model.Digest) : Result Bool := do + core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 self other + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::GrantId}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 248:41-248:50 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.GrantId.Insts.CoreCmpPartialEqGrantId.eq + (self : auths_model.GrantId) (other : auths_model.GrantId) : + Result Bool + := do + auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq self other + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:33-338:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp.eq + (self : auths_model.Timestamp) (other : auths_model.Timestamp) : + Result Bool + := do + ok (self = other) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:33-338:42 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp : + core.cmp.PartialEq auths_model.Timestamp auths_model.Timestamp := { + eq := auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp +} + +/-- [auths_model::{impl core::cmp::Eq for auths_model::Timestamp}::assert_fields_are_eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:29-338:31 + Name pattern: [auths_model::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::Eq}::assert_fields_are_eq"] +def auths_model.Timestamp.Insts.CoreCmpEq.assert_fields_are_eq + (self : auths_model.Timestamp) : Result Unit := do + ok () + +/-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:29-338:31 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def auths_model.Timestamp.Insts.CoreCmpEq : core.cmp.Eq auths_model.Timestamp + := { + partialEqInst := auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp + assert_fields_are_eq := + auths_model.Timestamp.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- [auths_model::{impl core::cmp::Ord for auths_model::Timestamp}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:44-338:47 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.Timestamp.Insts.CoreCmpOrd.cmp + (self : auths_model.Timestamp) (other : auths_model.Timestamp) : + Result Ordering + := do + ok (core.cmp.impls.OrdU64.cmp self other) + +/-- [auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}::partial_cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:49-338:59 + Name pattern: [auths_model::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialOrd}::partial_cmp"] +def auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp + (self : auths_model.Timestamp) (other : auths_model.Timestamp) : + Result (Option Ordering) + := do + let o ← auths_model.Timestamp.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:49-338:59 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +impl_def auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp : + core.cmp.PartialOrd auths_model.Timestamp auths_model.Timestamp := { + partialEqInst := auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp + partial_cmp := + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp + lt := core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp + gt := core.cmp.PartialOrd.gt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp +} + +/-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:44-338:47 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +impl_def auths_model.Timestamp.Insts.CoreCmpOrd : core.cmp.Ord + auths_model.Timestamp := { + eqInst := auths_model.Timestamp.Insts.CoreCmpEq + partialOrdInst := auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp + cmp := auths_model.Timestamp.Insts.CoreCmpOrd.cmp + min := core.cmp.Ord.min.trait_default auths_model.Timestamp.Insts.CoreCmpOrd +} + +/-- [auths_model::{auths_model::Timestamp}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 343:4-343:42 + Name pattern: [auths_model::{auths_model::Timestamp}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Timestamp}::new"] +def auths_model.Timestamp.new + (seconds : Std.U64) : Result auths_model.Timestamp := do + ok seconds + +/-- [auths_model::{auths_model::Timestamp}::get]: + Source: 'core/crates/auths-model/src/lib.rs', lines 348:4-348:33 + Name pattern: [auths_model::{auths_model::Timestamp}::get] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Timestamp}::get"] +def auths_model.Timestamp.get + (self : auths_model.Timestamp) : Result Std.U64 := do + ok self + +/-- [auths_model::{auths_model::FreshnessLimit}::get]: + Source: 'core/crates/auths-model/src/lib.rs', lines 978:4-978:33 + Name pattern: [auths_model::{auths_model::FreshnessLimit}::get] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::FreshnessLimit}::get"] +def auths_model.FreshnessLimit.get + (self : auths_model.FreshnessLimit) : Result Std.U64 := do + ok self + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalState}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2062:33-2062:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState.eq + (self : auths_model.PrincipalState) (other : auths_model.PrincipalState) : + Result Bool + := do + let self1 := read_discriminant self + let other1 := read_discriminant other + ok (self1 = other1) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalState}] + Source: 'core/crates/auths-model/src/lib.rs', lines 2062:33-2062:42 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState : + core.cmp.PartialEq auths_model.PrincipalState auths_model.PrincipalState := { + eq := auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState +} + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::GrantState}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2069:33-2069:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.GrantState.Insts.CoreCmpPartialEqGrantState.eq + (self : auths_model.GrantState) (other : auths_model.GrantState) : + Result Bool + := do + let self1 := read_discriminant self + let other1 := read_discriminant other + ok (self1 = other1) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::GrantState}] + Source: 'core/crates/auths-model/src/lib.rs', lines 2069:33-2069:42 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +impl_def auths_model.GrantState.Insts.CoreCmpPartialEqGrantState : + core.cmp.PartialEq auths_model.GrantState auths_model.GrantState := { + eq := auths_model.GrantState.Insts.CoreCmpPartialEqGrantState.eq + ne := core.cmp.PartialEq.ne.trait_default + auths_model.GrantState.Insts.CoreCmpPartialEqGrantState +} + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::method]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2137:4-2137:49 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::method] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::method"] +def auths_model.PrincipalStatusStatement.impl.method + (self : auths_model.PrincipalStatusStatement) : + Result auths_model.StatusMethodId + := do + ok self.method + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::principal]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2141:4-2141:49 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::principal] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::principal"] +def auths_model.PrincipalStatusStatement.impl.principal + (self : auths_model.PrincipalStatusStatement) : + Result auths_model.PrincipalId + := do + ok self.principal + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::state]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2145:4-2145:47 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::state] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::state"] +def auths_model.PrincipalStatusStatement.impl.state + (self : auths_model.PrincipalStatusStatement) : + Result auths_model.PrincipalState + := do + ok self.state + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::sequence]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2149:4-2149:39 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::sequence] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::sequence"] +def auths_model.PrincipalStatusStatement.impl.sequence + (self : auths_model.PrincipalStatusStatement) : Result Std.U64 := do + ok self.sequence + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::observed_at]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2153:4-2153:48 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::observed_at] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::observed_at"] +def auths_model.PrincipalStatusStatement.impl.observed_at + (self : auths_model.PrincipalStatusStatement) : + Result auths_model.Timestamp + := do + ok self.observed_at + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::valid_until]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2157:4-2157:48 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::valid_until] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::valid_until"] +def auths_model.PrincipalStatusStatement.impl.valid_until + (self : auths_model.PrincipalStatusStatement) : + Result auths_model.Timestamp + := do + ok self.valid_until + +/-- [auths_model::{auths_model::PrincipalStatusStatement}::issuer]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2161:4-2161:46 + Name pattern: [auths_model::{auths_model::PrincipalStatusStatement}::issuer] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusStatement}::issuer"] +def auths_model.PrincipalStatusStatement.impl.issuer + (self : auths_model.PrincipalStatusStatement) : + Result auths_model.PrincipalId + := do + ok self.issuer + +/-- [auths_model::{auths_model::SignedPrincipalStatus}::statement]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2185:4-2185:62 + Name pattern: [auths_model::{auths_model::SignedPrincipalStatus}::statement] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::SignedPrincipalStatus}::statement"] +def auths_model.SignedPrincipalStatus.impl.statement + (self : auths_model.SignedPrincipalStatus) : + Result auths_model.PrincipalStatusStatement + := do + ok self.statement + +/-- [auths_model::{auths_model::GrantStatusStatement}::method]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2252:4-2252:49 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::method] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::method"] +def auths_model.GrantStatusStatement.impl.method + (self : auths_model.GrantStatusStatement) : + Result auths_model.StatusMethodId + := do + ok self.method + +/-- [auths_model::{auths_model::GrantStatusStatement}::grant_id]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2256:4-2256:43 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::grant_id] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::grant_id"] +def auths_model.GrantStatusStatement.impl.grant_id + (self : auths_model.GrantStatusStatement) : Result auths_model.GrantId := do + ok self.grant_id + +/-- [auths_model::{auths_model::GrantStatusStatement}::state]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2260:4-2260:43 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::state] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::state"] +def auths_model.GrantStatusStatement.impl.state + (self : auths_model.GrantStatusStatement) : + Result auths_model.GrantState + := do + ok self.state + +/-- [auths_model::{auths_model::GrantStatusStatement}::sequence]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2264:4-2264:39 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::sequence] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::sequence"] +def auths_model.GrantStatusStatement.impl.sequence + (self : auths_model.GrantStatusStatement) : Result Std.U64 := do + ok self.sequence + +/-- [auths_model::{auths_model::GrantStatusStatement}::observed_at]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2268:4-2268:48 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::observed_at] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::observed_at"] +def auths_model.GrantStatusStatement.impl.observed_at + (self : auths_model.GrantStatusStatement) : + Result auths_model.Timestamp + := do + ok self.observed_at + +/-- [auths_model::{auths_model::GrantStatusStatement}::valid_until]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2272:4-2272:48 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::valid_until] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::valid_until"] +def auths_model.GrantStatusStatement.impl.valid_until + (self : auths_model.GrantStatusStatement) : + Result auths_model.Timestamp + := do + ok self.valid_until + +/-- [auths_model::{auths_model::GrantStatusStatement}::issuer]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2276:4-2276:46 + Name pattern: [auths_model::{auths_model::GrantStatusStatement}::issuer] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusStatement}::issuer"] +def auths_model.GrantStatusStatement.impl.issuer + (self : auths_model.GrantStatusStatement) : + Result auths_model.PrincipalId + := do + ok self.issuer + +/-- [auths_model::{auths_model::SignedGrantStatus}::statement]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2300:4-2300:58 + Name pattern: [auths_model::{auths_model::SignedGrantStatus}::statement] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::SignedGrantStatus}::statement"] +def auths_model.SignedGrantStatus.impl.statement + (self : auths_model.SignedGrantStatus) : + Result auths_model.GrantStatusStatement + := do + ok self.statement + +/-- [auths_model::{auths_model::StatusScopeAnchors}::contains]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2346:4-2346:58 + Name pattern: [auths_model::{auths_model::StatusScopeAnchors}::contains] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusScopeAnchors}::contains"] +def auths_model.StatusScopeAnchors.contains + (self : auths_model.StatusScopeAnchors) (anchor : auths_model.TrustAnchorId) + : + Result Bool + := do + let s := alloc.vec.Vec.deref self + let r ← + core.slice.Slice.binary_search auths_model.TrustAnchorId.Insts.CoreCmpOrd s + anchor + core.result.Result.is_ok r + +/-- [auths_model::{auths_model::TrustAnchor}::principal]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3565:4-3565:49 + Name pattern: [auths_model::{auths_model::TrustAnchor}::principal] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::TrustAnchor}::principal"] +def auths_model.TrustAnchor.impl.principal + (self : auths_model.TrustAnchor) : Result auths_model.PrincipalId := do + ok self.principal + +/-- [auths_model::{auths_model::TrustAnchor}::id]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3561:4-3561:44 + Name pattern: [auths_model::{auths_model::TrustAnchor}::id] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::TrustAnchor}::id"] +def auths_model.TrustAnchor.impl.id + (self : auths_model.TrustAnchor) : Result auths_model.TrustAnchorId := do + ok self.id + +/-- [auths_model::{auths_model::StatusScope}::covers]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2370:4-2370:76 + Name pattern: [auths_model::{auths_model::StatusScope}::covers] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusScope}::covers"] +def auths_model.StatusScope.covers + (self : auths_model.StatusScope) (issuer : auths_model.PrincipalId) + (anchor : auths_model.TrustAnchor) : + Result Bool + := do + match self with + | auths_model.StatusScope.OwnAnchor => + let pi ← auths_model.TrustAnchor.impl.principal anchor + auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq pi issuer + | auths_model.StatusScope.Anchors anchors => + let tai ← auths_model.TrustAnchor.impl.id anchor + auths_model.StatusScopeAnchors.contains anchors tai + | auths_model.StatusScope.AnyAnchor => ok true + +/-- [auths_model::{auths_model::StatusTrustRule}::issuer]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2483:4-2483:46 + Name pattern: [auths_model::{auths_model::StatusTrustRule}::issuer] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusTrustRule}::issuer"] +def auths_model.StatusTrustRule.impl.issuer + (self : auths_model.StatusTrustRule) : Result auths_model.PrincipalId := do + ok self.issuer + +/-- [auths_model::{auths_model::StatusTrustRule}::scope]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2471:4-2471:45 + Name pattern: [auths_model::{auths_model::StatusTrustRule}::scope] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusTrustRule}::scope"] +def auths_model.StatusTrustRule.impl.scope + (self : auths_model.StatusTrustRule) : Result auths_model.StatusScope := do + ok self.scope + +/-- [auths_model::status_issuer_in_scope]: loop 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 2395:4-2401:5 + Name pattern: [auths_model::status_issuer_in_scope] + Visibility: public -/ +@[rust_loop, rust_fun "auths_model::status_issuer_in_scope"] +def auths_model.status_issuer_in_scope_loop + (trust : Slice auths_model.StatusTrustRule) + (issuer : auths_model.PrincipalId) (anchor : auths_model.TrustAnchor) + (visible : Bool) (position : Std.Usize) : + Result Bool + := do + let i := Slice.len trust + if position < i + then + if visible + then + let rule ← Slice.index_usize trust position + let pi ← auths_model.StatusTrustRule.impl.issuer rule + let b ← + auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq pi issuer + let visible1 ← + if b + then + do + let ss ← auths_model.StatusTrustRule.impl.scope rule + auths_model.StatusScope.covers ss issuer anchor + else ok true + let position1 ← position + 1#usize + auths_model.status_issuer_in_scope_loop trust issuer anchor visible1 + position1 + else ok false + else ok visible +partial_fixpoint + +/-- [auths_model::status_issuer_in_scope]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2388:0-2392:9 + Name pattern: [auths_model::status_issuer_in_scope] + Visibility: public -/ +@[reducible, rust_fun "auths_model::status_issuer_in_scope"] +def auths_model.status_issuer_in_scope + (trust : Slice auths_model.StatusTrustRule) + (issuer : auths_model.PrincipalId) (anchor : auths_model.TrustAnchor) : + Result Bool + := do + auths_model.status_issuer_in_scope_loop trust issuer anchor true 0#usize + +/-- [auths_model::status_issuer_visible]: loop 0: + Source: 'core/crates/auths-model/src/lib.rs', lines 2430:12-2436:13 + Name pattern: [auths_model::status_issuer_visible] + Visibility: public -/ +@[rust_loop, rust_fun "auths_model::status_issuer_visible"] +def auths_model.status_issuer_visible_loop + (trust : Slice auths_model.StatusTrustRule) + (issuer : auths_model.PrincipalId) (visible : Bool) (position : Std.Usize) : + Result Bool + := do + let i := Slice.len trust + if position < i + then + if visible + then + let rule ← Slice.index_usize trust position + let pi ← auths_model.StatusTrustRule.impl.issuer rule + let b ← + auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq pi issuer + let visible1 ← + if b + then + do + let ss ← auths_model.StatusTrustRule.impl.scope rule + match ss with + | auths_model.StatusScope.OwnAnchor => ok false + | auths_model.StatusScope.Anchors _ => ok false + | auths_model.StatusScope.AnyAnchor => ok true + else ok true + let position1 ← position + 1#usize + auths_model.status_issuer_visible_loop trust issuer visible1 position1 + else ok false + else ok visible +partial_fixpoint + +/-- [auths_model::status_issuer_visible]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2420:0-2424:9 + Name pattern: [auths_model::status_issuer_visible] + Visibility: public -/ +@[rust_fun "auths_model::status_issuer_visible"] +def auths_model.status_issuer_visible + (trust : Slice auths_model.StatusTrustRule) + (issuer : auths_model.PrincipalId) (view : auths_model.StatusView) : + Result Bool + := do + match view with + | auths_model.StatusView.Anchor anchor => + auths_model.status_issuer_in_scope trust issuer anchor + | auths_model.StatusView.Approver => + auths_model.status_issuer_visible_loop trust issuer true 0#usize + +/-- [auths_model::{auths_model::StatusTrustRule}::method]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2477:4-2477:49 + Name pattern: [auths_model::{auths_model::StatusTrustRule}::method] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusTrustRule}::method"] +def auths_model.StatusTrustRule.impl.method + (self : auths_model.StatusTrustRule) : + Result auths_model.StatusMethodId + := do + ok self.method + +/-- [auths_model::{auths_model::StatusTrustRule}::sequence_floor]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2489:4-2489:45 + Name pattern: [auths_model::{auths_model::StatusTrustRule}::sequence_floor] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::StatusTrustRule}::sequence_floor"] +def auths_model.StatusTrustRule.impl.sequence_floor + (self : auths_model.StatusTrustRule) : Result Std.U64 := do + ok self.sequence_floor + +/-- [auths_model::{auths_model::PrincipalStatusSnapshot}::observed_at]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2603:4-2603:48 + Name pattern: [auths_model::{auths_model::PrincipalStatusSnapshot}::observed_at] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusSnapshot}::observed_at"] +def auths_model.PrincipalStatusSnapshot.impl.observed_at + (self : auths_model.PrincipalStatusSnapshot) : + Result auths_model.Timestamp + := do + ok self.observed_at + +/-- [auths_model::{auths_model::PrincipalStatusSnapshot}::valid_until]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2609:4-2609:48 + Name pattern: [auths_model::{auths_model::PrincipalStatusSnapshot}::valid_until] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusSnapshot}::valid_until"] +def auths_model.PrincipalStatusSnapshot.impl.valid_until + (self : auths_model.PrincipalStatusSnapshot) : + Result auths_model.Timestamp + := do + ok self.valid_until + +/-- [auths_model::{auths_model::PrincipalStatusSnapshot}::statements]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2615:4-2615:56 + Name pattern: [auths_model::{auths_model::PrincipalStatusSnapshot}::statements] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusSnapshot}::statements"] +def auths_model.PrincipalStatusSnapshot.impl.statements + (self : auths_model.PrincipalStatusSnapshot) : + Result (Slice auths_model.SignedPrincipalStatus) + := do + ok (alloc.vec.Vec.deref self.statements) + +/-- [auths_model::{auths_model::PrincipalStatusSnapshot}::trust]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2627:4-2627:45 + Name pattern: [auths_model::{auths_model::PrincipalStatusSnapshot}::trust] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::PrincipalStatusSnapshot}::trust"] +def auths_model.PrincipalStatusSnapshot.impl.trust + (self : auths_model.PrincipalStatusSnapshot) : + Result (Slice auths_model.StatusTrustRule) + := do + ok (alloc.vec.Vec.deref self.trust) + +/-- [auths_model::{auths_model::GrantStatusSnapshot}::observed_at]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2738:4-2738:48 + Name pattern: [auths_model::{auths_model::GrantStatusSnapshot}::observed_at] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusSnapshot}::observed_at"] +def auths_model.GrantStatusSnapshot.impl.observed_at + (self : auths_model.GrantStatusSnapshot) : Result auths_model.Timestamp := do + ok self.observed_at + +/-- [auths_model::{auths_model::GrantStatusSnapshot}::valid_until]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2744:4-2744:48 + Name pattern: [auths_model::{auths_model::GrantStatusSnapshot}::valid_until] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusSnapshot}::valid_until"] +def auths_model.GrantStatusSnapshot.impl.valid_until + (self : auths_model.GrantStatusSnapshot) : Result auths_model.Timestamp := do + ok self.valid_until + +/-- [auths_model::{auths_model::GrantStatusSnapshot}::statements]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2750:4-2750:52 + Name pattern: [auths_model::{auths_model::GrantStatusSnapshot}::statements] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusSnapshot}::statements"] +def auths_model.GrantStatusSnapshot.impl.statements + (self : auths_model.GrantStatusSnapshot) : + Result (Slice auths_model.SignedGrantStatus) + := do + ok (alloc.vec.Vec.deref self.statements) + +/-- [auths_model::{auths_model::GrantStatusSnapshot}::trust]: + Source: 'core/crates/auths-model/src/lib.rs', lines 2762:4-2762:45 + Name pattern: [auths_model::{auths_model::GrantStatusSnapshot}::trust] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::GrantStatusSnapshot}::trust"] +def auths_model.GrantStatusSnapshot.impl.trust + (self : auths_model.GrantStatusSnapshot) : + Result (Slice auths_model.StatusTrustRule) + := do + ok (alloc.vec.Vec.deref self.trust) + +/-- [auths_ports::{impl core::cmp::PartialEq for auths_ports::StatusDecision}::eq]: + Source: 'core/crates/auths-ports/src/lib.rs', lines 432:33-432:42 + Name pattern: [auths_ports::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_ports::{core::cmp::PartialEq}::eq"] +def auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq + (self : auths_ports.StatusDecision) (other : auths_ports.StatusDecision) : + Result Bool + := do + let self1 := read_discriminant self + let other1 := read_discriminant other + ok (self1 = other1) + +/-- [auths_ports::{auths_ports::StatusEvaluation}::new]: + Source: 'core/crates/auths-ports/src/lib.rs', lines 464:4-464:80 + Name pattern: [auths_ports::{auths_ports::StatusEvaluation}::new] + Visibility: public -/ +@[rust_fun "auths_ports::{auths_ports::StatusEvaluation}::new"] +def auths_ports.StatusEvaluation.new + (decision : auths_ports.StatusDecision) + (valid_through : auths_model.Timestamp) : + Result auths_ports.StatusEvaluation + := do + ok { decision, valid_through } + +/-- [auths_registries::{auths_registries::ExactStatusMethod}::freshness]: + Source: 'core/crates/auths-registries/src/lib.rs', lines 453:4-470:5 -/ +def ExactStatusMethod.freshness + (policy : auths_model.StatusPolicy) (observed_at : auths_model.Timestamp) + (valid_until : auths_model.Timestamp) + (evaluation_time : auths_model.Timestamp) : + Result auths_ports.StatusDecision + := do + match policy with + | auths_model.StatusPolicy.ExpiryOnly => ok auths_ports.StatusDecision.Active + | auths_model.StatusPolicy.SnapshotRequired _ max_age => + let b ← + core.cmp.PartialOrd.gt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp observed_at + evaluation_time + if b + then ok auths_ports.StatusDecision.Stale + else + let b1 ← + core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp valid_until + evaluation_time + if b1 + then ok auths_ports.StatusDecision.Stale + else + let i ← auths_model.Timestamp.get evaluation_time + let i1 ← auths_model.Timestamp.get observed_at + let i2 ← lift (core.num.U64.saturating_sub i i1) + let i3 ← auths_model.FreshnessLimit.get max_age + if i2 > i3 + then ok auths_ports.StatusDecision.Stale + else ok auths_ports.StatusDecision.Active + +/-- [auths_registries::status_sequence_floor]: loop 0: + Source: 'core/crates/auths-registries/src/lib.rs', lines 1:0-537:5 -/ +@[rust_loop] +def status_sequence_floor_loop + (rules : Slice auths_model.StatusTrustRule) + (method : auths_model.StatusMethodId) (issuer : auths_model.PrincipalId) + (found : Option Std.U64) (position : Std.Usize) : + Result (Option Std.U64) + := do + let i := Slice.len rules + if position < i + then + let b := core.option.Option.is_none found + if b + then + let rule ← Slice.index_usize rules position + let smi ← auths_model.StatusTrustRule.impl.method rule + let b1 ← + auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq smi + method + let found1 ← + if b1 + then + do + let pi ← auths_model.StatusTrustRule.impl.issuer rule + let b2 ← + auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq pi + issuer + if b2 + then + let i1 ← auths_model.StatusTrustRule.impl.sequence_floor rule + ok (some i1) + else ok found + else ok found + let position1 ← position + 1#usize + status_sequence_floor_loop rules method issuer found1 position1 + else ok found + else ok found +partial_fixpoint + +/-- [auths_registries::status_sequence_floor]: + Source: 'core/crates/auths-registries/src/lib.rs', lines 524:0-539:1 -/ +@[reducible] +def status_sequence_floor + (rules : Slice auths_model.StatusTrustRule) + (method : auths_model.StatusMethodId) (issuer : auths_model.PrincipalId) : + Result (Option Std.U64) + := do + status_sequence_floor_loop rules method issuer none 0#usize + +/-- [auths_registries::select_principal_from_snapshot]: loop 0: + Source: 'core/crates/auths-registries/src/lib.rs', lines 0:0-618:5 -/ +@[rust_loop] +def select_principal_from_snapshot_loop + (method : auths_model.StatusMethodId) (max_age : auths_model.FreshnessLimit) + (snapshot : auths_model.PrincipalStatusSnapshot) + (principal : auths_model.PrincipalId) (view : auths_model.StatusView) + (evaluation_time : auths_model.Timestamp) + (statements : Slice auths_model.SignedPrincipalStatus) + (rules : Slice auths_model.StatusTrustRule) (candidate_seen : Bool) + (method_seen : Bool) (rollback : Bool) (maximum : Option Std.U64) + (stale : Bool) (revoked : Bool) (valid_through : auths_model.Timestamp) + (position : Std.Usize) : + Result (Bool × Bool × Bool × (Option Std.U64) × Bool × Bool × + auths_model.Timestamp) + := do + let i := Slice.len statements + if position < i + then + if rollback + then + ok (candidate_seen, method_seen, true, maximum, stale, revoked, + valid_through) + else + let sps ← Slice.index_usize statements position + let statement ← auths_model.SignedPrincipalStatus.impl.statement sps + let pi ← auths_model.PrincipalStatusStatement.impl.principal statement + let b ← + auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq pi + principal + let (candidate_seen1, method_seen1, rollback1, maximum1, stale1, + revoked1, valid_through1) ← + if b + then + do + let pi1 ← + auths_model.PrincipalStatusStatement.impl.issuer statement + let b1 ← auths_model.status_issuer_visible rules pi1 view + if b1 + then + let smi ← + auths_model.PrincipalStatusStatement.impl.method statement + let b2 ← + auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq + smi method + let (b3, b4, o, b5, b6, t) ← + if b2 + then + do + let o1 ← status_sequence_floor rules method pi1 + let (b7, o2, b8, b9, t1) ← + match o1 with + | none => ok (false, maximum, stale, revoked, valid_through) + | some floor => + do + let sequence ← + auths_model.PrincipalStatusStatement.impl.sequence + statement + if sequence < floor + then ok (true, maximum, stale, revoked, valid_through) + else + let newer ← + match maximum with + | none => ok true + | some previous => ok (sequence > previous) + let equal ← + match maximum with + | none => ok false + | some previous => ok (sequence = previous) + let (maximum2, stale2, revoked2, valid_through2) ← + if newer + then + do + let valid_through3 ← + auths_model.PrincipalStatusSnapshot.impl.valid_until + snapshot + ok (some sequence, false, false, valid_through3) + else ok (maximum, stale, revoked, valid_through) + let (b10, b11, t2) ← + if newer + then + do + let stale3 ← + if stale2 + then ok true + else + do + let t3 ← + auths_model.PrincipalStatusStatement.impl.observed_at + statement + let t4 ← + auths_model.PrincipalStatusStatement.impl.valid_until + statement + let sd ← + ExactStatusMethod.freshness + (auths_model.StatusPolicy.SnapshotRequired + method max_age) t3 t4 evaluation_time + auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq + sd auths_ports.StatusDecision.Stale + let revoked3 ← + if revoked2 + then ok true + else + do + let ps ← + auths_model.PrincipalStatusStatement.impl.state + statement + core.cmp.PartialEq.ne.trait_default + auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState + ps auths_model.PrincipalState.Active + let t3 ← + auths_model.PrincipalStatusStatement.impl.valid_until + statement + let t4 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd + valid_through2 t3 + let t5 ← + auths_model.PrincipalStatusStatement.impl.observed_at + statement + let i1 ← auths_model.Timestamp.get t5 + let i2 ← auths_model.FreshnessLimit.get max_age + let i3 ← lift (core.num.U64.saturating_add i1 i2) + let t6 ← auths_model.Timestamp.new i3 + let valid_through3 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd t4 t6 + ok (stale3, revoked3, valid_through3) + else + if equal + then + do + let stale3 ← + if stale2 + then ok true + else + do + let t3 ← + auths_model.PrincipalStatusStatement.impl.observed_at + statement + let t4 ← + auths_model.PrincipalStatusStatement.impl.valid_until + statement + let sd ← + ExactStatusMethod.freshness + (auths_model.StatusPolicy.SnapshotRequired + method max_age) t3 t4 evaluation_time + auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq + sd auths_ports.StatusDecision.Stale + let revoked3 ← + if revoked2 + then ok true + else + do + let ps ← + auths_model.PrincipalStatusStatement.impl.state + statement + core.cmp.PartialEq.ne.trait_default + auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState + ps auths_model.PrincipalState.Active + let t3 ← + auths_model.PrincipalStatusStatement.impl.valid_until + statement + let t4 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd + valid_through2 t3 + let t5 ← + auths_model.PrincipalStatusStatement.impl.observed_at + statement + let i1 ← auths_model.Timestamp.get t5 + let i2 ← auths_model.FreshnessLimit.get max_age + let i3 ← lift (core.num.U64.saturating_add i1 i2) + let t6 ← auths_model.Timestamp.new i3 + let valid_through3 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd t4 t6 + ok (stale3, revoked3, valid_through3) + else ok (stale2, revoked2, valid_through2) + ok (false, maximum2, b10, b11, t2) + ok (true, b7, o2, b8, b9, t1) + else + ok (method_seen, false, maximum, stale, revoked, valid_through) + ok (true, b3, b4, o, b5, b6, t) + else + ok (candidate_seen, method_seen, false, maximum, stale, revoked, + valid_through) + else + ok (candidate_seen, method_seen, false, maximum, stale, revoked, + valid_through) + let position1 ← position + 1#usize + select_principal_from_snapshot_loop method max_age snapshot principal + view evaluation_time statements rules candidate_seen1 method_seen1 + rollback1 maximum1 stale1 revoked1 valid_through1 position1 + else + ok (candidate_seen, method_seen, rollback, maximum, stale, revoked, + valid_through) +partial_fixpoint + +/-- [auths_registries::select_principal_from_snapshot]: + Source: 'core/crates/auths-registries/src/lib.rs', lines 541:0-640:1 -/ +def select_principal_from_snapshot + (id : auths_model.StatusMethodId) (policy : auths_model.StatusPolicy) + (snapshot : auths_model.PrincipalStatusSnapshot) + (principal : auths_model.PrincipalId) (view : auths_model.StatusView) + (evaluation_time : auths_model.Timestamp) : + Result auths_ports.StatusEvaluation + := do + match policy with + | auths_model.StatusPolicy.ExpiryOnly => + let t ← auths_model.Timestamp.new core.num.U64.MAX + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.Active t + | auths_model.StatusPolicy.SnapshotRequired method max_age => + let b ← + core.cmp.impls.PartialEqShared.ne + auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId method + id + if b + then + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.WrongMethod + evaluation_time + else + let t ← auths_model.PrincipalStatusSnapshot.impl.observed_at snapshot + let b1 ← + core.cmp.PartialOrd.gt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp t + evaluation_time + if b1 + then + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.Stale + evaluation_time + else + let t1 ← + auths_model.PrincipalStatusSnapshot.impl.valid_until snapshot + let b2 ← + core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp t1 + evaluation_time + if b2 + then + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.Stale + evaluation_time + else + let statements ← + auths_model.PrincipalStatusSnapshot.impl.statements snapshot + let rules ← auths_model.PrincipalStatusSnapshot.impl.trust snapshot + let (candidate_seen, method_seen, rollback, maximum, stale, revoked, + through) ← + select_principal_from_snapshot_loop method max_age snapshot + principal view evaluation_time statements rules false false false + none false false t1 0#usize + let decision ← + if rollback + then ok auths_ports.StatusDecision.Rollback + else + if candidate_seen + then + if method_seen + then + let b3 := core.option.Option.is_none maximum + if b3 + then ok auths_ports.StatusDecision.UntrustedIssuer + else + if stale + then ok auths_ports.StatusDecision.Stale + else + if revoked + then ok auths_ports.StatusDecision.Revoked + else ok auths_ports.StatusDecision.Active + else ok auths_ports.StatusDecision.WrongMethod + else ok auths_ports.StatusDecision.Missing + let through1 ← + match decision with + | auths_ports.StatusDecision.Active => ok through + | auths_ports.StatusDecision.Revoked => ok through + | auths_ports.StatusDecision.Missing => + auths_model.PrincipalStatusSnapshot.impl.valid_until snapshot + | auths_ports.StatusDecision.Stale => ok evaluation_time + | auths_ports.StatusDecision.Rollback => ok evaluation_time + | auths_ports.StatusDecision.UntrustedIssuer => ok evaluation_time + | auths_ports.StatusDecision.WrongMethod => ok evaluation_time + auths_ports.StatusEvaluation.new decision through1 + +/-- [auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal]: + Source: 'core/crates/auths-registries/src/lib.rs', lines 486:4-502:5 + Visibility: public -/ +def ExactStatusMethod.Insts.Auths_portsStatusMethod.principal + (self : ExactStatusMethod) (policy : auths_model.StatusPolicy) + (snapshot : auths_model.PrincipalStatusSnapshot) + (principal : auths_model.PrincipalId) (view : auths_model.StatusView) + (evaluation_time : auths_model.Timestamp) : + Result (core.result.Result auths_ports.StatusEvaluation + auths_ports.RegistryOperationError) + := do + let se ← + select_principal_from_snapshot self.id policy snapshot principal view + evaluation_time + ok (core.result.Result.Ok se) + +/-- [auths_registries::select_grant_from_snapshot]: loop 0: + Source: 'core/crates/auths-registries/src/lib.rs', lines 0:0-717:5 -/ +@[rust_loop] +def select_grant_from_snapshot_loop + (method : auths_model.StatusMethodId) (max_age : auths_model.FreshnessLimit) + (snapshot : auths_model.GrantStatusSnapshot) (grant : auths_model.GrantId) + (view : auths_model.StatusView) (evaluation_time : auths_model.Timestamp) + (statements : Slice auths_model.SignedGrantStatus) + (rules : Slice auths_model.StatusTrustRule) (candidate_seen : Bool) + (method_seen : Bool) (rollback : Bool) (maximum : Option Std.U64) + (stale : Bool) (revoked : Bool) (valid_through : auths_model.Timestamp) + (position : Std.Usize) : + Result (Bool × Bool × Bool × (Option Std.U64) × Bool × Bool × + auths_model.Timestamp) + := do + let i := Slice.len statements + if position < i + then + if rollback + then + ok (candidate_seen, method_seen, true, maximum, stale, revoked, + valid_through) + else + let sgs ← Slice.index_usize statements position + let statement ← auths_model.SignedGrantStatus.impl.statement sgs + let gi ← auths_model.GrantStatusStatement.impl.grant_id statement + let b ← auths_model.GrantId.Insts.CoreCmpPartialEqGrantId.eq gi grant + let (candidate_seen1, method_seen1, rollback1, maximum1, stale1, + revoked1, valid_through1) ← + if b + then + do + let pi ← auths_model.GrantStatusStatement.impl.issuer statement + let b1 ← auths_model.status_issuer_visible rules pi view + if b1 + then + let smi ← auths_model.GrantStatusStatement.impl.method statement + let b2 ← + auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq + smi method + let (b3, b4, o, b5, b6, t) ← + if b2 + then + do + let o1 ← status_sequence_floor rules method pi + let (b7, o2, b8, b9, t1) ← + match o1 with + | none => ok (false, maximum, stale, revoked, valid_through) + | some floor => + do + let sequence ← + auths_model.GrantStatusStatement.impl.sequence statement + if sequence < floor + then ok (true, maximum, stale, revoked, valid_through) + else + let newer ← + match maximum with + | none => ok true + | some previous => ok (sequence > previous) + let equal ← + match maximum with + | none => ok false + | some previous => ok (sequence = previous) + let (maximum2, stale2, revoked2, valid_through2) ← + if newer + then + do + let valid_through3 ← + auths_model.GrantStatusSnapshot.impl.valid_until + snapshot + ok (some sequence, false, false, valid_through3) + else ok (maximum, stale, revoked, valid_through) + let (b10, b11, t2) ← + if newer + then + do + let stale3 ← + if stale2 + then ok true + else + do + let t3 ← + auths_model.GrantStatusStatement.impl.observed_at + statement + let t4 ← + auths_model.GrantStatusStatement.impl.valid_until + statement + let sd ← + ExactStatusMethod.freshness + (auths_model.StatusPolicy.SnapshotRequired + method max_age) t3 t4 evaluation_time + auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq + sd auths_ports.StatusDecision.Stale + let revoked3 ← + if revoked2 + then ok true + else + do + let gs ← + auths_model.GrantStatusStatement.impl.state + statement + core.cmp.PartialEq.ne.trait_default + auths_model.GrantState.Insts.CoreCmpPartialEqGrantState + gs auths_model.GrantState.Active + let t3 ← + auths_model.GrantStatusStatement.impl.valid_until + statement + let t4 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd + valid_through2 t3 + let t5 ← + auths_model.GrantStatusStatement.impl.observed_at + statement + let i1 ← auths_model.Timestamp.get t5 + let i2 ← auths_model.FreshnessLimit.get max_age + let i3 ← lift (core.num.U64.saturating_add i1 i2) + let t6 ← auths_model.Timestamp.new i3 + let valid_through3 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd t4 t6 + ok (stale3, revoked3, valid_through3) + else + if equal + then + do + let stale3 ← + if stale2 + then ok true + else + do + let t3 ← + auths_model.GrantStatusStatement.impl.observed_at + statement + let t4 ← + auths_model.GrantStatusStatement.impl.valid_until + statement + let sd ← + ExactStatusMethod.freshness + (auths_model.StatusPolicy.SnapshotRequired + method max_age) t3 t4 evaluation_time + auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq + sd auths_ports.StatusDecision.Stale + let revoked3 ← + if revoked2 + then ok true + else + do + let gs ← + auths_model.GrantStatusStatement.impl.state + statement + core.cmp.PartialEq.ne.trait_default + auths_model.GrantState.Insts.CoreCmpPartialEqGrantState + gs auths_model.GrantState.Active + let t3 ← + auths_model.GrantStatusStatement.impl.valid_until + statement + let t4 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd + valid_through2 t3 + let t5 ← + auths_model.GrantStatusStatement.impl.observed_at + statement + let i1 ← auths_model.Timestamp.get t5 + let i2 ← auths_model.FreshnessLimit.get max_age + let i3 ← lift (core.num.U64.saturating_add i1 i2) + let t6 ← auths_model.Timestamp.new i3 + let valid_through3 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd t4 t6 + ok (stale3, revoked3, valid_through3) + else ok (stale2, revoked2, valid_through2) + ok (false, maximum2, b10, b11, t2) + ok (true, b7, o2, b8, b9, t1) + else + ok (method_seen, false, maximum, stale, revoked, valid_through) + ok (true, b3, b4, o, b5, b6, t) + else + ok (candidate_seen, method_seen, false, maximum, stale, revoked, + valid_through) + else + ok (candidate_seen, method_seen, false, maximum, stale, revoked, + valid_through) + let position1 ← position + 1#usize + select_grant_from_snapshot_loop method max_age snapshot grant view + evaluation_time statements rules candidate_seen1 method_seen1 rollback1 + maximum1 stale1 revoked1 valid_through1 position1 + else + ok (candidate_seen, method_seen, rollback, maximum, stale, revoked, + valid_through) +partial_fixpoint + +/-- [auths_registries::select_grant_from_snapshot]: + Source: 'core/crates/auths-registries/src/lib.rs', lines 642:0-739:1 -/ +def select_grant_from_snapshot + (id : auths_model.StatusMethodId) (policy : auths_model.StatusPolicy) + (snapshot : auths_model.GrantStatusSnapshot) (grant : auths_model.GrantId) + (view : auths_model.StatusView) (evaluation_time : auths_model.Timestamp) : + Result auths_ports.StatusEvaluation + := do + match policy with + | auths_model.StatusPolicy.ExpiryOnly => + let t ← auths_model.Timestamp.new core.num.U64.MAX + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.Active t + | auths_model.StatusPolicy.SnapshotRequired method max_age => + let b ← + core.cmp.impls.PartialEqShared.ne + auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId method + id + if b + then + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.WrongMethod + evaluation_time + else + let t ← auths_model.GrantStatusSnapshot.impl.observed_at snapshot + let b1 ← + core.cmp.PartialOrd.gt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp t + evaluation_time + if b1 + then + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.Stale + evaluation_time + else + let t1 ← auths_model.GrantStatusSnapshot.impl.valid_until snapshot + let b2 ← + core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp t1 + evaluation_time + if b2 + then + auths_ports.StatusEvaluation.new auths_ports.StatusDecision.Stale + evaluation_time + else + let statements ← + auths_model.GrantStatusSnapshot.impl.statements snapshot + let rules ← auths_model.GrantStatusSnapshot.impl.trust snapshot + let (candidate_seen, method_seen, rollback, maximum, stale, revoked, + through) ← + select_grant_from_snapshot_loop method max_age snapshot grant view + evaluation_time statements rules false false false none false + false t1 0#usize + let decision ← + if rollback + then ok auths_ports.StatusDecision.Rollback + else + if candidate_seen + then + if method_seen + then + let b3 := core.option.Option.is_none maximum + if b3 + then ok auths_ports.StatusDecision.UntrustedIssuer + else + if stale + then ok auths_ports.StatusDecision.Stale + else + if revoked + then ok auths_ports.StatusDecision.Revoked + else ok auths_ports.StatusDecision.Active + else ok auths_ports.StatusDecision.WrongMethod + else ok auths_ports.StatusDecision.Missing + let through1 ← + match decision with + | auths_ports.StatusDecision.Active => ok through + | auths_ports.StatusDecision.Revoked => ok through + | auths_ports.StatusDecision.Missing => + auths_model.GrantStatusSnapshot.impl.valid_until snapshot + | auths_ports.StatusDecision.Stale => ok evaluation_time + | auths_ports.StatusDecision.Rollback => ok evaluation_time + | auths_ports.StatusDecision.UntrustedIssuer => ok evaluation_time + | auths_ports.StatusDecision.WrongMethod => ok evaluation_time + auths_ports.StatusEvaluation.new decision through1 + +/-- [auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant]: + Source: 'core/crates/auths-registries/src/lib.rs', lines 504:4-520:5 + Visibility: public -/ +def ExactStatusMethod.Insts.Auths_portsStatusMethod.grant + (self : ExactStatusMethod) (policy : auths_model.StatusPolicy) + (snapshot : auths_model.GrantStatusSnapshot) (grant : auths_model.GrantId) + (view : auths_model.StatusView) (evaluation_time : auths_model.Timestamp) : + Result (core.result.Result auths_ports.StatusEvaluation + auths_ports.RegistryOperationError) + := do + let se ← + select_grant_from_snapshot self.id policy snapshot grant view + evaluation_time + ok (core.result.Result.Ok se) + +end AuthsStatusSelection diff --git a/formal/qualification/aeneas/generated/status_selection/FunsExternal.lean b/formal/qualification/aeneas/generated/status_selection/FunsExternal.lean new file mode 100644 index 000000000..5e277a24f --- /dev/null +++ b/formal/qualification/aeneas/generated/status_selection/FunsExternal.lean @@ -0,0 +1,76 @@ +import qualification.aeneas.generated.status_selection.Types +import qualification.aeneas.generated.model.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsStatusSelection + +@[trait_default] +def core.cmp.PartialOrd.lt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right +@[trait_default] +def core.cmp.PartialOrd.gt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.gt.default implementation.partial_cmp left right +@[trait_default] +def core.cmp.Ord.max.default {Self : Type} + (implementation : Aeneas.Std.core.cmp.Ord Self) (left right : Self) : Result Self := + Aeneas.Std.core.cmp.Ord.max.default implementation.partialOrdInst.lt left right +abbrev alloc.string.String.Insts.CoreCmpPartialEqString.eq := + _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq +abbrev alloc.string.String.Insts.CoreCmpOrd.cmp := + _root_.alloc.string.String.Insts.CoreCmpOrd.cmp + +/-- Reviewed standard-library boundary: pinned Rust binary_search_by's exact + size/base transition and final comparison, including unsorted inputs. + Fuel is initial length + 1; exhausted/invalid indexing refuses explicitly. + This is not an Auths algorithm or an assumption of whitelist membership. -/ +def binarySearchLoop {T : Type} (order : Aeneas.Std.core.cmp.Ord T) + (values : List T) (target : T) : Nat → Nat → Nat → Result (core.result.Result Nat Nat) + | 0, _, _ => fail .panic + | fuel + 1, base, size => do + if size > 1 then + let half := size / 2 + let mid := base + half + match values[mid]? with + | none => fail .panic + | some value => + let comparison ← order.cmp value target + binarySearchLoop order values target fuel + (if comparison = .gt then base else mid) (size - half) + else + match values[base]? with + | none => fail .panic + | some value => + let comparison ← order.cmp value target + if comparison = .eq then ok (.Ok base) + else ok (.Err (base + if comparison = .lt then 1 else 0)) + +def core.slice.Slice.binary_search {T : Type} (order : Aeneas.Std.core.cmp.Ord T) + (values : Slice T) (target : T) : Result (core.result.Result Std.Usize Std.Usize) := do + if values.val.isEmpty then ok (.Err 0#usize) + else + let result ← binarySearchLoop order values.val target (values.val.length + 1) 0 values.val.length + match result with + | .Ok index => + let result ← UScalar.tryMk .Usize index + ok (.Ok result) + | .Err index => + let result ← UScalar.tryMk .Usize index + ok (.Err result) +theorem lt_default_delegates {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs) : + core.cmp.PartialOrd.lt.default implementation left right = + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right := rfl + +theorem gt_default_delegates {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs) : + core.cmp.PartialOrd.gt.default implementation left right = + Aeneas.Std.core.cmp.PartialOrd.gt.default implementation.partial_cmp left right := rfl + +theorem max_default_delegates {Self : Type} + (implementation : Aeneas.Std.core.cmp.Ord Self) (left right : Self) : + core.cmp.Ord.max.default implementation left right = + Aeneas.Std.core.cmp.Ord.max.default implementation.partialOrdInst.lt left right := rfl +end AuthsStatusSelection diff --git a/formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean new file mode 100644 index 000000000..30be1fa16 --- /dev/null +++ b/formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean @@ -0,0 +1,43 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_registries]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.status_selection.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open AuthsStatusSelection + +/-- [core::slice::{[T]}::binary_search]: + Source: '/rustc/library/core/src/slice/mod.rs', lines 2920:4-2922:15 + Name pattern: [core::slice::{[@T]}::binary_search] + Visibility: public -/ +@[rust_fun "core::slice::{[@T]}::binary_search"] +axiom core.slice.Slice.binary_search + {T : Type} (cmpOrdInst : core.cmp.Ord T) : + Slice T → T → Result (core.result.Result Std.Usize Std.Usize) + +/-- [alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:9-350:18 + Name pattern: [alloc::string::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "alloc::string::{core::cmp::PartialEq}::eq"] +axiom alloc.string.String.Insts.CoreCmpPartialEqString.eq + : String → String → Result Bool + +/-- [alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp]: + Source: '/rustc/library/alloc/src/string.rs', lines 350:36-350:39 + Name pattern: [alloc::string::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "alloc::string::{core::cmp::Ord}::cmp"] +axiom alloc.string.String.Insts.CoreCmpOrd.cmp + : String → String → Result Ordering + diff --git a/formal/qualification/aeneas/generated/status_selection/Types.lean b/formal/qualification/aeneas/generated/status_selection/Types.lean new file mode 100644 index 000000000..a8ab702bd --- /dev/null +++ b/formal/qualification/aeneas/generated/status_selection/Types.lean @@ -0,0 +1,462 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_registries]: type definitions +import Aeneas +import Auths.Support.Discriminant +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace AuthsStatusSelection + +/-- [auths_model::bounded::BoundedSet] + Source: 'core/crates/auths-model/src/bounded.rs', lines 31:0-31:47 + Name pattern: [auths_model::bounded::BoundedSet] + Visibility: public -/ +@[reducible, rust_type "auths_model::bounded::BoundedSet"] +def auths_model.bounded.BoundedSet (T : Type) (MAX : Std.Usize) := + alloc.vec.Vec T + +/-- [auths_model::ProtocolVersion] + Source: 'core/crates/auths-model/src/lib.rs', lines 88:0-88:26 + Name pattern: [auths_model::ProtocolVersion] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProtocolVersion"] +def auths_model.ProtocolVersion := Std.U16 + +/-- [auths_model::TrustAnchorId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::TrustAnchorId] + Visibility: public -/ +@[reducible, rust_type "auths_model::TrustAnchorId"] +def auths_model.TrustAnchorId := String + +/-- [auths_model::StatusMethodId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::StatusMethodId] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusMethodId"] +def auths_model.StatusMethodId := String + +/-- [auths_model::PrincipalMethodId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::PrincipalMethodId] + Visibility: public -/ +@[reducible, rust_type "auths_model::PrincipalMethodId"] +def auths_model.PrincipalMethodId := String + +/-- [auths_model::ResourceId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ResourceId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ResourceId"] +def auths_model.ResourceId := String + +/-- [auths_model::AssurancePolicyId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::AssurancePolicyId] + Visibility: public -/ +@[reducible, rust_type "auths_model::AssurancePolicyId"] +def auths_model.AssurancePolicyId := String + +/-- [auths_model::ProfileId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ProfileId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProfileId"] +def auths_model.ProfileId := String + +/-- [auths_model::Audience] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::Audience] + Visibility: public -/ +@[reducible, rust_type "auths_model::Audience"] +def auths_model.Audience := String + +/-- [auths_model::BudgetAlgebraId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::BudgetAlgebraId] + Visibility: public -/ +@[reducible, rust_type "auths_model::BudgetAlgebraId"] +def auths_model.BudgetAlgebraId := String + +/-- [auths_model::VerificationMethod] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::VerificationMethod] + Visibility: public -/ +@[reducible, rust_type "auths_model::VerificationMethod"] +def auths_model.VerificationMethod := String + +/-- [auths_model::SignatureSuiteId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::SignatureSuiteId] + Visibility: public -/ +@[reducible, rust_type "auths_model::SignatureSuiteId"] +def auths_model.SignatureSuiteId := String + +/-- [auths_model::CapabilityId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::CapabilityId] + Visibility: public -/ +@[reducible, rust_type "auths_model::CapabilityId"] +def auths_model.CapabilityId := String + +/-- [auths_model::ExtensionId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ExtensionId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ExtensionId"] +def auths_model.ExtensionId := String + +/-- [auths_model::PrincipalId] + Source: 'core/crates/auths-model/src/lib.rs', lines 154:0-154:22 + Name pattern: [auths_model::PrincipalId] + Visibility: public -/ +@[reducible, rust_type "auths_model::PrincipalId"] +def auths_model.PrincipalId := String + +/-- [auths_model::Digest] + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:17 + Name pattern: [auths_model::Digest] + Visibility: public -/ +@[reducible, rust_type "auths_model::Digest"] +def auths_model.Digest := Array Std.U8 32#usize + +/-- [auths_model::GrantId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::GrantId] + Visibility: public -/ +@[reducible, rust_type "auths_model::GrantId"] +def auths_model.GrantId := auths_model.Digest + +/-- [auths_model::StatusSnapshotId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::StatusSnapshotId] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusSnapshotId"] +def auths_model.StatusSnapshotId := auths_model.Digest + +/-- [auths_model::EvidenceId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::EvidenceId] + Visibility: public -/ +@[reducible, rust_type "auths_model::EvidenceId"] +def auths_model.EvidenceId := auths_model.Digest + +/-- [auths_model::Timestamp] + Source: 'core/crates/auths-model/src/lib.rs', lines 339:0-339:20 + Name pattern: [auths_model::Timestamp] + Visibility: public -/ +@[reducible, rust_type "auths_model::Timestamp"] +def auths_model.Timestamp := Std.U64 + +/-- [auths_model::ValidityWindow] + Source: 'core/crates/auths-model/src/lib.rs', lines 354:0-354:25 + Name pattern: [auths_model::ValidityWindow] + Visibility: public -/ +@[rust_type "auths_model::ValidityWindow"] +structure auths_model.ValidityWindow where + not_before : auths_model.Timestamp + expires_at : auths_model.Timestamp + +/-- [auths_model::ProfileRef] + Source: 'core/crates/auths-model/src/lib.rs', lines 427:0-427:21 + Name pattern: [auths_model::ProfileRef] + Visibility: public -/ +@[rust_type "auths_model::ProfileRef"] +structure auths_model.ProfileRef where + id : auths_model.ProfileId + version : Std.U16 + +/-- [auths_model::Permission] + Source: 'core/crates/auths-model/src/lib.rs', lines 504:0-504:21 + Name pattern: [auths_model::Permission] + Visibility: public -/ +@[rust_type "auths_model::Permission"] +structure auths_model.Permission where + capability : auths_model.CapabilityId + resource : auths_model.ResourceId + +/-- [auths_model::PermissionSet] + Source: 'core/crates/auths-model/src/lib.rs', lines 535:0-535:24 + Name pattern: [auths_model::PermissionSet] + Visibility: public -/ +@[reducible, rust_type "auths_model::PermissionSet"] +def auths_model.PermissionSet := + auths_model.bounded.BoundedSet auths_model.Permission 1024#usize + +/-- [auths_model::AudienceSet] + Source: 'core/crates/auths-model/src/lib.rs', lines 598:0-598:22 + Name pattern: [auths_model::AudienceSet] + Visibility: public -/ +@[reducible, rust_type "auths_model::AudienceSet"] +def auths_model.AudienceSet := + auths_model.bounded.BoundedSet auths_model.Audience 256#usize + +/-- [auths_model::BudgetCeiling] + Source: 'core/crates/auths-model/src/lib.rs', lines 832:0-832:24 + Name pattern: [auths_model::BudgetCeiling] + Visibility: public -/ +@[rust_type "auths_model::BudgetCeiling"] +structure auths_model.BudgetCeiling where + algebra : auths_model.BudgetAlgebraId + value : Std.U64 + +/-- [auths_model::FreshnessLimit] + Source: 'core/crates/auths-model/src/lib.rs', lines 960:0-960:25 + Name pattern: [auths_model::FreshnessLimit] + Visibility: public -/ +@[reducible, rust_type "auths_model::FreshnessLimit"] +def auths_model.FreshnessLimit := Std.U64 + +/-- [auths_model::StatusPolicy] + Source: 'core/crates/auths-model/src/lib.rs', lines 985:0-985:21 + Name pattern: [auths_model::StatusPolicy] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::StatusPolicy"] +inductive auths_model.StatusPolicy where +| ExpiryOnly : auths_model.StatusPolicy +| SnapshotRequired : + auths_model.StatusMethodId → + auths_model.FreshnessLimit → + auths_model.StatusPolicy + +/-- [auths_model::CriticalExtension] + Source: 'core/crates/auths-model/src/lib.rs', lines 1029:0-1029:28 + Name pattern: [auths_model::CriticalExtension] + Visibility: public -/ +@[rust_type "auths_model::CriticalExtension"] +structure auths_model.CriticalExtension where + id : auths_model.ExtensionId + bytes : alloc.vec.Vec Std.U8 + +/-- [auths_model::CriticalExtensions] + Source: 'core/crates/auths-model/src/lib.rs', lines 1060:0-1060:29 + Name pattern: [auths_model::CriticalExtensions] + Visibility: public -/ +@[reducible, rust_type "auths_model::CriticalExtensions"] +def auths_model.CriticalExtensions := + alloc.vec.Vec auths_model.CriticalExtension + +/-- [auths_model::SignatureDescriptor] + Source: 'core/crates/auths-model/src/lib.rs', lines 1147:0-1147:30 + Name pattern: [auths_model::SignatureDescriptor] + Visibility: public -/ +@[rust_type "auths_model::SignatureDescriptor"] +structure auths_model.SignatureDescriptor where + principal_method : auths_model.PrincipalMethodId + verification_method : auths_model.VerificationMethod + suite : auths_model.SignatureSuiteId + +/-- [auths_model::SignatureBytes] + Source: 'core/crates/auths-model/src/lib.rs', lines 1184:0-1184:25 + Name pattern: [auths_model::SignatureBytes] + Visibility: public -/ +@[reducible, rust_type "auths_model::SignatureBytes"] +def auths_model.SignatureBytes := alloc.vec.Vec Std.U8 + +/-- [auths_model::SignatureEnvelope] + Source: 'core/crates/auths-model/src/lib.rs', lines 1207:0-1207:28 + Name pattern: [auths_model::SignatureEnvelope] + Visibility: public -/ +@[rust_type "auths_model::SignatureEnvelope"] +structure auths_model.SignatureEnvelope where + descriptor : auths_model.SignatureDescriptor + signature : auths_model.SignatureBytes + +/-- [auths_model::PrincipalState] + Source: 'core/crates/auths-model/src/lib.rs', lines 2063:0-2063:23 + Name pattern: [auths_model::PrincipalState] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::PrincipalState"] +inductive auths_model.PrincipalState where +| Active : auths_model.PrincipalState +| Revoked : auths_model.PrincipalState +| Superseded : auths_model.PrincipalState + +/-- [auths_model::GrantState] + Source: 'core/crates/auths-model/src/lib.rs', lines 2070:0-2070:19 + Name pattern: [auths_model::GrantState] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::GrantState"] +inductive auths_model.GrantState where +| Active : auths_model.GrantState +| Revoked : auths_model.GrantState +| Superseded : auths_model.GrantState + +/-- [auths_model::PrincipalStatusStatement] + Source: 'core/crates/auths-model/src/lib.rs', lines 2085:0-2085:35 + Name pattern: [auths_model::PrincipalStatusStatement] + Visibility: public -/ +@[rust_type "auths_model::PrincipalStatusStatement"] +structure auths_model.PrincipalStatusStatement where + version : auths_model.ProtocolVersion + method : auths_model.StatusMethodId + principal : auths_model.PrincipalId + state : auths_model.PrincipalState + sequence : Std.U64 + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + issuer : auths_model.PrincipalId + extensions : auths_model.CriticalExtensions + +/-- [auths_model::SignedPrincipalStatus] + Source: 'core/crates/auths-model/src/lib.rs', lines 2171:0-2171:32 + Name pattern: [auths_model::SignedPrincipalStatus] + Visibility: public -/ +@[rust_type "auths_model::SignedPrincipalStatus"] +structure auths_model.SignedPrincipalStatus where + statement : auths_model.PrincipalStatusStatement + signature : auths_model.SignatureEnvelope + +/-- [auths_model::GrantStatusStatement] + Source: 'core/crates/auths-model/src/lib.rs', lines 2200:0-2200:31 + Name pattern: [auths_model::GrantStatusStatement] + Visibility: public -/ +@[rust_type "auths_model::GrantStatusStatement"] +structure auths_model.GrantStatusStatement where + version : auths_model.ProtocolVersion + method : auths_model.StatusMethodId + grant_id : auths_model.GrantId + state : auths_model.GrantState + sequence : Std.U64 + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + issuer : auths_model.PrincipalId + extensions : auths_model.CriticalExtensions + +/-- [auths_model::SignedGrantStatus] + Source: 'core/crates/auths-model/src/lib.rs', lines 2286:0-2286:28 + Name pattern: [auths_model::SignedGrantStatus] + Visibility: public -/ +@[rust_type "auths_model::SignedGrantStatus"] +structure auths_model.SignedGrantStatus where + statement : auths_model.GrantStatusStatement + signature : auths_model.SignatureEnvelope + +/-- [auths_model::StatusScopeAnchors] + Source: 'core/crates/auths-model/src/lib.rs', lines 2311:0-2311:29 + Name pattern: [auths_model::StatusScopeAnchors] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusScopeAnchors"] +def auths_model.StatusScopeAnchors := alloc.vec.Vec auths_model.TrustAnchorId + +/-- [auths_model::StatusScope] + Source: 'core/crates/auths-model/src/lib.rs', lines 2358:0-2358:20 + Name pattern: [auths_model::StatusScope] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::StatusScope"] +inductive auths_model.StatusScope where +| OwnAnchor : auths_model.StatusScope +| Anchors : auths_model.StatusScopeAnchors → auths_model.StatusScope +| AnyAnchor : auths_model.StatusScope + +/-- [auths_model::TrustAnchor] + Source: 'core/crates/auths-model/src/lib.rs', lines 3493:0-3493:22 + Name pattern: [auths_model::TrustAnchor] + Visibility: public -/ +@[rust_type "auths_model::TrustAnchor"] +structure auths_model.TrustAnchor where + id : auths_model.TrustAnchorId + principal : auths_model.PrincipalId + accepted_methods : alloc.vec.Vec auths_model.PrincipalMethodId + profiles : alloc.vec.Vec auths_model.ProfileRef + permissions : auths_model.PermissionSet + resource_namespaces : alloc.vec.Vec auths_model.ResourceId + audiences : auths_model.AudienceSet + validity : auths_model.ValidityWindow + budget_ceiling : Option auths_model.BudgetCeiling + max_delegation_depth : Std.U16 + assurance_policy : auths_model.AssurancePolicyId + status_policy : auths_model.StatusPolicy + +/-- [auths_model::StatusTrustRule] + Source: 'core/crates/auths-model/src/lib.rs', lines 2445:0-2445:26 + Name pattern: [auths_model::StatusTrustRule] + Visibility: public -/ +@[rust_type "auths_model::StatusTrustRule"] +structure auths_model.StatusTrustRule where + method : auths_model.StatusMethodId + issuer : auths_model.PrincipalId + sequence_floor : Std.U64 + scope : auths_model.StatusScope + +/-- [auths_model::StatusView] + Source: 'core/crates/auths-model/src/lib.rs', lines 2407:0-2407:23 + Name pattern: [auths_model::StatusView] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::StatusView"] +inductive auths_model.StatusView where +| Anchor : auths_model.TrustAnchor → auths_model.StatusView +| Approver : auths_model.StatusView + +/-- [auths_model::PrincipalStatusSnapshot] + Source: 'core/crates/auths-model/src/lib.rs', lines 2496:0-2496:34 + Name pattern: [auths_model::PrincipalStatusSnapshot] + Visibility: public -/ +@[rust_type "auths_model::PrincipalStatusSnapshot"] +structure auths_model.PrincipalStatusSnapshot where + id : auths_model.StatusSnapshotId + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + statements : alloc.vec.Vec auths_model.SignedPrincipalStatus + checkpoints : alloc.vec.Vec auths_model.EvidenceId + trust : alloc.vec.Vec auths_model.StatusTrustRule + +/-- [auths_model::GrantStatusSnapshot] + Source: 'core/crates/auths-model/src/lib.rs', lines 2634:0-2634:30 + Name pattern: [auths_model::GrantStatusSnapshot] + Visibility: public -/ +@[rust_type "auths_model::GrantStatusSnapshot"] +structure auths_model.GrantStatusSnapshot where + id : auths_model.StatusSnapshotId + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + statements : alloc.vec.Vec auths_model.SignedGrantStatus + checkpoints : alloc.vec.Vec auths_model.EvidenceId + trust : alloc.vec.Vec auths_model.StatusTrustRule + +/-- [auths_ports::RegistryOperationError] + Source: 'core/crates/auths-ports/src/lib.rs', lines 289:0-289:31 + Name pattern: [auths_ports::RegistryOperationError] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_ports::RegistryOperationError"] +inductive auths_ports.RegistryOperationError where +| ResourceLimitExceeded : auths_ports.RegistryOperationError +| InvalidInput : auths_ports.RegistryOperationError + +/-- [auths_ports::StatusDecision] + Source: 'core/crates/auths-ports/src/lib.rs', lines 433:0-433:23 + Name pattern: [auths_ports::StatusDecision] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_ports::StatusDecision"] +inductive auths_ports.StatusDecision where +| Active : auths_ports.StatusDecision +| Revoked : auths_ports.StatusDecision +| Missing : auths_ports.StatusDecision +| Stale : auths_ports.StatusDecision +| Rollback : auths_ports.StatusDecision +| UntrustedIssuer : auths_ports.StatusDecision +| WrongMethod : auths_ports.StatusDecision + +/-- [auths_ports::StatusEvaluation] + Source: 'core/crates/auths-ports/src/lib.rs', lines 454:0-454:27 + Name pattern: [auths_ports::StatusEvaluation] + Visibility: public -/ +@[rust_type "auths_ports::StatusEvaluation"] +structure auths_ports.StatusEvaluation where + decision : auths_ports.StatusDecision + valid_through : auths_model.Timestamp + +/-- [auths_registries::ExactStatusMethod] + Source: 'core/crates/auths-registries/src/lib.rs', lines 448:0-450:1 -/ +structure ExactStatusMethod where + id : auths_model.StatusMethodId + +end AuthsStatusSelection diff --git a/formal/qualification/aeneas/generated/status_selection/translation.json b/formal/qualification/aeneas/generated/status_selection/translation.json new file mode 100644 index 000000000..0d6b4beb1 --- /dev/null +++ b/formal/qualification/aeneas/generated/status_selection/translation.json @@ -0,0 +1,1972 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_registries", + "functions": [ + { + "def_id": 308, + "lean_name": "AuthsStatusSelection.core.slice.Slice.binary_search", + "lean_file": "qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "rust_name": "core::slice::{[T]}::binary_search", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/slice/mod.rs", + "begin_line": 2920, + "end_line": 2922 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 249, + "lean_name": "AuthsStatusSelection.alloc.string.String.Insts.CoreCmpPartialEqString.eq", + "lean_file": "qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 307, + "lean_name": "AuthsStatusSelection.alloc.string.String.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "rust_name": "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", + "is_local": false, + "source": { + "file": "/rustc/library/alloc/src/string.rs", + "begin_line": 350, + "end_line": 350 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 336, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 334, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 144, + "lean_name": "AuthsStatusSelection.auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::StatusMethodId}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 323, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 335, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId.partial_cmp", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}::partial_cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 153, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalId}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 153, + "end_line": 153 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 167, + "lean_name": "AuthsStatusSelection.auths_model.Digest.Insts.CoreCmpPartialEqDigest.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 229, + "end_line": 229 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 49, + "lean_name": "AuthsStatusSelection.auths_model.GrantId.Insts.CoreCmpPartialEqGrantId.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::GrantId}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 248, + "end_line": 248 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 250, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 254, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Timestamp}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 165, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Timestamp}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 151, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}::partial_cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 14, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.new", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::Timestamp}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 343, + "end_line": 343 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 40, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.get", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::Timestamp}::get", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 348, + "end_line": 348 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 41, + "lean_name": "AuthsStatusSelection.auths_model.FreshnessLimit.get", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::FreshnessLimit}::get", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 978, + "end_line": 978 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 161, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalState}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2062, + "end_line": 2062 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 169, + "lean_name": "AuthsStatusSelection.auths_model.GrantState.Insts.CoreCmpPartialEqGrantState.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::GrantState}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2069, + "end_line": 2069 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 30, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.method", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::method", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2137, + "end_line": 2137 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 25, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.principal", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::principal", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2141, + "end_line": 2141 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 35, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.state", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::state", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2145, + "end_line": 2145 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 32, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.sequence", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::sequence", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2149, + "end_line": 2149 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 33, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.observed_at", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::observed_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2153, + "end_line": 2153 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 34, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.valid_until", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::valid_until", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2157, + "end_line": 2157 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 28, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement.impl.issuer", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusStatement}::issuer", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2161, + "end_line": 2161 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 24, + "lean_name": "AuthsStatusSelection.auths_model.SignedPrincipalStatus.impl.statement", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::SignedPrincipalStatus}::statement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2185, + "end_line": 2185 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 51, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.method", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::method", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2252, + "end_line": 2252 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 48, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.grant_id", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::grant_id", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2256, + "end_line": 2256 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 55, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.state", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::state", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2260, + "end_line": 2260 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 52, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.sequence", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::sequence", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2264, + "end_line": 2264 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 53, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.observed_at", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::observed_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2268, + "end_line": 2268 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 54, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.valid_until", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::valid_until", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2272, + "end_line": 2272 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 50, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement.impl.issuer", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusStatement}::issuer", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2276, + "end_line": 2276 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 47, + "lean_name": "AuthsStatusSelection.auths_model.SignedGrantStatus.impl.statement", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::SignedGrantStatus}::statement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2300, + "end_line": 2300 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 290, + "lean_name": "AuthsStatusSelection.auths_model.StatusScopeAnchors.contains", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusScopeAnchors}::contains", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2346, + "end_line": 2346 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 288, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchor.impl.principal", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::TrustAnchor}::principal", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3565, + "end_line": 3565 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 289, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchor.impl.id", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::TrustAnchor}::id", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3561, + "end_line": 3561 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 251, + "lean_name": "AuthsStatusSelection.auths_model.StatusScope.covers", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusScope}::covers", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2370, + "end_line": 2370 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 155, + "lean_name": "AuthsStatusSelection.auths_model.StatusTrustRule.impl.issuer", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusTrustRule}::issuer", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2483, + "end_line": 2483 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 156, + "lean_name": "AuthsStatusSelection.auths_model.StatusTrustRule.impl.scope", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusTrustRule}::scope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2471, + "end_line": 2471 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 154, + "lean_name": "AuthsStatusSelection.auths_model.status_issuer_in_scope_loop", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::status_issuer_in_scope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2395, + "end_line": 2401 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsStatusSelection.auths_model.status_issuer_in_scope" + }, + { + "def_id": 154, + "lean_name": "AuthsStatusSelection.auths_model.status_issuer_in_scope", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::status_issuer_in_scope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2388, + "end_line": 2392 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 29, + "lean_name": "AuthsStatusSelection.auths_model.status_issuer_visible_loop", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::status_issuer_visible", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2430, + "end_line": 2436 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsStatusSelection.auths_model.status_issuer_visible" + }, + { + "def_id": 29, + "lean_name": "AuthsStatusSelection.auths_model.status_issuer_visible", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::status_issuer_visible", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2420, + "end_line": 2424 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 157, + "lean_name": "AuthsStatusSelection.auths_model.StatusTrustRule.impl.method", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusTrustRule}::method", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2477, + "end_line": 2477 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 158, + "lean_name": "AuthsStatusSelection.auths_model.StatusTrustRule.impl.sequence_floor", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::StatusTrustRule}::sequence_floor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2489, + "end_line": 2489 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.observed_at", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusSnapshot}::observed_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2603, + "end_line": 2603 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 19, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.valid_until", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusSnapshot}::valid_until", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2609, + "end_line": 2609 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 21, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.statements", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusSnapshot}::statements", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2615, + "end_line": 2615 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 22, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot.impl.trust", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::PrincipalStatusSnapshot}::trust", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2627, + "end_line": 2627 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 43, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.observed_at", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusSnapshot}::observed_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2738, + "end_line": 2738 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 44, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.valid_until", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusSnapshot}::valid_until", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2744, + "end_line": 2744 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 45, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.statements", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusSnapshot}::statements", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2750, + "end_line": 2750 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 46, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusSnapshot.impl.trust", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{auths_model::GrantStatusSnapshot}::trust", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2762, + "end_line": 2762 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 38, + "lean_name": "AuthsStatusSelection.auths_ports.StatusDecision.Insts.CoreCmpPartialEqStatusDecision.eq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_ports::{impl core::cmp::PartialEq for auths_ports::StatusDecision}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 432, + "end_line": 432 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "AuthsStatusSelection.auths_ports.StatusEvaluation.new", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_ports::{auths_ports::StatusEvaluation}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 464, + "end_line": 464 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 36, + "lean_name": "AuthsStatusSelection.ExactStatusMethod.freshness", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::{auths_registries::ExactStatusMethod}::freshness", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 453, + "end_line": 470 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 31, + "lean_name": "AuthsStatusSelection.status_sequence_floor_loop", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::status_sequence_floor", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 1, + "end_line": 537 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsStatusSelection.status_sequence_floor" + }, + { + "def_id": 31, + "lean_name": "AuthsStatusSelection.status_sequence_floor", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::status_sequence_floor", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 524, + "end_line": 539 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": true + }, + { + "def_id": 5, + "lean_name": "AuthsStatusSelection.select_principal_from_snapshot_loop", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::select_principal_from_snapshot", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 0, + "end_line": 618 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsStatusSelection.select_principal_from_snapshot" + }, + { + "def_id": 5, + "lean_name": "AuthsStatusSelection.select_principal_from_snapshot", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::select_principal_from_snapshot", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 541, + "end_line": 640 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.principal", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 486, + "end_line": 502 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "AuthsStatusSelection.select_grant_from_snapshot_loop", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::select_grant_from_snapshot", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 0, + "end_line": 717 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsStatusSelection.select_grant_from_snapshot" + }, + { + "def_id": 6, + "lean_name": "AuthsStatusSelection.select_grant_from_snapshot", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::select_grant_from_snapshot", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 642, + "end_line": 739 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "AuthsStatusSelection.ExactStatusMethod.Insts.Auths_portsStatusMethod.grant", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 504, + "end_line": 520 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 116, + "lean_name": "AuthsStatusSelection.auths_model.bounded.BoundedSet", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::bounded::BoundedSet", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/bounded.rs", + "begin_line": 31, + "end_line": 31 + } + }, + { + "def_id": 88, + "lean_name": "AuthsStatusSelection.auths_model.ProtocolVersion", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::ProtocolVersion", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 88, + "end_line": 88 + } + }, + { + "def_id": 79, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::TrustAnchorId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 9, + "lean_name": "AuthsStatusSelection.auths_model.StatusMethodId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusMethodId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 80, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalMethodId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::PrincipalMethodId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 83, + "lean_name": "AuthsStatusSelection.auths_model.ResourceId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::ResourceId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 87, + "lean_name": "AuthsStatusSelection.auths_model.AssurancePolicyId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::AssurancePolicyId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 115, + "lean_name": "AuthsStatusSelection.auths_model.ProfileId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::ProfileId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 118, + "lean_name": "AuthsStatusSelection.auths_model.Audience", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::Audience", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 119, + "lean_name": "AuthsStatusSelection.auths_model.BudgetAlgebraId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::BudgetAlgebraId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 126, + "lean_name": "AuthsStatusSelection.auths_model.VerificationMethod", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::VerificationMethod", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 127, + "lean_name": "AuthsStatusSelection.auths_model.SignatureSuiteId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::SignatureSuiteId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 128, + "lean_name": "AuthsStatusSelection.auths_model.CapabilityId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::CapabilityId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 129, + "lean_name": "AuthsStatusSelection.auths_model.ExtensionId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::ExtensionId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 3, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::PrincipalId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 154, + "end_line": 154 + } + }, + { + "def_id": 30, + "lean_name": "AuthsStatusSelection.auths_model.Digest", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::Digest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 230, + "end_line": 230 + } + }, + { + "def_id": 11, + "lean_name": "AuthsStatusSelection.auths_model.GrantId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::GrantId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 17, + "lean_name": "AuthsStatusSelection.auths_model.StatusSnapshotId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusSnapshotId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 21, + "lean_name": "AuthsStatusSelection.auths_model.EvidenceId", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::EvidenceId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 5, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::Timestamp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 339, + "end_line": 339 + } + }, + { + "def_id": 85, + "lean_name": "AuthsStatusSelection.auths_model.ValidityWindow", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::ValidityWindow", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 354, + "end_line": 354 + } + }, + { + "def_id": 81, + "lean_name": "AuthsStatusSelection.auths_model.ProfileRef", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::ProfileRef", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 427, + "end_line": 427 + } + }, + { + "def_id": 117, + "lean_name": "AuthsStatusSelection.auths_model.Permission", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::Permission", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 504, + "end_line": 504 + } + }, + { + "def_id": 82, + "lean_name": "AuthsStatusSelection.auths_model.PermissionSet", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::PermissionSet", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 535, + "end_line": 535 + } + }, + { + "def_id": 84, + "lean_name": "AuthsStatusSelection.auths_model.AudienceSet", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::AudienceSet", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 598, + "end_line": 598 + } + }, + { + "def_id": 86, + "lean_name": "AuthsStatusSelection.auths_model.BudgetCeiling", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::BudgetCeiling", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 832, + "end_line": 832 + } + }, + { + "def_id": 16, + "lean_name": "AuthsStatusSelection.auths_model.FreshnessLimit", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::FreshnessLimit", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 960, + "end_line": 960 + } + }, + { + "def_id": 1, + "lean_name": "AuthsStatusSelection.auths_model.StatusPolicy", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusPolicy", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 985, + "end_line": 985 + } + }, + { + "def_id": 120, + "lean_name": "AuthsStatusSelection.auths_model.CriticalExtension", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::CriticalExtension", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1029, + "end_line": 1029 + } + }, + { + "def_id": 89, + "lean_name": "AuthsStatusSelection.auths_model.CriticalExtensions", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::CriticalExtensions", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1060, + "end_line": 1060 + } + }, + { + "def_id": 112, + "lean_name": "AuthsStatusSelection.auths_model.SignatureDescriptor", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::SignatureDescriptor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1147, + "end_line": 1147 + } + }, + { + "def_id": 113, + "lean_name": "AuthsStatusSelection.auths_model.SignatureBytes", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::SignatureBytes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1184, + "end_line": 1184 + } + }, + { + "def_id": 77, + "lean_name": "AuthsStatusSelection.auths_model.SignatureEnvelope", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::SignatureEnvelope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1207, + "end_line": 1207 + } + }, + { + "def_id": 28, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalState", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::PrincipalState", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2063, + "end_line": 2063 + } + }, + { + "def_id": 32, + "lean_name": "AuthsStatusSelection.auths_model.GrantState", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::GrantState", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2070, + "end_line": 2070 + } + }, + { + "def_id": 27, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusStatement", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::PrincipalStatusStatement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2085, + "end_line": 2085 + } + }, + { + "def_id": 19, + "lean_name": "AuthsStatusSelection.auths_model.SignedPrincipalStatus", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::SignedPrincipalStatus", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2171, + "end_line": 2171 + } + }, + { + "def_id": 31, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusStatement", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::GrantStatusStatement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2200, + "end_line": 2200 + } + }, + { + "def_id": 29, + "lean_name": "AuthsStatusSelection.auths_model.SignedGrantStatus", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::SignedGrantStatus", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2286, + "end_line": 2286 + } + }, + { + "def_id": 114, + "lean_name": "AuthsStatusSelection.auths_model.StatusScopeAnchors", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusScopeAnchors", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2311, + "end_line": 2311 + } + }, + { + "def_id": 78, + "lean_name": "AuthsStatusSelection.auths_model.StatusScope", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusScope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2358, + "end_line": 2358 + } + }, + { + "def_id": 24, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchor", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::TrustAnchor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3493, + "end_line": 3493 + } + }, + { + "def_id": 22, + "lean_name": "AuthsStatusSelection.auths_model.StatusTrustRule", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusTrustRule", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2445, + "end_line": 2445 + } + }, + { + "def_id": 4, + "lean_name": "AuthsStatusSelection.auths_model.StatusView", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::StatusView", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2407, + "end_line": 2407 + } + }, + { + "def_id": 2, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalStatusSnapshot", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::PrincipalStatusSnapshot", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2496, + "end_line": 2496 + } + }, + { + "def_id": 10, + "lean_name": "AuthsStatusSelection.auths_model.GrantStatusSnapshot", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_model::GrantStatusSnapshot", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2634, + "end_line": 2634 + } + }, + { + "def_id": 8, + "lean_name": "AuthsStatusSelection.auths_ports.RegistryOperationError", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_ports::RegistryOperationError", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 289, + "end_line": 289 + } + }, + { + "def_id": 25, + "lean_name": "AuthsStatusSelection.auths_ports.StatusDecision", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_ports::StatusDecision", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 433, + "end_line": 433 + } + }, + { + "def_id": 7, + "lean_name": "AuthsStatusSelection.auths_ports.StatusEvaluation", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_ports::StatusEvaluation", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 454, + "end_line": 454 + } + }, + { + "def_id": 0, + "lean_name": "AuthsStatusSelection.ExactStatusMethod", + "lean_file": "qualification/aeneas/generated/status_selection/Types.lean", + "rust_name": "auths_registries::ExactStatusMethod", + "is_local": true, + "source": { + "file": "core/crates/auths-registries/src/lib.rs", + "begin_line": 448, + "end_line": 450 + } + } + ], + "globals": [], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 120, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpPartialEqTrustAnchorId", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 116, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 43, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 6, + "lean_name": "AuthsStatusSelection.auths_model.StatusMethodId.Insts.CoreCmpPartialEqStatusMethodId", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::StatusMethodId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 117, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpPartialOrdTrustAnchorId", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 5, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 108, + "lean_name": "AuthsStatusSelection.auths_model.TrustAnchorId.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 119, + "end_line": 119 + }, + "impl_trait_def_id": 6, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + }, + { + "def_id": 8, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalId.Insts.CoreCmpPartialEqPrincipalId", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalId}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 153, + "end_line": 153 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 59, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 61, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 43, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 7, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 5, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 11, + "lean_name": "AuthsStatusSelection.auths_model.Timestamp.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 6, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + }, + { + "def_id": 9, + "lean_name": "AuthsStatusSelection.auths_model.PrincipalState.Insts.CoreCmpPartialEqPrincipalState", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalState}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2062, + "end_line": 2062 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 14, + "lean_name": "AuthsStatusSelection.auths_model.GrantState.Insts.CoreCmpPartialEqGrantState", + "lean_file": "qualification/aeneas/generated/status_selection/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::GrantState}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2069, + "end_line": 2069 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/generated/stores/Funs.lean b/formal/qualification/aeneas/generated/stores/Funs.lean new file mode 100644 index 000000000..4de29174d --- /dev/null +++ b/formal/qualification/aeneas/generated/stores/Funs.lean @@ -0,0 +1,40 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_stores]: function definitions +import Aeneas +import qualification.aeneas.generated.stores.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace auths_stores + +/-- [auths_stores::gateway_fence::gateway_window_open]: + Source: 'product/stores/auths-stores/src/gateway_fence.rs', lines 7:0-12:1 + Visibility: public -/ +def gateway_fence.gateway_window_open + (expires_at : Std.U64) (collected_through : Option Std.U64) : + Result Bool + := do + match collected_through with + | none => ok true + | some cutoff => ok (expires_at > cutoff) + +/-- [auths_stores::gateway_fence::advance_gateway_collection]: + Source: 'product/stores/auths-stores/src/gateway_fence.rs', lines 18:0-23:1 + Visibility: public -/ +def gateway_fence.advance_gateway_collection + (current : Option Std.U64) (requested : Std.U64) : Result Std.U64 := do + match current with + | none => ok requested + | some previous => if previous > requested + then ok previous + else ok requested + +end auths_stores diff --git a/formal/qualification/aeneas/generated/stores/Types.lean b/formal/qualification/aeneas/generated/stores/Types.lean new file mode 100644 index 000000000..acc3b32a1 --- /dev/null +++ b/formal/qualification/aeneas/generated/stores/Types.lean @@ -0,0 +1,17 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_stores]: type definitions +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace auths_stores + +end auths_stores diff --git a/formal/qualification/aeneas/generated/stores/translation.json b/formal/qualification/aeneas/generated/stores/translation.json new file mode 100644 index 000000000..88bc7ed6a --- /dev/null +++ b/formal/qualification/aeneas/generated/stores/translation.json @@ -0,0 +1,45 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_stores", + "functions": [ + { + "def_id": 0, + "lean_name": "auths_stores.gateway_fence.gateway_window_open", + "lean_file": "qualification/aeneas/generated/stores/Funs.lean", + "rust_name": "auths_stores::gateway_fence::gateway_window_open", + "is_local": true, + "source": { + "file": "product/stores/auths-stores/src/gateway_fence.rs", + "begin_line": 7, + "end_line": 12 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "auths_stores.gateway_fence.advance_gateway_collection", + "lean_file": "qualification/aeneas/generated/stores/Funs.lean", + "rust_name": "auths_stores::gateway_fence::advance_gateway_collection", + "is_local": true, + "source": { + "file": "product/stores/auths-stores/src/gateway_fence.rs", + "begin_line": 18, + "end_line": 23 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + } + ], + "types": [], + "globals": [], + "trait_decls": [], + "trait_impls": [] +} diff --git a/formal/qualification/aeneas/generated/suite_adapter/Funs.lean b/formal/qualification/aeneas/generated/suite_adapter/Funs.lean new file mode 100644 index 000000000..c2716d419 --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/Funs.lean @@ -0,0 +1,107 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature]: function definitions +import Aeneas +import qualification.aeneas.generated.suite_adapter.Types +import qualification.aeneas.generated.suite_adapter.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +variable [edPrimitive : Auths.Crypto.Ed25519Primitives] +variable [p256Primitive : Auths.Crypto.P256Primitives] + +namespace AuthsSuiteAdapters + +/-- [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::Ed25519Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}::call_once]: + Source: 'core/crates/auths-signature/src/lib.rs', lines 52:17-56:9 -/ +def + SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError.call_once + (c : SignatureSuiteEd25519Suite.verify.closure) + (tupled_args : auths_signature_core.Ed25519Error) : + Result auths_ports.SignatureError + := do + match tupled_args with + | auths_signature_core.Ed25519Error.InvalidKey => + ok auths_ports.SignatureError.InvalidKey + | auths_signature_core.Ed25519Error.InvalidSignatureEncoding => + ok auths_ports.SignatureError.InvalidSignatureEncoding + | auths_signature_core.Ed25519Error.VerificationFailed => + ok auths_ports.SignatureError.InvalidSignature + +/-- Trait implementation: [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::Ed25519Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}] + Source: 'core/crates/auths-signature/src/lib.rs', lines 52:17-56:9 -/ +@[reducible] +def + SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError + : core.ops.function.FnOnce SignatureSuiteEd25519Suite.verify.closure + auths_signature_core.Ed25519Error auths_ports.SignatureError := { + call_once := + SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError.call_once +} + +/-- [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify]: + Source: 'core/crates/auths-signature/src/lib.rs', lines 46:4-57:5 + Visibility: public -/ +def Ed25519Suite.Insts.Auths_portsSignatureSuite.verify + (self : Ed25519Suite) (input : auths_ports.SignatureInput) : + Result (core.result.Result Unit auths_ports.SignatureError) + := do + let r ← + auths_signature_core.verify_ed25519 input.verification_key + input.signing_preimage input.signature + core.result.Result.map_err + SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError + r () + +/-- [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::P256Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}::call_once]: + Source: 'core/crates/auths-signature/src/lib.rs', lines 102:17-106:9 -/ +def + SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError.call_once + (c : SignatureSuiteP256Sha256Suite.verify.closure) + (tupled_args : auths_signature_core.P256Error) : + Result auths_ports.SignatureError + := do + match tupled_args with + | auths_signature_core.P256Error.InvalidKey => + ok auths_ports.SignatureError.InvalidKey + | auths_signature_core.P256Error.InvalidSignatureEncoding => + ok auths_ports.SignatureError.InvalidSignatureEncoding + | auths_signature_core.P256Error.VerificationFailed => + ok auths_ports.SignatureError.InvalidSignature + +/-- Trait implementation: [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::P256Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}] + Source: 'core/crates/auths-signature/src/lib.rs', lines 102:17-106:9 -/ +@[reducible] +def + SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError + : core.ops.function.FnOnce SignatureSuiteP256Sha256Suite.verify.closure + auths_signature_core.P256Error auths_ports.SignatureError := { + call_once := + SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError.call_once +} + +/-- [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify]: + Source: 'core/crates/auths-signature/src/lib.rs', lines 96:4-107:5 + Visibility: public -/ +def P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify + (self : P256Sha256Suite) (input : auths_ports.SignatureInput) : + Result (core.result.Result Unit auths_ports.SignatureError) + := do + let r ← + auths_signature_core.verify_p256_sha256 input.verification_key + input.signing_preimage input.signature + core.result.Result.map_err + SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError + r () + +end AuthsSuiteAdapters diff --git a/formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean b/formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean new file mode 100644 index 000000000..1767d3b68 --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean @@ -0,0 +1,77 @@ +-- EXACT DELEGATION TO QUALIFIED OWNING RUST UNITS, WITH EXHAUSTIVE ERROR REBOXING. +-- No Auths algorithm or crypto operation is assumed as an opaque function. +import qualification.aeneas.generated.suite_adapter.Types +import qualification.aeneas.generated.signature.Funs +import qualification.aeneas.generated.p256.Funs +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsSuiteAdapters + +abbrev core.result.Result.map_err := @_root_.core.result.Result.map_err + +def fromEdError : _root_.auths_signature_core.Ed25519Error → auths_signature_core.Ed25519Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def toEdError : auths_signature_core.Ed25519Error → _root_.auths_signature_core.Ed25519Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def fromP256Error : AuthsNativeP256.P256Error → auths_signature_core.P256Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def toP256Error : auths_signature_core.P256Error → AuthsNativeP256.P256Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def edResult : Aeneas.Std.core.result.Result Unit _root_.auths_signature_core.Ed25519Error → + Aeneas.Std.core.result.Result Unit auths_signature_core.Ed25519Error + | .Ok value => .Ok value | .Err reason => .Err (fromEdError reason) + +def p256Result : AuthsNativeP256.core.qualified_p256_type_decls_0 → + Aeneas.Std.core.result.Result Unit auths_signature_core.P256Error + | .Ok value => .Ok value | .Err reason => .Err (fromP256Error reason) + +def auths_signature_core.verify_ed25519 [P : Auths.Crypto.Ed25519Primitives] + (key message signature : Slice Std.U8) : + Result (Aeneas.Std.core.result.Result Unit auths_signature_core.Ed25519Error) := do + let result ← _root_.auths_signature_core.verify_ed25519 (primitives := P) key message signature + ok (edResult result) + +def auths_signature_core.verify_p256_sha256 [P : Auths.Crypto.P256Primitives] + (key message signature : Slice Std.U8) : + Result (Aeneas.Std.core.result.Result Unit auths_signature_core.P256Error) := do + let result ← AuthsNativeP256.verify_p256_sha256 (primitive := P) key message signature + ok (p256Result result) + +-- Both conversions are isomorphisms on the complete error domains. +theorem ed_error_to_from (reason : _root_.auths_signature_core.Ed25519Error) : + toEdError (fromEdError reason) = reason := by cases reason <;> rfl + +theorem ed_error_from_to (reason : auths_signature_core.Ed25519Error) : + fromEdError (toEdError reason) = reason := by cases reason <;> rfl + +theorem p256_error_to_from (reason : AuthsNativeP256.P256Error) : + toP256Error (fromP256Error reason) = reason := by cases reason <;> rfl + +theorem p256_error_from_to (reason : auths_signature_core.P256Error) : + fromP256Error (toP256Error reason) = reason := by cases reason <;> rfl + +theorem ed25519_delegates [P : Auths.Crypto.Ed25519Primitives] + (key message signature : Slice Std.U8) : + auths_signature_core.verify_ed25519 (P := P) key message signature = + (do let result ← _root_.auths_signature_core.verify_ed25519 (primitives := P) key message signature + ok (edResult result)) := rfl + +theorem p256_delegates [P : Auths.Crypto.P256Primitives] + (key message signature : Slice Std.U8) : + auths_signature_core.verify_p256_sha256 (P := P) key message signature = + (do let result ← AuthsNativeP256.verify_p256_sha256 (primitive := P) key message signature + ok (p256Result result)) := rfl + +end AuthsSuiteAdapters diff --git a/formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean new file mode 100644 index 000000000..b64804e94 --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean @@ -0,0 +1,47 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.suite_adapter.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open AuthsSuiteAdapters + +/-- [core::result::{core::result::Result}::map_err]: + Source: '/rustc/library/core/src/result.rs', lines 962:4-964:53 + Name pattern: [core::result::{core::result::Result<@T, @E>}::map_err] + Visibility: public -/ +@[rust_fun "core::result::{core::result::Result<@T, @E>}::map_err"] +axiom core.result.Result.map_err + {T : Type} {E : Type} {F : Type} {O : Type} (opsfunctionFnOnceOTupleEFInst : + core.ops.function.FnOnce O E F) : + core.result.Result T E → O → Result (core.result.Result T F) + +/-- [auths_signature_core::verify_ed25519]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 261:0-265:29 + Name pattern: [auths_signature_core::verify_ed25519] + Visibility: public -/ +@[rust_fun "auths_signature_core::verify_ed25519"] +axiom auths_signature_core.verify_ed25519 + : + Slice Std.U8 → Slice Std.U8 → Slice Std.U8 → Result (core.result.Result + Unit auths_signature_core.Ed25519Error) + +/-- [auths_signature_core::verify_p256_sha256]: + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 381:0-385:26 + Name pattern: [auths_signature_core::verify_p256_sha256] + Visibility: public -/ +@[rust_fun "auths_signature_core::verify_p256_sha256"] +axiom auths_signature_core.verify_p256_sha256 + : + Slice Std.U8 → Slice Std.U8 → Slice Std.U8 → Result (core.result.Result + Unit auths_signature_core.P256Error) + diff --git a/formal/qualification/aeneas/generated/suite_adapter/Types.lean b/formal/qualification/aeneas/generated/suite_adapter/Types.lean new file mode 100644 index 000000000..a36bed7f2 --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/Types.lean @@ -0,0 +1,81 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature]: type definitions +import Aeneas +import Auths.Support.Discriminant +import qualification.aeneas.generated.suite_adapter.TypesExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace AuthsSuiteAdapters + +/-- [auths_ports::SignatureInput] + Source: 'core/crates/auths-ports/src/lib.rs', lines 247:0-247:29 + Name pattern: [auths_ports::SignatureInput] + Visibility: public -/ +@[rust_type "auths_ports::SignatureInput"] +structure auths_ports.SignatureInput where + verification_key : Slice Std.U8 + signing_preimage : Slice Std.U8 + signature : Slice Std.U8 + +/-- [auths_ports::SignatureError] + Source: 'core/crates/auths-ports/src/lib.rs', lines 603:0-603:23 + Name pattern: [auths_ports::SignatureError] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_ports::SignatureError"] +inductive auths_ports.SignatureError where +| InvalidKey : auths_ports.SignatureError +| InvalidSignatureEncoding : auths_ports.SignatureError +| InvalidSignature : auths_ports.SignatureError + +/-- [auths_signature_core::Ed25519Error] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 128:0-128:21 + Name pattern: [auths_signature_core::Ed25519Error] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_signature_core::Ed25519Error"] +inductive auths_signature_core.Ed25519Error where +| InvalidKey : auths_signature_core.Ed25519Error +| InvalidSignatureEncoding : auths_signature_core.Ed25519Error +| VerificationFailed : auths_signature_core.Ed25519Error + +/-- [auths_signature_core::P256Error] + Source: 'core/crates/auths-signature-core/src/lib.rs', lines 151:0-151:18 + Name pattern: [auths_signature_core::P256Error] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_signature_core::P256Error"] +inductive auths_signature_core.P256Error where +| InvalidKey : auths_signature_core.P256Error +| InvalidSignatureEncoding : auths_signature_core.P256Error +| VerificationFailed : auths_signature_core.P256Error + +/-- [auths_signature::Ed25519Suite] + Source: 'core/crates/auths-signature/src/lib.rs', lines 15:0-17:1 + Visibility: public -/ +structure Ed25519Suite where + id : auths_model.SignatureSuiteId + +/-- [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure] + Source: 'core/crates/auths-signature/src/lib.rs', lines 52:17-56:9 -/ +@[reducible] +def SignatureSuiteEd25519Suite.verify.closure := Unit + +/-- [auths_signature::P256Sha256Suite] + Source: 'core/crates/auths-signature/src/lib.rs', lines 65:0-67:1 + Visibility: public -/ +structure P256Sha256Suite where + id : auths_model.SignatureSuiteId + +/-- [auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure] + Source: 'core/crates/auths-signature/src/lib.rs', lines 102:17-106:9 -/ +@[reducible] +def SignatureSuiteP256Sha256Suite.verify.closure := Unit + +end AuthsSuiteAdapters diff --git a/formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean b/formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean new file mode 100644 index 000000000..296ee161a --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean @@ -0,0 +1,6 @@ +-- REVIEWED STRING CARRIER FOR THE UNINSPECTED PRIVATE SUITE-ID FIELD. +-- The verified methods never read it; constructor/registry validity is separate. +import Aeneas +namespace AuthsSuiteAdapters +abbrev auths_model.SignatureSuiteId := Aeneas.Std.Str +end AuthsSuiteAdapters diff --git a/formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean b/formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean new file mode 100644 index 000000000..76eca5cb8 --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean @@ -0,0 +1,22 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_signature]: external types. +-- This is a template file: rename it to "TypesExternal.lean" and fill the holes. +import Aeneas +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/-- [auths_model::SignatureSuiteId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::SignatureSuiteId] + Visibility: public -/ +@[rust_type "auths_model::SignatureSuiteId"] +axiom auths_model.SignatureSuiteId : Type + diff --git a/formal/qualification/aeneas/generated/suite_adapter/translation.json b/formal/qualification/aeneas/generated/suite_adapter/translation.json new file mode 100644 index 000000000..4ec62db4e --- /dev/null +++ b/formal/qualification/aeneas/generated/suite_adapter/translation.json @@ -0,0 +1,270 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_signature", + "functions": [ + { + "def_id": 7, + "lean_name": "AuthsSuiteAdapters.core.result.Result.map_err", + "lean_file": "qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "rust_name": "core::result::{core::result::Result}::map_err", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/result.rs", + "begin_line": 962, + "end_line": 964 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "AuthsSuiteAdapters.auths_signature_core.verify_ed25519", + "lean_file": "qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "rust_name": "auths_signature_core::verify_ed25519", + "is_local": false, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 261, + "end_line": 265 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 12, + "lean_name": "AuthsSuiteAdapters.auths_signature_core.verify_p256_sha256", + "lean_file": "qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "rust_name": "auths_signature_core::verify_p256_sha256", + "is_local": false, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 381, + "end_line": 385 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "AuthsSuiteAdapters.SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError.call_once", + "lean_file": "qualification/aeneas/generated/suite_adapter/Funs.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::Ed25519Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 52, + "end_line": 56 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "AuthsSuiteAdapters.Ed25519Suite.Insts.Auths_portsSignatureSuite.verify", + "lean_file": "qualification/aeneas/generated/suite_adapter/Funs.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 46, + "end_line": 57 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 20, + "lean_name": "AuthsSuiteAdapters.SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError.call_once", + "lean_file": "qualification/aeneas/generated/suite_adapter/Funs.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::P256Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}::call_once", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 102, + "end_line": 106 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "AuthsSuiteAdapters.P256Sha256Suite.Insts.Auths_portsSignatureSuite.verify", + "lean_file": "qualification/aeneas/generated/suite_adapter/Funs.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 96, + "end_line": 107 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 10, + "lean_name": "AuthsSuiteAdapters.auths_model.SignatureSuiteId", + "lean_file": "qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean", + "rust_name": "auths_model::SignatureSuiteId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 1, + "lean_name": "AuthsSuiteAdapters.auths_ports.SignatureInput", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_ports::SignatureInput", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 247, + "end_line": 247 + } + }, + { + "def_id": 3, + "lean_name": "AuthsSuiteAdapters.auths_ports.SignatureError", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_ports::SignatureError", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 603, + "end_line": 603 + } + }, + { + "def_id": 4, + "lean_name": "AuthsSuiteAdapters.auths_signature_core.Ed25519Error", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_signature_core::Ed25519Error", + "is_local": false, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 128, + "end_line": 128 + } + }, + { + "def_id": 7, + "lean_name": "AuthsSuiteAdapters.auths_signature_core.P256Error", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_signature_core::P256Error", + "is_local": false, + "source": { + "file": "core/crates/auths-signature-core/src/lib.rs", + "begin_line": 151, + "end_line": 151 + } + }, + { + "def_id": 0, + "lean_name": "AuthsSuiteAdapters.Ed25519Suite", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_signature::Ed25519Suite", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 15, + "end_line": 17 + } + }, + { + "def_id": 5, + "lean_name": "AuthsSuiteAdapters.SignatureSuiteEd25519Suite.verify.closure", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 52, + "end_line": 56 + } + }, + { + "def_id": 6, + "lean_name": "AuthsSuiteAdapters.P256Sha256Suite", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_signature::P256Sha256Suite", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 65, + "end_line": 67 + } + }, + { + "def_id": 8, + "lean_name": "AuthsSuiteAdapters.SignatureSuiteP256Sha256Suite.verify.closure", + "lean_file": "qualification/aeneas/generated/suite_adapter/Types.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 102, + "end_line": 106 + } + } + ], + "globals": [], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 2, + "lean_name": "AuthsSuiteAdapters.SignatureSuiteEd25519Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleEd25519ErrorSignatureError", + "lean_file": "qualification/aeneas/generated/suite_adapter/Funs.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::Ed25519Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 52, + "end_line": 56 + }, + "impl_trait_def_id": 1, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + }, + { + "def_id": 4, + "lean_name": "AuthsSuiteAdapters.SignatureSuiteP256Sha256Suite.verify.closure.Insts.CoreOpsFunctionFnOnceTupleP256ErrorSignatureError", + "lean_file": "qualification/aeneas/generated/suite_adapter/Funs.lean", + "rust_name": "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::P256Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}", + "is_local": true, + "source": { + "file": "core/crates/auths-signature/src/lib.rs", + "begin_line": 102, + "end_line": 106 + }, + "impl_trait_def_id": 1, + "impl_trait_rust_name": "core::ops::function::FnOnce", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/generated/temporal_witness/Funs.lean b/formal/qualification/aeneas/generated/temporal_witness/Funs.lean new file mode 100644 index 000000000..14e34e43f --- /dev/null +++ b/formal/qualification/aeneas/generated/temporal_witness/Funs.lean @@ -0,0 +1,340 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_verifier]: function definitions +import Aeneas +import qualification.aeneas.generated.temporal_witness.Types +import qualification.aeneas.generated.temporal_witness.FunsExternal +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +/- You can remove the following line by using the CLI option `-all-computable`: -/ +noncomputable section + +namespace AuthsTemporalWitness + +/-- [auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}::eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:33-338:42 + Name pattern: [auths_model::{core::cmp::PartialEq}::eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialEq}::eq"] +def auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp.eq + (self : auths_model.Timestamp) (other : auths_model.Timestamp) : + Result Bool + := do + ok (self = other) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:33-338:42 + Name pattern: [core::cmp::PartialEq] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialEq"] +def auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp : core.cmp.PartialEq + auths_model.Timestamp auths_model.Timestamp := { + eq := auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp.eq +} + +/-- [auths_model::{impl core::cmp::Eq for auths_model::Timestamp}::assert_fields_are_eq]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:29-338:31 + Name pattern: [auths_model::{core::cmp::Eq}::assert_fields_are_eq] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::Eq}::assert_fields_are_eq"] +def auths_model.Timestamp.Insts.CoreCmpEq.assert_fields_are_eq + (self : auths_model.Timestamp) : Result Unit := do + ok () + +/-- Trait implementation: [auths_model::{impl core::cmp::Eq for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:29-338:31 + Name pattern: [core::cmp::Eq] -/ +@[reducible, rust_trait_impl "core::cmp::Eq"] +def auths_model.Timestamp.Insts.CoreCmpEq : core.cmp.Eq auths_model.Timestamp + := { + partialEqInst := auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp + assert_fields_are_eq := + auths_model.Timestamp.Insts.CoreCmpEq.assert_fields_are_eq +} + +/-- [auths_model::{impl core::cmp::Ord for auths_model::Timestamp}::cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:44-338:47 + Name pattern: [auths_model::{core::cmp::Ord}::cmp] + Visibility: public -/ +@[rust_fun "auths_model::{core::cmp::Ord}::cmp"] +def auths_model.Timestamp.Insts.CoreCmpOrd.cmp + (self : auths_model.Timestamp) (other : auths_model.Timestamp) : + Result Ordering + := do + ok (core.cmp.impls.OrdU64.cmp self other) + +/-- [auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}::partial_cmp]: + Source: 'core/crates/auths-model/src/lib.rs', lines 338:49-338:59 + Name pattern: [auths_model::{core::cmp::PartialOrd}::partial_cmp] + Visibility: public -/ +@[rust_fun + "auths_model::{core::cmp::PartialOrd}::partial_cmp"] +def auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp + (self : auths_model.Timestamp) (other : auths_model.Timestamp) : + Result (Option Ordering) + := do + let o ← auths_model.Timestamp.Insts.CoreCmpOrd.cmp self other + ok (some o) + +/-- Trait implementation: [auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:49-338:59 + Name pattern: [core::cmp::PartialOrd] -/ +@[reducible, rust_trait_impl + "core::cmp::PartialOrd"] +impl_def auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp : + core.cmp.PartialOrd auths_model.Timestamp auths_model.Timestamp := { + partialEqInst := auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp + partial_cmp := + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp + lt := core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp +} + +/-- Trait implementation: [auths_model::{impl core::cmp::Ord for auths_model::Timestamp}] + Source: 'core/crates/auths-model/src/lib.rs', lines 338:44-338:47 + Name pattern: [core::cmp::Ord] -/ +@[reducible, rust_trait_impl "core::cmp::Ord"] +impl_def auths_model.Timestamp.Insts.CoreCmpOrd : core.cmp.Ord + auths_model.Timestamp := { + eqInst := auths_model.Timestamp.Insts.CoreCmpEq + partialOrdInst := auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp + cmp := auths_model.Timestamp.Insts.CoreCmpOrd.cmp + min := core.cmp.Ord.min.trait_default auths_model.Timestamp.Insts.CoreCmpOrd +} + +/-- [auths_model::{auths_model::Timestamp}::new]: + Source: 'core/crates/auths-model/src/lib.rs', lines 343:4-343:42 + Name pattern: [auths_model::{auths_model::Timestamp}::new] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Timestamp}::new"] +def auths_model.Timestamp.new + (seconds : Std.U64) : Result auths_model.Timestamp := do + ok seconds + +/-- [auths_model::{auths_model::Timestamp}::get]: + Source: 'core/crates/auths-model/src/lib.rs', lines 348:4-348:33 + Name pattern: [auths_model::{auths_model::Timestamp}::get] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::Timestamp}::get"] +def auths_model.Timestamp.get + (self : auths_model.Timestamp) : Result Std.U64 := do + ok self + +/-- [auths_model::{auths_model::FreshnessLimit}::get]: + Source: 'core/crates/auths-model/src/lib.rs', lines 978:4-978:33 + Name pattern: [auths_model::{auths_model::FreshnessLimit}::get] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::FreshnessLimit}::get"] +def auths_model.FreshnessLimit.get + (self : auths_model.FreshnessLimit) : Result Std.U64 := do + ok self + +/-- [auths_model::{auths_model::AssuranceClaim}::observed_at]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3220:4-3220:56 + Name pattern: [auths_model::{auths_model::AssuranceClaim}::observed_at] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AssuranceClaim}::observed_at"] +def auths_model.AssuranceClaim.impl.observed_at + (self : auths_model.AssuranceClaim) : + Result (Option auths_model.Timestamp) + := do + ok self.observed_at + +/-- [auths_model::{auths_model::AssuranceRequirement}::maximum_age]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3402:4-3402:61 + Name pattern: [auths_model::{auths_model::AssuranceRequirement}::maximum_age] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AssuranceRequirement}::maximum_age"] +def auths_model.AssuranceRequirement.impl.maximum_age + (self : auths_model.AssuranceRequirement) : + Result (Option auths_model.FreshnessLimit) + := do + ok self.maximum_age + +/-- [auths_model::{auths_model::AssurancePolicy}::requirements]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3436:4-3436:57 + Name pattern: [auths_model::{auths_model::AssurancePolicy}::requirements] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AssurancePolicy}::requirements"] +def auths_model.AssurancePolicy.impl.requirements + (self : auths_model.AssurancePolicy) : + Result (Slice auths_model.AssuranceRequirement) + := do + ok (alloc.vec.Vec.deref self.requirements) + +/-- [auths_model::{auths_model::AssuranceSatisfaction}::requirement_index]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3469:4-3469:48 + Name pattern: [auths_model::{auths_model::AssuranceSatisfaction}::requirement_index] + Visibility: public -/ +@[rust_fun + "auths_model::{auths_model::AssuranceSatisfaction}::requirement_index"] +def auths_model.AssuranceSatisfaction.impl.requirement_index + (self : auths_model.AssuranceSatisfaction) : Result Std.U16 := do + ok self.requirement_index + +/-- [auths_model::{auths_model::AssuranceSatisfaction}::claim]: + Source: 'core/crates/auths-model/src/lib.rs', lines 3481:4-3481:48 + Name pattern: [auths_model::{auths_model::AssuranceSatisfaction}::claim] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::AssuranceSatisfaction}::claim"] +def auths_model.AssuranceSatisfaction.impl.claim + (self : auths_model.AssuranceSatisfaction) : + Result auths_model.AssuranceClaim + := do + ok self.claim + +/-- [auths_model::{auths_model::TrustedContext}::assurance_policy]: + Source: 'core/crates/auths-model/src/lib.rs', lines 4598:4-4598:60 + Name pattern: [auths_model::{auths_model::TrustedContext}::assurance_policy] + Visibility: public -/ +@[rust_fun "auths_model::{auths_model::TrustedContext}::assurance_policy"] +def auths_model.TrustedContext.impl.assurance_policy + (self : auths_model.TrustedContext) : + Result auths_model.AssurancePolicy + := do + ok self.assurance_policy + +/-- [auths_ports::{auths_ports::StatusEvaluation}::valid_through]: + Source: 'core/crates/auths-ports/src/lib.rs', lines 479:4-479:49 + Name pattern: [auths_ports::{auths_ports::StatusEvaluation}::valid_through] + Visibility: public -/ +@[rust_fun "auths_ports::{auths_ports::StatusEvaluation}::valid_through"] +def auths_ports.StatusEvaluation.impl.valid_through + (self : auths_ports.StatusEvaluation) : Result auths_model.Timestamp := do + ok self.valid_through + +/-- [auths_verifier::assurance_horizon]: loop 0: + Source: 'core/crates/auths-verifier/src/lib.rs', lines 1:0-2615:1 -/ +@[rust_loop] +def assurance_horizon_loop + (iter : core.slice.iter.Iter auths_model.AssuranceSatisfaction) + (context : auths_model.TrustedContext) + (valid_through : auths_model.Timestamp) : + Result (core.result.Result auths_model.Timestamp VerificationFailure) + := do + let (o, iter1) ← core.slice.iter.IteratorSliceIter.next iter + match o with + | none => ok (core.result.Result.Ok valid_through) + | some satisfaction => + let ap ← auths_model.TrustedContext.impl.assurance_policy context + let s ← auths_model.AssurancePolicy.impl.requirements ap + let i ← + auths_model.AssuranceSatisfaction.impl.requirement_index satisfaction + let i1 ← lift (core.convert.num.FromUsizeU16.from i) + let o1 ← + core.slice.Slice.get (core.slice.index.SliceIndexUsizeSlice + auths_model.AssuranceRequirement) s i1 + let r ← + core.option.Option.ok_or o1 (VerificationFailure.Indeterminate + auths_model.Requirement.AssuranceRequirementNotMet) + let cf ← core.result.Result.Insts.CoreOpsTry.branch r + match cf with + | core.ops.control_flow.ControlFlow.Continue val => + let o2 ← auths_model.AssuranceRequirement.impl.maximum_age val + match o2 with + | none => assurance_horizon_loop iter1 context valid_through + | some age => + let ac ← auths_model.AssuranceSatisfaction.impl.claim satisfaction + let o3 ← auths_model.AssuranceClaim.impl.observed_at ac + let r1 ← + core.option.Option.ok_or o3 (VerificationFailure.Indeterminate + auths_model.Requirement.AssuranceRequirementNotMet) + let cf1 ← core.result.Result.Insts.CoreOpsTry.branch r1 + match cf1 with + | core.ops.control_flow.ControlFlow.Continue val1 => + let i2 ← auths_model.Timestamp.get val1 + let i3 ← auths_model.FreshnessLimit.get age + let i4 ← lift (core.num.U64.saturating_add i2 i3) + let t ← auths_model.Timestamp.new i4 + let valid_through1 ← + core.cmp.Ord.min.trait_default + auths_model.Timestamp.Insts.CoreCmpOrd valid_through t + assurance_horizon_loop iter1 context valid_through1 + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Timestamp (core.convert.FromSame VerificationFailure) + residual + | core.ops.control_flow.ControlFlow.Break residual => + core.result.Result.Insts.CoreOpsTryTraitFromResidualResultInfallible.from_residual + auths_model.Timestamp (core.convert.FromSame VerificationFailure) + residual +partial_fixpoint + +/-- [auths_verifier::assurance_horizon]: + Source: 'core/crates/auths-verifier/src/lib.rs', lines 2589:0-2615:1 -/ +def assurance_horizon + (satisfactions : Slice auths_model.AssuranceSatisfaction) + (context : auths_model.TrustedContext) : + Result (core.result.Result auths_model.Timestamp VerificationFailure) + := do + let valid_through ← auths_model.Timestamp.new core.num.U64.MAX + let iter ← + SharedSlice.Insts.CoreIterTraitsCollectIntoIteratorSharedIter.into_iter + satisfactions + assurance_horizon_loop iter context valid_through + +/-- [auths_verifier::status_horizon]: + Source: 'core/crates/auths-verifier/src/lib.rs', lines 2848:0-2857:1 -/ +def status_horizon + (evaluation : auths_ports.StatusEvaluation) + (evaluation_time : auths_model.Timestamp) : + Result (core.result.Result auths_model.Timestamp VerificationFailure) + := do + let t ← auths_ports.StatusEvaluation.impl.valid_through evaluation + let b ← + core.cmp.PartialOrd.lt.default + auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp t evaluation_time + if b + then + ok (core.result.Result.Err (VerificationFailure.Indeterminate + auths_model.Requirement.StaleStatus)) + else ok (core.result.Result.Ok t) + +/-- [auths_verifier::status_decision]: + Source: 'core/crates/auths-verifier/src/lib.rs', lines 2859:0-2883:1 -/ +def status_decision + (decision : auths_ports.StatusDecision) (principal : Bool) : + Result (core.result.Result Unit VerificationFailure) + := do + match decision with + | auths_ports.StatusDecision.Active => ok (core.result.Result.Ok ()) + | auths_ports.StatusDecision.Revoked => + if principal + then + ok (core.result.Result.Err (VerificationFailure.Denied + auths_model.DenialReason.PrincipalRevoked)) + else + ok (core.result.Result.Err (VerificationFailure.Denied + auths_model.DenialReason.GrantRevoked)) + | auths_ports.StatusDecision.Missing => + if principal + then + ok (core.result.Result.Err (VerificationFailure.Indeterminate + auths_model.Requirement.MissingPrincipalStatus)) + else + ok (core.result.Result.Err (VerificationFailure.Indeterminate + auths_model.Requirement.MissingGrantStatus)) + | auths_ports.StatusDecision.Stale => + ok (core.result.Result.Err (VerificationFailure.Indeterminate + auths_model.Requirement.StaleStatus)) + | auths_ports.StatusDecision.Rollback => + ok (core.result.Result.Err (VerificationFailure.Denied + auths_model.DenialReason.StatusSequenceRollback)) + | auths_ports.StatusDecision.UntrustedIssuer => + ok (core.result.Result.Err (VerificationFailure.Denied + auths_model.DenialReason.StatusIssuerUntrusted)) + | auths_ports.StatusDecision.WrongMethod => + ok (core.result.Result.Err (VerificationFailure.Denied + auths_model.DenialReason.StatusMethodMismatch)) + +end AuthsTemporalWitness diff --git a/formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean b/formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean new file mode 100644 index 000000000..271416311 --- /dev/null +++ b/formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean @@ -0,0 +1,15 @@ +import qualification.aeneas.generated.temporal_witness.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsTemporalWitness +@[trait_default] +def core.cmp.PartialOrd.lt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right +abbrev core.option.Option.ok_or := @_root_.core.option.Option.ok_or +theorem lt_default_delegates {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs) : + core.cmp.PartialOrd.lt.default implementation left right = + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right := rfl +end AuthsTemporalWitness diff --git a/formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean b/formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean new file mode 100644 index 000000000..274a35f20 --- /dev/null +++ b/formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean @@ -0,0 +1,25 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_verifier]: external functions. +-- This is a template file: rename it to "FunsExternal.lean" and fill the holes. +import Aeneas +import qualification.aeneas.generated.temporal_witness.Types +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 +open AuthsTemporalWitness + +/-- [core::option::{core::option::Option}::ok_or]: + Source: '/rustc/library/core/src/option.rs', lines 1334:4-1334:73 + Name pattern: [core::option::{core::option::Option<@T>}::ok_or] + Visibility: public -/ +@[rust_fun "core::option::{core::option::Option<@T>}::ok_or"] +axiom core.option.Option.ok_or + {T : Type} {E : Type} : Option T → E → Result (core.result.Result T E) + diff --git a/formal/qualification/aeneas/generated/temporal_witness/Types.lean b/formal/qualification/aeneas/generated/temporal_witness/Types.lean new file mode 100644 index 000000000..8b7e4a11c --- /dev/null +++ b/formal/qualification/aeneas/generated/temporal_witness/Types.lean @@ -0,0 +1,828 @@ +-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS +-- [auths_verifier]: type definitions +import Aeneas +import Auths.Support.Discriminant +open Aeneas Aeneas.Std Result ControlFlow Error +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false + +/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/ +set_option maxHeartbeats 1000000 + +/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/ +set_option maxRecDepth 2048 + +namespace AuthsTemporalWitness + +/-- [auths_model::PrincipalId] + Source: 'core/crates/auths-model/src/lib.rs', lines 154:0-154:22 + Name pattern: [auths_model::PrincipalId] + Visibility: public -/ +@[reducible, rust_type "auths_model::PrincipalId"] +def auths_model.PrincipalId := String + +/-- [auths_model::approval::ApprovalRequirement] + Source: 'core/crates/auths-model/src/approval.rs', lines 39:0-39:30 + Name pattern: [auths_model::approval::ApprovalRequirement] + Visibility: public -/ +@[rust_type "auths_model::approval::ApprovalRequirement"] +structure auths_model.approval.ApprovalRequirement where + approvers : alloc.vec.Vec auths_model.PrincipalId + threshold : Std.U16 + +/-- [auths_model::FreshnessLimit] + Source: 'core/crates/auths-model/src/lib.rs', lines 960:0-960:25 + Name pattern: [auths_model::FreshnessLimit] + Visibility: public -/ +@[reducible, rust_type "auths_model::FreshnessLimit"] +def auths_model.FreshnessLimit := Std.U64 + +/-- [auths_model::StatusMethodId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::StatusMethodId] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusMethodId"] +def auths_model.StatusMethodId := String + +/-- [auths_model::StatusPolicy] + Source: 'core/crates/auths-model/src/lib.rs', lines 985:0-985:21 + Name pattern: [auths_model::StatusPolicy] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::StatusPolicy"] +inductive auths_model.StatusPolicy where +| ExpiryOnly : auths_model.StatusPolicy +| SnapshotRequired : + auths_model.StatusMethodId → + auths_model.FreshnessLimit → + auths_model.StatusPolicy + +/-- [auths_model::Timestamp] + Source: 'core/crates/auths-model/src/lib.rs', lines 339:0-339:20 + Name pattern: [auths_model::Timestamp] + Visibility: public -/ +@[reducible, rust_type "auths_model::Timestamp"] +def auths_model.Timestamp := Std.U64 + +/-- [auths_model::ValidityWindow] + Source: 'core/crates/auths-model/src/lib.rs', lines 354:0-354:25 + Name pattern: [auths_model::ValidityWindow] + Visibility: public -/ +@[rust_type "auths_model::ValidityWindow"] +structure auths_model.ValidityWindow where + not_before : auths_model.Timestamp + expires_at : auths_model.Timestamp + +/-- [auths_model::PrincipalMethodId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::PrincipalMethodId] + Visibility: public -/ +@[reducible, rust_type "auths_model::PrincipalMethodId"] +def auths_model.PrincipalMethodId := String + +/-- [auths_model::approval::ApproverAnchor] + Source: 'core/crates/auths-model/src/approval.rs', lines 122:0-122:25 + Name pattern: [auths_model::approval::ApproverAnchor] + Visibility: public -/ +@[rust_type "auths_model::approval::ApproverAnchor"] +structure auths_model.approval.ApproverAnchor where + principal : auths_model.PrincipalId + accepted_methods : alloc.vec.Vec auths_model.PrincipalMethodId + validity : auths_model.ValidityWindow + status_policy : auths_model.StatusPolicy + +/-- [auths_model::bounded::BoundedSet] + Source: 'core/crates/auths-model/src/bounded.rs', lines 31:0-31:47 + Name pattern: [auths_model::bounded::BoundedSet] + Visibility: public -/ +@[reducible, rust_type "auths_model::bounded::BoundedSet"] +def auths_model.bounded.BoundedSet (T : Type) (MAX : Std.Usize) := + alloc.vec.Vec T + +/-- [auths_model::ProtocolVersion] + Source: 'core/crates/auths-model/src/lib.rs', lines 88:0-88:26 + Name pattern: [auths_model::ProtocolVersion] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProtocolVersion"] +def auths_model.ProtocolVersion := Std.U16 + +/-- [auths_model::Audience] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::Audience] + Visibility: public -/ +@[reducible, rust_type "auths_model::Audience"] +def auths_model.Audience := String + +/-- [auths_model::ResourceMatcherId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ResourceMatcherId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ResourceMatcherId"] +def auths_model.ResourceMatcherId := String + +/-- [auths_model::ProfilePolicyId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ProfilePolicyId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProfilePolicyId"] +def auths_model.ProfilePolicyId := String + +/-- [auths_model::ChannelBindingId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ChannelBindingId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ChannelBindingId"] +def auths_model.ChannelBindingId := String + +/-- [auths_model::AssuranceClaimId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::AssuranceClaimId] + Visibility: public -/ +@[reducible, rust_type "auths_model::AssuranceClaimId"] +def auths_model.AssuranceClaimId := String + +/-- [auths_model::ClaimParameterId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ClaimParameterId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ClaimParameterId"] +def auths_model.ClaimParameterId := String + +/-- [auths_model::EvidenceSourceId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::EvidenceSourceId] + Visibility: public -/ +@[reducible, rust_type "auths_model::EvidenceSourceId"] +def auths_model.EvidenceSourceId := String + +/-- [auths_model::AdapterId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::AdapterId] + Visibility: public -/ +@[reducible, rust_type "auths_model::AdapterId"] +def auths_model.AdapterId := String + +/-- [auths_model::AssurancePolicyId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::AssurancePolicyId] + Visibility: public -/ +@[reducible, rust_type "auths_model::AssurancePolicyId"] +def auths_model.AssurancePolicyId := String + +/-- [auths_model::TrustAnchorId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::TrustAnchorId] + Visibility: public -/ +@[reducible, rust_type "auths_model::TrustAnchorId"] +def auths_model.TrustAnchorId := String + +/-- [auths_model::ResourceId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ResourceId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ResourceId"] +def auths_model.ResourceId := String + +/-- [auths_model::SignatureSuiteId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::SignatureSuiteId] + Visibility: public -/ +@[reducible, rust_type "auths_model::SignatureSuiteId"] +def auths_model.SignatureSuiteId := String + +/-- [auths_model::EvidenceTypeId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::EvidenceTypeId] + Visibility: public -/ +@[reducible, rust_type "auths_model::EvidenceTypeId"] +def auths_model.EvidenceTypeId := String + +/-- [auths_model::AssuranceImplicationId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::AssuranceImplicationId] + Visibility: public -/ +@[reducible, rust_type "auths_model::AssuranceImplicationId"] +def auths_model.AssuranceImplicationId := String + +/-- [auths_model::BudgetAlgebraId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::BudgetAlgebraId] + Visibility: public -/ +@[reducible, rust_type "auths_model::BudgetAlgebraId"] +def auths_model.BudgetAlgebraId := String + +/-- [auths_model::ExtensionId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ExtensionId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ExtensionId"] +def auths_model.ExtensionId := String + +/-- [auths_model::observation::ObserverAnchorId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::observation::ObserverAnchorId] + Visibility: public -/ +@[reducible, rust_type "auths_model::observation::ObserverAnchorId"] +def auths_model.observation.ObserverAnchorId := String + +/-- [auths_model::observation::ObservationSchemaId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::observation::ObservationSchemaId] + Visibility: public -/ +@[reducible, rust_type "auths_model::observation::ObservationSchemaId"] +def auths_model.observation.ObservationSchemaId := String + +/-- [auths_model::ProfileId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::ProfileId] + Visibility: public -/ +@[reducible, rust_type "auths_model::ProfileId"] +def auths_model.ProfileId := String + +/-- [auths_model::CapabilityId] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::CapabilityId] + Visibility: public -/ +@[reducible, rust_type "auths_model::CapabilityId"] +def auths_model.CapabilityId := String + +/-- [auths_model::VerificationMethod] + Source: 'core/crates/auths-model/src/lib.rs', lines 120:8-120:33 + Name pattern: [auths_model::VerificationMethod] + Visibility: public -/ +@[reducible, rust_type "auths_model::VerificationMethod"] +def auths_model.VerificationMethod := String + +/-- [auths_model::Digest] + Source: 'core/crates/auths-model/src/lib.rs', lines 230:0-230:17 + Name pattern: [auths_model::Digest] + Visibility: public -/ +@[reducible, rust_type "auths_model::Digest"] +def auths_model.Digest := Array Std.U8 32#usize + +/-- [auths_model::EvidenceId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::EvidenceId] + Visibility: public -/ +@[reducible, rust_type "auths_model::EvidenceId"] +def auths_model.EvidenceId := auths_model.Digest + +/-- [auths_model::VerifierConfigurationId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::VerifierConfigurationId] + Visibility: public -/ +@[reducible, rust_type "auths_model::VerifierConfigurationId"] +def auths_model.VerifierConfigurationId := auths_model.Digest + +/-- [auths_model::PlanId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::PlanId] + Visibility: public -/ +@[reducible, rust_type "auths_model::PlanId"] +def auths_model.PlanId := auths_model.Digest + +/-- [auths_model::RegistryManifestId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::RegistryManifestId] + Visibility: public -/ +@[reducible, rust_type "auths_model::RegistryManifestId"] +def auths_model.RegistryManifestId := auths_model.Digest + +/-- [auths_model::StatusSnapshotId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::StatusSnapshotId] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusSnapshotId"] +def auths_model.StatusSnapshotId := auths_model.Digest + +/-- [auths_model::GrantId] + Source: 'core/crates/auths-model/src/lib.rs', lines 249:8-249:33 + Name pattern: [auths_model::GrantId] + Visibility: public -/ +@[reducible, rust_type "auths_model::GrantId"] +def auths_model.GrantId := auths_model.Digest + +/-- [auths_model::Challenge] + Source: 'core/crates/auths-model/src/lib.rs', lines 308:0-308:20 + Name pattern: [auths_model::Challenge] + Visibility: public -/ +@[reducible, rust_type "auths_model::Challenge"] +def auths_model.Challenge := Array Std.U8 32#usize + +/-- [auths_model::ProfileRef] + Source: 'core/crates/auths-model/src/lib.rs', lines 427:0-427:21 + Name pattern: [auths_model::ProfileRef] + Visibility: public -/ +@[rust_type "auths_model::ProfileRef"] +structure auths_model.ProfileRef where + id : auths_model.ProfileId + version : Std.U16 + +/-- [auths_model::Permission] + Source: 'core/crates/auths-model/src/lib.rs', lines 504:0-504:21 + Name pattern: [auths_model::Permission] + Visibility: public -/ +@[rust_type "auths_model::Permission"] +structure auths_model.Permission where + capability : auths_model.CapabilityId + resource : auths_model.ResourceId + +/-- [auths_model::PermissionSet] + Source: 'core/crates/auths-model/src/lib.rs', lines 535:0-535:24 + Name pattern: [auths_model::PermissionSet] + Visibility: public -/ +@[reducible, rust_type "auths_model::PermissionSet"] +def auths_model.PermissionSet := + auths_model.bounded.BoundedSet auths_model.Permission 1024#usize + +/-- [auths_model::AudienceSet] + Source: 'core/crates/auths-model/src/lib.rs', lines 598:0-598:22 + Name pattern: [auths_model::AudienceSet] + Visibility: public -/ +@[reducible, rust_type "auths_model::AudienceSet"] +def auths_model.AudienceSet := + auths_model.bounded.BoundedSet auths_model.Audience 256#usize + +/-- [auths_model::BudgetCeiling] + Source: 'core/crates/auths-model/src/lib.rs', lines 832:0-832:24 + Name pattern: [auths_model::BudgetCeiling] + Visibility: public -/ +@[rust_type "auths_model::BudgetCeiling"] +structure auths_model.BudgetCeiling where + algebra : auths_model.BudgetAlgebraId + value : Std.U64 + +/-- [auths_model::CriticalExtension] + Source: 'core/crates/auths-model/src/lib.rs', lines 1029:0-1029:28 + Name pattern: [auths_model::CriticalExtension] + Visibility: public -/ +@[rust_type "auths_model::CriticalExtension"] +structure auths_model.CriticalExtension where + id : auths_model.ExtensionId + bytes : alloc.vec.Vec Std.U8 + +/-- [auths_model::CriticalExtensions] + Source: 'core/crates/auths-model/src/lib.rs', lines 1060:0-1060:29 + Name pattern: [auths_model::CriticalExtensions] + Visibility: public -/ +@[reducible, rust_type "auths_model::CriticalExtensions"] +def auths_model.CriticalExtensions := + alloc.vec.Vec auths_model.CriticalExtension + +/-- [auths_model::SignatureDescriptor] + Source: 'core/crates/auths-model/src/lib.rs', lines 1147:0-1147:30 + Name pattern: [auths_model::SignatureDescriptor] + Visibility: public -/ +@[rust_type "auths_model::SignatureDescriptor"] +structure auths_model.SignatureDescriptor where + principal_method : auths_model.PrincipalMethodId + verification_method : auths_model.VerificationMethod + suite : auths_model.SignatureSuiteId + +/-- [auths_model::SignatureBytes] + Source: 'core/crates/auths-model/src/lib.rs', lines 1184:0-1184:25 + Name pattern: [auths_model::SignatureBytes] + Visibility: public -/ +@[reducible, rust_type "auths_model::SignatureBytes"] +def auths_model.SignatureBytes := alloc.vec.Vec Std.U8 + +/-- [auths_model::SignatureEnvelope] + Source: 'core/crates/auths-model/src/lib.rs', lines 1207:0-1207:28 + Name pattern: [auths_model::SignatureEnvelope] + Visibility: public -/ +@[rust_type "auths_model::SignatureEnvelope"] +structure auths_model.SignatureEnvelope where + descriptor : auths_model.SignatureDescriptor + signature : auths_model.SignatureBytes + +/-- [auths_model::PrincipalState] + Source: 'core/crates/auths-model/src/lib.rs', lines 2063:0-2063:23 + Name pattern: [auths_model::PrincipalState] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::PrincipalState"] +inductive auths_model.PrincipalState where +| Active : auths_model.PrincipalState +| Revoked : auths_model.PrincipalState +| Superseded : auths_model.PrincipalState + +/-- [auths_model::GrantState] + Source: 'core/crates/auths-model/src/lib.rs', lines 2070:0-2070:19 + Name pattern: [auths_model::GrantState] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::GrantState"] +inductive auths_model.GrantState where +| Active : auths_model.GrantState +| Revoked : auths_model.GrantState +| Superseded : auths_model.GrantState + +/-- [auths_model::PrincipalStatusStatement] + Source: 'core/crates/auths-model/src/lib.rs', lines 2085:0-2085:35 + Name pattern: [auths_model::PrincipalStatusStatement] + Visibility: public -/ +@[rust_type "auths_model::PrincipalStatusStatement"] +structure auths_model.PrincipalStatusStatement where + version : auths_model.ProtocolVersion + method : auths_model.StatusMethodId + principal : auths_model.PrincipalId + state : auths_model.PrincipalState + sequence : Std.U64 + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + issuer : auths_model.PrincipalId + extensions : auths_model.CriticalExtensions + +/-- [auths_model::SignedPrincipalStatus] + Source: 'core/crates/auths-model/src/lib.rs', lines 2171:0-2171:32 + Name pattern: [auths_model::SignedPrincipalStatus] + Visibility: public -/ +@[rust_type "auths_model::SignedPrincipalStatus"] +structure auths_model.SignedPrincipalStatus where + statement : auths_model.PrincipalStatusStatement + signature : auths_model.SignatureEnvelope + +/-- [auths_model::GrantStatusStatement] + Source: 'core/crates/auths-model/src/lib.rs', lines 2200:0-2200:31 + Name pattern: [auths_model::GrantStatusStatement] + Visibility: public -/ +@[rust_type "auths_model::GrantStatusStatement"] +structure auths_model.GrantStatusStatement where + version : auths_model.ProtocolVersion + method : auths_model.StatusMethodId + grant_id : auths_model.GrantId + state : auths_model.GrantState + sequence : Std.U64 + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + issuer : auths_model.PrincipalId + extensions : auths_model.CriticalExtensions + +/-- [auths_model::SignedGrantStatus] + Source: 'core/crates/auths-model/src/lib.rs', lines 2286:0-2286:28 + Name pattern: [auths_model::SignedGrantStatus] + Visibility: public -/ +@[rust_type "auths_model::SignedGrantStatus"] +structure auths_model.SignedGrantStatus where + statement : auths_model.GrantStatusStatement + signature : auths_model.SignatureEnvelope + +/-- [auths_model::StatusScopeAnchors] + Source: 'core/crates/auths-model/src/lib.rs', lines 2311:0-2311:29 + Name pattern: [auths_model::StatusScopeAnchors] + Visibility: public -/ +@[reducible, rust_type "auths_model::StatusScopeAnchors"] +def auths_model.StatusScopeAnchors := alloc.vec.Vec auths_model.TrustAnchorId + +/-- [auths_model::StatusScope] + Source: 'core/crates/auths-model/src/lib.rs', lines 2358:0-2358:20 + Name pattern: [auths_model::StatusScope] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::StatusScope"] +inductive auths_model.StatusScope where +| OwnAnchor : auths_model.StatusScope +| Anchors : auths_model.StatusScopeAnchors → auths_model.StatusScope +| AnyAnchor : auths_model.StatusScope + +/-- [auths_model::StatusTrustRule] + Source: 'core/crates/auths-model/src/lib.rs', lines 2445:0-2445:26 + Name pattern: [auths_model::StatusTrustRule] + Visibility: public -/ +@[rust_type "auths_model::StatusTrustRule"] +structure auths_model.StatusTrustRule where + method : auths_model.StatusMethodId + issuer : auths_model.PrincipalId + sequence_floor : Std.U64 + scope : auths_model.StatusScope + +/-- [auths_model::PrincipalStatusSnapshot] + Source: 'core/crates/auths-model/src/lib.rs', lines 2496:0-2496:34 + Name pattern: [auths_model::PrincipalStatusSnapshot] + Visibility: public -/ +@[rust_type "auths_model::PrincipalStatusSnapshot"] +structure auths_model.PrincipalStatusSnapshot where + id : auths_model.StatusSnapshotId + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + statements : alloc.vec.Vec auths_model.SignedPrincipalStatus + checkpoints : alloc.vec.Vec auths_model.EvidenceId + trust : alloc.vec.Vec auths_model.StatusTrustRule + +/-- [auths_model::GrantStatusSnapshot] + Source: 'core/crates/auths-model/src/lib.rs', lines 2634:0-2634:30 + Name pattern: [auths_model::GrantStatusSnapshot] + Visibility: public -/ +@[rust_type "auths_model::GrantStatusSnapshot"] +structure auths_model.GrantStatusSnapshot where + id : auths_model.StatusSnapshotId + observed_at : auths_model.Timestamp + valid_until : auths_model.Timestamp + statements : alloc.vec.Vec auths_model.SignedGrantStatus + checkpoints : alloc.vec.Vec auths_model.EvidenceId + trust : alloc.vec.Vec auths_model.StatusTrustRule + +/-- [auths_model::CompositionRequirement] + Source: 'core/crates/auths-model/src/lib.rs', lines 2932:0-2932:33 + Name pattern: [auths_model::CompositionRequirement] + Visibility: public -/ +@[rust_type "auths_model::CompositionRequirement"] +structure auths_model.CompositionRequirement where + expected_plan : Option auths_model.PlanId + minimum_authorized_branches : Std.U16 + minimum_distinct_actors : Std.U16 + minimum_distinct_roots : Std.U16 + +/-- [auths_model::ParticipantRole] + Source: 'core/crates/auths-model/src/lib.rs', lines 3154:0-3154:24 + Name pattern: [auths_model::ParticipantRole] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::ParticipantRole"] +inductive auths_model.ParticipantRole where +| Root : auths_model.ParticipantRole +| Intermediate : auths_model.ParticipantRole +| Actor : auths_model.ParticipantRole +| ExternalIssuer : auths_model.ParticipantRole + +/-- [auths_model::AssuranceQuantifier] + Source: 'core/crates/auths-model/src/lib.rs', lines 3164:0-3164:28 + Name pattern: [auths_model::AssuranceQuantifier] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::AssuranceQuantifier"] +inductive auths_model.AssuranceQuantifier where +| Any : auths_model.AssuranceQuantifier +| Every : auths_model.AssuranceQuantifier + +/-- [auths_model::AssuranceClaim] + Source: 'core/crates/auths-model/src/lib.rs', lines 3172:0-3172:25 + Name pattern: [auths_model::AssuranceClaim] + Visibility: public -/ +@[rust_type "auths_model::AssuranceClaim"] +structure auths_model.AssuranceClaim where + kind : auths_model.AssuranceClaimId + «parameters» : alloc.vec.Vec (auths_model.ClaimParameterId × + auths_model.ClaimParameterId) + observed_at : Option auths_model.Timestamp + source : auths_model.EvidenceSourceId + +/-- [auths_model::AssuranceRequirement] + Source: 'core/crates/auths-model/src/lib.rs', lines 3298:0-3298:31 + Name pattern: [auths_model::AssuranceRequirement] + Visibility: public -/ +@[rust_type "auths_model::AssuranceRequirement"] +structure auths_model.AssuranceRequirement where + role : auths_model.ParticipantRole + quantifier : auths_model.AssuranceQuantifier + claim_kind : auths_model.AssuranceClaimId + «parameters» : alloc.vec.Vec (auths_model.ClaimParameterId × + auths_model.ClaimParameterId) + source : Option auths_model.EvidenceSourceId + adapter : Option auths_model.AdapterId + adapter_version : Option Std.U16 + maximum_age : Option auths_model.FreshnessLimit + +/-- [auths_model::AssurancePolicy] + Source: 'core/crates/auths-model/src/lib.rs', lines 3408:0-3408:26 + Name pattern: [auths_model::AssurancePolicy] + Visibility: public -/ +@[rust_type "auths_model::AssurancePolicy"] +structure auths_model.AssurancePolicy where + id : auths_model.AssurancePolicyId + requirements : alloc.vec.Vec auths_model.AssuranceRequirement + +/-- [auths_model::AssuranceSatisfaction] + Source: 'core/crates/auths-model/src/lib.rs', lines 3443:0-3443:32 + Name pattern: [auths_model::AssuranceSatisfaction] + Visibility: public -/ +@[rust_type "auths_model::AssuranceSatisfaction"] +structure auths_model.AssuranceSatisfaction where + requirement_index : Std.U16 + principal : auths_model.PrincipalId + claim : auths_model.AssuranceClaim + evidence : alloc.vec.Vec auths_model.EvidenceId + +/-- [auths_model::TrustAnchor] + Source: 'core/crates/auths-model/src/lib.rs', lines 3493:0-3493:22 + Name pattern: [auths_model::TrustAnchor] + Visibility: public -/ +@[rust_type "auths_model::TrustAnchor"] +structure auths_model.TrustAnchor where + id : auths_model.TrustAnchorId + principal : auths_model.PrincipalId + accepted_methods : alloc.vec.Vec auths_model.PrincipalMethodId + profiles : alloc.vec.Vec auths_model.ProfileRef + permissions : auths_model.PermissionSet + resource_namespaces : alloc.vec.Vec auths_model.ResourceId + audiences : auths_model.AudienceSet + validity : auths_model.ValidityWindow + budget_ceiling : Option auths_model.BudgetCeiling + max_delegation_depth : Std.U16 + assurance_policy : auths_model.AssurancePolicyId + status_policy : auths_model.StatusPolicy + +/-- [auths_model::VerifierLimits] + Source: 'core/crates/auths-model/src/lib.rs', lines 3612:0-3612:25 + Name pattern: [auths_model::VerifierLimits] + Visibility: public -/ +@[rust_type "auths_model::VerifierLimits"] +structure auths_model.VerifierLimits where + bundle_bytes : Std.Usize + action_bytes : Std.Usize + context_bytes : Std.Usize + grants : Std.Usize + actions : Std.Usize + plan_leaves : Std.Usize + plan_depth : Std.Usize + plan_branching : Std.Usize + evidence : Std.Usize + evidence_bytes : Std.Usize + bindings : Std.Usize + principal_status : Std.Usize + grant_status : Std.Usize + attachments : Std.Usize + attachment_bytes : Std.Usize + signatures : Std.Usize + signature_bytes : Std.Usize + permissions : Std.Usize + audiences : Std.Usize + extensions : Std.Usize + extension_bytes : Std.Usize + body_digests : Std.Usize + binding_evidence : Std.Usize + canonical_body_bytes : Std.Usize + registry_entries : Std.Usize + trust_anchors : Std.Usize + work_units : Std.U64 + approvals : Std.Usize + approver_anchors : Std.Usize + approval_requirements : Std.Usize + +/-- [auths_model::AcceptedRegistries] + Source: 'core/crates/auths-model/src/lib.rs', lines 3914:0-3914:29 + Name pattern: [auths_model::AcceptedRegistries] + Visibility: public -/ +@[rust_type "auths_model::AcceptedRegistries"] +structure auths_model.AcceptedRegistries where + manifest_id : auths_model.RegistryManifestId + principal_methods : alloc.vec.Vec auths_model.PrincipalMethodId + signature_suites : alloc.vec.Vec auths_model.SignatureSuiteId + evidence_types : alloc.vec.Vec auths_model.EvidenceTypeId + principal_status_methods : alloc.vec.Vec auths_model.StatusMethodId + grant_status_methods : alloc.vec.Vec auths_model.StatusMethodId + assurance_claims : alloc.vec.Vec auths_model.AssuranceClaimId + assurance_implications : alloc.vec.Vec auths_model.AssuranceImplicationId + resource_matchers : alloc.vec.Vec auths_model.ResourceMatcherId + budget_algebras : alloc.vec.Vec auths_model.BudgetAlgebraId + critical_extensions : alloc.vec.Vec auths_model.ExtensionId + profiles : alloc.vec.Vec auths_model.ProfileRef + profile_policies : alloc.vec.Vec auths_model.ProfilePolicyId + budget_free_profiles : alloc.vec.Vec auths_model.ProfileRef + +/-- [auths_model::observation::ObserverAnchor] + Source: 'core/crates/auths-model/src/observation.rs', lines 483:0-483:25 + Name pattern: [auths_model::observation::ObserverAnchor] + Visibility: public -/ +@[rust_type "auths_model::observation::ObserverAnchor"] +structure auths_model.observation.ObserverAnchor where + id : auths_model.observation.ObserverAnchorId + principal : auths_model.PrincipalId + accepted_methods : alloc.vec.Vec auths_model.PrincipalMethodId + schemas : alloc.vec.Vec auths_model.observation.ObservationSchemaId + subject_namespaces : alloc.vec.Vec auths_model.ResourceId + validity : auths_model.ValidityWindow + +/-- [auths_model::TrustedContext] + Source: 'core/crates/auths-model/src/lib.rs', lines 4235:0-4235:25 + Name pattern: [auths_model::TrustedContext] + Visibility: public -/ +@[rust_type "auths_model::TrustedContext"] +structure auths_model.TrustedContext where + configuration : auths_model.VerifierConfigurationId + composition : auths_model.CompositionRequirement + trust_anchors : alloc.vec.Vec auths_model.TrustAnchor + accepted_registries : auths_model.AcceptedRegistries + expected_audience : auths_model.Audience + expected_challenge : auths_model.Challenge + evaluation_time : auths_model.Timestamp + assurance_policy : auths_model.AssurancePolicy + principal_status_snapshot : auths_model.PrincipalStatusSnapshot + grant_status_snapshot : auths_model.GrantStatusSnapshot + resource_matcher : auths_model.ResourceMatcherId + profile_policy : auths_model.ProfilePolicyId + channel_policy : auths_model.ChannelBindingId + limits : auths_model.VerifierLimits + observer_anchors : alloc.vec.Vec auths_model.observation.ObserverAnchor + approver_anchors : alloc.vec.Vec auths_model.approval.ApproverAnchor + approval_requirements : alloc.vec.Vec + auths_model.approval.ApprovalRequirement + +/-- [auths_model::DenialReason] + Source: 'core/crates/auths-model/src/lib.rs', lines 4928:0-4928:21 + Name pattern: [auths_model::DenialReason] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::DenialReason"] +inductive auths_model.DenialReason where +| MalformedProof : auths_model.DenialReason +| NonCanonicalProof : auths_model.DenialReason +| ResourceLimitExceeded : auths_model.DenialReason +| DigestMismatch : auths_model.DenialReason +| DuplicateObject : auths_model.DenialReason +| MissingReference : auths_model.DenialReason +| ReferenceCycle : auths_model.DenialReason +| AmbiguousTerminalGrant : auths_model.DenialReason +| UnusedCriticalEvidence : auths_model.DenialReason +| InvalidSignature : auths_model.DenialReason +| PrincipalMethodMismatch : auths_model.DenialReason +| VerificationMethodMismatch : auths_model.DenialReason +| SignatureSuiteMismatch : auths_model.DenialReason +| UntrustedRoot : auths_model.DenialReason +| BrokenGrantChain : auths_model.DenialReason +| DelegationExpanded : auths_model.DenialReason +| PermissionNotGranted : auths_model.DenialReason +| ActionConstraintMismatch : auths_model.DenialReason +| BudgetCeilingExceeded : auths_model.DenialReason +| AuthorizationPlanInvalid : auths_model.DenialReason +| CompositionRequirementNotMet : auths_model.DenialReason +| PlanActionMismatch : auths_model.DenialReason +| ActionBodyMismatch : auths_model.DenialReason +| AudienceMismatch : auths_model.DenialReason +| ChallengeMismatch : auths_model.DenialReason +| ActionOutsideValidity : auths_model.DenialReason +| PrincipalRevoked : auths_model.DenialReason +| GrantRevoked : auths_model.DenialReason +| StatusSequenceRollback : auths_model.DenialReason +| StatusMethodMismatch : auths_model.DenialReason +| StatusIssuerUntrusted : auths_model.DenialReason +| RegistryManifestMismatch : auths_model.DenialReason +| VerifierConfigurationMismatch : auths_model.DenialReason +| ResourceNamespaceMismatch : auths_model.DenialReason +| CriticalExtensionUnknown : auths_model.DenialReason +| AttachmentMissing : auths_model.DenialReason +| AttachmentDigestMismatch : auths_model.DenialReason +| AttachmentLengthMismatch : auths_model.DenialReason +| DuplicateAttachment : auths_model.DenialReason +| UnusedCriticalAttachment : auths_model.DenialReason +| OpaqueAttachmentNotAllowed : auths_model.DenialReason +| LocalPolicyDenied : auths_model.DenialReason +| ObservationConditionFalse : auths_model.DenialReason +| ObserverInAuthorityChain : auths_model.DenialReason +| ObservationRequirementDropped : auths_model.DenialReason +| ApprovalThresholdNotMet : auths_model.DenialReason + +/-- [auths_model::Requirement] + Source: 'core/crates/auths-model/src/lib.rs', lines 5113:0-5113:20 + Name pattern: [auths_model::Requirement] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_model::Requirement"] +inductive auths_model.Requirement where +| UnsupportedProtocol : auths_model.Requirement +| UnsupportedPrincipalMethod : auths_model.Requirement +| UnsupportedSignatureSuite : auths_model.Requirement +| UnsupportedEvidenceType : auths_model.Requirement +| UnsupportedStatusMethod : auths_model.Requirement +| UnsupportedProfile : auths_model.Requirement +| UnsupportedProfilePolicy : auths_model.Requirement +| UnsupportedResourceMatcher : auths_model.Requirement +| UnsupportedBudgetAlgebra : auths_model.Requirement +| UnsupportedCriticalExtension : auths_model.Requirement +| UnsupportedAssuranceClaim : auths_model.Requirement +| MissingPrincipalEvidence : auths_model.Requirement +| MissingPrincipalStatus : auths_model.Requirement +| MissingGrantStatus : auths_model.Requirement +| StaleStatus : auths_model.Requirement +| HistoricalStateUnavailable : auths_model.Requirement +| AssuranceRequirementNotMet : auths_model.Requirement +| ExternalFactUnavailable : auths_model.Requirement +| ObservationMissing : auths_model.Requirement +| ObservationActionFactUnavailable : auths_model.Requirement +| ApprovalUnavailable : auths_model.Requirement + +/-- [auths_ports::StatusDecision] + Source: 'core/crates/auths-ports/src/lib.rs', lines 433:0-433:23 + Name pattern: [auths_ports::StatusDecision] + Visibility: public -/ +@[qualified_discriminant isize, rust_type "auths_ports::StatusDecision"] +inductive auths_ports.StatusDecision where +| Active : auths_ports.StatusDecision +| Revoked : auths_ports.StatusDecision +| Missing : auths_ports.StatusDecision +| Stale : auths_ports.StatusDecision +| Rollback : auths_ports.StatusDecision +| UntrustedIssuer : auths_ports.StatusDecision +| WrongMethod : auths_ports.StatusDecision + +/-- [auths_ports::StatusEvaluation] + Source: 'core/crates/auths-ports/src/lib.rs', lines 454:0-454:27 + Name pattern: [auths_ports::StatusEvaluation] + Visibility: public -/ +@[rust_type "auths_ports::StatusEvaluation"] +structure auths_ports.StatusEvaluation where + decision : auths_ports.StatusDecision + valid_through : auths_model.Timestamp + +/-- [auths_verifier::VerificationFailure] + Source: 'core/crates/auths-verifier/src/lib.rs', lines 48:0-53:1 + Visibility: public -/ +@[qualified_discriminant isize] +inductive VerificationFailure where +| Denied : auths_model.DenialReason → VerificationFailure +| Indeterminate : auths_model.Requirement → VerificationFailure + +end AuthsTemporalWitness diff --git a/formal/qualification/aeneas/generated/temporal_witness/translation.json b/formal/qualification/aeneas/generated/temporal_witness/translation.json new file mode 100644 index 000000000..6e013b344 --- /dev/null +++ b/formal/qualification/aeneas/generated/temporal_witness/translation.json @@ -0,0 +1,1340 @@ +{ + "aeneas_version": "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0", + "charon_version": "0.1.225", + "crate": "auths_verifier", + "functions": [ + { + "def_id": 11, + "lean_name": "AuthsTemporalWitness.core.option.Option.ok_or", + "lean_file": "qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean", + "rust_name": "core::option::{core::option::Option}::ok_or", + "is_local": false, + "source": { + "file": "/rustc/library/core/src/option.rs", + "begin_line": 1334, + "end_line": 1334 + }, + "is_opaque": true, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 155, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp.eq", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}::eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 153, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpEq.assert_fields_are_eq", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Timestamp}::assert_fields_are_eq", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 128, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpOrd.cmp", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Timestamp}::cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 137, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp.partial_cmp", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}::partial_cmp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 3, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.new", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::Timestamp}::new", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 343, + "end_line": 343 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 17, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.get", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::Timestamp}::get", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 348, + "end_line": 348 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 18, + "lean_name": "AuthsTemporalWitness.auths_model.FreshnessLimit.get", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::FreshnessLimit}::get", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 978, + "end_line": 978 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 16, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceClaim.impl.observed_at", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::AssuranceClaim}::observed_at", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3220, + "end_line": 3220 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 13, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceRequirement.impl.maximum_age", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::AssuranceRequirement}::maximum_age", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3402, + "end_line": 3402 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 7, + "lean_name": "AuthsTemporalWitness.auths_model.AssurancePolicy.impl.requirements", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::AssurancePolicy}::requirements", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3436, + "end_line": 3436 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 8, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceSatisfaction.impl.requirement_index", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::AssuranceSatisfaction}::requirement_index", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3469, + "end_line": 3469 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 15, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceSatisfaction.impl.claim", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::AssuranceSatisfaction}::claim", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3481, + "end_line": 3481 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 6, + "lean_name": "AuthsTemporalWitness.auths_model.TrustedContext.impl.assurance_policy", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{auths_model::TrustedContext}::assurance_policy", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4598, + "end_line": 4598 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 21, + "lean_name": "AuthsTemporalWitness.auths_ports.StatusEvaluation.impl.valid_through", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_ports::{auths_ports::StatusEvaluation}::valid_through", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 479, + "end_line": 479 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 0, + "lean_name": "AuthsTemporalWitness.assurance_horizon_loop", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_verifier::assurance_horizon", + "is_local": true, + "source": { + "file": "core/crates/auths-verifier/src/lib.rs", + "begin_line": 1, + "end_line": 2615 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": true, + "reducible": false, + "loop": { + "id": 0, + "pos": [ + 0 + ], + "is_body": false + }, + "parent_lean_name": "AuthsTemporalWitness.assurance_horizon" + }, + { + "def_id": 0, + "lean_name": "AuthsTemporalWitness.assurance_horizon", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_verifier::assurance_horizon", + "is_local": true, + "source": { + "file": "core/crates/auths-verifier/src/lib.rs", + "begin_line": 2589, + "end_line": 2615 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": true, + "is_rec": false, + "reducible": false + }, + { + "def_id": 1, + "lean_name": "AuthsTemporalWitness.status_horizon", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_verifier::status_horizon", + "is_local": true, + "source": { + "file": "core/crates/auths-verifier/src/lib.rs", + "begin_line": 2848, + "end_line": 2857 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + }, + { + "def_id": 2, + "lean_name": "AuthsTemporalWitness.status_decision", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_verifier::status_decision", + "is_local": true, + "source": { + "file": "core/crates/auths-verifier/src/lib.rs", + "begin_line": 2859, + "end_line": 2883 + }, + "is_opaque": false, + "can_fail": true, + "can_diverge": false, + "is_rec": false, + "reducible": false + } + ], + "types": [ + { + "def_id": 17, + "lean_name": "AuthsTemporalWitness.auths_model.PrincipalId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PrincipalId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 154, + "end_line": 154 + } + }, + { + "def_id": 35, + "lean_name": "AuthsTemporalWitness.auths_model.approval.ApprovalRequirement", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::approval::ApprovalRequirement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/approval.rs", + "begin_line": 39, + "end_line": 39 + } + }, + { + "def_id": 12, + "lean_name": "AuthsTemporalWitness.auths_model.FreshnessLimit", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::FreshnessLimit", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 960, + "end_line": 960 + } + }, + { + "def_id": 90, + "lean_name": "AuthsTemporalWitness.auths_model.StatusMethodId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::StatusMethodId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 86, + "lean_name": "AuthsTemporalWitness.auths_model.StatusPolicy", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::StatusPolicy", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 985, + "end_line": 985 + } + }, + { + "def_id": 3, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::Timestamp", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 339, + "end_line": 339 + } + }, + { + "def_id": 84, + "lean_name": "AuthsTemporalWitness.auths_model.ValidityWindow", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ValidityWindow", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 354, + "end_line": 354 + } + }, + { + "def_id": 79, + "lean_name": "AuthsTemporalWitness.auths_model.PrincipalMethodId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PrincipalMethodId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 34, + "lean_name": "AuthsTemporalWitness.auths_model.approval.ApproverAnchor", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::approval::ApproverAnchor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/approval.rs", + "begin_line": 122, + "end_line": 122 + } + }, + { + "def_id": 109, + "lean_name": "AuthsTemporalWitness.auths_model.bounded.BoundedSet", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::bounded::BoundedSet", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/bounded.rs", + "begin_line": 31, + "end_line": 31 + } + }, + { + "def_id": 118, + "lean_name": "AuthsTemporalWitness.auths_model.ProtocolVersion", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ProtocolVersion", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 88, + "end_line": 88 + } + }, + { + "def_id": 25, + "lean_name": "AuthsTemporalWitness.auths_model.Audience", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::Audience", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 29, + "lean_name": "AuthsTemporalWitness.auths_model.ResourceMatcherId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ResourceMatcherId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 30, + "lean_name": "AuthsTemporalWitness.auths_model.ProfilePolicyId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ProfilePolicyId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 31, + "lean_name": "AuthsTemporalWitness.auths_model.ChannelBindingId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ChannelBindingId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 38, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceClaimId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssuranceClaimId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 39, + "lean_name": "AuthsTemporalWitness.auths_model.ClaimParameterId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ClaimParameterId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 40, + "lean_name": "AuthsTemporalWitness.auths_model.EvidenceSourceId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::EvidenceSourceId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 41, + "lean_name": "AuthsTemporalWitness.auths_model.AdapterId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AdapterId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 42, + "lean_name": "AuthsTemporalWitness.auths_model.AssurancePolicyId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssurancePolicyId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 78, + "lean_name": "AuthsTemporalWitness.auths_model.TrustAnchorId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::TrustAnchorId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 82, + "lean_name": "AuthsTemporalWitness.auths_model.ResourceId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ResourceId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 88, + "lean_name": "AuthsTemporalWitness.auths_model.SignatureSuiteId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::SignatureSuiteId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 89, + "lean_name": "AuthsTemporalWitness.auths_model.EvidenceTypeId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::EvidenceTypeId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 91, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceImplicationId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssuranceImplicationId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 92, + "lean_name": "AuthsTemporalWitness.auths_model.BudgetAlgebraId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::BudgetAlgebraId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 93, + "lean_name": "AuthsTemporalWitness.auths_model.ExtensionId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ExtensionId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 98, + "lean_name": "AuthsTemporalWitness.auths_model.observation.ObserverAnchorId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::observation::ObserverAnchorId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 99, + "lean_name": "AuthsTemporalWitness.auths_model.observation.ObservationSchemaId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::observation::ObservationSchemaId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 108, + "lean_name": "AuthsTemporalWitness.auths_model.ProfileId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ProfileId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 117, + "lean_name": "AuthsTemporalWitness.auths_model.CapabilityId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::CapabilityId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 127, + "lean_name": "AuthsTemporalWitness.auths_model.VerificationMethod", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::VerificationMethod", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 120, + "end_line": 120 + } + }, + { + "def_id": 76, + "lean_name": "AuthsTemporalWitness.auths_model.Digest", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::Digest", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 230, + "end_line": 230 + } + }, + { + "def_id": 19, + "lean_name": "AuthsTemporalWitness.auths_model.EvidenceId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::EvidenceId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 21, + "lean_name": "AuthsTemporalWitness.auths_model.VerifierConfigurationId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::VerifierConfigurationId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 77, + "lean_name": "AuthsTemporalWitness.auths_model.PlanId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PlanId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 87, + "lean_name": "AuthsTemporalWitness.auths_model.RegistryManifestId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::RegistryManifestId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 94, + "lean_name": "AuthsTemporalWitness.auths_model.StatusSnapshotId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::StatusSnapshotId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 124, + "lean_name": "AuthsTemporalWitness.auths_model.GrantId", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::GrantId", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 249, + "end_line": 249 + } + }, + { + "def_id": 26, + "lean_name": "AuthsTemporalWitness.auths_model.Challenge", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::Challenge", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 308, + "end_line": 308 + } + }, + { + "def_id": 80, + "lean_name": "AuthsTemporalWitness.auths_model.ProfileRef", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ProfileRef", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 427, + "end_line": 427 + } + }, + { + "def_id": 110, + "lean_name": "AuthsTemporalWitness.auths_model.Permission", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::Permission", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 504, + "end_line": 504 + } + }, + { + "def_id": 81, + "lean_name": "AuthsTemporalWitness.auths_model.PermissionSet", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PermissionSet", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 535, + "end_line": 535 + } + }, + { + "def_id": 83, + "lean_name": "AuthsTemporalWitness.auths_model.AudienceSet", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AudienceSet", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 598, + "end_line": 598 + } + }, + { + "def_id": 85, + "lean_name": "AuthsTemporalWitness.auths_model.BudgetCeiling", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::BudgetCeiling", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 832, + "end_line": 832 + } + }, + { + "def_id": 126, + "lean_name": "AuthsTemporalWitness.auths_model.CriticalExtension", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::CriticalExtension", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1029, + "end_line": 1029 + } + }, + { + "def_id": 120, + "lean_name": "AuthsTemporalWitness.auths_model.CriticalExtensions", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::CriticalExtensions", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1060, + "end_line": 1060 + } + }, + { + "def_id": 121, + "lean_name": "AuthsTemporalWitness.auths_model.SignatureDescriptor", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::SignatureDescriptor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1147, + "end_line": 1147 + } + }, + { + "def_id": 122, + "lean_name": "AuthsTemporalWitness.auths_model.SignatureBytes", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::SignatureBytes", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1184, + "end_line": 1184 + } + }, + { + "def_id": 112, + "lean_name": "AuthsTemporalWitness.auths_model.SignatureEnvelope", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::SignatureEnvelope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 1207, + "end_line": 1207 + } + }, + { + "def_id": 119, + "lean_name": "AuthsTemporalWitness.auths_model.PrincipalState", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PrincipalState", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2063, + "end_line": 2063 + } + }, + { + "def_id": 125, + "lean_name": "AuthsTemporalWitness.auths_model.GrantState", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::GrantState", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2070, + "end_line": 2070 + } + }, + { + "def_id": 111, + "lean_name": "AuthsTemporalWitness.auths_model.PrincipalStatusStatement", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PrincipalStatusStatement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2085, + "end_line": 2085 + } + }, + { + "def_id": 95, + "lean_name": "AuthsTemporalWitness.auths_model.SignedPrincipalStatus", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::SignedPrincipalStatus", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2171, + "end_line": 2171 + } + }, + { + "def_id": 114, + "lean_name": "AuthsTemporalWitness.auths_model.GrantStatusStatement", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::GrantStatusStatement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2200, + "end_line": 2200 + } + }, + { + "def_id": 97, + "lean_name": "AuthsTemporalWitness.auths_model.SignedGrantStatus", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::SignedGrantStatus", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2286, + "end_line": 2286 + } + }, + { + "def_id": 123, + "lean_name": "AuthsTemporalWitness.auths_model.StatusScopeAnchors", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::StatusScopeAnchors", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2311, + "end_line": 2311 + } + }, + { + "def_id": 113, + "lean_name": "AuthsTemporalWitness.auths_model.StatusScope", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::StatusScope", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2358, + "end_line": 2358 + } + }, + { + "def_id": 96, + "lean_name": "AuthsTemporalWitness.auths_model.StatusTrustRule", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::StatusTrustRule", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2445, + "end_line": 2445 + } + }, + { + "def_id": 27, + "lean_name": "AuthsTemporalWitness.auths_model.PrincipalStatusSnapshot", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::PrincipalStatusSnapshot", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2496, + "end_line": 2496 + } + }, + { + "def_id": 28, + "lean_name": "AuthsTemporalWitness.auths_model.GrantStatusSnapshot", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::GrantStatusSnapshot", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2634, + "end_line": 2634 + } + }, + { + "def_id": 22, + "lean_name": "AuthsTemporalWitness.auths_model.CompositionRequirement", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::CompositionRequirement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 2932, + "end_line": 2932 + } + }, + { + "def_id": 36, + "lean_name": "AuthsTemporalWitness.auths_model.ParticipantRole", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::ParticipantRole", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3154, + "end_line": 3154 + } + }, + { + "def_id": 37, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceQuantifier", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssuranceQuantifier", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3164, + "end_line": 3164 + } + }, + { + "def_id": 13, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceClaim", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssuranceClaim", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3172, + "end_line": 3172 + } + }, + { + "def_id": 7, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceRequirement", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssuranceRequirement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3298, + "end_line": 3298 + } + }, + { + "def_id": 10, + "lean_name": "AuthsTemporalWitness.auths_model.AssurancePolicy", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssurancePolicy", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3408, + "end_line": 3408 + } + }, + { + "def_id": 0, + "lean_name": "AuthsTemporalWitness.auths_model.AssuranceSatisfaction", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AssuranceSatisfaction", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3443, + "end_line": 3443 + } + }, + { + "def_id": 23, + "lean_name": "AuthsTemporalWitness.auths_model.TrustAnchor", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::TrustAnchor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3493, + "end_line": 3493 + } + }, + { + "def_id": 32, + "lean_name": "AuthsTemporalWitness.auths_model.VerifierLimits", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::VerifierLimits", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3612, + "end_line": 3612 + } + }, + { + "def_id": 24, + "lean_name": "AuthsTemporalWitness.auths_model.AcceptedRegistries", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::AcceptedRegistries", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 3914, + "end_line": 3914 + } + }, + { + "def_id": 33, + "lean_name": "AuthsTemporalWitness.auths_model.observation.ObserverAnchor", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::observation::ObserverAnchor", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/observation.rs", + "begin_line": 483, + "end_line": 483 + } + }, + { + "def_id": 1, + "lean_name": "AuthsTemporalWitness.auths_model.TrustedContext", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::TrustedContext", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4235, + "end_line": 4235 + } + }, + { + "def_id": 16, + "lean_name": "AuthsTemporalWitness.auths_model.DenialReason", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::DenialReason", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 4928, + "end_line": 4928 + } + }, + { + "def_id": 11, + "lean_name": "AuthsTemporalWitness.auths_model.Requirement", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_model::Requirement", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 5113, + "end_line": 5113 + } + }, + { + "def_id": 15, + "lean_name": "AuthsTemporalWitness.auths_ports.StatusDecision", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_ports::StatusDecision", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 433, + "end_line": 433 + } + }, + { + "def_id": 14, + "lean_name": "AuthsTemporalWitness.auths_ports.StatusEvaluation", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_ports::StatusEvaluation", + "is_local": false, + "source": { + "file": "core/crates/auths-ports/src/lib.rs", + "begin_line": 454, + "end_line": 454 + } + }, + { + "def_id": 4, + "lean_name": "AuthsTemporalWitness.VerificationFailure", + "lean_file": "qualification/aeneas/generated/temporal_witness/Types.lean", + "rust_name": "auths_verifier::VerificationFailure", + "is_local": true, + "source": { + "file": "core/crates/auths-verifier/src/lib.rs", + "begin_line": 48, + "end_line": 53 + } + } + ], + "globals": [], + "trait_decls": [], + "trait_impls": [ + { + "def_id": 16, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpPartialEqTimestamp", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 21, + "impl_trait_rust_name": "core::cmp::PartialEq", + "impl_trait_is_builtin": true + }, + { + "def_id": 15, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpEq", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Eq for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 25, + "impl_trait_rust_name": "core::cmp::Eq", + "impl_trait_is_builtin": true + }, + { + "def_id": 10, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpPartialOrdTimestamp", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 4, + "impl_trait_rust_name": "core::cmp::PartialOrd", + "impl_trait_is_builtin": true + }, + { + "def_id": 8, + "lean_name": "AuthsTemporalWitness.auths_model.Timestamp.Insts.CoreCmpOrd", + "lean_file": "qualification/aeneas/generated/temporal_witness/Funs.lean", + "rust_name": "auths_model::{impl core::cmp::Ord for auths_model::Timestamp}", + "is_local": false, + "source": { + "file": "core/crates/auths-model/src/lib.rs", + "begin_line": 338, + "end_line": 338 + }, + "impl_trait_def_id": 3, + "impl_trait_rust_name": "core::cmp::Ord", + "impl_trait_is_builtin": true + } + ] +} diff --git a/formal/qualification/aeneas/qualification.toml b/formal/qualification/aeneas/qualification.toml index 62cc62aad..cd115d4a1 100644 --- a/formal/qualification/aeneas/qualification.toml +++ b/formal/qualification/aeneas/qualification.toml @@ -9,13 +9,86 @@ shipping_target = "workspace-host" extraction_target = "workspace-host" translation_warnings = [] required_compiled_external_axioms = 0 +# Reviewed naming normalization, positive bounded-vector carrier, and official recursive-loop extraction flag. +codegen_normalizations = ["scope-codec-qualified-discriminants-v1", "scope-codec-recursive-loops-v1", "composition-qualified-discriminants-v1", "composition-positive-vector-v1", "composition-recursive-loops-v1", "signature-recursive-loops-v1", "composition-unit-callback-return-v1", "signature-qualified-discriminants-v1", "signature-explicit-primitive-context-v1", "sha256-monomorphic-foreign-names-v1", "sha256-explicit-primitive-context-v1", "p256-monomorphic-export-names-v1", "p256-qualified-discriminants-v1", "p256-explicit-primitive-context-v1", "suite-qualified-discriminants-v1", "suite-explicit-linked-primitive-context-v1", "temporal-qualified-discriminants-v1", "temporal-recursive-loops-v1", "status-selection-qualified-discriminants-v1", "status-selection-recursive-loops-v1", "connection-construction-source-paths-v2", "connections-qualified-discriminants-v1"] source_files = [ + "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "product/runtime/auths-gateway-kernel/src/reservation_retry.rs", + "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "product/runtime/auths-gateway/src/bounds.rs", + "product/runtime/auths-gateway-kernel/src/frontier.rs", + "product/runtime/auths-gateway-kernel/src/identity.rs", + "product/runtime/auths-gateway/src/recipe.rs", + "product/runtime/auths-gateway/src/recipe/lower.rs", + "product/runtime/auths-gateway/src/recipe/strict_json.rs", + "product/runtime/auths-gateway/src/recipe/tests.rs", + "product/runtime/auths-gateway/src/store.rs", + "product/runtime/auths-gateway/src/connection.rs", + "product/runtime/auths-connections/src/model.rs", + "core/crates/auths-model/src/principal_scheme_tests.rs", + "core/crates/auths-model/src/scope_constructor_tests.rs", + "core/crates/auths-codec/src/scope_decode_tests.rs", + "formal/qualification/aeneas/cases/ScopeCodec.lean", + "core/crates/auths-registries/Cargo.toml", + "core/crates/auths-registries/src/lib.rs", + "core/crates/auths-registries/src/status_selection_tests.rs", + "formal/qualification/aeneas/cases/StatusSelection.lean", + "core/crates/auths-verifier/Cargo.toml", + "core/crates/auths-verifier/src/lib.rs", + "core/crates/auths-verifier/src/temporal_tests.rs", + "formal/qualification/aeneas/cases/TemporalWitness.lean", + "core/fixtures/crypto/import_p256_wycheproof.py", + "core/fixtures/crypto/p256-sha256-v1.tsv", + "core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json", + "core/fixtures/crypto/README.md", + "core/crates/auths-signature/tests/p256_corpus.rs", + "bindings/independent/typescript/p256-corpus.test.ts", + "bindings/independent/go/auths/p256_corpus_test.go", + "bindings/independent/typescript/semantic-verifier.ts", + "xtask/src/checks.rs", + "core/crates/auths-signature/Cargo.toml", + "core/crates/auths-signature/src/lib.rs", + "core/crates/auths-ports/Cargo.toml", + "core/crates/auths-ports/src/lib.rs", + "formal/qualification/aeneas/cases/SuiteAdapters.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/qualification/aeneas/cases/P256.lean", + "formal/Auths/Crypto/Sha256Primitives.lean", + "formal/qualification/aeneas/cases/Sha256.lean", + "formal/tools/SourceClosure.lean", + "formal/Auths/Crypto/NativePrimitives.lean", + "core/crates/auths-signature-core/Cargo.toml", + "core/crates/auths-signature-core/src/lib.rs", + "formal/qualification/aeneas/cases/Signature.lean", + "core/crates/auths-composition/Cargo.toml", + "core/crates/auths-composition/src/lib.rs", + "core/crates/auths-composition/src/summary.rs", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/qualification/aeneas/cases/Composition.lean", + "product/stores/auths-stores/Cargo.toml", + "product/stores/auths-stores/src/lib.rs", + "product/stores/auths-stores/src/gateway_fence.rs", + "formal/qualification/aeneas/cases/Stores.lean", + "core/crates/auths-codec/Cargo.toml", + "core/crates/auths-codec/src/lib.rs", + "core/crates/auths-codec/src/cbor.rs", + "core/crates/auths-codec/src/decode.rs", + "core/crates/auths-codec/src/encode.rs", + "core/crates/auths-codec/src/error.rs", + "core/crates/auths-codec/src/hash.rs", + "formal/qualification/aeneas/cases/Codec.lean", ".cargo/config.toml", "Cargo.toml", "Cargo.lock", "core/crates/auths-model/Cargo.toml", "core/crates/auths-model/src/lib.rs", + "core/crates/auths-model/src/identifier.rs", "core/crates/auths-model/src/observation.rs", "core/crates/auths-model/src/bounded_policy.rs", "core/crates/auths-model/src/approval.rs", @@ -34,6 +107,7 @@ source_files = [ "product/runtime/auths-gateway-kernel/Cargo.toml", "product/runtime/auths-gateway-kernel/src/lib.rs", "product/runtime/auths-gateway-kernel/src/construct.rs", + "product/runtime/auths-gateway-kernel/src/deadline.rs", "product/runtime/auths-gateway-kernel/src/order.rs", "product/runtime/auths-gateway-kernel/src/outcome.rs", "product/runtime/auths-gateway-kernel/src/ratio.rs", @@ -56,9 +130,75 @@ source_files = [ "xtask/ci-plan/src/lib.rs", "xtask/src/formal.rs", "xtask/src/formal_qualification.rs", + "formal/qualification/aeneas/entrypoints/profile_construction.rs", ] generated_files = [ + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/translation.json", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/translation.json", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/translation.json", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/translation.json", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/translation.json", + "formal/qualification/aeneas/generated/p256/name-normalization.json", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/translation.json", + "formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json", + "formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/translation.json", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/translation.json", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/translation.json", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/translation.json", "formal/qualification/aeneas/generated/model/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal_Template.lean", @@ -82,13 +222,32 @@ generated_files = [ "formal/qualification/aeneas/generated/lifecycle/translation.json", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean", "formal/qualification/aeneas/generated/gateway/translation.json", "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", "formal/qualification/aeneas/generated/connections/translation.json", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/translation.json", ] case_modules = [ + "qualification.aeneas.cases.ScopeCodec", + "qualification.aeneas.cases.StatusSelection", + "qualification.aeneas.cases.TemporalWitness", + "qualification.aeneas.cases.SuiteAdapters", + "qualification.aeneas.cases.P256", + "qualification.aeneas.cases.Sha256", + "qualification.aeneas.cases.Signature", + "qualification.aeneas.cases.Composition", + "qualification.aeneas.cases.Stores", + "qualification.aeneas.cases.Codec", "qualification.aeneas.cases.Model", "qualification.aeneas.cases.Algebra", "qualification.aeneas.cases.Authority", @@ -107,20 +266,279 @@ aeneas_commit = "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0" lean_toolchain = "leanprover/lean4:v4.31.0" kani = "0.67.0" +[[qualified_delegations]] +importer_translation_json = "formal/qualification/aeneas/generated/suite_adapter/translation.json" +rust_symbol = "auths_signature_core::verify_ed25519" +owner_translation_json = "formal/qualification/aeneas/generated/signature/translation.json" +owner_lean_declaration = "auths_signature_core.verify_ed25519" +bridge_artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +bridge_lean_declaration = "AuthsSuiteAdapters.auths_signature_core.verify_ed25519" +delegation_theorem = "AuthsSuiteAdapters.ed25519_delegates" + +[[qualified_delegations]] +importer_translation_json = "formal/qualification/aeneas/generated/suite_adapter/translation.json" +rust_symbol = "auths_signature_core::verify_p256_sha256" +owner_translation_json = "formal/qualification/aeneas/generated/p256/translation.json" +owner_lean_declaration = "AuthsNativeP256.verify_p256_sha256" +bridge_artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +bridge_lean_declaration = "AuthsSuiteAdapters.auths_signature_core.verify_p256_sha256" +delegation_theorem = "AuthsSuiteAdapters.p256_delegates" + +[[external_models]] +id = "scope-codec-transparent-standard-interfaces" +kind = "transparent-standard-identity-sort-and-range-interface" +artifact = "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean" +rust_symbols = ["alloc::slice::{[T]}::sort", "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", "alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from", "alloc::vec::{alloc::vec::Vec}::is_empty", "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from", "core::convert::num::{impl core::convert::TryFrom for u8}::try_from", "core::ops::range::{core::ops::range::RangeInclusive}::contains", "core::option::Option::Some", "core::option::{core::option::Option}::ok_or", "core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq", "core::result::{core::result::Result}::map", "core::result::{core::result::Result}::map_err", "core::result::{core::result::Result}::unwrap_or", "core::str::converts::from_utf8", "core::str::{str}::as_bytes", "core::str::{str}::is_empty", "core::str::{str}::len"] +authority_semantics = false +reviewed = true +axiom = false +scope = "Checked conversions, Option/Result, UTF-8 and string operations delegate to previously reviewed standard interfaces. Ordinary sorting delegates to the reviewed stable key-sort model with a pure stateless identity key; concrete identity behavior, actual String comparator laws, sorted permutation and constructor validity are proved, not assumed. This is no model of arbitrary stateful FnMut sorting and no proof of Rust standard-library machine code or physical allocation/work. RangeInclusive.contains follows the pinned short-circuit start <= item and item <= end dictionary calls. TypesExternal reuses the existing exact error carrier; no Auths type or algorithm is replaced. Only the four discriminant instance names in Types are qualified; every generated function body is unchanged. Complete byte-decoder correctness and full verification/runtime composition remain open." + +[[external_models]] +id = "status-selection-transparent-standard-interfaces" +kind = "transparent-standard-binary-search-and-dictionary-projections" +artifact = "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean" +rust_symbols = ["core::slice::binary_search", "alloc::string::String::eq", "alloc::string::String::cmp", "core::cmp::PartialOrd::lt", "core::cmp::PartialOrd::gt", "core::cmp::Ord::max"] +authority_semantics = false +reviewed = true +axiom = false +scope = "String equality/ordering delegate to the existing reviewed transparent model. The binary-search model follows the pinned nightly-2026-06-01 core slice binary_search_by size/base/half loop and final comparison, with an initial length-plus-one fuel bound, checked indexing and checked usize construction. It does not replace search with membership or assume sortedness, authenticity or an Auths visibility decision; the separate kernel-checked search-loop proof establishes total membership on bounded sorted scopes, and the Auths contains wrapper derives exact list membership. The ordered representation invariant is not yet derived from the actual sorting/validation constructor. Scoped comparison/max dictionary adapters project only the pinned standard fields and have unconditional compiled delegation equalities. Every Auths helper, comparison, getter and selector body is translated; no Auths algorithm is opaque and no generated function body changes. Published full-selector results fix the approval view. A separate kernel-checked semantic bridge relates the operational scan to the independent filter/max/tie-set specification; all-view source results require ordered listed-anchor scopes. Evidence authentication, sorting-constructor validity and full verifier composition remain separate obligations." + +[[external_models]] +id = "temporal-transparent-standard-interfaces" +kind = "transparent-standard-option-and-dictionary-projection" +artifact = "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean" +rust_symbols = ["core::option::Option::ok_or", "core::cmp::PartialOrd::lt"] +authority_semantics = false +reviewed = true +axiom = false +scope = "Standard Option.ok_or delegates to the previously reviewed transparent model. The scoped PartialOrd default adapter projects exactly the implementation partial_cmp field into the pinned standard default body; its unconditional delegation equality is compiled. The trait_default attribute permits the pinned impl_def macro to resolve the derived nonrecursive Timestamp dictionary. Every Auths function and imported Auths getter/comparison body is translated; no Auths algorithm, clock, witness selection or desired verifier result is an opaque premise. Only discriminant instance names are qualified; every generated function body is unchanged." + +[[external_models]] +id = "suite-private-id-carrier" +kind = "transparent-observational-string-carrier" +artifact = "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean" +rust_symbols = ["auths_model::SignatureSuiteId"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The private suite-ID newtype is represented by its bounded byte/string carrier. The proved verify methods do not inspect self.id, so their statements quantify over the broader represented carrier. No constructor validity, canonical suite ID, configured registry membership or runtime selection follows from this representation." + +[[external_models]] +id = "suite-qualified-native-delegation" +kind = "transparent-qualified-firstparty-function-delegation-and-error-isomorphism" +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean" +rust_symbols = ["auths_signature_core::verify_ed25519", "auths_signature_core::verify_p256_sha256", "core::result::Result::map_err"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The two imported Auths calls delegate directly to their mechanically translated, qualified owning public functions with unchanged key/message/signature slices. Exhaustive error-constructor reboxing has both inverse proofs; standard map_err uses the existing transparent model and the translated error callbacks. The closed qualified_delegations table checks each importing and owning Rust/Lean identity, requires a transparent local owner, and requires both exact owner and bridge constants in a compiled delegation theorem. There is no opaque assumed Auths algorithm, new crypto instance/law, desired-result premise or callback assumption." + +[[external_models]] +id = "p256-monomorphic-export-names" +kind = "typed-ir-name-only-adaptation" +artifact = "formal/qualification/aeneas/generated/p256/name-normalization.json" +rust_symbols = ["auths_signature_core::verify_p256_sha256_with", "auths_signature_core::decode_p256_key_with"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The pinned emitter cannot print Instantiated export paths. Exactly 31 foreign paths receive unique aliases; exactly two unique Auths helper specializations lose only the final name-only Instantiated element, preserving their base source identities. Original concrete names and source spans remain in the ledger. Every body, signature, generic, layout and call/type ID is checked unchanged against the complete typed JSON; the pinned Charon reader reparses the output. Canonical before/after hashes use pinned Charon pretty printing; two fresh translations and generated Lean must match byte-for-byte. No Auths function becomes opaque." + +[[external_models]] +id = "p256-explicit-foreign-types" +kind = "explicit-parameter-foreign-type-interface" +artifact = "formal/qualification/aeneas/generated/p256/TypesExternal.lean" +rust_symbols = ["ecdsa::verifying::VerifyingKey", "ecdsa::Signature", "signature::error::Error"] +authority_semantics = false +reviewed = true +axiom = false +scope = "Foreign key/signature/error types are associated types of the explicit P256Primitives theorem parameter. There is no instance, crypto law, global axiom or opaque Auths type. Per-unit namespace qualification avoids conflating Ed25519 and P-256 implementation parameters. Exact section variables generalize only dependent types and functions; all generated Rust bodies remain unchanged." + +[[external_models]] +id = "p256-explicit-calls-and-standard-results" +kind = "explicit-foreign-parameters-and-transparent-standard-matches" +artifact = "formal/qualification/aeneas/generated/p256/FunsExternal.lean" +rust_symbols = ["ecdsa::VerifyingKey::from_sec1_bytes", "ecdsa::Signature::from_slice", "signature::Verifier::verify", "core::result::Result", "core::convert::TryInto<[u8;64]>", "core::slice::len"] +authority_semantics = false +reviewed = true +axiom = false +scope = "Three actual foreign library calls are transparent projections with displayed functional-contract premises in public wrapper theorems. Monomorphic standard Result/Option/Try/control-flow cases preserve constructors and errors, fixed-array conversion copies exactly 64 source bytes iff length matches, and slice length is exact. The production key validator uses a direct result match, with no erased unit callback or callback assumption. No Auths algorithm is modeled opaquely, no implementation is installed globally, and no crypto-security or arithmetic law is asserted." + +[[external_models]] +id = "sha256-monomorphic-foreign-export-names" +kind = "metadata-only-foreign-name-aliases" +artifact = "formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json" +rust_symbols = ["sha2::Sha256::digest", "core::convert::Into<[u8;32]>::into", "generic_array::GenericArray"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The pinned emitter cannot print foreign Instantiated path elements. Eleven exact foreign declaration-name paths and their metadata cache copies receive unique export aliases. The ledger retains original names, concrete instantiation metadata and source spans. Its before/after hashes use the pinned Charon canonical printer because short-name cache order and hash-cons memo references are nondeterministic; two fresh canonical translations and generated Lean files must still match byte-for-byte. Every Auths name, all declaration fields other than those foreign names, all bodies, signatures, layouts, generics and call/type IDs are checked unchanged. No foreign function is made transparent and no Auths algorithm is replaced. Normalized foreign rust_name values in this unit are export aliases whose exact original identities are this ledger, not new Rust source symbols." + +[[external_models]] +id = "sha256-explicit-output-interface" +kind = "explicit-parameter-foreign-output-type" +artifact = "formal/qualification/aeneas/generated/sha256/TypesExternal.lean" +rust_symbols = ["generic_array::GenericArray"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The selected foreign output is an associated type of the explicit Sha256Primitives parameter. No instance, layout identity or cryptographic law is asserted globally. The output conversion remains an explicit selected primitive call, not an assumed identity." + +[[external_models]] +id = "sha256-explicit-one-shot-calls" +kind = "explicit-parameter-foreign-digest-and-output-conversion" +artifact = "formal/qualification/aeneas/generated/sha256/FunsExternal.lean" +rust_symbols = ["digest::qualified_sha256_fun_decls_1", "core::qualified_sha256_fun_decls_2"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The two metadata-name aliases map to the exact original foreign one-shot digest and selected Into<[u8;32]> conversion in the ledger. Transparent projections use explicit implementation parameters. Their functional SHA-256/output contracts are theorem premises. No streaming operation, global crypto axiom, global implementation instance or opaque Auths algorithm is added." + +[[external_models]] +id = "signature-explicit-foreign-types" +kind = "explicit-parameter-foreign-library-types" +artifact = "formal/qualification/aeneas/generated/signature/TypesExternal.lean" +rust_symbols = ["ed25519::Signature", "ed25519_dalek::verifying::VerifyingKey", "signature::error::Error"] +authority_semantics = false +reviewed = true +axiom = false +scope = "Foreign types are associated types of the explicit Ed25519Primitives theorem parameter. There is no default or global instance, opaque Auths type, or axiom. These aliases do not assert any cryptographic law. The generated section generalizes only declarations depending on this implementation parameter." + +[[external_models]] +id = "signature-explicit-foreign-calls" +kind = "explicit-parameter-foreign-library-calls-and-transparent-result" +artifact = "formal/qualification/aeneas/generated/signature/FunsExternal.lean" +rust_symbols = ["core::result::{core::result::Result}::ok", "core::result::{core::result::Result}::map", "ed25519::{ed25519::Signature}::from_bytes", "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::from_bytes", "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::verify_strict"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The three selected foreign library calls are transparent projections from the explicit Ed25519Primitives parameter. Their exact functional contracts are displayed premises of public-wrapper theorems; no primitive correctness or authenticity is assumed globally. Result-to-Option is an exact transparent standard Result match; Result.map uses the existing reviewed model. Every Auths helper, closure call, wrapper, branch and payload remains mechanically translated." + +[[external_models]] +id = "composition-unit-output-abi" +kind = "transparent-isomorphic-callback-result-representation" +artifact = "formal/Auths/Support/UnitCallback.lean" +rust_symbols = ["core::ops::function::FnMut::call_mut"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The pinned backend erases the concrete unit output of evaluate's stateless observer but retains a generic FnMut dictionary field expecting Unit times state. A single checked dictionary-field adapter restores that component. Both result round trips are proved for every success, failure and divergence value. Every generated Auths function body, constructor, argument, callback call and branch remains unchanged. Only the exact zero-output closure dictionary receives this bridge." + +[[external_models]] +id = "composition-ordered-set-carriers" +kind = "transparent-standard-library-type-model" +artifact = "formal/qualification/aeneas/generated/composition/TypesExternal.lean" +rust_symbols = ["alloc::collections::btree::set::BTreeSet", "alloc::collections::btree::set::IntoIter"] +authority_semantics = false +reviewed = true +axiom = false +scope = "usize-bounded ordered sequences represent the standard ordered set and its consuming iterator. The shipping closure uses Global allocation and copied fixed-width ProofRef values only. Insertion, uniqueness, order, membership and iterator consumption are proved against the transparent model. The Rust standard-library container implementation and physical allocation remain the named library boundary. No Auths function is opaque." + +[[external_models]] +id = "composition-ordered-set-operations" +kind = "transparent-standard-library-function-model" +artifact = "formal/qualification/aeneas/generated/composition/FunsExternal.lean" +rust_symbols = [ + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::new", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::insert", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::len", + "alloc::collections::btree::set::{impl core::iter::traits::collect::IntoIterator> for alloc::collections::btree::set::BTreeSet}::into_iter", + "alloc::collections::btree::set::{impl core::iter::traits::iterator::Iterator for alloc::collections::btree::set::IntoIter}::next" +] +authority_semantics = false +reviewed = true +axiom = false +scope = "new, insertion, length, consuming conversion and next satisfy ordered-set semantics for the actual Global/ProofRef call sites. The translated ProofRef comparison is proved equal to lawful lexicographic byte order; insertion returns true exactly for fresh members, preserves ordering and exact set membership, and checks the usize bound. This is a standard-container semantic contract, not a proof of tree balancing, memory allocation or runtime cost." + +[[external_models]] +id = "composition-positive-bounded-vector" +kind = "transparent-isomorphic-standard-library-type-model" +artifact = "formal/Auths/Support/PositiveVec.lean" +rust_symbols = ["alloc::vec::Vec", "alloc::vec::{impl core::ops::deref::Deref<[T]> for alloc::vec::Vec}::deref"] +authority_semantics = false +reviewed = true +axiom = false +scope = "A strictly positive length-indexed list with the same usize bound as the pinned Aeneas Vec. Both conversion round trips and injectivity are proved for all bounded vectors; deref delegates exactly to the pinned implementation. Only the composition extraction uses this carrier, with capacity, length, emptiness and push links delegating to the pinned model or exact sequence views. Push sequence preservation is proved under the pinned usize capacity premise. No function body or Auths algorithm is replaced." + +[[external_models]] +id = "composition-option-default-and-standard-links" +kind = "transparent-standard-library-model" +artifact = "formal/qualification/aeneas/generated/composition/FunsExternal.lean" +rust_symbols = [ + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "core::option::{impl core::default::Default for core::option::Option}::default", + "core::result::{core::result::Result}::unwrap_or", + "alloc::vec::{alloc::vec::Vec}::is_empty" +] +authority_semantics = false +reviewed = true +axiom = false +scope = "Option::default is None; conversion and Result operations import the existing exact codec models. The positive Vec delegates with_capacity, len and push to the pinned Vec through the proved isomorphism; is_empty views the exact element list. The trait-default Ord::max adapter follows the pinned Rust other-less-than-self branch and preserves its second-argument tie rule. Its sole source call uses Usize and the pinned lawful numeric order. No Auths callback or algorithm is modeled as an external." + +[[external_models]] +id = "codec-utf8-error-erasure" +kind = "transparent-standard-library-type-model" +artifact = "formal/qualification/aeneas/generated/codec/TypesExternal.lean" +rust_symbols = ["core::str::error::Utf8Error"] +authority_semantics = false +reviewed = true +axiom = false +scope = "The private codec discards every UTF-8 error payload and returns Malformed. Unit models that unobserved payload; no public error field is represented by this erasure." + +[[external_models]] +id = "codec-standard-values-and-utf8" +kind = "transparent-standard-library-model" +artifact = "formal/qualification/aeneas/generated/codec/FunsExternal.lean" +rust_symbols = [ + "core::option::{core::option::Option}::and_then", + "core::convert::num::{impl core::convert::TryFrom for isize}::try_from", + "alloc::slice::{[T]}::sort_by_key", + "alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from", + "alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref", + "alloc::vec::{alloc::vec::Vec}::as_slice", + "alloc::vec::{alloc::vec::Vec}::is_empty", + "core::array::{impl core::cmp::Ord for [T; N]}::cmp", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "core::convert::num::{impl core::convert::TryFrom for u16}::try_from", + "core::convert::num::{impl core::convert::TryFrom for u8}::try_from", + "core::option::Option::Some", + "core::option::{core::option::Option}::as_ref", + "core::option::{core::option::Option}::ok_or", + "core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq", + "core::result::{core::result::Result}::map", + "core::result::{core::result::Result}::map_err", + "core::result::{core::result::Result}::unwrap_or", + "core::str::converts::from_utf8", + "core::str::{str}::as_bytes", + "core::str::{str}::is_empty", + "core::str::{str}::len", + ] +authority_semantics = false +reviewed = true +axiom = false +scope = "Fallible usize-to-isize uses the pinned exact signed-bound constructor and returns typed failure outside its range. Option.and_then dispatches exactly on Some/None and calls the selected FnOnce once. Checked unsigned conversions, Option/Result combinators, exact UTF-8 validation and string copying, and Vec projections. The sorting model applies to the sole extracted Unit digest-key closure, whose exact stateless behavior is proved by Auths.Codec.Action.attachment_key_stateless, and the lawful lexicographic digest order; it is not a model of arbitrary stateful FnMut callbacks. The imported array/borrowed-string operations use the separately inventoried standard-ordering-and-bytes model." + [[external_models]] id = "aeneas-standard-ordering-and-bytes" kind = "transparent-standard-library-model" artifact = "formal/qualification/aeneas/generated/model/FunsExternal.lean" rust_symbols = [ + "alloc::string::{impl core::cmp::Eq for alloc::string::String}::assert_fields_are_eq", + "alloc::string::{impl core::cmp::PartialOrd for alloc::string::String}::partial_cmp", "core::array::{impl core::cmp::Ord for [T; N]}::cmp", "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", "alloc::string::{alloc::string::String}::as_bytes", + "core::str::{str}::len", + "core::str::{str}::is_empty", + "core::str::{str}::as_bytes", ] authority_semantics = false reviewed = true axiom = false -scope = "Exact equality and lexicographic ordering for strings and fixed arrays, plus exact UTF-8 bytes for constructor-validated Auths strings; byte conversion fails outside Aeneas' U32 string carrier bound." +scope = "String PartialOrd returns Some of the same exact lexicographic comparison; the Eq marker returns unit without state. Exact equality and lexicographic ordering for strings and fixed arrays, plus exact UTF-8 bytes for constructor-validated Auths strings; byte conversion fails outside Aeneas' U32 string carrier bound. Borrowed str length, emptiness, and byte projection are exact operations on the Aeneas byte-slice carrier, without assuming UTF-8 validity." [[external_models]] id = "authority-carrier-link" @@ -213,13 +631,356 @@ artifact = "formal/.lake/packages/aeneas/backends/lean/AeneasMeta/Utils.lean" upstream_lines = [1344] classification = "Pinned upstream meta proof hole; comments and diagnostic strings are excluded, and audited Auths declarations are separately required to have zero transitive sorryAx dependencies." +[[translations]] +crate_name = "auths_codec" +translation_json = "formal/qualification/aeneas/generated/scope_codec/translation.json" +local_functions = 25 +external_functions = 37 +opaque_local_functions = 0 +required_symbols = ["auths_codec::cbor::malformed", "auths_codec::cbor::read_head", "auths_codec::cbor::read_tail", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64", "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8", "auths_codec::decode::array", "auths_codec::decode::decode_error", "auths_codec::decode::key", "auths_codec::decode::map", "auths_codec::decode::status_scope", "auths_codec::decode::status_scope_anchor", "auths_codec::decode::status_trust", "auths_codec::decode::status_trust_rule", "auths_codec::decode::text", "auths_codec::error::limit_error", "auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}::from"] +allowed_external_symbols = ["alloc::slice::{[T]}::sort", "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", "alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from", "alloc::vec::{alloc::vec::Vec}::is_empty", "auths_model::identifier::bounded_identifier_valid", "auths_model::identifier::contains_forbidden_identifier", "auths_model::identifier::forbidden_identifier_at", "auths_model::identifier::forbidden_three_byte_prefix", "auths_model::identifier::principal_scheme_byte_valid", "auths_model::identifier::principal_scheme_valid", "auths_model::{auths_model::PrincipalId}::parse", "auths_model::{auths_model::StatusMethodId}::parse", "auths_model::{auths_model::StatusScopeAnchors}::new", "auths_model::{auths_model::StatusTrustRule}::new", "auths_model::{auths_model::TrustAnchorId}::parse", "auths_model::{auths_model::VerifierLimits}::get", "auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}::assert_fields_are_eq", "auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}::cmp", "auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}::eq", "auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}::partial_cmp", "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from", "core::convert::num::{impl core::convert::TryFrom for u8}::try_from", "core::ops::range::{core::ops::range::RangeInclusive}::contains", "core::option::Option::Some", "core::option::{core::option::Option}::ok_or", "core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq", "core::result::{core::result::Result}::map", "core::result::{core::result::Result}::map_err", "core::result::{core::result::Result}::unwrap_or", "core::str::converts::from_utf8", "core::str::{str}::as_bytes", "core::str::{str}::is_empty", "core::str::{str}::len"] + +[[translations]] +crate_name = "auths_registries" +translation_json = "formal/qualification/aeneas/generated/status_selection/translation.json" +local_functions = 9 +external_functions = 58 +opaque_local_functions = 0 +required_symbols = ["auths_registries::{auths_registries::ExactStatusMethod}::freshness", "auths_registries::status_sequence_floor", "auths_registries::select_principal_from_snapshot", "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", "auths_registries::select_grant_from_snapshot", "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant"] +allowed_external_symbols = ["core::slice::{[T]}::binary_search", "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", "auths_model::{impl core::cmp::PartialEq for auths_model::TrustAnchorId}::eq", "auths_model::{impl core::cmp::Eq for auths_model::TrustAnchorId}::assert_fields_are_eq", "auths_model::{impl core::cmp::PartialEq for auths_model::StatusMethodId}::eq", "auths_model::{impl core::cmp::Ord for auths_model::TrustAnchorId}::cmp", "auths_model::{impl core::cmp::PartialOrd for auths_model::TrustAnchorId}::partial_cmp", "auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalId}::eq", "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", "auths_model::{impl core::cmp::PartialEq for auths_model::GrantId}::eq", "auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}::eq", "auths_model::{impl core::cmp::Eq for auths_model::Timestamp}::assert_fields_are_eq", "auths_model::{impl core::cmp::Ord for auths_model::Timestamp}::cmp", "auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}::partial_cmp", "auths_model::{auths_model::Timestamp}::new", "auths_model::{auths_model::Timestamp}::get", "auths_model::{auths_model::FreshnessLimit}::get", "auths_model::{impl core::cmp::PartialEq for auths_model::PrincipalState}::eq", "auths_model::{impl core::cmp::PartialEq for auths_model::GrantState}::eq", "auths_model::{auths_model::PrincipalStatusStatement}::method", "auths_model::{auths_model::PrincipalStatusStatement}::principal", "auths_model::{auths_model::PrincipalStatusStatement}::state", "auths_model::{auths_model::PrincipalStatusStatement}::sequence", "auths_model::{auths_model::PrincipalStatusStatement}::observed_at", "auths_model::{auths_model::PrincipalStatusStatement}::valid_until", "auths_model::{auths_model::PrincipalStatusStatement}::issuer", "auths_model::{auths_model::SignedPrincipalStatus}::statement", "auths_model::{auths_model::GrantStatusStatement}::method", "auths_model::{auths_model::GrantStatusStatement}::grant_id", "auths_model::{auths_model::GrantStatusStatement}::state", "auths_model::{auths_model::GrantStatusStatement}::sequence", "auths_model::{auths_model::GrantStatusStatement}::observed_at", "auths_model::{auths_model::GrantStatusStatement}::valid_until", "auths_model::{auths_model::GrantStatusStatement}::issuer", "auths_model::{auths_model::SignedGrantStatus}::statement", "auths_model::{auths_model::StatusScopeAnchors}::contains", "auths_model::{auths_model::TrustAnchor}::principal", "auths_model::{auths_model::TrustAnchor}::id", "auths_model::{auths_model::StatusScope}::covers", "auths_model::{auths_model::StatusTrustRule}::issuer", "auths_model::{auths_model::StatusTrustRule}::scope", "auths_model::status_issuer_in_scope", "auths_model::status_issuer_in_scope", "auths_model::status_issuer_visible", "auths_model::status_issuer_visible", "auths_model::{auths_model::StatusTrustRule}::method", "auths_model::{auths_model::StatusTrustRule}::sequence_floor", "auths_model::{auths_model::PrincipalStatusSnapshot}::observed_at", "auths_model::{auths_model::PrincipalStatusSnapshot}::valid_until", "auths_model::{auths_model::PrincipalStatusSnapshot}::statements", "auths_model::{auths_model::PrincipalStatusSnapshot}::trust", "auths_model::{auths_model::GrantStatusSnapshot}::observed_at", "auths_model::{auths_model::GrantStatusSnapshot}::valid_until", "auths_model::{auths_model::GrantStatusSnapshot}::statements", "auths_model::{auths_model::GrantStatusSnapshot}::trust", "auths_ports::{impl core::cmp::PartialEq for auths_ports::StatusDecision}::eq", "auths_ports::{auths_ports::StatusEvaluation}::new"] + +[[translations]] +crate_name = "auths_verifier" +translation_json = "formal/qualification/aeneas/generated/temporal_witness/translation.json" +local_functions = 4 +external_functions = 15 +opaque_local_functions = 0 +required_symbols = ["auths_verifier::assurance_horizon", "auths_verifier::assurance_horizon", "auths_verifier::status_horizon", "auths_verifier::status_decision"] +allowed_external_symbols = ["core::option::{core::option::Option}::ok_or", "auths_model::{impl core::cmp::PartialEq for auths_model::Timestamp}::eq", "auths_model::{impl core::cmp::Eq for auths_model::Timestamp}::assert_fields_are_eq", "auths_model::{impl core::cmp::Ord for auths_model::Timestamp}::cmp", "auths_model::{impl core::cmp::PartialOrd for auths_model::Timestamp}::partial_cmp", "auths_model::{auths_model::Timestamp}::new", "auths_model::{auths_model::Timestamp}::get", "auths_model::{auths_model::FreshnessLimit}::get", "auths_model::{auths_model::AssuranceClaim}::observed_at", "auths_model::{auths_model::AssuranceRequirement}::maximum_age", "auths_model::{auths_model::AssurancePolicy}::requirements", "auths_model::{auths_model::AssuranceSatisfaction}::requirement_index", "auths_model::{auths_model::AssuranceSatisfaction}::claim", "auths_model::{auths_model::TrustedContext}::assurance_policy", "auths_ports::{auths_ports::StatusEvaluation}::valid_through"] + +[[translations]] +crate_name = "auths_signature" +translation_json = "formal/qualification/aeneas/generated/suite_adapter/translation.json" +local_functions = 4 +external_functions = 3 +opaque_local_functions = 0 +required_symbols = ["auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::Ed25519Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}::call_once", "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::P256Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}::call_once", "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify"] +allowed_external_symbols = ["core::result::{core::result::Result}::map_err", "auths_signature_core::verify_ed25519", "auths_signature_core::verify_p256_sha256"] + +[[translations]] +crate_name = "auths_signature_core" +translation_json = "formal/qualification/aeneas/generated/p256/translation.json" +local_functions = 14 +external_functions = 10 +opaque_local_functions = 0 +required_symbols = ["auths_signature_core::p256_key_encoding_is_canonical", "auths_signature_core::p256_signature_is_low_s", "auths_signature_core::p256_signature_is_low_s", "auths_signature_core::decode_p256_point", "auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::decode", "auths_signature_core::decode_p256_key_with", "auths_signature_core::decode_p256_key", "auths_signature_core::validate_p256_key", "auths_signature_core::parse_p256_signature", "auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::parse", "auths_signature_core::verify_p256_equation", "auths_signature_core::{impl auths_signature_core::P256Primitive for auths_signature_core::NativeP256}::verify", "auths_signature_core::verify_p256_sha256_with", "auths_signature_core::verify_p256_sha256"] +allowed_external_symbols = ["core::qualified_p256_fun_decls_7", "core::qualified_p256_fun_decls_27", "core::qualified_p256_fun_decls_30", "core::qualified_p256_fun_decls_24", "core::qualified_p256_fun_decls_5", "core::qualified_p256_fun_decls_6", "core::qualified_p256_fun_decls_20", "ecdsa::qualified_p256_fun_decls_23", "ecdsa::qualified_p256_fun_decls_29", "ecdsa::qualified_p256_fun_decls_26"] + +[[translations]] +crate_name = "auths_codec" +translation_json = "formal/qualification/aeneas/generated/sha256/translation.json" +local_functions = 1 +external_functions = 3 +opaque_local_functions = 0 +required_symbols = [ + "auths_codec::hash::raw_sha256", +] +allowed_external_symbols = [ + "core::qualified_sha256_fun_decls_2", + "digest::qualified_sha256_fun_decls_1", + "auths_model::{auths_model::Digest}::new", +] + +[[translations]] +crate_name = "auths_signature_core" +translation_json = "formal/qualification/aeneas/generated/signature/translation.json" +local_functions = 23 +external_functions = 5 +opaque_local_functions = 0 +required_symbols = [ + "auths_signature_core::ed25519_point_encoding_is_canonical", + "auths_signature_core::p256_key_encoding_is_canonical", + "auths_signature_core::p256_signature_is_low_s", + "auths_signature_core::ed25519_same_coordinate", + "auths_signature_core::ed25519_has_small_order_coordinate", + "auths_signature_core::ed25519_signature_r_is_allowed", + "auths_signature_core::decode_ed25519_point", + "auths_signature_core::decode_ed25519_key::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::decode_ed25519_key::closure}::call_once", + "auths_signature_core::ed25519_key_encoding", + "auths_signature_core::decode_ed25519_key_with", + "auths_signature_core::decode_ed25519_key", + "auths_signature_core::validate_ed25519_key::{impl core::ops::function::FnOnce<(ed25519_dalek::verifying::VerifyingKey,), ()> for auths_signature_core::validate_ed25519_key::closure}::call_once", + "auths_signature_core::validate_ed25519_key", + "auths_signature_core::verify_ed25519_with", + "auths_signature_core::verify_ed25519_equation", + "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ ed25519_dalek::verifying::VerifyingKey, &'_ [u8], &'_ [u8; 64usize]), bool> for auths_signature_core::verify_ed25519::closure#1}::call_once", + "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::verify_ed25519::closure}::call_once", + "auths_signature_core::verify_ed25519", + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::verify_p256_sha256_with", +] +allowed_external_symbols = [ + "core::result::{core::result::Result}::ok", + "core::result::{core::result::Result}::map", + "ed25519::{ed25519::Signature}::from_bytes", + "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::from_bytes", + "ed25519_dalek::verifying::{ed25519_dalek::verifying::VerifyingKey}::verify_strict", +] + +[[translations]] +crate_name = "auths_composition" +translation_json = "formal/qualification/aeneas/generated/composition/translation.json" +local_functions = 14 +external_functions = 27 +opaque_local_functions = 0 +required_symbols = [ + "auths_composition::{auths_composition::EvaluationEvent}::outcome", + "auths_composition::evaluate", + "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut", + "auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_once", + "core::array::{impl core::cmp::Ord for [T; N]}::cmp", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "core::option::{impl core::default::Default for core::option::Option}::default", + "core::result::{core::result::Result}::unwrap_or", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::new", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::insert", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::len", + "alloc::collections::btree::set::{impl core::iter::traits::collect::IntoIterator> for alloc::collections::btree::set::BTreeSet}::into_iter", + "alloc::collections::btree::set::{impl core::iter::traits::iterator::Iterator for alloc::collections::btree::set::IntoIter}::next", + "alloc::vec::{alloc::vec::Vec}::is_empty", + "auths_algebra_kernel::generated::threshold_counts", + "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", + "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", + "auths_model::{impl core::cmp::PartialEq for auths_model::ProofRef}::eq", + "auths_model::{impl core::cmp::Eq for auths_model::ProofRef}::assert_fields_are_eq", + "auths_model::{impl core::cmp::Ord for auths_model::ProofRef}::cmp", + "auths_model::{impl core::cmp::PartialOrd for auths_model::ProofRef}::partial_cmp", + "auths_model::{auths_model::AuthorizationPlan}::as_ref", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_model::{auths_model::Requirement}::code_order", + "auths_model::{auths_model::Requirement}::code_precedes", + "auths_model::{auths_model::DenialReason}::code_order", + "auths_model::{auths_model::DenialReason}::code_precedes", + "auths_composition::evaluate_threshold_counts", + "auths_composition::summary::threshold", + "auths_composition::summary::all", + "auths_composition::summary::push", + "auths_composition::summary::{impl core::default::Default for auths_composition::summary::Summary}::default", + "auths_composition::observe_aggregate", + "auths_composition::evaluate_members", + "auths_composition::evaluate_node", + "auths_composition::evaluate_observed" +] +allowed_external_symbols = [ + "core::array::{impl core::cmp::Ord for [T; N]}::cmp", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "core::option::{impl core::default::Default for core::option::Option}::default", + "core::result::{core::result::Result}::unwrap_or", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::new", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::insert", + "alloc::collections::btree::set::{alloc::collections::btree::set::BTreeSet}::len", + "alloc::collections::btree::set::{impl core::iter::traits::collect::IntoIterator> for alloc::collections::btree::set::BTreeSet}::into_iter", + "alloc::collections::btree::set::{impl core::iter::traits::iterator::Iterator for alloc::collections::btree::set::IntoIter}::next", + "alloc::vec::{alloc::vec::Vec}::is_empty", + "auths_algebra_kernel::generated::threshold_counts", + "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", + "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", + "auths_model::{impl core::cmp::PartialEq for auths_model::ProofRef}::eq", + "auths_model::{impl core::cmp::Eq for auths_model::ProofRef}::assert_fields_are_eq", + "auths_model::{impl core::cmp::Ord for auths_model::ProofRef}::cmp", + "auths_model::{impl core::cmp::PartialOrd for auths_model::ProofRef}::partial_cmp", + "auths_model::{auths_model::AuthorizationPlan}::as_ref", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_model::{auths_model::Requirement}::code_order", + "auths_model::{auths_model::Requirement}::code_precedes", + "auths_model::{auths_model::DenialReason}::code_order", + "auths_model::{auths_model::DenialReason}::code_precedes" +] + +[[translations]] +crate_name = "auths_stores" +translation_json = "formal/qualification/aeneas/generated/stores/translation.json" +local_functions = 2 +external_functions = 0 +opaque_local_functions = 0 +required_symbols = [ + "auths_stores::gateway_fence::gateway_window_open", + "auths_stores::gateway_fence::advance_gateway_collection", +] +allowed_external_symbols = [] + +[[translations]] +crate_name = "auths_codec" +translation_json = "formal/qualification/aeneas/generated/codec/translation.json" +local_functions = 80 +external_functions = 78 +opaque_local_functions = 0 +required_symbols = [ + "auths_codec::cbor::malformed", + "auths_codec::cbor::{impl core::cmp::PartialEq for auths_codec::cbor::Type}::eq", + "auths_codec::cbor::read_tail", + "auths_codec::cbor::read_head", + "auths_codec::cbor::append_tail", + "auths_codec::cbor::encode_head", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::new", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::at", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::position", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u16", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::bytes", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::null", + "auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::datatype", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::new", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::into_writer", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::head", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::map", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::array", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::u64", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::u16", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::u8", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::payload", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::bytes", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::str", + "auths_codec::cbor::{auths_codec::cbor::Encoder}::null", + "auths_codec::decode::decode_error", + "auths_codec::decode::map", + "auths_codec::error::limit_error", + "auths_codec::decode::array", + "auths_codec::decode::key", + "auths_codec::decode::text", + "auths_codec::decode::bounded_bytes", + "auths_codec::decode::digest_bytes", + "auths_codec::decode::is_null", + "auths_codec::decode::null", + "auths_codec::error::{impl core::convert::From for auths_codec::error::CodecError}::from", + "auths_codec::decode::profile_ref", + "auths_codec::decode::permission", + "auths_codec::decode::budget", + "auths_codec::decode::optional_budget", + "auths_codec::decode::ensure_complete", + "auths_codec::decode::attachment_batch_step", + "auths_codec::decode::attachment_batch", + "auths_codec::encode::encode_error", + "auths_codec::encode::bytes", + "auths_codec::encode::key", + "auths_codec::encode::map", + "auths_codec::encode::encode_canonical_attachment", + "auths_codec::encode::text", + "auths_codec::encode::encode_budget", + "auths_codec::encode::encode_optional_budget", + "auths_codec::encode::encode_permission", + "auths_codec::encode::encode_profile_ref", + "auths_codec::encode::length", + "auths_codec::encode::array", + "auths_codec::encode::encode_canonical_action", + "auths_codec::decode::decode_canonical_action", + "auths_codec::hash::preimage_buffer", + "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure#1<'_0>}::call_once", + "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure<'_0>}::call_once", + "auths_codec::hash::commitment_preimage", + "auths_codec::hash::identifier_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::identifier_preimage::closure<'_0>}::call_once", + "auths_codec::hash::identifier_preimage", + "auths_codec::hash::signing_preimage", +] +allowed_external_symbols = [ + "core::array::{impl core::cmp::Ord for [T; N]}::cmp", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for usize}::try_from", + "core::convert::num::{impl core::convert::TryFrom for u8}::try_from", + "core::convert::num::{impl core::convert::TryFrom for u16}::try_from", + "core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u16}::try_from", + "core::convert::num::{impl core::convert::TryFrom for isize}::try_from", + "core::option::Option::Some", + "core::option::{core::option::Option}::as_ref", + "core::option::{core::option::Option}::ok_or", + "core::option::{core::option::Option}::and_then", + "core::option::{impl core::cmp::PartialEq> for core::option::Option}::eq", + "core::result::{core::result::Result}::map", + "core::result::{core::result::Result}::map_err", + "core::result::{core::result::Result}::unwrap_or", + "core::str::converts::from_utf8", + "core::str::{str}::len", + "core::str::{str}::is_empty", + "core::str::{str}::as_bytes", + "alloc::slice::{[T]}::sort_by_key", + "alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref", + "alloc::string::{impl core::convert::From<&'_0 str> for alloc::string::String}::from", + "alloc::vec::{alloc::vec::Vec}::as_slice", + "alloc::vec::{alloc::vec::Vec}::is_empty", + "auths_model::identifier::forbidden_three_byte_prefix", + "auths_model::identifier::forbidden_identifier_at", + "auths_model::identifier::contains_forbidden_identifier", + "auths_model::identifier::bounded_identifier_valid", + "auths_model::{auths_model::MediaType}::parse", + "auths_model::{auths_model::ProfileId}::parse", + "auths_model::{auths_model::CapabilityId}::parse", + "auths_model::{auths_model::ResourceId}::parse", + "auths_model::{auths_model::BudgetAlgebraId}::parse", + "auths_model::{auths_model::MediaType}::as_str", + "auths_model::{auths_model::ProfileId}::as_str", + "auths_model::{auths_model::CapabilityId}::as_str", + "auths_model::{auths_model::ResourceId}::as_str", + "auths_model::{auths_model::BudgetAlgebraId}::as_str", + "auths_model::{impl core::cmp::PartialEq for auths_model::Digest}::eq", + "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", + "auths_model::{auths_model::Digest}::new", + "auths_model::{auths_model::Digest}::as_bytes", + "auths_model::{impl core::cmp::PartialEq for auths_model::AttachmentDigest}::eq", + "auths_model::{impl core::cmp::Eq for auths_model::AttachmentDigest}::assert_fields_are_eq", + "auths_model::{impl core::cmp::Ord for auths_model::AttachmentDigest}::cmp", + "auths_model::{impl core::cmp::PartialOrd for auths_model::AttachmentDigest}::partial_cmp", + "auths_model::{auths_model::AttachmentDigest}::new", + "auths_model::{auths_model::AttachmentDigest}::as_bytes", + "auths_model::{auths_model::ProfileRef}::new", + "auths_model::{auths_model::ProfileRef}::id", + "auths_model::{auths_model::ProfileRef}::version", + "auths_model::{auths_model::Permission}::new", + "auths_model::{auths_model::Permission}::capability", + "auths_model::{auths_model::Permission}::resource", + "auths_model::{auths_model::BudgetCeiling}::new", + "auths_model::{auths_model::BudgetCeiling}::algebra", + "auths_model::{auths_model::BudgetCeiling}::value", + "auths_model::{auths_model::DetachedAttachment}::bytes", + "auths_model::{auths_model::DetachedAttachment}::digest", + "auths_model::canonical_attachments_valid", + "auths_model::{auths_model::CanonicalAction}::new", + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnMut<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}::call_mut", + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments::{impl core::ops::function::FnOnce<(&'_ auths_model::DetachedAttachment,), auths_model::AttachmentDigest> for auths_model::{auths_model::CanonicalAction}::with_detached_attachments::closure}::call_once", + "auths_model::{auths_model::CanonicalAction}::with_detached_attachments", + "auths_model::{auths_model::CanonicalAction}::profile", + "auths_model::{auths_model::CanonicalAction}::media_type", + "auths_model::{auths_model::CanonicalAction}::body", + "auths_model::{auths_model::CanonicalAction}::permission", + "auths_model::{auths_model::CanonicalAction}::requested_budget", + "auths_model::{auths_model::CanonicalAction}::detached_attachments", + "auths_model::{auths_model::DetachedAttachment}::new", + "auths_model::{auths_model::VerifierLimits}::hard", + "auths_model::{auths_model::VerifierLimits}::get", + "auths_model::{auths_model::VerifierLimits}::validate", +] + [[translations]] crate_name = "auths_model" translation_json = "formal/qualification/aeneas/generated/model/translation.json" -local_functions = 135 -external_functions = 4 +local_functions = 141 +external_functions = 7 opaque_local_functions = 0 required_symbols = [ + "auths_model::identifier::bounded_identifier_valid", + "auths_model::identifier::contains_forbidden_identifier", + "auths_model::identifier::forbidden_identifier_at", + "auths_model::identifier::forbidden_three_byte_prefix", "auths_model::budget_ceiling_covers_action", "auths_model::inclusive_window_contains", "auths_model::validity_window_contains", @@ -287,6 +1048,9 @@ allowed_external_symbols = [ "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", "alloc::string::{alloc::string::String}::as_bytes", + "core::str::{str}::len", + "core::str::{str}::is_empty", + "core::str::{str}::as_bytes", ] [[translations]] @@ -369,75 +1133,113 @@ allowed_external_symbols = [ [[translations]] crate_name = "auths_bounded_policy" translation_json = "formal/qualification/aeneas/generated/bounded_policy/translation.json" -local_functions = 28 +local_functions = 29 external_functions = 0 opaque_local_functions = 0 -required_symbols = [ - "auths_bounded_policy::kernel::configuration_match_code", - "auths_bounded_policy::kernel::checked_add_u64", - "auths_bounded_policy::kernel::checked_sub_u64", - "auths_bounded_policy::kernel::checked_mul_u64", - "auths_bounded_policy::kernel::checked_div_u64", - "auths_bounded_policy::kernel::ceiling_count_code", - "auths_bounded_policy::kernel::ceiling_count_tightens", - "auths_bounded_policy::kernel::window_index", - "auths_bounded_policy::kernel::chain_counts_admit", - "auths_bounded_policy::kernel::chain_sums_admit", - "auths_bounded_policy::kernel::bytes_equal", - "auths_bounded_policy::kernel::values_contain", - "auths_bounded_policy::kernel::values_subset", - "auths_bounded_policy::kernel::values_narrow", - "auths_bounded_policy::kernel::partition_narrows", - "auths_bounded_policy::kernel::sum_tightens", - "auths_bounded_policy::kernel::scope_tightens", - "auths_bounded_policy::kernel::argument_policy_tightens", -] +required_symbols = ["auths_bounded_policy::kernel::argument_policy_tightens", "auths_bounded_policy::kernel::bytes_equal", "auths_bounded_policy::kernel::ceiling_count_code", "auths_bounded_policy::kernel::ceiling_count_tightens", "auths_bounded_policy::kernel::chain_counts_admit", "auths_bounded_policy::kernel::chain_sums_admit", "auths_bounded_policy::kernel::checked_add_u64", "auths_bounded_policy::kernel::checked_div_u64", "auths_bounded_policy::kernel::checked_mul_u64", "auths_bounded_policy::kernel::checked_sub_u64", "auths_bounded_policy::kernel::configuration_match_code", "auths_bounded_policy::kernel::partition_narrows", "auths_bounded_policy::kernel::reservation_admission", "auths_bounded_policy::kernel::scope_tightens", "auths_bounded_policy::kernel::sum_tightens", "auths_bounded_policy::kernel::values_contain", "auths_bounded_policy::kernel::values_narrow", "auths_bounded_policy::kernel::values_subset", "auths_bounded_policy::kernel::window_index"] allowed_external_symbols = [] [[translations]] crate_name = "auths_gateway_kernel" translation_json = "formal/qualification/aeneas/generated/gateway/translation.json" -local_functions = 123 -external_functions = 0 +local_functions = 181 +external_functions = 2 opaque_local_functions = 0 -required_symbols = [ - "auths_gateway_kernel::recovery::recovery_capability", - "auths_gateway_kernel::construct::construct_write", - "auths_gateway_kernel::construct::construct_action_read", - "auths_gateway_kernel::construct::construct_credential_read", - "auths_gateway_kernel::construct::build_url", - "auths_gateway_kernel::construct::build_body", - "auths_gateway_kernel::construct::action_headers", - "auths_gateway_kernel::construct::scope_value_valid", - "auths_gateway_kernel::order::start", - "auths_gateway_kernel::order::next_step", - "auths_gateway_kernel::order::after_ceiling", - "auths_gateway_kernel::transition::valid_transition", - "auths_gateway_kernel::transition::consistent", - "auths_gateway_kernel::transition::stage_transition_allowed", - "auths_gateway_kernel::ratio::relative_basis", - "auths_gateway_kernel::ratio::relative_ceiling_admits", -] -allowed_external_symbols = [] +required_symbols = ["auths_gateway_kernel::construct::account_bytes_valid", "auths_gateway_kernel::construct::account_scope_header", "auths_gateway_kernel::construct::action_headers", "auths_gateway_kernel::construct::append_bytes", "auths_gateway_kernel::construct::append_form_byte", "auths_gateway_kernel::construct::append_form_encoded", "auths_gateway_kernel::construct::append_form_piece", "auths_gateway_kernel::construct::append_form_pieces", "auths_gateway_kernel::construct::append_json_argument", "auths_gateway_kernel::construct::append_json_byte", "auths_gateway_kernel::construct::append_json_escaped", "auths_gateway_kernel::construct::append_json_piece", "auths_gateway_kernel::construct::append_json_pieces", "auths_gateway_kernel::construct::append_json_string", "auths_gateway_kernel::construct::append_path_byte", "auths_gateway_kernel::construct::append_path_encoded", "auths_gateway_kernel::construct::append_percent", "auths_gateway_kernel::construct::append_segment", "auths_gateway_kernel::construct::append_segments", "auths_gateway_kernel::construct::append_version_headers", "auths_gateway_kernel::construct::build_body", "auths_gateway_kernel::construct::build_url", "auths_gateway_kernel::construct::construct_action_read", "auths_gateway_kernel::construct::construct_credential_read", "auths_gateway_kernel::construct::construct_write", "auths_gateway_kernel::construct::copy_bytes", "auths_gateway_kernel::construct::copy_header", "auths_gateway_kernel::construct::field_index", "auths_gateway_kernel::construct::field_name_equal", "auths_gateway_kernel::construct::fixed_url", "auths_gateway_kernel::construct::form_piece_valid", "auths_gateway_kernel::construct::form_pieces_valid", "auths_gateway_kernel::construct::hex_lower", "auths_gateway_kernel::construct::hex_upper", "auths_gateway_kernel::construct::is_account_byte", "auths_gateway_kernel::construct::is_alphanumeric", "auths_gateway_kernel::construct::is_form_literal", "auths_gateway_kernel::construct::is_path_literal", "auths_gateway_kernel::construct::json_piece_valid", "auths_gateway_kernel::construct::json_pieces_valid", "auths_gateway_kernel::construct::path_error", "auths_gateway_kernel::construct::scope_value_valid", "auths_gateway_kernel::construct::segment_error", "auths_gateway_kernel::construct::segment_value_valid", "auths_gateway_kernel::counter_aggregation::aggregate", "auths_gateway_kernel::counter_aggregation::aggregate_sum", "auths_gateway_kernel::counter_aggregation::contribute", "auths_gateway_kernel::counter_aggregation::contribute_sum", "auths_gateway_kernel::counter_aggregation::count_capacity", "auths_gateway_kernel::counter_aggregation::counter_equal", "auths_gateway_kernel::counter_aggregation::counter_position", "auths_gateway_kernel::counter_aggregation::linked_sum_contribution", "auths_gateway_kernel::counter_aggregation::sum_position", "auths_gateway_kernel::counter_preimages::append_component", "auths_gateway_kernel::counter_preimages::append_coordinates", "auths_gateway_kernel::counter_preimages::append_word", "auths_gateway_kernel::counter_preimages::count_counter_preimage", "auths_gateway_kernel::counter_preimages::count_slot_preimage", "auths_gateway_kernel::counter_preimages::slot_preimage", "auths_gateway_kernel::counter_preimages::sum_counter_preimage", "auths_gateway_kernel::counter_preimages::sum_slot_preimage", "auths_gateway_kernel::deadline::entry_time_allows", "auths_gateway_kernel::deadline::intersect_entry_bounds", "auths_gateway_kernel::entry_authorization::entry_allows", "auths_gateway_kernel::entry_authorization::profile_allowed", "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate", "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new", "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe", "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe", "auths_gateway_kernel::identity::connection_record_preimage", "auths_gateway_kernel::identity::logical_operation_preimage", "auths_gateway_kernel::identity::valid_token", "auths_gateway_kernel::order::after_account", "auths_gateway_kernel::order::after_admission", "auths_gateway_kernel::order::after_ceiling", "auths_gateway_kernel::order::after_claim", "auths_gateway_kernel::order::after_credentials", "auths_gateway_kernel::order::after_denied", "auths_gateway_kernel::order::after_pre_entry", "auths_gateway_kernel::order::after_prefix", "auths_gateway_kernel::order::after_read_back", "auths_gateway_kernel::order::after_reads", "auths_gateway_kernel::order::after_response", "auths_gateway_kernel::order::after_write", "auths_gateway_kernel::order::ceiling_from", "auths_gateway_kernel::order::denied_from", "auths_gateway_kernel::order::entry_step", "auths_gateway_kernel::order::go", "auths_gateway_kernel::order::halt", "auths_gateway_kernel::order::lease_failed", "auths_gateway_kernel::order::lease_step", "auths_gateway_kernel::order::next_step", "auths_gateway_kernel::order::not_entered", "auths_gateway_kernel::order::pre_claim", "auths_gateway_kernel::order::pre_claim_step", "auths_gateway_kernel::order::pre_entry_from", "auths_gateway_kernel::order::start", "auths_gateway_kernel::order::stop", "auths_gateway_kernel::ratio::relative_basis", "auths_gateway_kernel::ratio::relative_ceiling_admits", "auths_gateway_kernel::recovery::provider_link", "auths_gateway_kernel::recovery::recovery_capability", "auths_gateway_kernel::recovery::recovery_class", "auths_gateway_kernel::recovery::unknown_resolution", "auths_gateway_kernel::reservation_batch::build_batch", "auths_gateway_kernel::reservation_retry::retry_target", "auths_gateway_kernel::slot_record::counter_hex_matches", "auths_gateway_kernel::slot_record::validate_cumulative", "auths_gateway_kernel::transition::absent", "auths_gateway_kernel::transition::adds_pre_entry", "auths_gateway_kernel::transition::adds_response", "auths_gateway_kernel::transition::checkpoint_valid", "auths_gateway_kernel::transition::consistent", "auths_gateway_kernel::transition::has_link", "auths_gateway_kernel::transition::has_reading", "auths_gateway_kernel::transition::link_equal", "auths_gateway_kernel::transition::observed_stage", "auths_gateway_kernel::transition::permits_response", "auths_gateway_kernel::transition::plan_kept", "auths_gateway_kernel::transition::pre_entry_kept", "auths_gateway_kernel::transition::provider_stage", "auths_gateway_kernel::transition::refusal_stage", "auths_gateway_kernel::transition::requires_response", "auths_gateway_kernel::transition::resolves_unknown", "auths_gateway_kernel::transition::response_kept", "auths_gateway_kernel::transition::same_bytes", "auths_gateway_kernel::transition::same_bytes_from", "auths_gateway_kernel::transition::stage_transition_allowed", "auths_gateway_kernel::transition::valid_transition"] +allowed_external_symbols = ["core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from", "core::result::{core::result::Result}::unwrap_or"] [[translations]] crate_name = "auths_connections" translation_json = "formal/qualification/aeneas/generated/connections/translation.json" -local_functions = 7 -external_functions = 0 +local_functions = 38 +external_functions = 5 opaque_local_functions = 0 -required_symbols = [ - "auths_connections::kernel::next_generation", - "auths_connections::kernel::state_change", - "auths_connections::kernel::rotation", - "auths_connections::kernel::retained_generation", - "auths_connections::kernel::lease_generation", -] -allowed_external_symbols = [] +required_symbols = ["auths_connections::kernel::ascii_graphic_valid", "auths_connections::kernel::lease_generation", "auths_connections::kernel::lower_tail_valid", "auths_connections::kernel::lower_token_valid", "auths_connections::kernel::next_generation", "auths_connections::kernel::profiles_valid", "auths_connections::kernel::record_change_allows", "auths_connections::kernel::record_times_valid", "auths_connections::kernel::recovery_binding_requirement", "auths_connections::kernel::recovery_lease", "auths_connections::kernel::retained_generation", "auths_connections::kernel::rotation", "auths_connections::kernel::semantic_head_valid", "auths_connections::kernel::semantic_id_valid", "auths_connections::kernel::semantic_tail_valid", "auths_connections::kernel::state_change", "auths_connections::kernel::state_transition_allows", "auths_connections::kernel::strictly_sorted_unique", "auths_connections::kernel::validate_record_shape", "auths_connections::kernel::workloads_valid", "auths_connections::model::{impl core::cmp::Eq for auths_connections::model::ConnectionProfile}::assert_fields_are_eq", "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}::cmp", "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::SemanticId}::cmp", "auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::ConnectionProfile}::eq", "auths_connections::model::{impl core::cmp::PartialEq for auths_connections::model::SemanticId}::eq", "auths_connections::model::{impl core::cmp::PartialOrd for auths_connections::model::ConnectionProfile}::partial_cmp"] +allowed_external_symbols = ["alloc::string::{alloc::string::String}::as_bytes", "alloc::string::{impl core::cmp::Eq for alloc::string::String}::assert_fields_are_eq", "alloc::string::{impl core::cmp::Ord for alloc::string::String}::cmp", "alloc::string::{impl core::cmp::PartialEq for alloc::string::String}::eq", "alloc::string::{impl core::cmp::PartialOrd for alloc::string::String}::partial_cmp"] + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean" +count = 1 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean" +count = 18 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean" +count = 3 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean" +count = 1 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean" +count = 1 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean" +count = 3 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean" +count = 3 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean" +count = 10 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean" +count = 1 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean" +count = 2 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean" +count = 3 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean" +count = 5 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean" +count = 2 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean" +count = 10 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean" +count = 1 +compiled = false + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean" +count = 24 +compiled = false [[template_axioms]] artifact = "formal/qualification/aeneas/generated/model/FunsExternal_Template.lean" -count = 4 +count = 7 compiled = false [[template_axioms]] @@ -449,3 +1251,39 @@ compiled = false artifact = "formal/qualification/aeneas/generated/authority/FunsExternal_Template.lean" count = 21 compiled = false + +[[external_models]] +id = "gateway-counter-standard-interfaces" +kind = "transparent-standard-checked-conversion-and-result-projection" +artifact = "formal/qualification/aeneas/generated/gateway/FunsExternal.lean" +rust_symbols = ["core::convert::num::ptr_try_from_impls::{impl core::convert::TryFrom for u64}::try_from", "core::result::{core::result::Result}::unwrap_or"] +authority_semantics = false +reviewed = true +axiom = false +scope = "Reuses the existing reviewed usize-to-u64 checked conversion and Result.unwrap_or definitions, moved unchanged from the codec bridge into generated/standard/CheckedResult.lean so unrelated string/sort models are not imported into gateway proofs. No Auths algorithm is opaque. Counter and slot byte framing is translated from production; SHA-256 collision resistance, allocator behavior, and backend atomicity remain separate contracts." + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean" +count = 2 +compiled = false + + +[[translations]] +crate_name = "auths_profile_construction" +translation_json = "formal/qualification/aeneas/generated/profile_construction/translation.json" +local_functions = 4 +external_functions = 17 +opaque_local_functions = 0 +required_symbols = ["auths_connections::model::{auths_connections::model::ConnectionAlias}::parse", "auths_connections::model::{auths_connections::model::ConnectionProfile}::new", "auths_connections::model::{auths_connections::model::ProviderKind}::parse", "auths_connections::model::{auths_connections::model::SemanticId}::parse", "auths_profile_construction::construct", "auths_profile_construction::parse_alias", "auths_profile_construction::parse_provider", "auths_profile_construction::parse_semantic"] +allowed_external_symbols = ["alloc::string::{alloc::string::String}::as_bytes", "alloc::string::{impl core::ops::deref::Deref for alloc::string::String}::deref", "auths_connections::kernel::lower_tail_valid", "auths_connections::kernel::lower_token_valid", "auths_connections::kernel::semantic_head_valid", "auths_connections::kernel::semantic_id_valid", "auths_connections::kernel::semantic_tail_valid", "auths_connections::model::is_lower_token", "auths_connections::model::{auths_connections::model::ConnectionAlias}::parse", "auths_connections::model::{auths_connections::model::ConnectionProfile}::new", "auths_connections::model::{auths_connections::model::ProviderKind}::parse", "auths_connections::model::{auths_connections::model::SemanticId}::parse", "core::str::{str}::as_bytes"] + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean" +count = 3 +compiled = false + + +[[template_axioms]] +artifact = "formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean" +count = 5 +compiled = false diff --git a/formal/qualification/aeneas/source-closure.json b/formal/qualification/aeneas/source-closure.json index c2ffeac9d..246fff3c4 100644 --- a/formal/qualification/aeneas/source-closure.json +++ b/formal/qualification/aeneas/source-closure.json @@ -1,6 +1,6 @@ { "schema": "auths-proof-translation-source-closure/v2", - "digest": "cdfc1e60823a53d8ed627e77d9bdaee386faa45e1d8bd440f8d69645a96dc6cc", + "digest": "182ce049a050aeef56cb3ac53dad37a08f5ef9b35d1fbf27816471bd22ca3ac0", "files": [ { "path": ".cargo/config.toml", @@ -8,12 +8,108 @@ }, { "path": "Cargo.lock", - "sha256": "f84825e2ac0d4af57a406ab4b49ae5ce4e9360caf0a23e092906257743509b04", + "sha256": "17f4875379c53e15d1b196286aa0b83a2d2c854891759aa563a6c3c2f589c595", "normalization": "translated-cargo-closure-v1" }, { "path": "Cargo.toml", - "sha256": "6e0240aa432bcdb5b4f855618994582d2e428afe5ee4e4f6a3f8d21a518f8d24" + "sha256": "2cc6fc79bfa459cedad6237ed79064dfd13683232940d63d5778a2e994fbb30d" + }, + { + "path": "bindings/independent/go/auths/p256_corpus_test.go", + "sha256": "72b7daff20df43d920f9fdd31f616d4b6ef5053c98448efe153c3469da226845" + }, + { + "path": "bindings/independent/typescript/p256-corpus.test.ts", + "sha256": "76482387905f1a9f4e4e38e9b94074e9f2f156aaf99ad014cbd5580bb31922b1" + }, + { + "path": "bindings/independent/typescript/semantic-verifier.ts", + "sha256": "76006567974f717da4e46f7d96dd06ee35ef58f83f7844c6298259f5aa2b0d91" + }, + { + "path": "core/adapters/auths-did-keri/Cargo.toml", + "sha256": "86ba3e3f9a0a70d970568bfb3113b7ba7bbdd81c3eebbb52743dd574a0c0ecaa" + }, + { + "path": "core/adapters/auths-did-keri/src/lib.rs", + "sha256": "a75674842f8a7142004369ccd206ab43e476459293f0ff4bed4d4e659031b3e3" + }, + { + "path": "core/adapters/auths-did-keri/tests/fixtures/keripy/rot_remove.icp.att", + "sha256": "b960b8ddbae13e5bb0d8c2ed4e5e0365132435bb0f064aa38ea3e3222d484143" + }, + { + "path": "core/adapters/auths-did-keri/tests/fixtures/keripy/rot_remove.icp.json", + "sha256": "675c8be7338cd0d377b84f997d88b04cc69d0350c61a603aa3d1c971cd0723fc" + }, + { + "path": "core/adapters/auths-did-keri/tests/fixtures/keripy/rot_remove.rot.att", + "sha256": "be3fe05e9a745b1b42ce19a3232c03cac48a351bb1fc748a20b6bb52f00eba54" + }, + { + "path": "core/adapters/auths-did-keri/tests/fixtures/keripy/rot_remove.rot.json", + "sha256": "a13d665078292b6e3348680740558410d4d47257533f5530c6d4f200f72cc89e" + }, + { + "path": "core/adapters/auths-did-key/Cargo.toml", + "sha256": "d5a3ae07ecde83f91eed4c3785051dd0f44eab6c891754f3309b6b40596707d7" + }, + { + "path": "core/adapters/auths-did-key/src/lib.rs", + "sha256": "b76a3f4528a725df53cfa9242e6e414e1d26caa48468aaed497e28b121f4497c" + }, + { + "path": "core/adapters/auths-did-web/Cargo.toml", + "sha256": "851692ce82a034de341faa08c2043e0ce759dd41daf9d2591e983a3b8c1b6fb2" + }, + { + "path": "core/adapters/auths-did-web/src/lib.rs", + "sha256": "2524f33979429214c1282c7fbd8823f19ca6b0ec4997e4bbea8a9472749be099" + }, + { + "path": "core/adapters/auths-hsm-attested/Cargo.toml", + "sha256": "55b1581f654bfc62c3a838212e8d034a05066afd7ea382efeb6254a26a8da98a" + }, + { + "path": "core/adapters/auths-hsm-attested/src/lib.rs", + "sha256": "42594b26a7d6ebc47b44096ad5e3472c677c64f3b470b85b91e55334f3899bb6" + }, + { + "path": "core/adapters/auths-raw-key/Cargo.toml", + "sha256": "f49616bc18c19e6aaa7e6a02ccebcdb9f5c1422c1278ef9869e0dbf22ceda7be" + }, + { + "path": "core/adapters/auths-raw-key/src/lib.rs", + "sha256": "45eec1b295dac3bed65cd79c942870b926b06b3f5d38eaebaeb6140ac69315fa" + }, + { + "path": "core/adapters/auths-signature-ed25519/Cargo.toml", + "sha256": "47a70030633b264bacc5d0d301ba6ca19f9c7dfb88cdb70ed2acb0dbf3731ce9" + }, + { + "path": "core/adapters/auths-signature-ed25519/README.md", + "sha256": "db674be2735e49a47264790d09205cb3e8c681c2cca8b69e787de997bca1ddc0" + }, + { + "path": "core/adapters/auths-signature-ed25519/src/lib.rs", + "sha256": "ab30df01217858dfceb6d6a20341d1cd66ba56323d164da696a335bf4dd78053" + }, + { + "path": "core/adapters/auths-spiffe-x509/Cargo.toml", + "sha256": "6201e1d823d1ce7f6bf63bcc11b20699dae0c3a0df6e3ab5fbf32158c8088827" + }, + { + "path": "core/adapters/auths-spiffe-x509/src/lib.rs", + "sha256": "724808ac4fdbc1a912ac31b6af36789041be2ca8b9d80ec10df598130e961932" + }, + { + "path": "core/adapters/auths-webauthn/Cargo.toml", + "sha256": "53c91387dc2f44da35f30477b3a2e5daab374ea27e64784519df5df60f71d5af" + }, + { + "path": "core/adapters/auths-webauthn/src/lib.rs", + "sha256": "d660d8881d60808461f1f6fcdbd5f6bd17b27f5f86799ab3e2212a6eb1817719" }, { "path": "core/crates/auths-algebra-kernel/Cargo.toml", @@ -27,6 +123,26 @@ "path": "core/crates/auths-algebra-kernel/src/lib.rs", "sha256": "6654667eeb9b353d6648954c9fd2e8838462a82ce6b2803eb49e1366892c68c6" }, + { + "path": "core/crates/auths-assurance/Cargo.toml", + "sha256": "afcb12a97ddd09d7a264b9ecd3fcaefc865ff2c9b4539ee85b00883420ba333a" + }, + { + "path": "core/crates/auths-assurance/src/lib.rs", + "sha256": "0fb2ec844d674b25a9e20b1601452c89c2454901fa506adfa9bb38ef9a7fa213" + }, + { + "path": "core/crates/auths-author/Cargo.toml", + "sha256": "1e6f0e3bc079ddb558decf0db26b291c6e72fc47327b6df1b7650d41689b215f" + }, + { + "path": "core/crates/auths-author/src/lib.rs", + "sha256": "e14475f2f49715a1869d5fa6b11ff1fbb72497e39097e09f833b0bae7e5b3f2b" + }, + { + "path": "core/crates/auths-author/src/observations.rs", + "sha256": "dda7d6bfa6f4bd7e95a480ca283c2c0e996f69c5c15cb0c7197af328131a7066" + }, { "path": "core/crates/auths-authority/Cargo.toml", "sha256": "4f68212938029f79ebd857b4f3038494eb85d0163d49f07e51376715cf959815" @@ -35,6 +151,90 @@ "path": "core/crates/auths-authority/src/lib.rs", "sha256": "da88d5194de4e17449e69972c0fb042afa3c39798a8f570f30771e77c384f1eb" }, + { + "path": "core/crates/auths-codec/Cargo.toml", + "sha256": "b164e44179704bcb76d32f7e25281ed17f738e434290997e979739ebe49b4f77" + }, + { + "path": "core/crates/auths-codec/src/approval.rs", + "sha256": "eb0a867ab26c151f9f947090dd81b5802541e818104ac2b363634e2c8f568005" + }, + { + "path": "core/crates/auths-codec/src/bounded_policy.rs", + "sha256": "5c84447f057e2bf356323c6d83cab4daf64fcce221051a0863350f414ad0fb85" + }, + { + "path": "core/crates/auths-codec/src/cbor.rs", + "sha256": "03f43d462fe39a45c7ad5ef487376ce109ae359b7874ec2b0200601ad0563361" + }, + { + "path": "core/crates/auths-codec/src/decode.rs", + "sha256": "41b1e08a76ba4fc841c80f81994e78a23f4692eab9262604080c36bb8d1be3bd" + }, + { + "path": "core/crates/auths-codec/src/encode.rs", + "sha256": "163dcb12f640eb63fbdb872e75bab1ee9e01571797cdf3a10b77cfd0b02a0c0b" + }, + { + "path": "core/crates/auths-codec/src/error.rs", + "sha256": "80c1e7fdd190a0d050c69fbcde9836a4702d9b98e8effd76bc659c3d75ea8175" + }, + { + "path": "core/crates/auths-codec/src/hash.rs", + "sha256": "db5e7773c8c1f6193c2494c95e3575d712c573e737ceb16b547f0f105efe1236" + }, + { + "path": "core/crates/auths-codec/src/lib.rs", + "sha256": "09688b7ffb9527cd89e3182ca556b2cbb0fb0c924d7e1e9889686b81b2bdf601" + }, + { + "path": "core/crates/auths-codec/src/observation.rs", + "sha256": "fb2d1151558b144a9d10dbc9a028c48f19c96344e396d0c292ff59be473b2149" + }, + { + "path": "core/crates/auths-codec/src/scope_decode_tests.rs", + "sha256": "61720a13ba4e2fefabcc492778348aaca5b3052e2570302de5ebc92efce12ab5" + }, + { + "path": "core/crates/auths-codec/tests/formal_action_witness.rs", + "sha256": "f8e5e7af2f5cb6198547767e9bd173c74aed85af05fbead360a8a7ce69575853" + }, + { + "path": "core/crates/auths-composition/Cargo.toml", + "sha256": "331e13025eb82588b5269ed3975929eb41c823d588c49e4c296273d85c6fe80e" + }, + { + "path": "core/crates/auths-composition/src/lib.rs", + "sha256": "e8a0f96ae904d831042f2284c5b8a7a8c9ccb030b4d6ac4b9912229039d4f535" + }, + { + "path": "core/crates/auths-composition/src/oracle.rs", + "sha256": "423c08f866797759fce7daeeb6316f15da870052a915504cbbd8954498cf942a" + }, + { + "path": "core/crates/auths-composition/src/summary.rs", + "sha256": "57ddc0376ae1182f73105147aa068d5b1e411444658f8da4ade56a5d0d4b4c6d" + }, + { + "path": "core/crates/auths-identity/Cargo.toml", + "sha256": "4c0b69816e1c00caee21927a39ea2daf55d24d77cf60c216d9cb8a0e2622c993" + }, + { + "path": "core/crates/auths-identity/README.md", + "sha256": "1e9efc35b80410ca4a79cfa6d3a417f44c1aac5d309cde34506de38d264e0516" + }, + { + "path": "core/crates/auths-identity/examples/custom-method.rs", + "sha256": "2efca1ffbaf35348d0567d66100af7690c18ef32bf54ec1ad45ef3e1eb3d614d" + }, + { + "path": "core/crates/auths-identity/examples/signed_message.rs", + "sha256": "a29bf595ee99f36fa77f89fe104803bdc9877ccc97b1dbf7c8fc9346a50a7168" + }, + { + "path": "core/crates/auths-identity/src/lib.rs", + "sha256": "09e84bd7743a76c4656aa2e531f69dbe76e0e67207ac5c7615d9b8e4fa04da5c" + }, { "path": "core/crates/auths-model/Cargo.toml", "sha256": "565c15302b0cc9270db1e28efa3862804846850ba933cc17aea8abcec4a65987" @@ -51,13 +251,273 @@ "path": "core/crates/auths-model/src/bounded_policy.rs", "sha256": "306a8f049cc7cfc7635fe0e4de47eb7813eed63d3c14c3be2b51586aa4eea450" }, + { + "path": "core/crates/auths-model/src/identifier.rs", + "sha256": "fcfb49e42682de6358980e4d86ca7763bba6a9a04967a4a6022b9ca8157103de" + }, { "path": "core/crates/auths-model/src/lib.rs", - "sha256": "e7cfe6bb9574c6b016aa63e70658c31e0b90903ec6479a49f4a2ceb64f5bad97" + "sha256": "238d198437a9f4cc1ad180181d4409809071e8e92e1cc056c3b4431738ed4168" }, { "path": "core/crates/auths-model/src/observation.rs", - "sha256": "b3ed3e3cc090afca2896a7d3de7988afccc1ee1ea0ebd91b51a8bc0f20ad8dbb" + "sha256": "0f0a8a4bd942867f168c0e411a8bca5d7f57e94065beaebe919b26b08ddd2108" + }, + { + "path": "core/crates/auths-model/src/principal_scheme_tests.rs", + "sha256": "d64588a32503cd70b954c21f8582e46a20292ec918ea8e3f7278c0b99c1528c9" + }, + { + "path": "core/crates/auths-model/src/scope_constructor_tests.rs", + "sha256": "a107fce37f38b5db2d9ae5c5585b49f011f88a5120c6a72c5a141da49f698c82" + }, + { + "path": "core/crates/auths-multikey/Cargo.toml", + "sha256": "858756c1197befcada06134742bffe8d58cf674cadd6c046bf710570e96efaf2" + }, + { + "path": "core/crates/auths-multikey/src/lib.rs", + "sha256": "f5177fffb11e40eeaaa665ba886c541fc1f24d5eacdd6983fb03dc20148733f0" + }, + { + "path": "core/crates/auths-path-webpki/Cargo.toml", + "sha256": "b1b3e498fde58392f039d05b3abc41cedf76e2c033cb2bc4fbcd3f02ecc25a43" + }, + { + "path": "core/crates/auths-path-webpki/src/lib.rs", + "sha256": "4e80058649340dbd961ac3f5567e2370f15ed30ed064965b54e6e86fb5e9ad1a" + }, + { + "path": "core/crates/auths-ports/Cargo.toml", + "sha256": "596a9b0f5af3717c16a6d13f7054d8a106bcd9f01f5f72c2235dd2afcf0ab16c" + }, + { + "path": "core/crates/auths-ports/src/binding.rs", + "sha256": "a16c012d40aa4249e3ec54372b9611006d0bfe8c7dc3c741911c2194ad17736d" + }, + { + "path": "core/crates/auths-ports/src/diagnostics.rs", + "sha256": "aa596572503b5a65a918bb2ff38281c144ff53821ee914e9325c852828d852df" + }, + { + "path": "core/crates/auths-ports/src/lib.rs", + "sha256": "e7f7fdcb480de4d69d488af5234915542627eb2fbc987232c4b5c47363a491dc" + }, + { + "path": "core/crates/auths-ports/src/path.rs", + "sha256": "b68fc547b4e4d97a60cbbc1cc1939fc6b34a8233b81f840bd396914a707e3ea1" + }, + { + "path": "core/crates/auths-raw-key-core/Cargo.toml", + "sha256": "98c0bc8527a537512e43a74dd6ba9658c6f0cdc16610cf938e3f9b43785d836d" + }, + { + "path": "core/crates/auths-raw-key-core/src/lib.rs", + "sha256": "98c0500c41697aae28708ad0bf970b9a97583d96a3d2c18d23e7fa351e0f7d12" + }, + { + "path": "core/crates/auths-registries/Cargo.toml", + "sha256": "590e49e58b0622d9d6274fea46796dcdb07dec9550eff295cce6a6427ffa51e2" + }, + { + "path": "core/crates/auths-registries/src/lib.rs", + "sha256": "0e94b31ddb24d57c2d0d82f479fcc138a677b606b89c8f16a8e9dc5497afc5c5" + }, + { + "path": "core/crates/auths-registries/src/status_selection_tests.rs", + "sha256": "456d830b1c65db272f337e0dacc12aaaeefa99071ff3251d19b2f0417bf0a284" + }, + { + "path": "core/crates/auths-registries/src/template.rs", + "sha256": "1224039dd2b3ce6fa8357613d8cafbae40400493da7176da202b9ade62fa05e4" + }, + { + "path": "core/crates/auths-signature-core/Cargo.toml", + "sha256": "6bee2230eb30af1be0bd5c2d57bd3e1903497a70028d47290d4ac6e9e0e8bca0" + }, + { + "path": "core/crates/auths-signature-core/src/lib.rs", + "sha256": "d8f9465b337deabf3dedc4337223913aa637a10192d6b504281f28475a13ea11" + }, + { + "path": "core/crates/auths-signature/Cargo.toml", + "sha256": "7f7b5682466ba439d8c59579022cb61068cad9fb4bd2d73e1cc21327c902b450" + }, + { + "path": "core/crates/auths-signature/src/lib.rs", + "sha256": "b3d9ac4cc3ba0797b9e1c09f2d6ac05089b25dac4e285a5af28c0165b33d925b" + }, + { + "path": "core/crates/auths-signature/tests/p256_corpus.rs", + "sha256": "c707b21495f32dc1192033b24fdd56aa46f79f968f069ced84d442fa03ca5234" + }, + { + "path": "core/crates/auths-verifier/Cargo.toml", + "sha256": "c43358e06a33324b41a8b93e5cc7279c55f7d21f1f6cfaa539a3fc7b4c27a38f" + }, + { + "path": "core/crates/auths-verifier/src/approval.rs", + "sha256": "2826a5227945a3e0ea000584f1e1c794bec3b313b13843f4284e0e716f830d33" + }, + { + "path": "core/crates/auths-verifier/src/causal.rs", + "sha256": "9635230f33b13a263573d319ac8a1976addbcc07677514a43e3c7bf28dc04587" + }, + { + "path": "core/crates/auths-verifier/src/lib.rs", + "sha256": "7d3ae3a95680018ae7d709b5fd64f1fa48ef838e3d389ee727b8087fbc4d9d50" + }, + { + "path": "core/crates/auths-verifier/src/observation.rs", + "sha256": "2b43ee60e1f105d33b325914ae723f91fe191675f27a9a9c04ea812c2fe27785" + }, + { + "path": "core/crates/auths-verifier/src/temporal_tests.rs", + "sha256": "c242d8bed72936ea7437e45ab88b98b28f0d82f9f92a6f750ef8b27fa71e8fef" + }, + { + "path": "core/crates/auths-verifier/src/trace.rs", + "sha256": "2213d72023a1d9e0413a2cf2c51c3dad9e04775d86033a0caaa9d29a8f0036f8" + }, + { + "path": "core/crates/auths-verifier/tests/approval_properties.rs", + "sha256": "ade9928d0efd1544fe0c6af909b6ac4ea6905e8210d3f0315a6df3b40a830de1" + }, + { + "path": "core/crates/auths-verifier/tests/observation_action_facts.rs", + "sha256": "a1889530553e1313abb256ff51f5901bd18dfdad47f24dfe9faa933035ad8dde" + }, + { + "path": "core/crates/auths-verifier/tests/portable_conformance.rs", + "sha256": "06130c2b403eca87a3be3edeab5395e80db96c87faa5d14c2878a78250fe958e" + }, + { + "path": "core/fixtures/crypto/README.md", + "sha256": "d03594fddca61115ec52405a8c604b33f37dde2b848392206c50e3ecba634d87" + }, + { + "path": "core/fixtures/crypto/import_p256_wycheproof.py", + "sha256": "d0162fa1e8045d5b42e7af82227c0e83e683b604b628421b286579a5df5c9ace" + }, + { + "path": "core/fixtures/crypto/p256-sha256-v1.tsv", + "sha256": "52ca4cb96b873e9f6ead20abcb3e7fc78e795f746bae88ed6a9f18b68ffd256f" + }, + { + "path": "core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json", + "sha256": "c60de693930e386c3a5472d08081623ef8504decc54b38ac01ec6b2a2575c986" + }, + { + "path": "core/testkit/auths-testkit/Cargo.toml", + "sha256": "d2c38ae2edfed6bcb8c3e3fa83bc4d62d88441026302c99c237a4c6c32724986" + }, + { + "path": "core/testkit/auths-testkit/src/action_decode.rs", + "sha256": "510057e80afec42aefe89e2229dcb781109f926d3a059ba1e518ce18dc361ae0" + }, + { + "path": "core/testkit/auths-testkit/src/adversarial/context.rs", + "sha256": "ce3bd4638d8a3fba4b72d8a2e54a3f4e865ac185c905c5d9e9f7f93f9b36526a" + }, + { + "path": "core/testkit/auths-testkit/src/adversarial/mod.rs", + "sha256": "184728c6aa4fd2e6a3ad3153388b8f85e380974e09a8f61fbcd438c1871dc2b4" + }, + { + "path": "core/testkit/auths-testkit/src/adversarial/mutation.rs", + "sha256": "eee0a6a94b28dba4fa7b4877151543e014c242dd5b7dd742ce907e33c645e3ed" + }, + { + "path": "core/testkit/auths-testkit/src/adversarial/oracle.rs", + "sha256": "05fb0738ccf2939457eda356d76cd55e42a3c238c60e88895212df2aa196e778" + }, + { + "path": "core/testkit/auths-testkit/src/adversarial/shrink.rs", + "sha256": "b947731dc50c7b79f3850c7c4637c1a1855a76c458a14b5b07caaf78c2ab7fc7" + }, + { + "path": "core/testkit/auths-testkit/src/approval.rs", + "sha256": "07c6035ef4fd1ca32029696bff4b60f556acba12d41e42e3f598a119e48f4433" + }, + { + "path": "core/testkit/auths-testkit/src/bounded_policy.rs", + "sha256": "98f465d5eef8cc103dcf84acd744909176760f5e756a70eb218e41095e3d0ed4" + }, + { + "path": "core/testkit/auths-testkit/src/check_sites.rs", + "sha256": "b8068f7025e85ca74a88ec8b014566f752f26c0b61b5d6459d1f688dd6517586" + }, + { + "path": "core/testkit/auths-testkit/src/conformance.rs", + "sha256": "6c6c5bf61003e6837cc3a99b60196ab78931cf3e3fa154b995843a7dd7081ad1" + }, + { + "path": "core/testkit/auths-testkit/src/kernel_checks.rs", + "sha256": "43787567221fb1868e465634ad73d71e8ff527b275dacff6e3584a39345983f8" + }, + { + "path": "core/testkit/auths-testkit/src/lib.rs", + "sha256": "8a5d42d0bddc59f883ff1207efb9a4389c181b86cfe26ea8a858d25ebbe5b0ea" + }, + { + "path": "core/testkit/auths-testkit/src/mechanism_conformance.rs", + "sha256": "da5ca5e080fcf4c0ca1fd3f1fd77317653d924e87b1b50864df795a2d684f150" + }, + { + "path": "core/testkit/auths-testkit/src/observation.rs", + "sha256": "d9e3e85da180dbc975dbc1a4052b0824d8d20a7f3da7fc0c8f87e9df416ab97d" + }, + { + "path": "core/testkit/auths-testkit/src/product_waist.rs", + "sha256": "9a47bd772b6974b1da08c06b5883e77b6ed3ed9fdc761507b3461a18792e75de" + }, + { + "path": "core/testkit/auths-testkit/src/status_extensions.rs", + "sha256": "c1de567ab6f2dd4075a07d988e3cfb190f5d2ee1143e4c73be8d0a2d4064def4" + }, + { + "path": "core/testkit/auths-testkit/src/status_scope.rs", + "sha256": "2a1566884515030b2062eb193d747ec3d74c97e310f7776e98ebead3522b5f79" + }, + { + "path": "exchange/crates/auths-proof-exchange-model/Cargo.toml", + "sha256": "34b2db64f93a288e942b5a3918d28cdcbef906e0dc9074ce848018d3d5f7a1fa" + }, + { + "path": "exchange/crates/auths-proof-exchange-model/src/lib.rs", + "sha256": "49fac5aff2339d3a57c41cb8bb2a82852538e8f77ecc4b157c88e264ff31fb55" + }, + { + "path": "exchange/crates/auths-proof-exchange-port/Cargo.toml", + "sha256": "7ff660f1b7579dc570c791090aeb450404fbbf44c92781e289f5ccdde746d739" + }, + { + "path": "exchange/crates/auths-proof-exchange-port/src/lib.rs", + "sha256": "b408fb40c6432edc1facb3d8b3e9433a033f8dc73fe2e0ba5a88c972ca675021" + }, + { + "path": "formal/Auths/Crypto/NativePrimitives.lean", + "sha256": "8d73a3205320a2306a4e1bd59121c039e8e2cc2848f63f64474a69b1d05ac601" + }, + { + "path": "formal/Auths/Crypto/P256Primitives.lean", + "sha256": "6280c8cb79eb16d89f812f88dbb845bf3b8b40867256d16b3c38c130c0807dae" + }, + { + "path": "formal/Auths/Crypto/Sha256Primitives.lean", + "sha256": "9cdb232550b3b620d588810e384f729f22eb314a0a165cd8aa1d83adda7dbedd" + }, + { + "path": "formal/Auths/Support/Discriminant.lean", + "sha256": "d0c9b2b98232238d7c5f23579114ea9146f2e8a274b5b4e06783068490cbf88c" + }, + { + "path": "formal/Auths/Support/PositiveVec.lean", + "sha256": "246c314719867482a10057612dc199e605e38189c67a59cf4e57a274b5ad0bb5" + }, + { + "path": "formal/Auths/Support/UnitCallback.lean", + "sha256": "d109873a6dd0b27d2dc8a555b303a1d39adf25543dc9f9a1ba6c970801059d25" }, { "path": "formal/algebra-contract-v1.toml", @@ -73,15 +533,23 @@ }, { "path": "formal/qualification/aeneas/cases/BoundedPolicy.lean", - "sha256": "715bf2b8fc224e5cb80fe46f930b323af962832d8eab6fd2bcbab884ada85b28" + "sha256": "35b36202f49130d7ebb55363a7280afe0e22d52eea136ce9b9e1fb2d9541d195" + }, + { + "path": "formal/qualification/aeneas/cases/Codec.lean", + "sha256": "577239d7a0de2a907a3d98289f7ae6d6fe79fe8e98b498e6d6e7f75a18a13882" + }, + { + "path": "formal/qualification/aeneas/cases/Composition.lean", + "sha256": "bb179bff1e876947ed8632fcdc92b2c2996a1175deafddcd5c7ba26e158ce72e" }, { "path": "formal/qualification/aeneas/cases/Connections.lean", - "sha256": "d85f77492deae33b8c8d3b6ad7bd876130077caae6440e3f9cad34ddc06bfa2f" + "sha256": "9c1285c7e6d81f185f20d4b3fb7bf8252bc0f77f0ace8e4e73b5b3cac6548be1" }, { "path": "formal/qualification/aeneas/cases/Gateway.lean", - "sha256": "a6d3148ab9ad313a0d00b92313d6fb2bc70a131759e5ccffb9d6f5e028738264" + "sha256": "c8c66fa9123cdee3d97d7d7887576095a0c37ba548d5e6c02a11f1fba623b074" }, { "path": "formal/qualification/aeneas/cases/Lifecycle.lean", @@ -89,16 +557,96 @@ }, { "path": "formal/qualification/aeneas/cases/Model.lean", - "sha256": "b27e252238449bcee87a3d4d4deeca5537e8af380e2559ca24ea04fa88265793" + "sha256": "ebd31a481094b891fc64a924e12581ad516c0bed153238f3f2b7b97d1b914724" + }, + { + "path": "formal/qualification/aeneas/cases/P256.lean", + "sha256": "d471138de5d7fb81fb34097e378250466e6abfa890d3f18034ab3646fdbc720c" + }, + { + "path": "formal/qualification/aeneas/cases/ScopeCodec.lean", + "sha256": "48c0ad57f71ff15bf7a11a669782ab05c9e3d910584edb7161be0ebb899b0f3d" + }, + { + "path": "formal/qualification/aeneas/cases/Sha256.lean", + "sha256": "a9ded04b2ebee0b5120532ec659fa48711931b6e67514b3c4c26263297db0baf" + }, + { + "path": "formal/qualification/aeneas/cases/Signature.lean", + "sha256": "22a78fb9f640ef2e2f24c581fdbc04a7fa4bbbcbaf8e6bcf18317dff757cf869" + }, + { + "path": "formal/qualification/aeneas/cases/StatusSelection.lean", + "sha256": "4338ad7661a6a6617aef295397a1f7bbb192e2ab5488465f076880fec38b6faa" + }, + { + "path": "formal/qualification/aeneas/cases/Stores.lean", + "sha256": "7cb57dba378673e1ad581380d738d35978fd0ee97c5d5a62af4190f9938167ee" + }, + { + "path": "formal/qualification/aeneas/cases/SuiteAdapters.lean", + "sha256": "e567da83843387e0cdb5031c2791b9c6d4df7a3ffc65c4be4edb1e8488c99c54" + }, + { + "path": "formal/qualification/aeneas/cases/TemporalWitness.lean", + "sha256": "777a4aa448ef5e28e9cf9f41ef94da623f342f2899351c67a0f532df42872788" + }, + { + "path": "formal/qualification/aeneas/entrypoints/profile_construction.rs", + "sha256": "4e6c4a3bfbd147a5ceab64e24a80fe10f08b0715210343b6be63fecaffdbd5ee" }, { "path": "formal/qualification/aeneas/qualification.toml", - "sha256": "38aa0babb5be3ac958c7e91f0640ad0ae3b6e4f265257642976dfe8bd3330850" + "sha256": "0bc0b2d28f762aae45bf5045c97750e1d2990fce0133cc97de2678bed752f2ca" + }, + { + "path": "formal/tools/SourceClosure.lean", + "sha256": "1c5c6aa4abf38e31ad4f5fdaac275ecf0d651a65e97c0acf96abec12229133dc" }, { "path": "formal/translation-toolchain.lock", "sha256": "0c45a8a08ac06e313d775e669749097bd3a0abfb8e3395c69416ba0238770d53" }, + { + "path": "product/config/auths-config/Cargo.toml", + "sha256": "e4b568ab9f6d84f7d7e6d66443fe825f360db9c27bc7c31d6ddc0647ba3ab304" + }, + { + "path": "product/config/auths-config/src/lib.rs", + "sha256": "fecf00ea65cef9018fda9af2063326d7065b869266d0d9e73a4f06816f1102cc" + }, + { + "path": "product/errors/auths-errors/Cargo.toml", + "sha256": "3b3a199b6460ba75bda84475bb5accd35e1485448a3981038db85bf4772dd350" + }, + { + "path": "product/errors/auths-errors/src/lib.rs", + "sha256": "7feeb9069fa4003f94f1f07c1c94619cf1c883e0dbaaf2187f04d0f742264bdd" + }, + { + "path": "product/operations/auths-operations/Cargo.toml", + "sha256": "73dde1e914ba5e1386f8d49c0d730423cc72ae77ec44c6554a6a75cc8e8922b1" + }, + { + "path": "product/operations/auths-operations/src/explanation.rs", + "sha256": "b4a39bcbd5712cb9e735ee7deeb281f3fa6af5ddca973735bf3d87dce427ef11" + }, + { + "path": "product/operations/auths-operations/src/lib.rs", + "sha256": "3f401a56555113b98f57bca172a2660eaecedf76247b83a3fdbb089c133a29cd" + }, + { + "path": "product/operations/auths-operations/src/render/json.rs", + "sha256": "2ae042639960afee123730e945d373bc5dda1d2b3af20ae16c939a7e99b9e418" + }, + { + "path": "product/operations/auths-operations/src/render/mod.rs", + "sha256": "b3b7f6fe473f49227ace5a68bfc3d8dc14b5db8dd9888fd9e207070337b1b8bf" + }, + { + "path": "product/operations/auths-operations/src/render/text.rs", + "sha256": "f216cf3bdb00e264523271b16e7059535ac6b1aabf271cebd7935af155e4bfec" + }, { "path": "product/policy/auths-bounded-policy/Cargo.toml", "sha256": "babd5d200923137ead71d8c2528f847cea323ce98da942a1320b054436612c47" @@ -137,7 +685,7 @@ }, { "path": "product/policy/auths-bounded-policy/src/kernel.rs", - "sha256": "99187c28b161ac70bee1afed60711f7f645adb4d1671a01863f9849b369811d5" + "sha256": "00f66e91381dc53fbb5753dcb22276f41667529f584fe00770fe388b979a73f7" }, { "path": "product/policy/auths-bounded-policy/src/lib.rs", @@ -151,6 +699,50 @@ "path": "product/policy/auths-bounded-policy/src/registry.rs", "sha256": "4e251ea5833559841f8ee0bd9b66c0c01c39fa5e3a21720a19c4e8adbfcb99d0" }, + { + "path": "product/profiles/auths-profile-api/Cargo.toml", + "sha256": "7ae85761f58625b5d678f961fd052eebf3e000ef565c7312e3ac857763c0017f" + }, + { + "path": "product/profiles/auths-profile-api/src/lib.rs", + "sha256": "a194b82b20bf8aa864c2334ef6c6aec30b2154ded972862252d5dcefa488ab95" + }, + { + "path": "product/profiles/auths-profile-mcp/Cargo.toml", + "sha256": "db264fc25242f7b7e4133cbe5782545b3107b406c87168ae072683cfb59eac66" + }, + { + "path": "product/profiles/auths-profile-mcp/profile-v1.json", + "sha256": "fd46beeda8b55b802f8d4e61d4f5d0b1b74db77fcbeebddafab54bc06098df31" + }, + { + "path": "product/profiles/auths-profile-mcp/profile-v2.json", + "sha256": "2547772b2c38a28efef13adc789f9a55d13edfedbd301ff80a3216571dd6918e" + }, + { + "path": "product/profiles/auths-profile-mcp/src/arguments.rs", + "sha256": "a5de696586d507e2aee4a49fee99ef1ef4c51a2e46603f8838f1af6d9009833f" + }, + { + "path": "product/profiles/auths-profile-mcp/src/lib.rs", + "sha256": "d0f8b733a09ef8408336cdebc8948d6a5861012ce6878598b11be7084dfd4280" + }, + { + "path": "product/profiles/auths-profile-mcp/src/session.rs", + "sha256": "166c281fa66333388e4760d6098dad02d3359e1d5de4b8f93312c014f97abb03" + }, + { + "path": "product/receipts/auths-receipts/Cargo.toml", + "sha256": "6001fa1375899953aafcb07c23a6da0c8f57ea7ec08bb9c950b12a60a8cc6f0f" + }, + { + "path": "product/receipts/auths-receipts/src/disclosure.rs", + "sha256": "ba9ed439be0a320c8a01f5b6e9b51361c1a37e076947490d8e4a484ba6bb119c" + }, + { + "path": "product/receipts/auths-receipts/src/lib.rs", + "sha256": "547a57c4160256719cafb7d0ab972d9fc80b0da14fbbce4148c70c414070ff36" + }, { "path": "product/runtime/auths-connections/Cargo.toml", "sha256": "babeb6e1dda3dfb66291713ce1e43dce5c349833d0b50ea4dccbf986030026b2" @@ -161,7 +753,7 @@ }, { "path": "product/runtime/auths-connections/src/kernel.rs", - "sha256": "a456af19526ef7b19278551fd8d97606b6e7aa5a195e70bdd85d1e0786090ce8" + "sha256": "d53bf8df4e1343e8e798f0ab2d9d092059db7b266b0d1bad3ae4e6d463abce74" }, { "path": "product/runtime/auths-connections/src/lib.rs", @@ -169,23 +761,63 @@ }, { "path": "product/runtime/auths-connections/src/model.rs", - "sha256": "de34a089cac9702acb889b7602b3e4732306c9e61029ec892582b7e02b73fc77" + "sha256": "f6af1c15fc10a904eb598d30827d24ca202f52853a5a8d2af2164a5dc025959c" + }, + { + "path": "product/runtime/auths-connections/src/record_time_tests.rs", + "sha256": "201c61940d95f84ea4e125d672c6244f4cd1fefb414e9e583db509d2db5d175b" + }, + { + "path": "product/runtime/auths-connections/src/recovery_guard_tests.rs", + "sha256": "ce918bca22cd4f1d2d430951ba191e76ee5dc2b0fa145acf13da08ba52274a62" }, { "path": "product/runtime/auths-connections/src/registry.rs", "sha256": "e57640e003e72ad3235c567c2bb944a262bd64e673f023b62ea091094cc7e946" }, + { + "path": "product/runtime/auths-connections/src/strict_order_tests.rs", + "sha256": "2aa297d2955cdaedc0abbc118ba1027c363803d4bc825091b2e1db1121dc865c" + }, + { + "path": "product/runtime/auths-connections/src/string_constructor_tests.rs", + "sha256": "7af0e6b75baef268c9b11ea8aa551e8e7793d26378b11455ead7dcb7f2493008" + }, { "path": "product/runtime/auths-gateway-kernel/Cargo.toml", "sha256": "34f864e67656af4ac7e5c7a347a23f01fc8ab31365b8e23c0ef474483b14a183" }, { "path": "product/runtime/auths-gateway-kernel/src/construct.rs", - "sha256": "e9d65744bae273d65face4285e5d2da75c06a92ab48f7b8333d496604e31c63c" + "sha256": "ba592901a463c2cd81dc434ae62f33efeccc5e13f441a0dff65d60162a588b61" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "sha256": "4bc970895b118f71c074a091ede8d0c558ed43d912ae5d0aebdc03aa64a8f78c" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "sha256": "d364f9c9955dbbda5e18dba547169a3ec61f5147153308b14eb85456bd04c175" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/deadline.rs", + "sha256": "25c96a7ef2427f54930e90cf739e6149dc21de9454f5d6d20984f0d5735cca19" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "sha256": "4ee6c6a014bfc246f34fbcbc65c020b3329377ac2cd262481060c480efede129" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/frontier.rs", + "sha256": "09650383952c76180295ab471b4f9344e0714071c0f72ecd7d0e8081b447519d" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/identity.rs", + "sha256": "38b6226778fee35abe163a20be35fe7099de7ebc1a24f94f8ee2c27132ed2c36" }, { "path": "product/runtime/auths-gateway-kernel/src/lib.rs", - "sha256": "cfda6f8453426564c085475f183b6f790b438768a19668f1b65d33ba59dc8632" + "sha256": "2707427b76ae35c7c44921433506dab1bad1306e2c59360756bf18e9c8d85aae" }, { "path": "product/runtime/auths-gateway-kernel/src/order.rs", @@ -203,10 +835,58 @@ "path": "product/runtime/auths-gateway-kernel/src/recovery.rs", "sha256": "9f46dcd1685ab6e4d1ba04a3fc286a9f3afee8fb47829be1fbc670a7926a2dc6" }, + { + "path": "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "sha256": "25770ea6be3dddf1d771ed4650c9678323795b82479d761ff6bfbf57b875c67e" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/reservation_retry.rs", + "sha256": "0feb8731a31b55bfcb4dececc6b79b76b2966e1bc8b4cb84ca4bca71eb75a319" + }, + { + "path": "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "sha256": "da9b30cec8d728282e7eefb6f5dee1606b27902fd19d204792c2d5ebb5c8b33a" + }, { "path": "product/runtime/auths-gateway-kernel/src/transition.rs", "sha256": "cefb8f01d915880f6921f2501ff881ad94b9de61072c34d9cd19220992f97374" }, + { + "path": "product/runtime/auths-gateway/src/bounds.rs", + "sha256": "c5f35c5abae551697b18443cb2ce9b04798adc32741efb0d71e1c0ba9731cb42" + }, + { + "path": "product/runtime/auths-gateway/src/connection.rs", + "sha256": "3ea2c7f6b233e395a2ec0463f526a1b01de3a29c6790c2eca36f8ffc95470400" + }, + { + "path": "product/runtime/auths-gateway/src/recipe.rs", + "sha256": "fc2c6581d80f880d1052c8a6d05a5368d2467669c57ba900358d3ccf80d25f16" + }, + { + "path": "product/runtime/auths-gateway/src/recipe/lower.rs", + "sha256": "b7ed4742fff4ffa505b0edbe7f390ecb845b07fa5026ecdb24aa107b21ebf3a1" + }, + { + "path": "product/runtime/auths-gateway/src/recipe/strict_json.rs", + "sha256": "59f6ab5e641d85f9429172023feed3d06566a87b700fbeee20fce79bd669ccb0" + }, + { + "path": "product/runtime/auths-gateway/src/recipe/tests.rs", + "sha256": "411271b06f8a53ad406aa15d7aeb3c5c437f237502034ec1e62221d843498c3f" + }, + { + "path": "product/runtime/auths-gateway/src/store.rs", + "sha256": "fb1a92a02cea9b47d4b9552918ac2f58381133be0b9ed3b2117df5073e94f1ce" + }, + { + "path": "product/runtime/auths-kernel-runtime/Cargo.toml", + "sha256": "926bcd0053e5edd703be8f0027ad009e2982db013c8174c1366edbf38b48087d" + }, + { + "path": "product/runtime/auths-kernel-runtime/src/lib.rs", + "sha256": "7108faae9ca4bc32dc093ddaf885ac8f74f3c9b8d317b7c7d0ed00d1d0ab5972" + }, { "path": "product/runtime/auths-lifecycle/Cargo.toml", "sha256": "c5053c705f8d5554b44e432fe75287a2faf11d644e5a2552e45ad6cd94176af5" @@ -259,6 +939,66 @@ "path": "product/runtime/auths-lifecycle/tests/lifecycle.rs", "sha256": "735466062bd8f032f9a9d410384d62107e32bcff5457520426d7deca5aecd686" }, + { + "path": "product/runtime/auths-runtime/Cargo.toml", + "sha256": "dd29d80a8b4bb56c869f036a6c9998f6e6d1c0383ac5dc03fa42b24abe2a7ff7" + }, + { + "path": "product/runtime/auths-runtime/src/lib.rs", + "sha256": "132ca03d58c14905d3a822a4972f42a22a5ad33a45f2ba9ca44f3a57d810b4b0" + }, + { + "path": "product/runtime/auths-runtime/src/production.rs", + "sha256": "fd4eff4270c571c10fcff6cf27df28961ebf074de8a1a028f500fda1ca376820" + }, + { + "path": "product/stores/auths-stores/Cargo.toml", + "sha256": "a32c4b76d17b264be5d40d24497ff237e1ed87822e8bab86229b3db93106dbe3" + }, + { + "path": "product/stores/auths-stores/migrations/postgres_lifecycle_v7.sql", + "sha256": "1986577c5e1905e3c451bd8b272ffbd2a3b78852ba2c6a581d20848e2ee88657" + }, + { + "path": "product/stores/auths-stores/src/gateway_attempt.rs", + "sha256": "81c5ed9dad20ef8d544299b111b496d4a2af3d234364482bc5f892de358fa0ad" + }, + { + "path": "product/stores/auths-stores/src/gateway_fence.rs", + "sha256": "b3286828c65b8d0d9203c1ce2381eef709b8cd1ae89b9b3f5ddcf87707f2a906" + }, + { + "path": "product/stores/auths-stores/src/lib.rs", + "sha256": "6cf1be4c3ea934531f920713db3b278b770cfa94c6b910e18c119bd5d70ff36a" + }, + { + "path": "product/stores/auths-stores/src/lifecycle.rs", + "sha256": "0ecbb634275b0e468e35bbd90f9271741b6bb582a22b03b0b08fc29cffadff9d" + }, + { + "path": "product/stores/auths-stores/tests/postgres_lifecycle.rs", + "sha256": "4f51a0e27f2d96e0ed8acf7ec9055ddf993ee49f3af2e299c81539f7e065bc85" + }, + { + "path": "product/stores/auths-stores/tests/postgres_tls/.gitignore", + "sha256": "f5c10da83055c0c3e72f3167971d1916e443dc90390e32b42844552cc37b81e0" + }, + { + "path": "product/stores/auths-stores/tests/postgres_tls/README.md", + "sha256": "87d1549181a7524d2b13bc1e581b253849187f888e972fc894e6b31b1ff47fb6" + }, + { + "path": "product/stores/auths-stores/tests/postgres_tls/compose.yaml", + "sha256": "66ce27e1b1156c3ed8acd26ffc0150c82de28b4d673866274bf0dc37f9d7557c" + }, + { + "path": "product/stores/auths-stores/tests/postgres_tls/generate-certificates.sh", + "sha256": "5785c6f975d340e0a6cbd2ddff9b924a1605d910b0e3a87a5ae4489fb14a8303" + }, + { + "path": "product/stores/auths-stores/tests/production_recovery.rs", + "sha256": "605629e4f79d7c38c8acd86aad1fcd2c9d3fcfbbe0a2f56de411ce7937cea2e5" + }, { "path": "xtask/Cargo.toml", "sha256": "66b2989994cb878392e352a3c1a632b6cc64074aa4e37e8e77361a191a60a0c5" @@ -273,7 +1013,7 @@ }, { "path": "xtask/ci-plan/src/lib.rs", - "sha256": "aeae292998e347454a2396933d4e4968460c70c165f88b7a6586985582a0463c" + "sha256": "e67e98ea4139ac77d0008cfbf843bbc33dd4c5a31586ecf2231bc652407387b7" }, { "path": "xtask/ci-plan/src/main.rs", @@ -301,7 +1041,7 @@ }, { "path": "xtask/src/checks.rs", - "sha256": "d67a92a45d88be5d59e558b5fba1bd59a3ca676bfc57cc8fa9a587c2df6780f3" + "sha256": "7440763f146f138bda0d1f591f9af1555bc7760d792a962435f3e1830c861232" }, { "path": "xtask/src/compliance.rs", @@ -325,11 +1065,11 @@ }, { "path": "xtask/src/formal.rs", - "sha256": "99d0378a44c59d6ce227033a5aa8af193d6b55fe76a519ba06e28d0f2ae2094d" + "sha256": "cd757c2013fe18aeab14d8d8d099cdf9a389797c9bfdf81284a11c7f1a783d61" }, { "path": "xtask/src/formal_coverage.rs", - "sha256": "9736ece0a2c869d4cf0a498282925da9d306eb05d8dd8f60bd7e8f6bed1dcd0b" + "sha256": "cfe5b9e105b05eaa41f0199cad4a975b4740e3c2c0fb7bf3ec2f404ba5165fbd" }, { "path": "xtask/src/formal_mutations.rs", @@ -337,7 +1077,7 @@ }, { "path": "xtask/src/formal_qualification.rs", - "sha256": "1826078f21dbf946801413cb6cf1f66dfd7495c9de3853455fbf2eb151f899e6" + "sha256": "97170293013da1b2678fe40e4b94f72caf47682435366697c2ec5dcf1c91ae15" }, { "path": "xtask/src/fuzz.rs", @@ -345,7 +1085,7 @@ }, { "path": "xtask/src/kani_harness.rs", - "sha256": "33013cb22709e8ad557b8da626dc35ac455484f5f272d431c0ec151e708c6212" + "sha256": "7e2e429784d26e9d5542d063c98f496dbfa15fe49c2788825ffbdae76a3f93c4" }, { "path": "xtask/src/live_demo.rs", @@ -401,7 +1141,7 @@ }, { "path": "xtask/src/semantic_freeze.rs", - "sha256": "9e36c78ae7ed8ce11bbc545ef7db8c1741c826038d01a7fb66d6e7fa5c91b18b" + "sha256": "697005576d88fd595e9efeb9ca67465ac45f71beb5636a144741b7c54444eeb3" }, { "path": "xtask/src/stripe.rs", diff --git a/formal/theorem-kinds-v1.toml b/formal/theorem-kinds-v1.toml index 39cc53bdc..01c0ac7a8 100644 --- a/formal/theorem-kinds-v1.toml +++ b/formal/theorem-kinds-v1.toml @@ -12,6 +12,370 @@ schema = "auths-proof-theorem-kinds/v1" [kinds] +"Auths.Codec.Payload.payload_exact" = "exact" +"Auths.Codec.Payload.bytes_exact" = "exact" +"Auths.Codec.Payload.str_exact" = "exact" +"Auths.Codec.Payload.success_earns_span" = "partial" +"Auths.Codec.Collection.collection_exact" = "exact" +"Auths.Codec.Collection.map_exact" = "exact" +"Auths.Codec.Collection.array_exact" = "exact" +"Auths.Codec.Fields.key_exact" = "exact" +"Auths.Codec.Fields.map_exact" = "exact" +"Auths.Codec.Fields.text_exact" = "exact" +"Auths.Codec.Fields.null_exact" = "exact" +"Auths.Codec.Fields.is_null_exact" = "exact" +"Auths.Codec.Fields.array_exact" = "exact" +"Auths.Codec.Fields.bounded_bytes_exact" = "exact" +"Auths.Codec.Fields.digest_bytes_exact" = "exact" +"Auths.Codec.Cursor.new_exact" = "exact" +"Auths.Codec.Cursor.at_exact" = "exact" +"Auths.Codec.Cursor.position_exact" = "exact" +"Auths.Codec.Cursor.head_exact" = "exact" +"Auths.Codec.Cursor.u64_exact" = "exact" +"Auths.Codec.Cursor.u8_exact" = "exact" +"Auths.Codec.Cursor.u16_exact" = "exact" +"Auths.Codec.Cursor.null_exact" = "exact" +"Auths.Codec.Cursor.datatype_exact" = "exact" +"Auths.Codec.Cursor.ensure_complete_exact" = "exact" +"Auths.Product.RecordShape.Refinement.text_order_exact" = "exact" +"Auths.Product.RecordShape.Refinement.profile_order_exact" = "exact" +"Auths.Product.RecordShape.Refinement.workloads_exact" = "exact" +"Auths.Product.RecordShape.Refinement.profiles_exact" = "exact" +"Auths.Product.RecordShape.Refinement.record_shape_exact" = "exact" +"Auths.Product.RecordShape.Refinement.success_earns_all_invariants" = "partial" +"Auths.Product.StrictOrder.Refinement.strict_order_exact" = "exact" +"Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates" = "partial" +"Auths.Product.RecordTimes.Refinement.record_times_exact" = "exact" +"Auths.Product.RecordTimes.Refinement.success_earns_order" = "partial" +"Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape" = "partial" + +"Auths.Product.StringConstructors.Refinement.actual_provider_exact" = "exact" +"Auths.Product.StringConstructors.Refinement.actual_alias_exact" = "exact" +"Auths.Product.StringConstructors.Refinement.actual_semantic_exact" = "exact" +"Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload" = "partial" +"Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload" = "partial" +"Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload" = "partial" + +"Auths.Product.RecoveryGate.Refinement.record_change_exact" = "exact" +"Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time" = "partial" +"Auths.Product.RecoveryGate.Refinement.recovery_exact" = "exact" +"Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation" = "partial" +"Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state" = "partial" +"Auths.Product.RecoveryGate.Refinement.binding_requirement_exact" = "exact" +"Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation" = "partial" +"Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation" = "partial" +"Auths.Product.RecoveryGate.Refinement.state_transition_exact" = "exact" +"Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time" = "partial" + +"Auths.Product.SemanticId.Refinement.semantic_head_exact" = "exact" +"Auths.Product.SemanticId.Refinement.semantic_tail_exact" = "exact" +"Auths.Product.SemanticId.Refinement.semantic_valid_exact" = "exact" +"Auths.Product.SemanticId.Refinement.source_earns_no_nul" = "partial" +"Auths.Product.SemanticId.Refinement.source_earns_ascii" = "partial" +"Auths.Product.SemanticId.Refinement.source_earns_bounds" = "partial" +"Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact" = "exact" + +"Auths.Product.ProfileConstructor.Refinement.constructor_exact" = "exact" +"Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields" = "partial" +"Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused" = "partial" + +"Auths.Product.ConnectionBytes.Refinement.lower_tail_exact" = "exact" +"Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact" = "exact" +"Auths.Product.ConnectionBytes.Refinement.lower_valid_exact" = "exact" +"Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul" = "partial" +"Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul" = "partial" +"Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound" = "partial" +"Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound" = "partial" + +"Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact" = "exact" +"Auths.Product.ConnectionEntry.Refinement.entry_allows_exact" = "exact" +"Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile" = "partial" +"Auths.Product.ConnectionEntry.Refinement.source_disabled_refused" = "partial" +"Auths.Product.ConnectionEntry.Refinement.source_revoked_refused" = "partial" + +"Auths.Product.ReservationAdmission.Refinement.reservation_admission_exact" = "exact" +"Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds" = "partial" +"Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum" = "partial" +"Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors" = "partial" +"Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow" = "partial" + +"Auths.Product.CounterAggregation.Refinement.count_capacity_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact" = "exact" +"Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum" = "exact" + +"Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec" = "exact" +"Auths.Product.SlotRecord.Refinement.validate_cumulative_exact" = "exact" +"Auths.Product.SlotRecord.Refinement.source_accepted_binds_record" = "partial" +"Auths.Product.SlotRecord.Refinement.source_invalid_record_refused" = "partial" + +"Auths.Product.SlotBatch.Refinement.count_loop_exact" = "exact" +"Auths.Product.SlotBatch.Refinement.sum_loop_exact" = "exact" +"Auths.Product.SlotBatch.Refinement.build_exact" = "exact" +"Auths.Product.SlotBatch.Refinement.source_claim_first" = "partial" +"Auths.Product.SlotBatch.Refinement.source_complete_entry_count" = "partial" +"Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused" = "partial" + +"Auths.Product.ReservationRetry.Refinement.retry_target_exact" = "exact" +"Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay" = "partial" +"Auths.Product.ReservationRetry.Refinement.source_count_progress_safe" = "partial" +"Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe" = "partial" + +"Auths.Product.CounterAggregation.Refinement.sum_position_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.contribute_sum_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique" = "partial" +"Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities" = "partial" + +"Auths.Product.CounterAggregation.Refinement.counter_equal_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.counter_position_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.contribute_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.aggregate_spec" = "exact" +"Auths.Product.CounterAggregation.Refinement.source_aggregate_unique" = "partial" +"Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities" = "partial" + +"Auths.Product.CounterFrames.Refinement.word_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.component_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.coordinates_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.count_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.sum_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.count_slot_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.sum_slot_exact" = "exact" +"Auths.Product.CounterFrames.Refinement.count_source_binds_inputs" = "partial" +"Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs" = "partial" + +"Auths.Lifecycle.Refinement.translated_terminal_refines_rich" = "exact" +"Auths.Product.Frontier.Refinement.source_work_bound" = "partial" +"Auths.ScopeConstructor.constructed_grant_selection" = "partial" +"Auths.ScopeConstructor.constructed_principal_selection" = "partial" +"Auths.Product.Frontier.Refinement.start_exact" = "exact" +"Auths.Product.Frontier.Refinement.probe_exact" = "exact" +"Auths.Product.Frontier.Refinement.observe_exact" = "exact" +"Auths.Product.Frontier.Refinement.candidate_exact" = "exact" +"Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity" = "partial" +"Auths.ScopeConstructor.accepted_rule_valid" = "partial" +"Auths.ScopeConstructor.accepted_trust_valid" = "partial" +"Auths.ScopeConstructor.decoded_trust_principal" = "partial" +"Auths.ScopeConstructor.decoded_trust_grant" = "partial" +"Auths.Product.SchemaIndex.Refinement.field_name_equal_spec" = "exact" +"Auths.Product.SchemaIndex.Refinement.field_index_spec" = "exact" +"Auths.Product.OperationIdentity.Refinement.logical_preimage_exact" = "exact" +"Auths.Product.OperationIdentity.Refinement.token_exact" = "exact" +"Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list" = "case" +"Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list" = "case" +"Auths.ScopeConstructor.decoded_scope_covers" = "partial" +"Auths.ScopeConstructor.accepted_scope_valid" = "partial" +"Auths.ScopeConstructor.DecodeExamples.accepts_own" = "case" +"Auths.ScopeConstructor.DecodeExamples.accepts_any" = "case" +"Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag" = "case" +"Auths.ScopeConstructor.DecodeExamples.refuses_truncation" = "case" +"Auths.ScopeConstructor.DecodeExamples.accepts_listed" = "case" +"Auths.ScopeConstructor.DecodeExamples.refuses_empty_list" = "case" +"Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id" = "case" +"Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit" = "case" +"Auths.StatusSelection.principal_method_all_views" = "partial" +"Auths.StatusSelection.grant_method_all_views" = "partial" +"Auths.StatusSelection.AnchorExamples.own_anchor_active" = "case" +"Auths.StatusSelection.AnchorExamples.other_anchor_hidden" = "case" +"Auths.StatusSelection.principal_method_approver_independent" = "partial" +"Auths.StatusSelection.grant_method_approver_independent" = "partial" +# Imported transparent Auths-model bodies remain audited source components; +# this metric classifies only locally owned functions in each translation. +# approver_visibility_refines therefore has no owned-function metric row. +"Auths.StatusSelection.sequence_floor_refines" = "exact" +"Auths.StatusSelection.freshness_exact" = "partial" +"Auths.StatusSelection.principal_loop_refines" = "partial" +"Auths.StatusSelection.principal_selector_approver_refines" = "partial" +"Auths.StatusSelection.principal_method_approver_refines" = "partial" +"Auths.StatusSelection.grant_loop_refines" = "partial" +"Auths.StatusSelection.grant_selector_approver_refines" = "partial" +"Auths.StatusSelection.grant_method_approver_refines" = "partial" +"Auths.StatusSelection.Examples.active_selected_horizon" = "case" +"Auths.StatusSelection.Examples.revoked_selected_horizon" = "case" +"Auths.StatusSelection.Examples.stale_selected_refused" = "case" +"Auths.StatusSelection.Examples.rollback_despite_newer" = "case" +"Auths.StatusSelection.Examples.newer_discards_old_stale_revocation" = "case" +"Auths.StatusSelection.Examples.latest_ties_conservatively_revoke" = "case" +"Auths.StatusSelection.Examples.wrong_method_refused" = "case" +"Auths.StatusSelection.Examples.missing_uses_snapshot_window" = "case" +"Auths.StatusSelection.Examples.unknown_issuer_refused" = "case" +"Auths.TemporalWitness.status_horizon_exact" = "exact" +"Auths.TemporalWitness.status_horizon_accepts_iff" = "verdict-exact" +"Auths.TemporalWitness.status_horizon_stale_refused" = "partial" +"Auths.TemporalWitness.status_decision_accepts_iff" = "verdict-exact" +"Auths.TemporalWitness.Status.decision_refines" = "exact" +"Auths.TemporalWitness.assurance_loop_refines" = "exact" +"Auths.TemporalWitness.assurance_entry_refines" = "exact" +"Auths.TemporalWitness.successful_native_horizon_exact" = "partial" +"Auths.TemporalWitness.native_horizon_permits_iff" = "partial" +"Auths.TemporalWitness.Examples.inclusive_status_endpoint" = "case" +"Auths.TemporalWitness.Examples.expired_status_refused" = "case" +"Auths.TemporalWitness.Examples.revoked_principal_refused" = "case" +"Auths.TemporalWitness.Examples.revoked_grant_refused" = "case" +"AuthsSuiteAdapters.ed25519_delegates" = "partial" +"AuthsSuiteAdapters.p256_delegates" = "partial" +"Auths.Crypto.SuiteAdapters.ed_public_refines" = "exact" +"Auths.Crypto.SuiteAdapters.ed_accepts_iff" = "verdict-exact" +"Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted" = "case" +"Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused" = "case" +"Auths.Crypto.SuiteAdapters.p256_public_refines" = "exact" +"Auths.Crypto.SuiteAdapters.p256_accepts_iff" = "verdict-exact" +"Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted" = "case" +"Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused" = "case" +"Auths.Crypto.P256Encoding.guard_refines" = "exact" +"Auths.Crypto.P256LowScan.loop_refines" = "exact" +"Auths.Crypto.P256LowContract.guard_refines" = "exact" +"Auths.Crypto.P256LowContract.r_bytes_irrelevant" = "partial" +"Auths.Crypto.P256Native.decode_leaf_refines" = "exact" +"Auths.Crypto.P256Native.parse_leaf_refines" = "exact" +"Auths.Crypto.P256Native.equation_leaf_refines" = "exact" +"Auths.Crypto.P256Native.decode_refines" = "exact" +"Auths.Crypto.P256Native.public_verify_refines" = "exact" +"Auths.Crypto.P256Native.public_accepts_iff" = "verdict-exact" +"Auths.Crypto.P256Native.public_validate_refines" = "exact" +"Auths.Crypto.P256Examples.public_call_forwards_exact_bytes" = "case" +"Auths.Crypto.P256Examples.changed_message_is_refused" = "case" +"Auths.Crypto.P256Examples.changed_key_is_refused" = "case" +"Auths.Crypto.P256Examples.changed_signature_is_refused" = "case" +"Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract" = "case" +"Auths.Crypto.FramingTotality.identifier_total" = "exact" +"Auths.Crypto.FramingTotality.identifier_accepts_iff" = "exact" +"Auths.Crypto.FramingTotality.identifier_refuses_iff" = "exact" +"Auths.Crypto.FramingTotality.application_total" = "exact" +"Auths.Crypto.FramingTotality.application_accepts_iff" = "exact" +"Auths.Crypto.FramingTotality.application_refuses_iff" = "exact" +"Auths.Crypto.FramingTotality.signing_total" = "exact" +"Auths.Crypto.FramingTotality.signing_accepts_iff" = "exact" +"Auths.Crypto.FramingTotality.signing_refuses_iff" = "exact" +"Auths.Crypto.CommitmentValidity.application_accepted_frame_valid" = "partial" +"Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid" = "partial" +"Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind" = "partial" +"Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind" = "partial" +"Auths.Crypto.CommitmentValidity.application_output_length" = "partial" +"Auths.Crypto.CommitmentValidity.identifier_output_length" = "partial" +"Auths.Crypto.BufferAllocation.buffer_refines" = "exact" +"Auths.Crypto.BufferAllocation.accepted_empty" = "partial" +"Auths.Crypto.BufferAllocation.accepted_capacity_fits" = "partial" +"Auths.Crypto.CommitmentRefinement.application_preimage_exact" = "partial" +"Auths.Crypto.CommitmentRefinement.identifier_preimage_exact" = "partial" +"Auths.Crypto.Sha256Native.raw_hash_refines" = "exact" +"Auths.Crypto.CommitmentExamples.empty_domain_refused" = "case" +"Auths.Crypto.CommitmentExamples.oversized_domain_refused" = "case" +"Auths.Crypto.CommitmentExamples.application_sample_admitted" = "case" +"Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted" = "case" +"Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest" = "case" +"Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest" = "case" +"Auths.Crypto.Native.decode_leaf_refines" = "exact" +"Auths.Crypto.Native.equation_leaf_refines" = "exact" +"Auths.Crypto.Native.public_verify_refines" = "exact" +"Auths.Crypto.Native.public_verify_accepts_iff" = "verdict-exact" +"Auths.Crypto.Native.public_validate_refines" = "exact" +"Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes" = "case" +"Auths.Crypto.NativeExamples.changed_message_is_refused" = "case" +"Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract" = "case" +"Auths.Crypto.LowScan.loop_refines" = "partial" +"Auths.Crypto.LowContract.guard_refines" = "exact" +"Auths.Crypto.LowContract.r_bytes_irrelevant" = "partial" +"Auths.Crypto.CoordinateScan.loop_refines" = "partial" +"Auths.Crypto.CoordinateContract.guard_refines" = "exact" +"Auths.Crypto.WeakContract.guard_refines" = "exact" +"Auths.Crypto.RContract.guard_refines" = "exact" +"Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines" = "exact" +"Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines" = "exact" +"Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines" = "exact" +"Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines" = "exact" +"Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines" = "exact" +"Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff" = "verdict-exact" +"Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff" = "verdict-exact" +"Auths.Crypto.Strict.Examples.zero_s_form_allowed" = "case" +"Auths.Crypto.Strict.Examples.half_s_form_allowed" = "case" +"Auths.Crypto.Strict.Examples.above_half_s_refused" = "case" +"Auths.Crypto.Strict.Examples.maximum_s_refused" = "case" +"Auths.Crypto.Strict.Examples.identity_coordinate_is_weak" = "case" +"Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak" = "case" +"Auths.Crypto.Strict.Examples.weak_r_form_refused" = "case" +"Auths.Crypto.Strict.Examples.public_r_form_allowed" = "case" +"Auths.Composition.Facade.event_outcome_exact" = "exact" +"Auths.Composition.Facade.observer_mut_exact" = "exact" +"Auths.Composition.Facade.observer_once_exact" = "exact" +"Auths.Composition.Facade.evaluate_refines" = "exact" +"Auths.Composition.Facade.invalid_plan_preserves_callback" = "partial" +"Auths.Composition.FacadeExamples.conjunction_authorizes" = "case" +"Auths.Composition.FacadeExamples.duplicate_refused" = "case" +"Auths.Composition.FacadeExamples.threshold_indeterminate" = "case" +"Auths.Crypto.Encoding.Scan.loop_refines" = "partial" +"Auths.Crypto.Encoding.RootFlags.root_flags" = "partial" +"Auths.Crypto.Encoding.Ed25519.guard_refines" = "verdict-exact" +"Auths.Crypto.Encoding.P256.guard_refines" = "verdict-exact" +"Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted" = "case" +"Auths.Crypto.Encoding.Examples.field_alias_refused" = "case" +"Auths.Crypto.Encoding.Examples.negative_zero_refused" = "case" +"Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted" = "case" +"Auths.Crypto.Encoding.Examples.compressed_form_accepted" = "case" +"Auths.Crypto.Encoding.Examples.uncompressed_tag_refused" = "case" +"Auths.Crypto.Encoding.Examples.short_compressed_refused" = "case" +"Auths.Composition.ValidationPublic.public_evaluator_refines" = "exact" +"Auths.Composition.ValidationContract.valid_public_evaluator_refines" = "exact" +"Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks" = "partial" +"Auths.Composition.ValidationContract.public_event_bound" = "partial" +"Auths.Composition.ValidationExamples.public_conjunction" = "case" +"Auths.Composition.ValidationExamples.duplicate_refused" = "case" +"Auths.Composition.ValidationExamples.zero_threshold_refused" = "case" +"Auths.Composition.ValidationExamples.public_threshold_indeterminate" = "case" +"Auths.Composition.ValidationExamples.narrow_refused" = "case" +"Auths.Composition.ValidationExamples.shallow_refused" = "case" +"Auths.Composition.Bounds.source_bounded_events" = "partial" +"Auths.Composition.Traversal.evaluator_refines" = "exact" +"Auths.Composition.Work.source_event_count" = "partial" +"Auths.Composition.Work.source_leaf_order" = "partial" +"Auths.Composition.PlanExamples.two_leaf_conjunction" = "case" +"Auths.Composition.PlanExamples.all_visits_after_denial" = "case" +"Auths.Composition.PlanExamples.any_visits_after_authorization" = "case" +"Auths.Composition.PlanExamples.threshold_indeterminate" = "case" +"Auths.Composition.PlanExamples.threshold_refused" = "case" +"Auths.Composition.Refinement.push_exact" = "partial" +"Auths.Composition.Refinement.all_exact" = "exact" +"Auths.Composition.Refinement.threshold_exact" = "exact" +"Auths.Composition.Refinement.threshold_authorized_exact" = "verdict-exact" +"Auths.Crypto.Refinement.signing_preimage_exact" = "partial" +"Auths.Crypto.Refinement.accepted_frame_valid" = "partial" +"Auths.Crypto.Refinement.accepted_preimages_bind_inputs" = "partial" +"Auths.Crypto.Refinement.preimage_length_exact" = "partial" +"Auths.Crypto.Refinement.object_domains_separate" = "partial" +"Auths.Crypto.Refinement.profile_limit_refused" = "partial" +"Auths.Crypto.Examples.minimal_preimage_exact" = "case" +"Auths.Crypto.Examples.unicode_preimage_exact" = "case" +"Auths.Codec.Action.bounded_bytes_valid" = "partial" +"Auths.Codec.Action.decoded_body_valid" = "partial" +"Auths.Codec.Action.decoded_body_within_deployment" = "partial" +"Auths.Codec.Examples.minimal_encoding_exact" = "case" +"Auths.Codec.Examples.minimal_action_accepted" = "case" +"Auths.Codec.Examples.duplicate_key_refused" = "case" +"Auths.Codec.Examples.nonminimal_integer_refused" = "case" +"Auths.Codec.Examples.invalid_utf8_refused" = "case" +"Auths.Codec.Examples.truncated_refused" = "case" +"Auths.Codec.Examples.trailing_byte_refused" = "case" +"Auths.Codec.Examples.action_byte_limit_refused" = "case" +"Auths.Codec.Examples.action_byte_limit_exact" = "case" +"Auths.Refinement.Identifier.identifier_string_exact" = "partial" +"Auths.Codec.Action.decode_encode_exact" = "partial" +"Auths.Codec.Action.accepted_encoding_unique" = "partial" +"Auths.Refinement.Identifier.forbidden_at_exact" = "exact" +"Auths.Refinement.Identifier.scan_exact" = "exact" +"Auths.Refinement.Identifier.identifier_exact" = "exact" +"Auths.Refinement.Identifier.identifier_unicode_exact" = "partial" +"Auths.Codec.Refinement.Encoder.append_tail_exact" = "partial" +"Auths.Codec.Refinement.Encoder.encode_head_refines" = "exact" +"Auths.Codec.Refinement.Encoder.encode_head_byte_bound" = "partial" +"Auths.Codec.Refinement.Encoder.encode_head_roundtrip" = "partial" +"Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model" = "exact" +"Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model" = "exact" +"Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses" = "partial" +"Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model" = "exact" +"Auths.Product.Refinement.CollectionFence.translated_advance_refines_model" = "exact" +"Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses" = "partial" +"Auths.Codec.Refinement.read_head_refines" = "exact" +"Auths.Codec.Refinement.read_tail_bounded" = "exact" +"Auths.Codec.Refinement.read_head_accepts_encoding" = "partial" "Auths.Lifecycle.Refinement.translated_additive_capacity_refines_rich" = "exact" "Auths.Lifecycle.Refinement.translated_exclusive_capacity_refines_rich" = "exact" "Auths.Lifecycle.Refinement.translated_replay_refines_rich" = "exact" diff --git a/formal/tools/SourceClosure.lean b/formal/tools/SourceClosure.lean new file mode 100644 index 000000000..947fc13c8 --- /dev/null +++ b/formal/tools/SourceClosure.lean @@ -0,0 +1,38 @@ +/- Resolve repository source imports with the pinned Lean parser and search +path in one process. This is the same parser/resolver used by `lean --src-deps`. +The Rust caller independently checks ownership, uniqueness and the entry root. +No proof, theorem statement, axiom or compiled module is created here. -/ +import Lean.Elab.Import +open Lean System + +def isOwned (root path : FilePath) : Bool := + root.components.isPrefixOf path.components && + !(root / ".lake").components.isPrefixOf path.components && + path.extension == some "lean" + +partial def collectSources (root : FilePath) (search : Lean.SearchPath) + (pending : List FilePath) (visited : Std.TreeSet String) : IO (Std.TreeSet String) := do + match pending with + | [] => pure visited + | path :: pending => + let path ← IO.FS.realPath path + if visited.contains path.toString then + collectSources root search pending visited + else + let text ← IO.FS.readFile path + let (imports, _, messages) ← Lean.Elab.parseImports text (some path.toString) + if messages.hasErrors then + throw (IO.userError s!"invalid Lean header: {path}") + let mut pending := pending + for item in imports do + let resolved ← IO.FS.realPath (← Lean.findLean search item.module) + if isOwned root resolved then pending := resolved :: pending + collectSources root search pending (visited.insert path.toString) + +def main (args : List String) : IO Unit := do + unless args.length == 2 do throw (IO.userError "expected formal root and entry source") + let root ← IO.FS.realPath args[0]! + let entry ← IO.FS.realPath args[1]! + unless isOwned root entry do throw (IO.userError "entry is outside formal root") + let sources ← collectSources root (← Lean.getSrcSearchPath) [entry] {} + IO.println (toJson sources.toList).compress diff --git a/product/policy/auths-bounded-policy/src/kernel.rs b/product/policy/auths-bounded-policy/src/kernel.rs index 44cc1d13a..83749249d 100644 --- a/product/policy/auths-bounded-policy/src/kernel.rs +++ b/product/policy/auths-bounded-policy/src/kernel.rs @@ -173,6 +173,42 @@ pub fn chain_sums_admit(sums: &[u64], argument: u64, capacities: &[u64]) -> bool true } +/// The ordered outcome of count-slot and cumulative-sum admission. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum ReservationCode { + /// Every count and sum counter has room for the requested action. + Admit, + /// A count or sum-slot frontier has no room, or its vector is malformed. + WindowExhausted, + /// A cumulative sum would exceed its limit, overflow, or have wrong shape. + SumExhausted, +} + +/// Decides one reservation from every distinct counter's current frontier, +/// smallest capacity and cumulative total. Window exhaustion takes precedence +/// over sum exhaustion. Shape mismatches and word overflow never admit. +/// This pure decision does not insert records or grant an execution handle. +#[must_use] +pub fn reservation_admission( + counts: &[u64], + count_capacities: &[u64], + sum_slots: &[u64], + sum_slot_capacities: &[u64], + totals: &[u64], + sum_capacities: &[u64], + argument: u64, +) -> ReservationCode { + if !chain_counts_admit(counts, count_capacities) + || !chain_counts_admit(sum_slots, sum_slot_capacities) + { + ReservationCode::WindowExhausted + } else if !chain_sums_admit(totals, argument, sum_capacities) { + ReservationCode::SumExhausted + } else { + ReservationCode::Admit + } +} + /// A policy's list of admitted values for one named verified argument. #[derive(Clone, Debug, Eq, PartialEq)] pub struct ValueList { @@ -525,6 +561,58 @@ mod proofs { mod tests { use super::*; + #[test] + fn complete_reservation_decision_matches_the_preceding_ordered_guards() { + let slices: [&[u64]; 6] = [&[], &[0], &[1], &[u64::MAX], &[0, 1], &[1, u64::MAX]]; + let mut cases = 0; + for counts in slices { + for count_caps in slices { + for slots in slices { + for slot_caps in slices { + for totals in slices { + for sum_caps in slices { + for argument in [0, 1, u64::MAX] { + let counts_fit = counts.len() == count_caps.len() + && counts + .iter() + .zip(count_caps) + .all(|(value, cap)| value < cap); + let slots_fit = slots.len() == slot_caps.len() + && slots + .iter() + .zip(slot_caps) + .all(|(value, cap)| value < cap); + let sums_fit = totals.len() == sum_caps.len() + && totals.iter().zip(sum_caps).all(|(value, cap)| { + value + .checked_add(argument) + .is_some_and(|next| next <= *cap) + }); + let expected = if !counts_fit || !slots_fit { + ReservationCode::WindowExhausted + } else if !sums_fit { + ReservationCode::SumExhausted + } else { + ReservationCode::Admit + }; + assert_eq!( + reservation_admission( + counts, count_caps, slots, slot_caps, totals, sum_caps, + argument + ), + expected + ); + cases += 1; + } + } + } + } + } + } + } + assert_eq!(cases, 139_968); + } + #[test] fn ceiling_count_checks_the_ceiling_before_the_window() { assert_eq!(ceiling_count_code(10, 10, 0, 1), CeilingCountCode::Eligible); diff --git a/product/qualification/auths-recipe-qualification-issuance/src/bin/auths-qualification.rs b/product/qualification/auths-recipe-qualification-issuance/src/bin/auths-qualification.rs index 6287529c9..badb58cf8 100644 --- a/product/qualification/auths-recipe-qualification-issuance/src/bin/auths-qualification.rs +++ b/product/qualification/auths-recipe-qualification-issuance/src/bin/auths-qualification.rs @@ -204,7 +204,8 @@ struct CertificateOptions { root: PathBuf, #[arg(long)] signer_id: String, - #[arg(long)] + // Base64url public keys may start with '-', which is part of the value. + #[arg(long, allow_hyphen_values = true)] public_key: String, #[arg(long)] issued_at: Option, @@ -815,3 +816,43 @@ fn main() -> ExitCode { } } } + +#[cfg(test)] +mod tests { + use super::{Cli, Command}; + use auths_recipe_qualification::PublicKeyB64; + use clap::Parser; + + #[test] + fn certificate_commands_accept_public_keys_starting_with_a_hyphen() { + let public_key = PublicKeyB64::from_bytes(&[0xfb; 32]); + assert!(public_key.as_str().starts_with('-')); + for command in ["certify", "certify-commissioner"] { + let parsed = Cli::try_parse_from([ + "auths-qualification", + command, + "--root-key", + "synthetic-root.key", + "--root", + "synthetic-root.json", + "--signer-id", + "synthetic-signer", + "--public-key", + public_key.as_str(), + "--not-before", + "1", + "--not-after", + "2", + "--out", + "synthetic-certificate.json", + ]) + .expect("base64url public key is one argument"); + let (Command::Certify(options) | Command::CertifyCommissioner(options)) = + parsed.command + else { + panic!("expected a certificate command"); + }; + assert_eq!(options.public_key, public_key.as_str()); + } + } +} diff --git a/product/qualification/auths-recipe-qualification/src/commissioning.rs b/product/qualification/auths-recipe-qualification/src/commissioning.rs index 07a796713..2b30aedfb 100644 --- a/product/qualification/auths-recipe-qualification/src/commissioning.rs +++ b/product/qualification/auths-recipe-qualification/src/commissioning.rs @@ -361,6 +361,19 @@ impl VerifiedCommissioningPermit { &self.permit } + /// Exclusive last entry time of the exact authenticated permit, its + /// signer and revocation list. Evaluation must still check current + /// revocations, clock trust and installed bindings. + #[must_use] + pub fn entry_not_after(&self) -> u64 { + self.permit + .body() + .statement + .not_after + .min(self.certificate.body().statement.not_after) + .min(self.revocations.body().statement.next_update) + } + /// Permanently remembers authenticated revocations and the largest sequence. /// /// A stale list still revokes what it names. The runtime must durably diff --git a/product/qualification/auths-recipe-qualification/src/vectors/mod.rs b/product/qualification/auths-recipe-qualification/src/vectors/mod.rs index 47d3314c2..d37c09620 100644 --- a/product/qualification/auths-recipe-qualification/src/vectors/mod.rs +++ b/product/qualification/auths-recipe-qualification/src/vectors/mod.rs @@ -280,7 +280,7 @@ pub(super) fn target() -> QualificationTarget { gateway_version: bounded("1.0.0-rc.1"), gateway_build_sha256: digest_of("gateway build"), store_kind: LifecycleStoreKind::PostgresqlV1, - store_schema: bounded("auths.lifecycle.postgresql/6"), + store_schema: bounded("auths.lifecycle.postgresql/7"), credential_store_kind: CredentialStoreKind::AwsSecretsManagerV1, } } diff --git a/product/qualification/auths-recipe-qualification/src/verify.rs b/product/qualification/auths-recipe-qualification/src/verify.rs index 39d620604..49df272cd 100644 --- a/product/qualification/auths-recipe-qualification/src/verify.rs +++ b/product/qualification/auths-recipe-qualification/src/verify.rs @@ -71,18 +71,25 @@ pub struct QualificationVerdict { /// The first reason the deployment is not qualified; `None` exactly when /// the state is qualified. pub refusal: Option, + /// Inclusive temporal horizon of the selected qualified attestation, + /// signer and revocation list. Absent for every refusal. + pub valid_through: Option, } impl QualificationVerdict { - const QUALIFIED: Self = Self { - state: RecipeQualificationState::Qualified, - refusal: None, - }; + const fn qualified(valid_through: u64) -> Self { + Self { + state: RecipeQualificationState::Qualified, + refusal: None, + valid_through: Some(valid_through), + } + } const fn refused(state: RecipeQualificationState, refusal: QualificationRefusal) -> Self { Self { state, refusal: Some(refusal), + valid_through: None, } } @@ -503,33 +510,62 @@ impl VerifiedQualifications { } // The attestation nearest to qualified decides: another target's // attestation never hides the one that fits. - usable + let selected = usable .iter() .map(|(listed, attestation)| { - let tuple = &listed.record.body().tuple; - let digests_equal = tuple.compiled_recipe_sha256 - == deployment.compiled_recipe_sha256 - && tuple.profile_lock_sha256 == deployment.profile_lock_sha256 - && tuple.provider_contract_id == deployment.provider_contract_id - && tuple.gateway_semantic_closure_sha256 - == deployment.gateway_semantic_closure_sha256; - if now > attestation.body().statement.not_after || now > signer.not_after { - Refusal::Expired - } else if !digests_equal { - Refusal::DigestMismatch - } else if tuple.target != deployment.target { - Refusal::TargetMismatch - } else { - return None; - } - .into() - }) - .max_by_key(|refusal: &Option| { - refusal.map_or(u8::MAX, |refusal| refusal as u8) - }) - .flatten() - .map_or(QualificationVerdict::QUALIFIED, |refusal| { - QualificationVerdict::refused(State::Stale, refusal) + evaluate_attestation( + listed, + attestation, + deployment, + now, + signer.not_after, + list.next_update, + ) }) + .max_by_key(|(refusal, valid_through): &(Option, u64)| { + ( + refusal.map_or(u8::MAX, |refusal| refusal as u8), + *valid_through, + ) + }); + match selected { + Some((None, valid_through)) => QualificationVerdict::qualified(valid_through), + Some((Some(refusal), _)) => QualificationVerdict::refused(State::Stale, refusal), + None => QualificationVerdict::refused(State::Unqualified, Refusal::Missing), + } } } + +/// Evaluates one already authenticated candidate without changing refusal +/// precedence; successful candidates retain their exact temporal endpoint. +fn evaluate_attestation( + listed: &Listed, + attestation: &RecipeQualificationAttestation, + deployment: &QualificationTuple, + now: u64, + signer_not_after: u64, + revocations_not_after: u64, +) -> (Option, u64) { + use QualificationRefusal as Refusal; + let tuple = &listed.record.body().tuple; + let digests_equal = tuple.compiled_recipe_sha256 == deployment.compiled_recipe_sha256 + && tuple.profile_lock_sha256 == deployment.profile_lock_sha256 + && tuple.provider_contract_id == deployment.provider_contract_id + && tuple.gateway_semantic_closure_sha256 == deployment.gateway_semantic_closure_sha256; + let valid_through = attestation + .body() + .statement + .not_after + .min(signer_not_after) + .min(revocations_not_after); + let refusal = if now > attestation.body().statement.not_after || now > signer_not_after { + Refusal::Expired + } else if !digests_equal { + Refusal::DigestMismatch + } else if tuple.target != deployment.target { + Refusal::TargetMismatch + } else { + return (None, valid_through); + }; + (Some(refusal), valid_through) +} diff --git a/product/runtime/auths-connections/src/kernel.rs b/product/runtime/auths-connections/src/kernel.rs index dccca984f..927b49829 100644 --- a/product/runtime/auths-connections/src/kernel.rs +++ b/product/runtime/auths-connections/src/kernel.rs @@ -10,9 +10,8 @@ //! secret stored at exactly `credential_generation`, found as the newest //! stored generation not after `generation`. //! -//! This module is a translated leaf: closed `Copy` structs, `match` -//! dispatch, one index loop over a slice, and no standard-library call -//! beyond checked addition. +//! These translated leaves use closed structs/enums, scalar decisions and +//! bounded byte/generation loops. They perform no credential or provider I/O. /// The two generations of one connection record. #[derive(Clone, Copy, Debug, Eq, PartialEq)] @@ -100,10 +99,360 @@ pub fn lease_generation( } } +#[allow( + clippy::manual_range_contains, + reason = "explicit scalar comparisons keep this mechanically translated boundary free of RangeInclusive interfaces" +)] +fn lower_tail_valid(byte: u8) -> bool { + (byte >= b'a' && byte <= b'z') || (byte >= b'0' && byte <= b'9') || byte == b'-' +} +/// Whether bytes form a nonempty bounded `[a-z][a-z0-9-]*` token. +/// Oversized buffers refuse before scanning; no string allocation is performed. +#[must_use] +#[allow( + clippy::manual_range_contains, + reason = "explicit scalar comparisons keep this mechanically translated boundary free of RangeInclusive interfaces" +)] +pub fn lower_token_valid(value: &[u8], maximum: usize) -> bool { + if value.is_empty() || value.len() > maximum { + return false; + } + let first = value[0]; + if first < b'a' || first > b'z' { + return false; + } + let mut index = 0; + while index < value.len() { + let byte = value[index]; + if !lower_tail_valid(byte) { + return false; + } + index += 1; + } + true +} +/// Whether bytes are nonempty, bounded and entirely printable ASCII. +/// NUL, whitespace, control bytes and UTF-8 multibyte sequences refuse. +#[must_use] +#[allow( + clippy::manual_range_contains, + reason = "explicit scalar comparisons keep this mechanically translated boundary free of RangeInclusive interfaces" +)] +pub fn ascii_graphic_valid(value: &[u8], maximum: usize) -> bool { + if value.is_empty() || value.len() > maximum { + return false; + } + let mut index = 0; + while index < value.len() { + let byte = value[index]; + if byte < 0x21 || byte > 0x7e { + return false; + } + index += 1; + } + true +} + +#[allow( + clippy::manual_range_contains, + reason = "explicit scalar comparisons keep this mechanically translated boundary free of RangeInclusive interfaces" +)] +fn semantic_head_valid(byte: u8) -> bool { + (byte >= b'a' && byte <= b'z') + || (byte >= b'A' && byte <= b'Z') + || (byte >= b'0' && byte <= b'9') +} +fn semantic_tail_valid(byte: u8) -> bool { + semantic_head_valid(byte) + || byte == b'.' + || byte == b'_' + || byte == b':' + || byte == b'/' + || byte == b'-' +} +/// Whether bytes form a nonempty bounded `[A-Za-z0-9][A-Za-z0-9._:/-]*` identifier. +/// Oversized input refuses before scanning; no allocation is performed. +#[must_use] +pub fn semantic_id_valid(value: &[u8], maximum: usize) -> bool { + if value.is_empty() || value.len() > maximum { + return false; + } + if !semantic_head_valid(value[0]) { + return false; + } + let mut index = 0; + while index < value.len() { + if !semantic_tail_valid(value[index]) { + return false; + } + index += 1; + } + true +} + +use crate::model::{ + ConnectionProfile, ConnectionRecordError, ConnectionState, MAX_PROFILES, MAX_WORKLOADS, +}; +/// Authorizes recovery at a positive generation no newer than the record. +/// Revocation takes precedence and always refuses. Zero raw generations refuse +/// even though the typed shipping caller already excludes them. +/// +/// # Errors +/// Returns `Revoked` for a tombstone and `InvalidGeneration` for invalid bounds. +pub fn recovery_lease( + state: ConnectionState, + record_generation: u64, + requested_generation: u64, +) -> Result<(), ConnectionRecordError> { + match state { + ConnectionState::Revoked => Err(ConnectionRecordError::Revoked), + ConnectionState::Active | ConnectionState::Disabled => { + if record_generation == 0 + || requested_generation == 0 + || requested_generation > record_generation + { + Err(ConnectionRecordError::InvalidGeneration) + } else { + Ok(()) + } + } + } +} + +/// Which credential commitment a recovery binding must authenticate. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum RecoveryBindingRequirement { + /// The generation tuple is malformed or inconsistent. + Refuse, + /// The operation predates the current credential; use its authenticated record. + RecordedCommitment, + /// The operation uses the current credential; compare the current commitment. + CurrentCommitment, +} + +/// Selects which authenticated credential commitment recovery must check. +/// Invalid tuples refuse. An operation before the current credential generation +/// uses its recorded pair; later operations must name the exact current one. +#[must_use] +pub fn recovery_binding_requirement( + current_credential_generation: u64, + operation_generation: u64, + operation_credential_generation: u64, +) -> RecoveryBindingRequirement { + if current_credential_generation == 0 + || operation_generation == 0 + || operation_credential_generation == 0 + || operation_credential_generation > operation_generation + { + return RecoveryBindingRequirement::Refuse; + } + if operation_generation >= current_credential_generation { + if operation_credential_generation == current_credential_generation { + RecoveryBindingRequirement::CurrentCommitment + } else { + RecoveryBindingRequirement::Refuse + } + } else { + RecoveryBindingRequirement::RecordedCommitment + } +} + +/// Allows only a changed administrative state from a non-revoked record at a +/// nondecreasing timestamp. Revocation is a terminal state. +#[must_use] +pub fn state_transition_allows( + current: ConnectionState, + next: ConnectionState, + previous_time: u64, + proposed_time: u64, +) -> bool { + if proposed_time < previous_time { + return false; + } + matches!( + (current, next), + ( + ConnectionState::Active, + ConnectionState::Disabled | ConnectionState::Revoked + ) | ( + ConnectionState::Disabled, + ConnectionState::Active | ConnectionState::Revoked + ) + ) +} + +/// Allows administrative data changes only from a non-revoked record at a +/// nondecreasing timestamp. Rotation and authorization replacement share this rule. +#[must_use] +pub fn record_change_allows( + state: ConnectionState, + previous_time: u64, + proposed_time: u64, +) -> bool { + match state { + ConnectionState::Revoked => false, + ConnectionState::Active | ConnectionState::Disabled => proposed_time >= previous_time, + } +} + +/// Validates the complete temporal shape of a durable connection record. +/// Creation never follows update; only revoked records carry a revocation +/// timestamp, and that timestamp lies within the inclusive record lifetime. +#[must_use] +pub fn record_times_valid( + state: ConnectionState, + created: u64, + updated: u64, + revoked_at: Option, +) -> bool { + if created > updated { + return false; + } + match (state, revoked_at) { + (ConnectionState::Revoked, Some(value)) => created <= value && value <= updated, + (ConnectionState::Revoked, None) + | (ConnectionState::Active | ConnectionState::Disabled, Some(_)) => false, + (ConnectionState::Active | ConnectionState::Disabled, None) => true, + } +} + +/// Whether every adjacent pair is strictly ordered by T's native comparator. +/// Empty and singleton slices are ordered. The scan allocates nothing and +/// preserves comparator invocation order; the caller enforces collection bounds. +#[must_use] +pub fn strictly_sorted_unique(values: &[T]) -> bool { + if values.is_empty() { + return true; + } + let mut index = 1; + while index < values.len() { + if values[index - 1] < values[index] { + index += 1; + } else { + return false; + } + } + true +} + +/// Validates the complete workload allowlist: 1–256 strictly ordered, unique +/// names, each 1–128 bytes of printable ASCII. Invalid length refuses before +/// ordering or scanning text, and no allocation is performed. +#[must_use] +pub fn workloads_valid(values: &[String]) -> bool { + if values.is_empty() || values.len() > MAX_WORKLOADS || !strictly_sorted_unique(values) { + return false; + } + let mut index = 0; + while index < values.len() { + if !ascii_graphic_valid(values[index].as_bytes(), 128) { + return false; + } + index += 1; + } + true +} + +/// Validates the complete profile allowlist: 1–32 strictly ordered, unique +/// identifier/version pairs. Profile field validity is earned by their constructors. +#[must_use] +pub fn profiles_valid(values: &[ConnectionProfile]) -> bool { + !values.is_empty() && values.len() <= MAX_PROFILES && strictly_sorted_unique(values) +} + +/// Composes every check made by `ConnectionRecord::validate` over its actual +/// stored fields. Workload, profile and timestamp errors retain that precedence. +/// Descriptor, generation and commitment checks belong to assembly/decoding. +/// +/// # Errors +/// Returns `InvalidWorkloads`, `InvalidProfiles`, or `InvalidTimestamps` for the +/// first invalid record component. +pub fn validate_record_shape( + workloads: &[String], + profiles: &[ConnectionProfile], + state: ConnectionState, + created: u64, + updated: u64, + revoked: Option, +) -> Result<(), ConnectionRecordError> { + if !workloads_valid(workloads) { + return Err(ConnectionRecordError::InvalidWorkloads); + } + if !profiles_valid(profiles) { + return Err(ConnectionRecordError::InvalidProfiles); + } + if !record_times_valid(state, created, updated, revoked) { + return Err(ConnectionRecordError::InvalidTimestamps); + } + Ok(()) +} + #[cfg(test)] mod tests { use super::*; + fn original(value: &[u8], maximum: usize) -> bool { + (1..=maximum).contains(&value.len()) + && value.is_ascii() + && value.iter().copied().enumerate().all(|(index, byte)| { + byte.is_ascii_alphanumeric() + || (index > 0 && matches!(byte, b'.' | b'_' | b':' | b'/' | b'-')) + }) + } + #[test] + fn original_semantic_grammar_for_all_byte_pairs_and_length_boundaries() { + for first in 0..=u8::MAX { + for second in 0..=u8::MAX { + let pair = [first, second]; + for length in 0..=2 { + for maximum in [0, 1, 2, 128, usize::MAX] { + assert_eq!( + semantic_id_valid(&pair[..length], maximum), + original(&pair[..length], maximum) + ); + } + } + } + } + for length in [127, 128, 129] { + let mut value = vec![b'a'; length]; + for index in 0..length { + for byte in 0..=u8::MAX { + value[index] = byte; + assert_eq!(semantic_id_valid(&value, 128), original(&value, 128)); + } + value[index] = b'a'; + } + } + } + + fn oracle_lower(value: &[u8], maximum: usize) -> bool { + (1..=maximum).contains(&value.len()) + && value.is_ascii() + && value.iter().copied().enumerate().all(|(index, byte)| { + byte.is_ascii_lowercase() || (index > 0 && (byte.is_ascii_digit() || byte == b'-')) + }) + } + #[test] + fn all_byte_pairs_preserve_the_original_ascii_predicates() { + for first in 0..=u8::MAX { + for second in 0..=u8::MAX { + let bytes = [first, second]; + for length in 0..=2 { + for maximum in [0, 1, 2, 64, usize::MAX] { + let value = &bytes[..length]; + assert_eq!( + lower_token_valid(value, maximum), + oracle_lower(value, maximum) + ); + let expected = (1..=maximum).contains(&value.len()) + && value.iter().all(u8::is_ascii_graphic); + assert_eq!(ascii_graphic_valid(value, maximum), expected); + } + } + } + } + } #[test] fn state_changes_keep_and_rotations_set_the_credential_generation() { let installed = Generations { diff --git a/product/runtime/auths-connections/src/model.rs b/product/runtime/auths-connections/src/model.rs index 0768e641c..fe5f09d09 100644 --- a/product/runtime/auths-connections/src/model.rs +++ b/product/runtime/auths-connections/src/model.rs @@ -12,8 +12,8 @@ const OBSOLETE_RECORD_SCHEMA_VERSION: u8 = 1; const RECORD_FIELD_COUNT: u64 = 18; const MAX_RECORD_BYTES: usize = 262_144; const MAX_DESCRIPTOR_BYTES: usize = 65_536; -const MAX_WORKLOADS: usize = 256; -const MAX_PROFILES: usize = 32; +pub(crate) const MAX_WORKLOADS: usize = 256; +pub(crate) const MAX_PROFILES: usize = 32; /// Lowercase provider kind. #[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)] @@ -77,12 +77,7 @@ impl SemanticId { /// Returns [`ConnectionRecordError::InvalidSemanticId`] for an invalid value. pub fn parse(value: impl Into) -> Result { let value = value.into(); - let valid = (1..=128).contains(&value.len()) - && value.is_ascii() - && value.bytes().enumerate().all(|(index, byte)| { - byte.is_ascii_alphanumeric() - || (index > 0 && matches!(byte, b'.' | b'_' | b':' | b'/' | b'-')) - }); + let valid = kernel::semantic_id_valid(value.as_bytes(), 128); if !valid { return Err(ConnectionRecordError::InvalidSemanticId); } @@ -526,33 +521,14 @@ impl ConnectionRecord { } fn validate(&self) -> Result<(), ConnectionRecordError> { - if !(1..=MAX_WORKLOADS).contains(&self.allowed_workloads.len()) - || !strictly_sorted_unique(&self.allowed_workloads) - || self - .allowed_workloads - .iter() - .any(|value| !is_ascii_graphic(value, 128)) - { - return Err(ConnectionRecordError::InvalidWorkloads); - } - if !(1..=MAX_PROFILES).contains(&self.allowed_profiles.len()) - || !strictly_sorted_unique(&self.allowed_profiles) - { - return Err(ConnectionRecordError::InvalidProfiles); - } - if self.created_at_unix_seconds > self.updated_at_unix_seconds { - return Err(ConnectionRecordError::InvalidTimestamps); - } - match (self.state, self.revoked_at_unix_seconds) { - (ConnectionState::Revoked, Some(value)) - if (self.created_at_unix_seconds..=self.updated_at_unix_seconds) - .contains(&value) => {} - (ConnectionState::Revoked, _) | (_, Some(_)) => { - return Err(ConnectionRecordError::InvalidTimestamps); - } - _ => {} - } - Ok(()) + kernel::validate_record_shape( + &self.allowed_workloads, + &self.allowed_profiles, + self.state, + self.created_at_unix_seconds, + self.updated_at_unix_seconds, + self.revoked_at_unix_seconds, + ) } /// Returns the provider kind. @@ -681,13 +657,7 @@ impl ConnectionRecord { &self, generation: NonZeroU64, ) -> Result<(), ConnectionRecordError> { - if self.state == ConnectionState::Revoked { - return Err(ConnectionRecordError::Revoked); - } - if generation > self.generation { - return Err(ConnectionRecordError::InvalidGeneration); - } - Ok(()) + kernel::recovery_lease(self.state, self.generation.get(), generation.get()) } /// Reconstructs the sealed binding of an unresolved operation at @@ -715,14 +685,20 @@ impl ConnectionRecord { credential_reference_commitment: CredentialReferenceCommitment, ) -> Result { self.authorize_recovery_lease(generation)?; - if credential_generation > generation { - return Err(ConnectionRecordError::InvalidGeneration); - } - if generation >= self.credential_generation - && (credential_generation != self.credential_generation - || !credential_reference_commitment.matches(&self.credential_reference_commitment)) - { - return Err(ConnectionRecordError::InvalidGeneration); + match kernel::recovery_binding_requirement( + self.credential_generation.get(), + generation.get(), + credential_generation.get(), + ) { + kernel::RecoveryBindingRequirement::Refuse => { + return Err(ConnectionRecordError::InvalidGeneration); + } + kernel::RecoveryBindingRequirement::CurrentCommitment => { + if !credential_reference_commitment.matches(&self.credential_reference_commitment) { + return Err(ConnectionRecordError::InvalidGeneration); + } + } + kernel::RecoveryBindingRequirement::RecordedCommitment => {} } Ok(ConnectionBinding { provider_kind: self.provider_kind.clone(), @@ -756,10 +732,12 @@ impl ConnectionRecord { state: ConnectionState, updated_at_unix_seconds: u64, ) -> Result { - if state == self.state - || self.state == ConnectionState::Revoked - || updated_at_unix_seconds < self.updated_at_unix_seconds - { + if !kernel::state_transition_allows( + self.state, + state, + self.updated_at_unix_seconds, + updated_at_unix_seconds, + ) { return Err(ConnectionRecordError::InvalidState); } let generations = kernel::state_change(self.generations()) @@ -798,9 +776,11 @@ impl ConnectionRecord { credential_reference_commitment: [u8; 32], updated_at_unix_seconds: u64, ) -> Result { - if self.state == ConnectionState::Revoked - || updated_at_unix_seconds < self.updated_at_unix_seconds - { + if !kernel::record_change_allows( + self.state, + self.updated_at_unix_seconds, + updated_at_unix_seconds, + ) { return Err(ConnectionRecordError::InvalidState); } let generations = @@ -838,9 +818,11 @@ impl ConnectionRecord { allowed_profiles: Vec, updated_at_unix_seconds: u64, ) -> Result { - if self.state == ConnectionState::Revoked - || updated_at_unix_seconds < self.updated_at_unix_seconds - { + if !kernel::record_change_allows( + self.state, + self.updated_at_unix_seconds, + updated_at_unix_seconds, + ) { return Err(ConnectionRecordError::InvalidState); } let generations = kernel::state_change(self.generations()) @@ -1084,19 +1066,7 @@ pub enum ConnectionRecordError { } fn is_lower_token(value: &str, maximum: usize) -> bool { - (1..=maximum).contains(&value.len()) - && value.is_ascii() - && value.bytes().enumerate().all(|(index, byte)| { - byte.is_ascii_lowercase() || (index > 0 && (byte.is_ascii_digit() || byte == b'-')) - }) -} - -fn is_ascii_graphic(value: &str, maximum: usize) -> bool { - (1..=maximum).contains(&value.len()) && value.bytes().all(|byte| (0x21..=0x7e).contains(&byte)) -} - -fn strictly_sorted_unique(values: &[T]) -> bool { - values.windows(2).all(|pair| pair[0] < pair[1]) + kernel::lower_token_valid(value.as_bytes(), maximum) } fn encode_text( @@ -1400,3 +1370,19 @@ pub(crate) mod tests { ); } } + +#[cfg(test)] +#[path = "recovery_guard_tests.rs"] +mod recovery_guard_tests; + +#[cfg(test)] +#[path = "string_constructor_tests.rs"] +mod string_constructor_tests; + +#[cfg(test)] +#[path = "record_time_tests.rs"] +mod record_time_tests; + +#[cfg(test)] +#[path = "strict_order_tests.rs"] +mod strict_order_tests; diff --git a/product/runtime/auths-connections/src/record_time_tests.rs b/product/runtime/auths-connections/src/record_time_tests.rs new file mode 100644 index 000000000..833d936a8 --- /dev/null +++ b/product/runtime/auths-connections/src/record_time_tests.rs @@ -0,0 +1,177 @@ +//! Frozen complete record validation and real canonical decoder parity. +use super::*; + +fn original_validate(record: &ConnectionRecord) -> Result<(), ConnectionRecordError> { + if !(1..=MAX_WORKLOADS).contains(&record.allowed_workloads.len()) + || !original_order(&record.allowed_workloads) + || record.allowed_workloads.iter().any(|value| { + !(1..=128).contains(&value.len()) || !value.bytes().all(|byte| byte.is_ascii_graphic()) + }) + { + return Err(ConnectionRecordError::InvalidWorkloads); + } + if !(1..=MAX_PROFILES).contains(&record.allowed_profiles.len()) + || !original_order(&record.allowed_profiles) + { + return Err(ConnectionRecordError::InvalidProfiles); + } + if record.created_at_unix_seconds > record.updated_at_unix_seconds { + return Err(ConnectionRecordError::InvalidTimestamps); + } + match (record.state, record.revoked_at_unix_seconds) { + (ConnectionState::Revoked, Some(value)) + if (record.created_at_unix_seconds..=record.updated_at_unix_seconds) + .contains(&value) => {} + (ConnectionState::Revoked, _) | (_, Some(_)) => { + return Err(ConnectionRecordError::InvalidTimestamps); + } + _ => {} + } + Ok(()) +} + +#[test] +fn complete_record_times_preserve_validation_and_decoder_behavior() { + let values = [0, 1, 2, u64::MAX - 1, u64::MAX]; + let revocations = [ + None, + Some(0), + Some(1), + Some(2), + Some(u64::MAX - 1), + Some(u64::MAX), + ]; + let mut accepted = 0; + let mut refused = 0; + for state in [ + ConnectionState::Active, + ConnectionState::Disabled, + ConnectionState::Revoked, + ] { + for created in values { + for updated in values { + for revoked in revocations { + let mut record = super::tests::record(); + record.state = state; + record.created_at_unix_seconds = created; + record.updated_at_unix_seconds = updated; + record.revoked_at_unix_seconds = revoked; + let expected = original_validate(&record); + assert_eq!(record.validate(), expected); + let bytes = record.to_canonical_cbor().unwrap(); + match ConnectionRecord::from_canonical_cbor(&bytes) { + Ok(decoded) => { + assert_eq!(expected, Ok(())); + assert_eq!(decoded, record); + accepted += 1; + } + Err(error) => { + assert_eq!(expected, Err(error)); + refused += 1; + } + } + } + } + } + } + // Two non-revoked states * fifteen ordered pairs, plus thirty-five + // created/revoked/updated triples with repetition among five values. + assert_eq!((accepted, refused), (65, 385)); +} + +fn original_order(values: &[T]) -> bool { + values.windows(2).all(|pair| pair[0] < pair[1]) +} + +#[test] +fn complete_record_shape_preserves_all_guards_and_error_precedence() { + let profile = |name: &str, version| { + ConnectionProfile::new(SemanticId::parse(name).unwrap(), version).unwrap() + }; + let workloads = [ + vec![], + vec!["a".to_owned()], + vec!["a".to_owned(), "b".to_owned()], + vec!["b".to_owned(), "a".to_owned()], + vec!["a".to_owned(), "a".to_owned()], + vec![String::new()], + vec!["a b".to_owned()], + vec!["é".to_owned()], + vec!["a".repeat(128)], + vec!["a".repeat(129)], + (0..256).map(|n| format!("w-{n:03}")).collect(), + (0..257).map(|n| format!("w-{n:03}")).collect(), + ]; + let profiles = [ + vec![], + vec![profile("a", 1)], + vec![profile("a", 1), profile("a", 2)], + vec![profile("a", 2), profile("a", 1)], + vec![profile("a", 1), profile("a", 1)], + (0..31).map(|n| profile(&format!("p-{n:02}"), 1)).collect(), + (0..32).map(|n| profile(&format!("p-{n:02}"), 1)).collect(), + (0..33).map(|n| profile(&format!("p-{n:02}"), 1)).collect(), + ]; + let times = [0, 1, 2, u64::MAX - 1, u64::MAX]; + let revocations = [ + None, + Some(0), + Some(1), + Some(2), + Some(u64::MAX - 1), + Some(u64::MAX), + ]; + let mut counts = [0; 4]; + for workloads in &workloads { + for profiles in &profiles { + for state in [ + ConnectionState::Active, + ConnectionState::Disabled, + ConnectionState::Revoked, + ] { + for created in times { + for updated in times { + for revoked in revocations { + let mut record = super::tests::record(); + record.allowed_workloads.clone_from(workloads); + record.allowed_profiles.clone_from(profiles); + record.state = state; + record.created_at_unix_seconds = created; + record.updated_at_unix_seconds = updated; + record.revoked_at_unix_seconds = revoked; + let expected = original_validate(&record); + assert_eq!(record.validate(), expected); + // The unchanged decoder rejects collection bounds while reading, + // before it reaches complete semantic validation. + let expected_decode = if !(1..=256).contains(&workloads.len()) { + Err(ConnectionRecordError::InvalidWorkloads) + } else if !(1..=32).contains(&profiles.len()) { + Err(ConnectionRecordError::InvalidProfiles) + } else { + expected + }; + let decoded = ConnectionRecord::from_canonical_cbor( + &record.to_canonical_cbor().unwrap(), + ); + match decoded { + Ok(decoded) => { + assert_eq!(expected_decode, Ok(())); + assert_eq!(decoded, record); + } + Err(error) => assert_eq!(expected_decode, Err(error)), + } + counts[match expected { + Ok(()) => 0, + Err(ConnectionRecordError::InvalidWorkloads) => 1, + Err(ConnectionRecordError::InvalidProfiles) => 2, + Err(ConnectionRecordError::InvalidTimestamps) => 3, + Err(error) => panic!("unexpected frozen-validator result: {error}"), + }] += 1; + } + } + } + } + } + } + assert_eq!(counts, [1040, 28_800, 7200, 6160]); +} diff --git a/product/runtime/auths-connections/src/recovery_guard_tests.rs b/product/runtime/auths-connections/src/recovery_guard_tests.rs new file mode 100644 index 000000000..89d8d790a --- /dev/null +++ b/product/runtime/auths-connections/src/recovery_guard_tests.rs @@ -0,0 +1,294 @@ +//! Frozen pre-cutover native algorithms exercise complete valid records and +//! result fields independently of the new translated policy guards. +use super::*; + +fn original_authorize_recovery_lease( + record: &ConnectionRecord, + generation: NonZeroU64, +) -> Result<(), ConnectionRecordError> { + if record.state == ConnectionState::Revoked { + return Err(ConnectionRecordError::Revoked); + } + if generation > record.generation { + return Err(ConnectionRecordError::InvalidGeneration); + } + Ok(()) +} + +fn original_binding_for_recovery( + record: &ConnectionRecord, + generation: NonZeroU64, + credential_generation: NonZeroU64, + credential_reference_commitment: CredentialReferenceCommitment, +) -> Result { + original_authorize_recovery_lease(record, generation)?; + if credential_generation > generation { + return Err(ConnectionRecordError::InvalidGeneration); + } + if generation >= record.credential_generation + && (credential_generation != record.credential_generation + || !credential_reference_commitment.matches(&record.credential_reference_commitment)) + { + return Err(ConnectionRecordError::InvalidGeneration); + } + Ok(ConnectionBinding { + provider_kind: record.provider_kind.clone(), + alias: record.alias.clone(), + connection_id: record.connection_id.clone(), + contract: record.contract.clone(), + descriptor_schema: record.descriptor_schema.clone(), + descriptor: record.descriptor.clone(), + generation, + credential_generation, + descriptor_commitment: record.descriptor_commitment, + account_commitment: record.account_commitment, + credential_reference_commitment: *credential_reference_commitment.as_bytes(), + }) +} + +fn original_transition_state( + record: &ConnectionRecord, + state: ConnectionState, + updated_at_unix_seconds: u64, +) -> Result { + if state == record.state + || record.state == ConnectionState::Revoked + || updated_at_unix_seconds < record.updated_at_unix_seconds + { + return Err(ConnectionRecordError::InvalidState); + } + let generations = kernel::state_change(record.generations()) + .ok_or(ConnectionRecordError::InvalidGeneration)?; + ConnectionRecord::assemble( + record.provider_kind.clone(), + record.alias.clone(), + record.connection_id.clone(), + record.contract.clone(), + record.descriptor_schema.clone(), + record.descriptor.clone(), + record.account_commitment, + record.credential_reference_commitment, + generations, + state, + record.allowed_workloads.clone(), + record.allowed_profiles.clone(), + record.created_at_unix_seconds, + updated_at_unix_seconds, + (state == ConnectionState::Revoked).then_some(updated_at_unix_seconds), + ) +} + +fn record_for(state: ConnectionState, generation: u64, credential: u64) -> ConnectionRecord { + let mut record = super::tests::record(); + record.state = state; + record.generation = NonZeroU64::new(generation).unwrap(); + record.credential_generation = NonZeroU64::new(credential).unwrap(); + record.revoked_at_unix_seconds = (state == ConnectionState::Revoked).then_some(10); + ConnectionRecord::from_canonical_cbor(&record.to_canonical_cbor().unwrap()).unwrap() +} + +#[test] +fn recovery_policy_preserves_full_native_records_and_commitments() { + let values = [1, 2, 3, u64::MAX - 1, u64::MAX]; + let mut accepted = 0; + let mut refused = 0; + for state in [ + ConnectionState::Active, + ConnectionState::Disabled, + ConnectionState::Revoked, + ] { + for generation in values { + for current_credential in values { + if current_credential > generation { + continue; + } + let record = record_for(state, generation, current_credential); + for operation in values { + let operation = NonZeroU64::new(operation).unwrap(); + assert_eq!( + record.authorize_recovery_lease(operation), + original_authorize_recovery_lease(&record, operation) + ); + for credential in values { + for bytes in [[3; 32], [4; 32]] { + let credential = NonZeroU64::new(credential).unwrap(); + let reference = CredentialReferenceCommitment::for_tests(bytes); + let expected = original_binding_for_recovery( + &record, operation, credential, reference, + ); + let actual = + record.binding_for_recovery(operation, credential, reference); + if actual.is_ok() { + accepted += 1; + } else { + refused += 1; + } + assert_eq!(actual, expected); + } + } + } + } + } + } + // Two non-revoked states. For record index i and current credential index j, + // older operations contribute j*(j+1) pairs, current ones contribute i-j+1. + // Summing 2*sum(i=0..4, j=0..i) gives 210 accepts among 2250 bindings. + assert_eq!((accepted, refused), (210, 2040)); +} + +#[test] +fn administrative_transitions_preserve_the_full_frozen_record() { + let states = [ + ConnectionState::Active, + ConnectionState::Disabled, + ConnectionState::Revoked, + ]; + let times = [0, 1, 2, u64::MAX - 1, u64::MAX]; + let mut checked = 0; + for current in states { + for next in states { + for generation in [1, u64::MAX] { + for previous in times { + let mut record = record_for(current, generation, 1); + record.created_at_unix_seconds = 0; + record.updated_at_unix_seconds = previous; + record.revoked_at_unix_seconds = + (current == ConnectionState::Revoked).then_some(previous); + record = + ConnectionRecord::from_canonical_cbor(&record.to_canonical_cbor().unwrap()) + .unwrap(); + for proposed in times { + let actual = record.transition_state(next, proposed); + let expected = original_transition_state(&record, next, proposed); + assert_eq!(actual, expected); + checked += 1; + } + } + } + } + } + assert_eq!(checked, 450); +} + +fn original_rotated( + record: &ConnectionRecord, + descriptor: Vec, + account_commitment: [u8; 32], + credential_reference_commitment: [u8; 32], + updated_at_unix_seconds: u64, +) -> Result { + if record.state == ConnectionState::Revoked + || updated_at_unix_seconds < record.updated_at_unix_seconds + { + return Err(ConnectionRecordError::InvalidState); + } + let generations = + kernel::rotation(record.generations()).ok_or(ConnectionRecordError::InvalidGeneration)?; + ConnectionRecord::assemble( + record.provider_kind.clone(), + record.alias.clone(), + record.connection_id.clone(), + record.contract.clone(), + record.descriptor_schema.clone(), + descriptor, + account_commitment, + credential_reference_commitment, + generations, + record.state, + record.allowed_workloads.clone(), + record.allowed_profiles.clone(), + record.created_at_unix_seconds, + updated_at_unix_seconds, + None, + ) +} + +fn original_with_authorization( + record: &ConnectionRecord, + allowed_workloads: Vec, + allowed_profiles: Vec, + updated_at_unix_seconds: u64, +) -> Result { + if record.state == ConnectionState::Revoked + || updated_at_unix_seconds < record.updated_at_unix_seconds + { + return Err(ConnectionRecordError::InvalidState); + } + let generations = kernel::state_change(record.generations()) + .ok_or(ConnectionRecordError::InvalidGeneration)?; + ConnectionRecord::assemble( + record.provider_kind.clone(), + record.alias.clone(), + record.connection_id.clone(), + record.contract.clone(), + record.descriptor_schema.clone(), + record.descriptor.clone(), + record.account_commitment, + record.credential_reference_commitment, + generations, + record.state, + allowed_workloads, + allowed_profiles, + record.created_at_unix_seconds, + updated_at_unix_seconds, + None, + ) +} + +#[test] +fn rotation_and_authorization_replacement_preserve_frozen_order_and_fields() { + let mut rotations = (0, 0); + let mut replacements = (0, 0); + for state in [ + ConnectionState::Active, + ConnectionState::Disabled, + ConnectionState::Revoked, + ] { + for generation in [1, u64::MAX] { + for previous in [0, 1, 2, u64::MAX - 1, u64::MAX] { + let mut record = record_for(state, generation, 1); + record.created_at_unix_seconds = 0; + record.updated_at_unix_seconds = previous; + record.revoked_at_unix_seconds = + (state == ConnectionState::Revoked).then_some(previous); + record = + ConnectionRecord::from_canonical_cbor(&record.to_canonical_cbor().unwrap()) + .unwrap(); + for proposed in [0, 1, 2, u64::MAX - 1, u64::MAX] { + for descriptor in [vec![], vec![1], vec![0; MAX_DESCRIPTOR_BYTES + 1]] { + let expected = original_rotated( + &record, + descriptor.clone(), + [7; 32], + [8; 32], + proposed, + ); + let actual = record.rotated(descriptor, [7; 32], [8; 32], proposed); + rotations.0 += 1; + rotations.1 += usize::from(actual.is_ok()); + assert_eq!(actual, expected); + } + for workloads in [vec![], record.allowed_workloads.clone()] { + for profiles in [vec![], record.allowed_profiles.clone()] { + let expected = original_with_authorization( + &record, + workloads.clone(), + profiles.clone(), + proposed, + ); + let actual = + record.with_authorization(workloads.clone(), profiles, proposed); + replacements.0 += 1; + replacements.1 += usize::from(actual.is_ok()); + assert_eq!(actual, expected); + } + } + } + } + } + } + // Two eligible states, one non-overflowing generation and fifteen + // nondecreasing timestamp pairs, with one valid payload per pair. + assert_eq!(rotations, (450, 30)); + assert_eq!(replacements, (600, 30)); +} diff --git a/product/runtime/auths-connections/src/strict_order_tests.rs b/product/runtime/auths-connections/src/strict_order_tests.rs new file mode 100644 index 000000000..51d537dae --- /dev/null +++ b/product/runtime/auths-connections/src/strict_order_tests.rs @@ -0,0 +1,129 @@ +//! Frozen ordering and complete-record/decoder checks for the two real consumers. +use super::*; +fn original_order(values: &[T]) -> bool { + values.windows(2).all(|pair| pair[0] < pair[1]) +} +fn sequences(alphabet: &[T; 4], maximum: u32) -> Vec> { + let mut output = Vec::new(); + for length in 0..=maximum { + for mut code in 0..4_usize.pow(length) { + let mut values = Vec::new(); + for _ in 0..length { + values.push(alphabet[code % 4].clone()); + code /= 4; + } + output.push(values); + } + } + output +} +#[test] +fn generic_ordering_preserves_both_real_comparators_and_integer_edges() { + fn check(values: Vec>) { + let mut accepted = 0; + let mut checked = 0; + for value in values { + let actual = kernel::strictly_sorted_unique(&value); + assert_eq!(actual, original_order(&value)); + accepted += usize::from(actual); + checked += 1; + } + // Each subset of four distinct ordered keys gives exactly one strict list. + assert_eq!((checked, accepted), (5461, 16)); + } + let profiles = [ + ConnectionProfile::new(SemanticId::parse("a").unwrap(), 1).unwrap(), + ConnectionProfile::new(SemanticId::parse("a").unwrap(), 2).unwrap(), + ConnectionProfile::new(SemanticId::parse("b").unwrap(), 1).unwrap(), + ConnectionProfile::new(SemanticId::parse("b").unwrap(), 2).unwrap(), + ]; + check(sequences(&[0_u64, 1, 2, u64::MAX], 6)); + check(sequences( + &[ + "a".to_owned(), + "aa".to_owned(), + "b".to_owned(), + "z".to_owned(), + ], + 6, + )); + check(sequences(&profiles, 6)); +} +#[test] +fn complete_allowlist_records_and_decoder_keep_order_bounds_and_error_codes() { + fn check(record: &ConnectionRecord, expected: Result<(), ConnectionRecordError>) -> bool { + assert_eq!(record.validate(), expected); + match ConnectionRecord::from_canonical_cbor(&record.to_canonical_cbor().unwrap()) { + Ok(decoded) => { + assert_eq!(expected, Ok(())); + assert_eq!(&decoded, record); + true + } + Err(error) => { + assert_eq!(expected, Err(error)); + false + } + } + } + let mut workloads = sequences( + &[ + "w-a".to_owned(), + "w-b".to_owned(), + "w-c".to_owned(), + "w-d".to_owned(), + ], + 4, + ); + for length in [255, 256, 257] { + workloads.push((0..length).map(|index| format!("w-{index:03}")).collect()); + } + let mut workload_successes = 0; + for values in &workloads { + let valid = (1..=MAX_WORKLOADS).contains(&values.len()) && original_order(values); + let mut record = super::tests::record(); + record.allowed_workloads.clone_from(values); + workload_successes += usize::from(check( + &record, + if valid { + Ok(()) + } else { + Err(ConnectionRecordError::InvalidWorkloads) + }, + )); + } + let profile = |id: &str, version| { + ConnectionProfile::new(SemanticId::parse(id).unwrap(), version).unwrap() + }; + let mut profiles = sequences( + &[ + profile("a", 1), + profile("a", 2), + profile("b", 1), + profile("b", 2), + ], + 4, + ); + for length in [31, 32, 33] { + profiles.push( + (0..length) + .map(|index| profile(&format!("p-{index:02}"), 1)) + .collect(), + ); + } + let mut profile_successes = 0; + for values in &profiles { + let valid = (1..=MAX_PROFILES).contains(&values.len()) && original_order(values); + let mut record = super::tests::record(); + record.allowed_profiles.clone_from(values); + profile_successes += usize::from(check( + &record, + if valid { + Ok(()) + } else { + Err(ConnectionRecordError::InvalidProfiles) + }, + )); + } + assert_eq!((workloads.len(), workload_successes), (344, 17)); + assert_eq!((profiles.len(), profile_successes), (344, 17)); +} diff --git a/product/runtime/auths-connections/src/string_constructor_tests.rs b/product/runtime/auths-connections/src/string_constructor_tests.rs new file mode 100644 index 000000000..231feb532 --- /dev/null +++ b/product/runtime/auths-connections/src/string_constructor_tests.rs @@ -0,0 +1,99 @@ +//! Independent character-language oracles exercise actual owned-String APIs. +use super::*; + +fn lower_language(value: &str) -> bool { + let mut characters = value.chars(); + value.len() <= 64 + && matches!(characters.next(), Some('a'..='z')) + && characters.all(|character| matches!(character, 'a'..='z' | '0'..='9' | '-')) +} + +fn semantic_language(value: &str) -> bool { + let mut characters = value.chars(); + value.len() <= 128 + && characters + .next() + .is_some_and(|character| character.is_ascii_alphanumeric()) + && characters.all(|character| { + character.is_ascii_alphanumeric() || matches!(character, '.' | '_' | ':' | '/' | '-') + }) +} + +fn check(value: &str) -> [bool; 3] { + let lower = lower_language(value); + let semantic = semantic_language(value); + let provider = ProviderKind::parse(value.to_owned()).map(|parsed| parsed.as_str().to_owned()); + let alias = ConnectionAlias::parse(value.to_owned()).map(|parsed| parsed.as_str().to_owned()); + let identifier = SemanticId::parse(value.to_owned()).map(|parsed| parsed.as_str().to_owned()); + assert_eq!( + provider, + if lower { + Ok(value.to_owned()) + } else { + Err(ConnectionRecordError::InvalidProviderKind) + } + ); + assert_eq!( + alias, + if lower { + Ok(value.to_owned()) + } else { + Err(ConnectionRecordError::InvalidAlias) + } + ); + assert_eq!( + identifier, + if semantic { + Ok(value.to_owned()) + } else { + Err(ConnectionRecordError::InvalidSemanticId) + } + ); + [provider.is_ok(), alias.is_ok(), identifier.is_ok()] +} + +#[test] +fn actual_string_constructors_preserve_payloads_and_closed_errors() { + let mut accepted = [0; 3]; + let mut texts = 0; + for first in 0..=u8::MAX { + for second in 0..=u8::MAX { + let pair = [first, second]; + for length in 0..=2 { + if let Ok(value) = std::str::from_utf8(&pair[..length]) { + let result = check(value); + for index in 0..3 { + accepted[index] += usize::from(result[index]); + } + texts += 1; + } + } + } + } + // Independent language cardinalities: 26 heads/37 tails versus 62/67. + assert_eq!(texts, 65_536 + 128 * 256 + 128 * 128 + 30 * 64); + assert_eq!( + accepted, + [26 * 256 + 26 * 37, 26 * 256 + 26 * 37, 62 * 256 + 62 * 67] + ); + for value in [ + "stripe", + "a-b", + "A:1", + "auths.profile/1", + "é", + "e\u{301}", + "猫", + "🙂", + "\0", + "", + "--", + "a/b", + "A123", + ] { + check(value); + } + for length in [63, 64, 65, 127, 128, 129] { + check(&"a".repeat(length)); + } +} diff --git a/product/runtime/auths-gateway-kernel/src/construct.rs b/product/runtime/auths-gateway-kernel/src/construct.rs index dfe9d5a08..e3b8b7aad 100644 --- a/product/runtime/auths-gateway-kernel/src/construct.rs +++ b/product/runtime/auths-gateway-kernel/src/construct.rs @@ -1048,3 +1048,73 @@ mod tests { ); } } + +/// Exact byte equality used when binding a source field name to its schema. +#[must_use] +pub fn field_name_equal(left: &[u8], right: &[u8]) -> bool { + if left.len() != right.len() { + return false; + } + let mut position = 0; + let mut equal = true; + while position < left.len() && equal { + equal = left[position] == right[position]; + position += 1; + } + equal +} + +/// Returns the first exact field-name position. The compiler supplies the +/// unique schema names in the same order as verified argument projection. +#[must_use] +pub fn field_index(names: &[Vec], wanted: &[u8]) -> Option { + let mut position = 0; + let mut found = None; + while position < names.len() && found.is_none() { + if field_name_equal(&names[position], wanted) { + found = Some(position); + } + position += 1; + } + found +} + +#[cfg(test)] +mod field_binding_tests { + use super::{field_index, field_name_equal}; + use alloc::vec; + use alloc::vec::Vec; + + #[test] + fn exact_field_binding_agrees_with_independent_iterator_oracle() { + let alphabet: &[&[u8]] = &[ + b"", + b"id", + b"invoice_id", + b"payment_id", + b"ID", + &[0], + &[255], + ]; + for length in 0..=5 { + for seed in 0..512_usize { + let mut word = seed; + let mut names = Vec::new(); + for _ in 0..length { + names.push(alphabet[word % alphabet.len()].to_vec()); + word /= alphabet.len(); + } + for wanted in alphabet { + let expected = names.iter().position(|name| name.as_slice() == *wanted); + assert_eq!(field_index(&names, wanted), expected); + } + } + } + assert_eq!(field_index(&[vec![1], vec![2], vec![1]], &[1]), Some(0)); + for left in alphabet { + for right in alphabet { + assert_eq!(field_name_equal(left, right), left == right); + } + } + } +} diff --git a/product/runtime/auths-gateway-kernel/src/counter_aggregation.rs b/product/runtime/auths-gateway-kernel/src/counter_aggregation.rs new file mode 100644 index 000000000..ddf9d7bbb --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/counter_aggregation.rs @@ -0,0 +1,347 @@ +//! A keyed capacity update retains the first key position and the smallest +//! capacity of every contribution to that key. Inputs are public counter IDs. + +use alloc::vec::Vec; + +/// One shared counter and its tightest capacity. +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct CounterCapacity { + /// Domain-separated counter ID. + pub key: [u8; 32], + /// Smallest capacity contributed so far. + pub capacity: u64, +} + +/// Exact public counter-ID equality. These IDs contain no secret material. +#[must_use] +pub fn counter_equal(left: &[u8; 32], right: &[u8; 32]) -> bool { + let mut index = 0; + while index < 32 { + if left[index] != right[index] { + return false; + } + index += 1; + } + true +} + +/// Finds the first exact counter key; an absent key has no position. +#[must_use] +pub fn counter_position(counters: &[CounterCapacity], key: &[u8; 32]) -> Option { + let mut index = 0; + while index < counters.len() { + if counter_equal(&counters[index].key, key) { + return Some(index); + } + index += 1; + } + None +} + +/// The first exact count counter's capacity, or zero when absent. An absent +/// link therefore grants no sum slots. Counter IDs are public identifiers. +#[must_use] +pub fn count_capacity(counters: &[CounterCapacity], key: &[u8; 32]) -> u64 { + match counter_position(counters, key) { + Some(index) => counters[index].capacity, + None => 0, + } +} + +/// Builds one sum contribution using the shared count counter's actual +/// minimum as its slot bound. Callers derive both IDs from the same link. +#[must_use] +pub fn linked_sum_contribution( + counts: &[CounterCapacity], + count_key: &[u8; 32], + sum_key: [u8; 32], + capacity: u64, +) -> SumCapacity { + SumCapacity { + key: sum_key, + capacity, + slots: count_capacity(counts, count_key), + } +} + +/// Adds one contribution to the same shared counter. This function never +/// increases an existing capacity or appends a second copy of an existing ID. +#[must_use] +pub fn contribute( + mut counters: Vec, + key: [u8; 32], + capacity: u64, +) -> Vec { + match counter_position(&counters, &key) { + Some(index) => { + if capacity < counters[index].capacity { + counters[index].capacity = capacity; + } + } + None => counters.push(CounterCapacity { key, capacity }), + } + counters +} + +/// Aggregates every contribution, preserving the first key order and taking +/// the smallest capacity for each shared ID. Gateway chains supply at most +/// sixteen contributions; callers must bound attacker-controlled collections. +#[must_use] +pub fn aggregate(contributions: &[CounterCapacity]) -> Vec { + let mut counters = Vec::new(); + let mut index = 0; + while index < contributions.len() { + let contribution = &contributions[index]; + counters = contribute(counters, contribution.key, contribution.capacity); + index += 1; + } + counters +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn linked_sum_slots_use_the_exact_shared_count_capacity() { + let key = [7; 32]; + let contributions = [ + CounterCapacity { + key, + capacity: u64::MAX, + }, + CounterCapacity { + key: [8; 32], + capacity: 19, + }, + CounterCapacity { key, capacity: 3 }, + ]; + let counts = aggregate(&contributions); + let sum = linked_sum_contribution(&counts, &key, [9; 32], 700); + assert_eq!( + sum, + SumCapacity { + key: [9; 32], + capacity: 700, + slots: 3 + } + ); + assert_eq!(count_capacity(&counts, &[10; 32]), 0); + assert_eq!(count_capacity(&[], &key), 0); + assert_eq!(count_capacity(&contributions, &key), u64::MAX); + } + + fn original( + mut counters: Vec, + key: [u8; 32], + capacity: u64, + ) -> Vec { + match counters.iter_mut().find(|counter| counter.key == key) { + Some(counter) => counter.capacity = counter.capacity.min(capacity), + None => counters.push(CounterCapacity { key, capacity }), + } + counters + } + + #[test] + fn keyed_updates_preserve_the_previous_complete_result() { + let mut seed = 0x4155_5448_5350_524fu64; + for length in 0..=24 { + let mut state = Vec::new(); + for _ in 0..length { + seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1); + state.push(CounterCapacity { + key: [((seed >> 32) % 7) as u8; 32], + capacity: seed, + }); + } + for byte in 0..=9 { + let key = [byte; 32]; + for capacity in [0, 1, 255, u64::MAX] { + assert_eq!( + contribute(state.clone(), key, capacity), + original(state.clone(), key, capacity) + ); + let expected = state.iter().fold(Vec::new(), |prior, entry| { + original(prior, entry.key, entry.capacity) + }); + assert_eq!(aggregate(&state), expected); + } + } + } + } + + #[test] + fn every_prefix_keeps_one_shared_smallest_capacity() { + let mut actual = Vec::new(); + let mut expected = alloc::collections::BTreeMap::<[u8; 32], u64>::new(); + let mut seed = 0x4155_5448_534d_494eu64; + for _ in 0..6000 { + seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1); + let key = [((seed >> 32) % 17) as u8; 32]; + let limit = seed; + actual = contribute(actual, key, limit); + expected + .entry(key) + .and_modify(|old| *old = (*old).min(limit)) + .or_insert(limit); + assert_eq!(actual.len(), expected.len()); + for counter in &actual { + assert_eq!(Some(&counter.capacity), expected.get(&counter.key)); + assert_eq!( + actual + .iter() + .filter(|other| other.key == counter.key) + .count(), + 1 + ); + } + } + } + + #[test] + fn public_counter_equality_and_first_position_are_exact() { + let key = [42; 32]; + assert!(counter_equal(&key, &key)); + for index in 0..32 { + let mut changed = key; + changed[index] ^= 1; + assert!(!counter_equal(&key, &changed)); + assert!(!counter_equal(&changed, &key)); + } + let counters = alloc::vec![ + CounterCapacity { key, capacity: 9 }, + CounterCapacity { key, capacity: 1 }, + ]; + assert_eq!(counter_position(&counters, &key), Some(0)); + assert_eq!(counter_position(&counters, &[0; 32]), None); + } +} + +/// A shared sum counter and the count-slot bound derived by its caller. +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct SumCapacity { + /// Domain-separated sum counter ID. + pub key: [u8; 32], + /// Smallest sum limit contributed so far. + pub capacity: u64, + /// Count-slot bound supplied by the first contribution to this ID. + pub slots: u64, +} + +/// Finds the first exact sum counter ID. +#[must_use] +pub fn sum_position(counters: &[SumCapacity], key: &[u8; 32]) -> Option { + let mut index = 0; + while index < counters.len() { + if counter_equal(&counters[index].key, key) { + return Some(index); + } + index += 1; + } + None +} + +/// Tightens a shared sum capacity while preserving the first count-slot bound. +/// The caller derives that bound from the corresponding shared count counter. +#[must_use] +pub fn contribute_sum( + mut counters: Vec, + key: [u8; 32], + capacity: u64, + slots: u64, +) -> Vec { + match sum_position(&counters, &key) { + Some(index) => { + if capacity < counters[index].capacity { + counters[index].capacity = capacity; + } + } + None => counters.push(SumCapacity { + key, + capacity, + slots, + }), + } + counters +} + +/// Aggregates every sum contribution in order, without adding another slot +/// pool for duplicate IDs. Gateway chains supply at most sixteen entries. +#[must_use] +pub fn aggregate_sum(contributions: &[SumCapacity]) -> Vec { + let mut counters = Vec::new(); + let mut index = 0; + while index < contributions.len() { + let contribution = &contributions[index]; + counters = contribute_sum( + counters, + contribution.key, + contribution.capacity, + contribution.slots, + ); + index += 1; + } + counters +} + +#[cfg(test)] +mod sum_tests { + use super::*; + + fn original( + mut counters: Vec, + key: [u8; 32], + capacity: u64, + slots: u64, + ) -> Vec { + match counters.iter_mut().find(|counter| counter.key == key) { + Some(counter) => counter.capacity = counter.capacity.min(capacity), + None => counters.push(SumCapacity { + key, + capacity, + slots, + }), + } + counters + } + + #[test] + fn sums_preserve_the_first_slot_bound_and_tighten_only_capacity() { + let key = [9; 32]; + let state = alloc::vec![SumCapacity { + key, + capacity: 20, + slots: 3 + }]; + for capacity in [0, 1, 20, u64::MAX] { + for slots in [0, 1, 100, u64::MAX] { + let actual = contribute_sum(state.clone(), key, capacity, slots); + assert_eq!(actual, original(state.clone(), key, capacity, slots)); + assert_eq!(actual[0].slots, 3); + } + } + } + + #[test] + fn full_sum_aggregation_preserves_the_previous_result() { + let mut seed = 0x4155_5448_5353_554du64; + for length in 0..=24 { + for _ in 0..64 { + let mut incoming = Vec::new(); + for _ in 0..length { + seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1); + incoming.push(SumCapacity { + key: [((seed >> 32) % 7) as u8; 32], + capacity: seed, + slots: seed >> 8, + }); + } + let expected = incoming.iter().fold(Vec::new(), |prior, entry| { + original(prior, entry.key, entry.capacity, entry.slots) + }); + assert_eq!(aggregate_sum(&incoming), expected); + } + } + } +} diff --git a/product/runtime/auths-gateway-kernel/src/counter_preimages.rs b/product/runtime/auths-gateway-kernel/src/counter_preimages.rs new file mode 100644 index 000000000..b6dfa3b8e --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/counter_preimages.rs @@ -0,0 +1,170 @@ +//! Exact bounded-counter and slot commitment preimages. Hashing is performed +//! by the runtime with its existing SHA-256 primitive. +use crate::construct::{append_bytes, copy_bytes}; +use alloc::vec::Vec; + +fn append_word(output: Vec, value: u64) -> Vec { + append_bytes(output, &value.to_be_bytes()) +} + +fn append_component(output: Vec, value: &[u8]) -> Vec { + let length = u64::try_from(value.len()).unwrap_or(u64::MAX); + let output = append_word(output, length); + append_bytes(output, value) +} + +fn append_coordinates(output: Vec, window: u64, index: u64) -> Vec { + let output = append_word(output, window); + append_word(output, index) +} + +/// Exact count-counter framing: domain, length-prefixed namespace, subject +/// and evaluator, followed by the fixed-width window length and index. +/// The runtime supplies constructor-validated namespace/principal/evaluator +/// bytes. Input components are never normalized or treated as delimiters. +#[must_use] +pub fn count_counter_preimage( + namespace: &[u8], + subject: &[u8], + evaluator: &[u8], + window: u64, + index: u64, +) -> Vec { + let output = copy_bytes(b"auths.gateway-bounded-count/2\0"); + let output = append_component(output, namespace); + let output = append_component(output, subject); + let output = append_component(output, evaluator); + append_coordinates(output, window, index) +} + +/// Exact sum-counter framing, adding the length-prefixed partition after +/// the evaluator. An unpartitioned counter supplies an empty partition. +#[must_use] +pub fn sum_counter_preimage( + namespace: &[u8], + subject: &[u8], + evaluator: &[u8], + partition: &[u8], + window: u64, + index: u64, +) -> Vec { + let output = copy_bytes(b"auths.gateway-bounded-sum/1\0"); + let output = append_component(output, namespace); + let output = append_component(output, subject); + let output = append_component(output, evaluator); + let output = append_component(output, partition); + append_coordinates(output, window, index) +} + +fn slot_preimage(domain: &[u8], counter: &[u8; 32], slot: u64) -> Vec { + let output = append_bytes(copy_bytes(domain), counter); + append_word(output, slot) +} + +/// Count-slot domain followed by the exact 32-byte counter ID and an +/// eight-byte big-endian slot number. No claim/actor/process input is added. +#[must_use] +pub fn count_slot_preimage(counter: &[u8; 32], slot: u64) -> Vec { + slot_preimage(b"auths.gateway-bounded-count-slot/2\0", counter, slot) +} + +/// Sum-slot domain followed by the exact 32-byte counter ID and an +/// eight-byte big-endian slot number. No claim/actor/process input is added. +#[must_use] +pub fn sum_slot_preimage(counter: &[u8; 32], slot: u64) -> Vec { + slot_preimage(b"auths.gateway-bounded-sum-slot/1\0", counter, slot) +} + +#[cfg(test)] +mod tests { + use super::*; + + // Independent frozen framing; deliberately uses the former iterator form. + fn original_counter(domain: &[u8], components: &[&[u8]], window: u64, index: u64) -> Vec { + let mut bytes = Vec::from(domain); + for component in components { + bytes.extend_from_slice( + &u64::try_from(component.len()) + .unwrap_or(u64::MAX) + .to_be_bytes(), + ); + bytes.extend_from_slice(component); + } + bytes.extend_from_slice(&window.to_be_bytes()); + bytes.extend_from_slice(&index.to_be_bytes()); + bytes + } + + #[test] + fn component_lengths_order_and_full_width_words_match_previous_framing() { + let parts: &[&[u8]] = &[ + b"", + b"a", + b"ab", + b"bc", + b"raw:subject", + b"contains\0separator", + "unicode-λ".as_bytes(), + ]; + for namespace in parts { + for subject in parts { + for partition in parts { + for value in [0, 1, 255, 256, u64::MAX] { + let evaluator = b"auths.gateway.argument-ceiling-window-count/2"; + assert_eq!( + count_counter_preimage(namespace, subject, evaluator, value, value), + original_counter( + b"auths.gateway-bounded-count/2\0", + &[namespace, subject, evaluator], + value, + value + ) + ); + assert_eq!( + sum_counter_preimage( + namespace, subject, evaluator, partition, value, value + ), + original_counter( + b"auths.gateway-bounded-sum/1\0", + &[namespace, subject, evaluator, partition], + value, + value + ) + ); + } + } + } + } + } + + #[test] + fn domain_and_component_boundaries_are_visible() { + assert_ne!( + count_counter_preimage(b"a", b"bc", b"e", 60, 1), + count_counter_preimage(b"ab", b"c", b"e", 60, 1) + ); + assert_ne!( + count_counter_preimage(b"a", b"b", b"e", 60, 1), + sum_counter_preimage(b"a", b"b", b"e", b"", 60, 1) + ); + for counter in [[0; 32], [255; 32]] { + for slot in [0, 1, 255, 256, u64::MAX] { + for (prefix, output) in [ + ( + b"auths.gateway-bounded-count-slot/2\0".as_slice(), + count_slot_preimage(&counter, slot), + ), + ( + b"auths.gateway-bounded-sum-slot/1\0".as_slice(), + sum_slot_preimage(&counter, slot), + ), + ] { + let mut original = Vec::from(prefix); + original.extend_from_slice(&counter); + original.extend_from_slice(&slot.to_be_bytes()); + assert_eq!(output, original); + } + } + } + } +} diff --git a/product/runtime/auths-gateway-kernel/src/deadline.rs b/product/runtime/auths-gateway-kernel/src/deadline.rs new file mode 100644 index 000000000..0d0426691 --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/deadline.rs @@ -0,0 +1,31 @@ +//! Exact endpoint arithmetic for the final provider-entry gate. + +/// One finite upper endpoint. A half-open permit stays half-open even when +/// another inclusive authorization ends at the same timestamp. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct EntryBound { + /// Last timestamp at the boundary. + pub not_after: u64, + /// Whether equality with `not_after` is allowed. + pub inclusive: bool, +} + +/// Intersects two upper endpoints without incrementing or overflowing time. +#[must_use] +pub fn intersect_entry_bounds(left: EntryBound, right: EntryBound) -> EntryBound { + match left.not_after.cmp(&right.not_after) { + core::cmp::Ordering::Less => left, + core::cmp::Ordering::Greater => right, + core::cmp::Ordering::Equal => EntryBound { + not_after: left.not_after, + inclusive: left.inclusive && right.inclusive, + }, + } +} + +/// Checks both the authority endpoint and the lower bound established by +/// verification. Clock rollback never grants a new provider entry. +#[must_use] +pub fn entry_time_allows(evaluated_at: u64, now: u64, bound: EntryBound) -> bool { + now >= evaluated_at && (now < bound.not_after || (now == bound.not_after && bound.inclusive)) +} diff --git a/product/runtime/auths-gateway-kernel/src/entry_authorization.rs b/product/runtime/auths-gateway-kernel/src/entry_authorization.rs new file mode 100644 index 000000000..3b26318ef --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/entry_authorization.rs @@ -0,0 +1,110 @@ +//! Exact workload and profile membership for a connection entry. Inputs are +//! explicit public record fields; reloads, credential leases and transport +//! entry remain in the runtime. +use crate::construct::{field_index, field_name_equal}; +use alloc::vec::Vec; + +/// Administrative state projected from the loaded connection record. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum EntryState { + /// New entries may pass the workload and profile checks. + Active, + /// New entries are disabled. + Disabled, + /// The connection has been revoked. + Revoked, +} + +/// The exact profile identifier and version projected from a connection. +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct EntryProfile { + /// Public profile identifier bytes, without case folding or normalization. + pub id: Vec, + /// Exact profile version; validity of the record is a caller boundary. + pub version: u16, +} + +/// Whether a complete profile identifier and version occur in the list. +/// Empty lists refuse; callers bound collections through record validation. +#[must_use] +pub fn profile_allowed(allowed: &[EntryProfile], requested: &EntryProfile) -> bool { + let mut index = 0; + while index < allowed.len() { + let profile = &allowed[index]; + if profile.version == requested.version && field_name_equal(&profile.id, &requested.id) { + return true; + } + index += 1; + } + false +} + +/// Allows only active records listing the exact workload and profile/version. +/// This is a necessary entry check, not an execution handle or a lease. +#[must_use] +pub fn entry_allows( + state: EntryState, + workloads: &[Vec], + profiles: &[EntryProfile], + workload: &[u8], + profile: &EntryProfile, +) -> bool { + match state { + EntryState::Disabled | EntryState::Revoked => return false, + EntryState::Active => {} + } + match field_index(workloads, workload) { + None => false, + Some(_) => profile_allowed(profiles, profile), + } +} + +#[cfg(test)] +mod tests { + use super::*; + #[test] + fn entry_projection_matches_complete_membership_for_all_states() { + let names = [ + b"".to_vec(), + b"worker".to_vec(), + b"Worker".to_vec(), + "worker-é".as_bytes().to_vec(), + ]; + let profiles: Vec<_> = names + .iter() + .flat_map(|id| { + [0, 1, u16::MAX].map(|version| EntryProfile { + id: id.clone(), + version, + }) + }) + .collect(); + for state in [ + EntryState::Active, + EntryState::Disabled, + EntryState::Revoked, + ] { + for name in &names { + for requested in &profiles { + for workload_count in 0..=names.len() { + for profile_count in 0..=profiles.len() { + let expected = state == EntryState::Active + && names[..workload_count].contains(name) + && profiles[..profile_count].contains(requested); + assert_eq!( + entry_allows( + state, + &names[..workload_count], + &profiles[..profile_count], + name, + requested + ), + expected + ); + } + } + } + } + } + } +} diff --git a/product/runtime/auths-gateway-kernel/src/frontier.rs b/product/runtime/auths-gateway-kernel/src/frontier.rs new file mode 100644 index 000000000..c26231b3f --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/frontier.rs @@ -0,0 +1,147 @@ +//! Pure binary-search state for an append-only occupied slot prefix. +//! The runtime performs each requested read; this module has no store access. + +/// A bounded search interval. Only the constructor and observed-read transition +/// can create a state, preserving `lower <= upper <= original bound`. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct FrontierSearch { + lower: u64, + upper: u64, +} + +impl FrontierSearch { + /// Starts a search for the first unoccupied slot below `bound`. Zero means + /// the counter has no available slots. The complete `u64` domain is valid. + #[must_use] + pub const fn new(bound: u64) -> Self { + Self { + lower: 0, + upper: bound, + } + } + + /// The next slot to read, or `None` when the interval has closed. A probe + /// is strictly below the original bound, including at `u64::MAX`. + #[must_use] + pub const fn probe(self) -> Option { + if self.lower < self.upper { + Some(self.lower + (self.upper - self.lower) / 2) + } else { + None + } + } + + /// Consumes the occupancy result for this state's probe. Every nonterminal + /// transition shrinks the interval. Terminal states remain unchanged. + #[must_use] + pub const fn observe(self, occupied: bool) -> Self { + match self.probe() { + Some(middle) => { + if occupied { + Self { + lower: middle + 1, + upper: self.upper, + } + } else { + Self { + lower: self.lower, + upper: middle, + } + } + } + None => self, + } + } + + /// The candidate frontier. The runtime uses it only after `probe` returns + /// `None`; concurrent insertions can make it stale and require a retry. + #[must_use] + pub const fn candidate(self) -> u64 { + self.lower + } +} + +#[cfg(test)] +mod tests { + use super::FrontierSearch; + use alloc::vec::Vec; + + fn original(bound: u64, mut occupied: impl FnMut(u64) -> bool) -> u64 { + let (mut low, mut high) = (0, bound); + while low < high { + let middle = low + (high - low) / 2; + if occupied(middle) { + low = middle + 1; + } else { + high = middle; + } + } + low + } + + fn run(bound: u64, mut occupied: impl FnMut(u64) -> bool) -> (u64, Vec) { + let mut state = FrontierSearch::new(bound); + let mut reads = Vec::new(); + while let Some(slot) = state.probe() { + assert!(slot < bound); + reads.push(slot); + assert!(reads.len() <= 64); + state = state.observe(occupied(slot)); + } + assert_eq!(state.observe(false), state); + assert_eq!(state.observe(true), state); + (state.candidate(), reads) + } + + #[test] + fn every_small_prefix_and_sparse_observation_matches_the_previous_loop() { + for bound in 0..=256 { + for frontier in 0..=bound { + let (candidate, reads) = run(bound, |slot| slot < frontier); + let mut expected_reads = Vec::new(); + assert_eq!( + candidate, + original(bound, |slot| { + expected_reads.push(slot); + slot < frontier + }) + ); + assert_eq!(candidate, frontier); + assert_eq!(reads, expected_reads); + } + } + for mask in 0..=u16::MAX { + let (candidate, reads) = run(16, |slot| mask & (1 << slot) != 0); + let mut expected_reads = Vec::new(); + assert_eq!( + candidate, + original(16, |slot| { + expected_reads.push(slot); + mask & (1 << slot) != 0 + }) + ); + assert_eq!(reads, expected_reads); + } + } + + #[test] + fn full_width_and_monotone_concurrent_prefixes_keep_the_candidate_conservative() { + for bound in [0, 1, 2, 3, 63, 64, 65, u64::MAX - 1, u64::MAX] { + for frontier in [0, 1, bound / 2, bound.saturating_sub(1), bound] { + let frontier = frontier.min(bound); + assert_eq!(run(bound, |slot| slot < frontier).0, frontier); + } + let mut committed = 0_u64; + let mut seed = 0x2040_0199_u64; + let (candidate, _) = run(bound, |slot| { + seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1); + committed = committed.saturating_add(seed % 17).min(bound); + slot < committed + }); + assert!(candidate <= committed); + if candidate >= committed { + assert_eq!(candidate, committed); + } + } + } +} diff --git a/product/runtime/auths-gateway-kernel/src/identity.rs b/product/runtime/auths-gateway-kernel/src/identity.rs new file mode 100644 index 000000000..3e5331923 --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/identity.rs @@ -0,0 +1,117 @@ +//! Bounded logical-operation token validation and exact replay-key preimages. +//! Hashing remains a separately specified primitive; these leaves contain no +//! credential, challenge, actor, recipe, case-version or process input. +use crate::construct::{append_bytes, copy_bytes, is_alphanumeric}; +use alloc::vec::Vec; + +/// Validates the canonical ASCII token grammar used by operator namespaces +/// and logical operation IDs: an initial alphanumeric byte followed by +/// alphanumerics, dots, underscores or hyphens, within the supplied byte bound. +#[must_use] +pub fn valid_token(value: &[u8], maximum: usize) -> bool { + if value.is_empty() || value.len() > maximum { + return false; + } + let mut position = 0; + let mut valid = true; + while position < value.len() && valid { + let byte = value[position]; + valid = is_alphanumeric(byte) + || (position > 0 && (byte == b'.' || byte == b'_' || byte == b'-')); + position += 1; + } + valid +} + +/// The precise bytes hashed for a logical operation. The shipping caller +/// supplies validated 1–64-byte and 1–128-byte tokens, respectively; their +/// NUL-free grammar makes the separator unambiguous. +#[must_use] +pub fn logical_operation_preimage(namespace: &[u8], operation: &[u8]) -> Vec { + let mut output = copy_bytes(b"auths.gateway-logical-operation/1\0"); + output = append_bytes(output, namespace); + output.push(0); + append_bytes(output, operation) +} + +/// Exact domain-separated bytes hashed for a gateway connection key. +/// The shipping caller supplies validated provider and alias tokens of at most +/// 64 bytes each. Their NUL-free grammar makes the separator unambiguous. +#[must_use] +pub fn connection_record_preimage(provider: &[u8], alias: &[u8]) -> Vec { + let mut output = copy_bytes(b"auths.gateway-connection/1\0"); + output = append_bytes(output, provider); + output.push(0); + append_bytes(output, alias) +} + +#[cfg(test)] +mod tests { + use super::{connection_record_preimage, logical_operation_preimage, valid_token}; + use alloc::vec; + use alloc::vec::Vec; + + #[test] + fn exact_frozen_preimage_for_binary_components() { + for first in 0..=u8::MAX { + for second in 0..=u8::MAX { + let provider = [first, second]; + let alias = [second, first]; + for p_len in 0..=2 { + for a_len in 0..=2 { + let mut expected = Vec::from(b"auths.gateway-connection/1\0".as_slice()); + expected.extend_from_slice(&provider[..p_len]); + expected.push(0); + expected.extend_from_slice(&alias[..a_len]); + assert_eq!( + connection_record_preimage(&provider[..p_len], &alias[..a_len]), + expected + ); + } + } + } + } + } + + fn reference(value: &[u8], maximum: usize) -> bool { + !value.is_empty() + && value.len() <= maximum + && value.is_ascii() + && value.iter().enumerate().all(|(index, byte)| { + byte.is_ascii_alphanumeric() || (index > 0 && matches!(*byte, b'.' | b'_' | b'-')) + }) + } + + #[test] + fn token_validation_matches_the_independent_ascii_oracle() { + for first in 0_u8..=255 { + for second in 0_u8..=255 { + for maximum in [0, 1, 2, 64, 128] { + assert_eq!( + valid_token(&[first, second], maximum), + reference(&[first, second], maximum) + ); + } + } + assert_eq!(valid_token(&[first], 1), reference(&[first], 1)); + } + for length in [0, 1, 63, 64, 65, 127, 128, 129, 512] { + let bytes = vec![b'a'; length]; + for maximum in [0, 64, 128] { + assert_eq!(valid_token(&bytes, maximum), reference(&bytes, maximum)); + } + } + } + + #[test] + fn operation_preimage_preserves_the_existing_framing() { + let mut expected = Vec::from(b"auths.gateway-logical-operation/1\0".as_slice()); + expected.extend_from_slice(b"operator"); + expected.push(0); + expected.extend_from_slice(b"payment-1"); + assert_eq!( + logical_operation_preimage(b"operator", b"payment-1"), + expected + ); + } +} diff --git a/product/runtime/auths-gateway-kernel/src/lib.rs b/product/runtime/auths-gateway-kernel/src/lib.rs index a9f63d92e..1fdc0fdf3 100644 --- a/product/runtime/auths-gateway-kernel/src/lib.rs +++ b/product/runtime/auths-gateway-kernel/src/lib.rs @@ -18,8 +18,31 @@ extern crate alloc; pub mod construct; +pub mod deadline; +pub mod identity; pub mod order; pub mod outcome; pub mod ratio; pub mod recovery; pub mod transition; + +/// Bounded slot-prefix search decisions; storage remains in the runtime. +pub mod frontier; + +/// Exact bounded-counter and slot commitment bytes; hashing stays in the runtime. +pub mod counter_preimages; + +/// Shared keyed minimum-capacity aggregation; no actor or process identity is added. +pub mod counter_aggregation; + +/// Checked conflict retries for claim/count/sum reservation batches. +pub mod reservation_retry; + +/// Complete checked claim/count/sum descriptions before record serialization. +pub mod reservation_batch; + +/// Exact identity and numeric validation of decoded cumulative slot records. +pub mod slot_record; + +/// Exact active-state, workload and profile/version checks for connection entry. +pub mod entry_authorization; diff --git a/product/runtime/auths-gateway-kernel/src/reservation_batch.rs b/product/runtime/auths-gateway-kernel/src/reservation_batch.rs new file mode 100644 index 000000000..7673a14c4 --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/reservation_batch.rs @@ -0,0 +1,178 @@ +//! Complete claim/count/sum descriptions. Policy guards remain in the caller; +//! this builder checks shape, bounded work, and cumulative arithmetic. +use crate::counter_aggregation::{CounterCapacity, SumCapacity}; +use alloc::vec::Vec; + +/// The admitted per-kind counter bound used by the gateway. +pub const MAX_COUNTERS_PER_KIND: usize = 16; + +/// A complete entry description before canonical record serialization. +#[derive(Clone, Debug, Eq, PartialEq)] +pub enum SlotEntry { + /// The logical-operation claim is always entry zero. + Claim { key: [u8; 32] }, + /// One count reservation, preserving the counter and frontier order. + Count { counter: [u8; 32], slot: u64 }, + /// One sum reservation, with the checked new cumulative value. + Sum { + counter: [u8; 32], + slot: u64, + amount: u64, + cumulative: u64, + }, +} + +/// Describes every slot and the claim, or rejects inconsistent vector shapes, +/// excessive counter counts, and sum overflow before any storage operation. +/// A successful description does not by itself authorize execution. +#[must_use] +#[allow( + clippy::question_mark, + reason = "the explicit branch avoids additional Option Try/FromResidual interfaces in this mechanically translated boundary" +)] +pub fn build_batch( + claim: [u8; 32], + counts: &[CounterCapacity], + count_slots: &[u64], + sums: &[SumCapacity], + sum_slots: &[u64], + totals: &[u64], + amount: u64, +) -> Option> { + if counts.len() > MAX_COUNTERS_PER_KIND || sums.len() > MAX_COUNTERS_PER_KIND { + return None; + } + if counts.len() != count_slots.len() + || sums.len() != sum_slots.len() + || sums.len() != totals.len() + { + return None; + } + let mut entries = Vec::new(); + entries.push(SlotEntry::Claim { key: claim }); + let mut index = 0; + while index < counts.len() { + entries.push(SlotEntry::Count { + counter: counts[index].key, + slot: count_slots[index], + }); + index += 1; + } + let mut index = 0; + while index < sums.len() { + let Some(cumulative) = totals[index].checked_add(amount) else { + return None; + }; + entries.push(SlotEntry::Sum { + counter: sums[index].key, + slot: sum_slots[index], + amount, + cumulative, + }); + index += 1; + } + Some(entries) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn counts(length: usize) -> Vec { + (0..length) + .map(|index| CounterCapacity { + key: [u8::try_from(index).expect("small index"); 32], + capacity: u64::MAX, + }) + .collect() + } + fn sums(length: usize) -> Vec { + (0..length) + .map(|index| SumCapacity { + key: [128 + u8::try_from(index).expect("small index"); 32], + capacity: u64::MAX, + slots: u64::MAX, + }) + .collect() + } + + #[test] + fn every_required_counter_is_present_in_retry_order() { + for count in 0..=16 { + for sum in 0..=16 { + let counts = counts(count); + let sums = sums(sum); + let count_slots: Vec<_> = (0..count) + .map(|index| u64::try_from(index).expect("small index")) + .collect(); + let sum_slots: Vec<_> = (0..sum) + .map(|index| u64::try_from(index).expect("small index")) + .collect(); + let totals = alloc::vec![10; sum]; + let entries = build_batch( + [42; 32], + &counts, + &count_slots, + &sums, + &sum_slots, + &totals, + 5, + ) + .expect("complete batch"); + assert_eq!(entries.len(), 1 + count + sum); + assert_eq!(entries[0], SlotEntry::Claim { key: [42; 32] }); + for (index, counter) in counts.iter().enumerate() { + assert_eq!( + entries[1 + index], + SlotEntry::Count { + counter: counter.key, + slot: count_slots[index] + } + ); + } + for (index, counter) in sums.iter().enumerate() { + assert_eq!( + entries[1 + count + index], + SlotEntry::Sum { + counter: counter.key, + slot: sum_slots[index], + amount: 5, + cumulative: 15 + } + ); + } + } + } + } + + #[test] + fn no_partial_batch_survives_shape_or_arithmetic_failure() { + assert_eq!( + build_batch([0; 32], &counts(1), &[], &[], &[], &[], 0), + None + ); + assert_eq!(build_batch([0; 32], &[], &[], &sums(1), &[], &[0], 0), None); + assert_eq!(build_batch([0; 32], &[], &[], &sums(1), &[0], &[], 0), None); + assert_eq!( + build_batch([0; 32], &counts(17), &[0; 17], &[], &[], &[], 0), + None + ); + assert_eq!( + build_batch([0; 32], &[], &[], &sums(17), &[0; 17], &[0; 17], 0), + None + ); + assert_eq!( + build_batch( + [0; 32], + &counts(1), + &[0], + &sums(2), + &[0, 1], + &[0, u64::MAX], + 1 + ), + None + ); + assert!(build_batch([0; 32], &[], &[], &sums(1), &[0], &[u64::MAX - 1], 1).is_some()); + } +} diff --git a/product/runtime/auths-gateway-kernel/src/reservation_retry.rs b/product/runtime/auths-gateway-kernel/src/reservation_retry.rs new file mode 100644 index 000000000..42494de0e --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/reservation_retry.rs @@ -0,0 +1,153 @@ +//! Public batch-conflict interpretation. No branch grants execution authority. + +/// The only progress a failed atomic reservation may request. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum RetryTarget { + /// The logical claim already exists; never retry ownership acquisition. + Replay, + /// Advance one count frontier by exactly one. + Count { position: usize, next: u64 }, + /// Read this exact sum slot before advancing its frontier. + Sum { + position: usize, + read_slot: u64, + next: u64, + }, + /// The backend index or local frontier cannot represent safe progress. + Corrupt, +} + +/// Interprets the index of the existing member of a claim/count/sum batch. +/// All index arithmetic is guarded and frontier additions are checked, so a +/// malformed backend response or corrupt frontier fails closed. +#[must_use] +pub fn retry_target( + index: usize, + counts: &[u64], + sums: &[u64], + totals_len: usize, + sum_counters_len: usize, +) -> RetryTarget { + if index == 0 { + return RetryTarget::Replay; + } + let position = index - 1; + if position < counts.len() { + return match counts[position].checked_add(1) { + Some(next) => RetryTarget::Count { position, next }, + None => RetryTarget::Corrupt, + }; + } + let position = position - counts.len(); + if position >= sums.len() || position >= totals_len || position >= sum_counters_len { + return RetryTarget::Corrupt; + } + let read_slot = sums[position]; + match read_slot.checked_add(1) { + Some(next) => RetryTarget::Sum { + position, + read_slot, + next, + }, + None => RetryTarget::Corrupt, + } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn conflicts_keep_the_claim_count_sum_batch_order() { + let counts = [4, 9]; + let sums = [2]; + assert_eq!(retry_target(0, &counts, &sums, 1, 1), RetryTarget::Replay); + assert_eq!( + retry_target(1, &counts, &sums, 1, 1), + RetryTarget::Count { + position: 0, + next: 5 + } + ); + assert_eq!( + retry_target(2, &counts, &sums, 1, 1), + RetryTarget::Count { + position: 1, + next: 10 + } + ); + assert_eq!( + retry_target(3, &counts, &sums, 1, 1), + RetryTarget::Sum { + position: 0, + read_slot: 2, + next: 3 + } + ); + assert_eq!(retry_target(4, &counts, &sums, 1, 1), RetryTarget::Corrupt); + } + + #[test] + fn malformed_indices_missing_arrays_and_overflow_fail_closed() { + for counts in [ + alloc::vec![], + alloc::vec![0], + alloc::vec![u64::MAX - 1], + alloc::vec![u64::MAX], + ] { + for sums in [ + alloc::vec![], + alloc::vec![0], + alloc::vec![u64::MAX - 1], + alloc::vec![u64::MAX], + ] { + for total_size in 0..=2 { + for counter_size in 0..=2 { + for index in [0, 1, 2, 3, 4, usize::MAX] { + match retry_target(index, &counts, &sums, total_size, counter_size) { + RetryTarget::Replay => assert_eq!(index, 0), + RetryTarget::Count { position, next } => { + assert_eq!(index, position + 1); + assert_eq!( + counts.get(position).and_then(|value| value.checked_add(1)), + Some(next) + ); + } + RetryTarget::Sum { + position, + read_slot, + next, + } => { + assert_eq!(index, counts.len() + position + 1); + assert!(position < total_size && position < counter_size); + assert_eq!(sums.get(position), Some(&read_slot)); + assert_eq!(read_slot.checked_add(1), Some(next)); + } + RetryTarget::Corrupt => assert_ne!(index, 0), + } + } + } + } + } + } + assert_eq!( + retry_target(usize::MAX, &[], &[0], usize::MAX, usize::MAX), + RetryTarget::Corrupt + ); + assert_eq!( + retry_target(1, &[u64::MAX], &[], 0, 0), + RetryTarget::Corrupt + ); + assert_eq!( + retry_target(1, &[], &[u64::MAX], 1, 1), + RetryTarget::Corrupt + ); + assert_eq!( + retry_target(1, &[u64::MAX - 1], &[], 0, 0), + RetryTarget::Count { + position: 0, + next: u64::MAX + } + ); + } +} diff --git a/product/runtime/auths-gateway-kernel/src/slot_record.rs b/product/runtime/auths-gateway-kernel/src/slot_record.rs new file mode 100644 index 000000000..a31071370 --- /dev/null +++ b/product/runtime/auths-gateway-kernel/src/slot_record.rs @@ -0,0 +1,133 @@ +//! Validation of the decoded sum-slot projection. JSON parsing remains at the +//! storage boundary; this function binds the decoded record to the exact slot. +use crate::construct::{field_name_equal, hex_lower}; + +/// Numeric fields of a decoded sum-slot record. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct SumValues { + /// Slot number recorded in the payload. + pub slot: u64, + /// Delta recorded in this slot. + pub amount: u64, + /// Cumulative sum recorded after this delta. + pub cumulative: u64, +} + +/// Exact lowercase hexadecimal identity of a public 32-byte counter ID. +#[must_use] +pub fn counter_hex_matches(stored: &[u8], counter: &[u8; 32]) -> bool { + if stored.len() != 64 { + return false; + } + let mut index = 0; + while index < 32 { + let byte = counter[index]; + if stored[index * 2] != hex_lower(byte / 16) + || stored[index * 2 + 1] != hex_lower(byte % 16) + { + return false; + } + index += 1; + } + true +} + +/// Accepts only the exact sum-slot schema, lowercase counter ID, requested +/// slot and a cumulative value at least as large as its recorded delta. +/// This checks the decoded projection; storage integrity and JSON correctness +/// are separate boundaries. +#[must_use] +pub fn validate_cumulative( + schema: &[u8], + expected_schema: &[u8], + counter_hex: &[u8], + counter: &[u8; 32], + expected_slot: u64, + values: SumValues, +) -> Option { + if !field_name_equal(schema, expected_schema) + || !counter_hex_matches(counter_hex, counter) + || values.slot != expected_slot + || values.amount > values.cumulative + { + return None; + } + Some(values.cumulative) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn encoded(counter: &[u8; 32]) -> alloc::vec::Vec { + use core::fmt::Write as _; + let mut encoded = alloc::string::String::with_capacity(64); + for byte in counter { + write!(encoded, "{byte:02x}").expect("writing to a String"); + } + encoded.into_bytes() + } + + #[test] + fn public_counter_binding_matches_canonical_hex_on_all_byte_values() { + for value in 0..=u8::MAX { + let counter = [value; 32]; + let canonical = encoded(&counter); + assert!(counter_hex_matches(&canonical, &counter)); + assert!(!counter_hex_matches(&canonical[..63], &counter)); + let mut extended = canonical.clone(); + extended.push(b'0'); + assert!(!counter_hex_matches(&extended, &counter)); + for index in 0..64 { + let mut changed = canonical.clone(); + changed[index] ^= 1; + assert!(!counter_hex_matches(&changed, &counter)); + } + let uppercase: alloc::vec::Vec<_> = + canonical.iter().map(u8::to_ascii_uppercase).collect(); + assert_eq!( + counter_hex_matches(&uppercase, &counter), + uppercase == canonical + ); + } + } + + #[test] + fn complete_decoded_gate_preserves_the_previous_acceptance_rule() { + let counter = [42; 32]; + let canonical = encoded(&counter); + let schema = b"auths.gateway-bounded-sum/1"; + for recorded_schema in [schema.as_slice(), b"wrong".as_slice()] { + for stored_hex in [canonical.as_slice(), b"not-a-counter".as_slice()] { + for stored_slot in [0, 1, u64::MAX] { + for expected_slot in [0, 1, u64::MAX] { + for amount in [0, 1, u64::MAX] { + for cumulative in [0, 1, u64::MAX] { + let expected = (recorded_schema == schema + && stored_hex == canonical + && stored_slot == expected_slot + && amount <= cumulative) + .then_some(cumulative); + assert_eq!( + validate_cumulative( + recorded_schema, + schema, + stored_hex, + &counter, + expected_slot, + SumValues { + slot: stored_slot, + amount, + cumulative + } + ), + expected + ); + } + } + } + } + } + } + } +} diff --git a/product/runtime/auths-gateway/semantic-closure.json b/product/runtime/auths-gateway/semantic-closure.json index b5d7f2261..637ce1c36 100644 --- a/product/runtime/auths-gateway/semantic-closure.json +++ b/product/runtime/auths-gateway/semantic-closure.json @@ -1 +1 @@ -{"files":[{"path":"Cargo.lock","sha256":"0e75e2fdef44e79e57797ac6661295ae58ddb8de4a1990a6fd22ce6c54f78604"},{"path":"Cargo.toml","sha256":"6e0240aa432bcdb5b4f855618994582d2e428afe5ee4e4f6a3f8d21a518f8d24"},{"path":"core/adapters/auths-did-keri/Cargo.toml","sha256":"86ba3e3f9a0a70d970568bfb3113b7ba7bbdd81c3eebbb52743dd574a0c0ecaa"},{"path":"core/adapters/auths-did-keri/src/lib.rs","sha256":"a75674842f8a7142004369ccd206ab43e476459293f0ff4bed4d4e659031b3e3"},{"path":"core/adapters/auths-did-key/Cargo.toml","sha256":"d5a3ae07ecde83f91eed4c3785051dd0f44eab6c891754f3309b6b40596707d7"},{"path":"core/adapters/auths-did-key/src/lib.rs","sha256":"b76a3f4528a725df53cfa9242e6e414e1d26caa48468aaed497e28b121f4497c"},{"path":"core/adapters/auths-raw-key/Cargo.toml","sha256":"f49616bc18c19e6aaa7e6a02ccebcdb9f5c1422c1278ef9869e0dbf22ceda7be"},{"path":"core/adapters/auths-raw-key/src/lib.rs","sha256":"45eec1b295dac3bed65cd79c942870b926b06b3f5d38eaebaeb6140ac69315fa"},{"path":"core/crates/auths-algebra-kernel/Cargo.toml","sha256":"0cb078915287b8c47d20fb97b6fa14135ed1c61c4985c4de2753855563c27bba"},{"path":"core/crates/auths-algebra-kernel/src/generated.rs","sha256":"ae4bcbef42a408c7ffa0c6a74a42f7de177a6f14479e51d205acf830bda05960"},{"path":"core/crates/auths-algebra-kernel/src/lib.rs","sha256":"6654667eeb9b353d6648954c9fd2e8838462a82ce6b2803eb49e1366892c68c6"},{"path":"core/crates/auths-assurance/Cargo.toml","sha256":"afcb12a97ddd09d7a264b9ecd3fcaefc865ff2c9b4539ee85b00883420ba333a"},{"path":"core/crates/auths-assurance/src/lib.rs","sha256":"0fb2ec844d674b25a9e20b1601452c89c2454901fa506adfa9bb38ef9a7fa213"},{"path":"core/crates/auths-author/Cargo.toml","sha256":"1e6f0e3bc079ddb558decf0db26b291c6e72fc47327b6df1b7650d41689b215f"},{"path":"core/crates/auths-author/src/lib.rs","sha256":"e14475f2f49715a1869d5fa6b11ff1fbb72497e39097e09f833b0bae7e5b3f2b"},{"path":"core/crates/auths-author/src/observations.rs","sha256":"dda7d6bfa6f4bd7e95a480ca283c2c0e996f69c5c15cb0c7197af328131a7066"},{"path":"core/crates/auths-authority/Cargo.toml","sha256":"4f68212938029f79ebd857b4f3038494eb85d0163d49f07e51376715cf959815"},{"path":"core/crates/auths-authority/src/lib.rs","sha256":"da88d5194de4e17449e69972c0fb042afa3c39798a8f570f30771e77c384f1eb"},{"path":"core/crates/auths-codec/Cargo.toml","sha256":"e20e51826e17814effd9d8925d18d5fbdd6c0d37bf50231e743ec2611314722c"},{"path":"core/crates/auths-codec/src/approval.rs","sha256":"fbff43bf4d57f69f8b7738a8647751cde75c5a932dee65d924a1fe9c7202f91f"},{"path":"core/crates/auths-codec/src/bounded_policy.rs","sha256":"d21f6728be2d8a04b6d94921f2b683f7e61cbb42e0ac6866f1c88a49caa534c3"},{"path":"core/crates/auths-codec/src/decode.rs","sha256":"ba2999584cdf53b1b517ecb9c7ea50d39efee17c666a9a38e2ad1ac94379f778"},{"path":"core/crates/auths-codec/src/encode.rs","sha256":"8491192053e2e15d62b4d2a491de22405b7487ead69ab6f6bca40669ce7ca5f7"},{"path":"core/crates/auths-codec/src/error.rs","sha256":"fecb0737c16deb42d859f1dc7727c698438d9ac12064fd99e0024629642c390c"},{"path":"core/crates/auths-codec/src/hash.rs","sha256":"f88e111f1dbb2cef6b7b5e9c948cb45ff92e366710c8a5f5c636138aa748479e"},{"path":"core/crates/auths-codec/src/lib.rs","sha256":"3b0e5c94c6f34f750b88a9333e1d5c8145746d845d3a23e0d2f61807cf592ea7"},{"path":"core/crates/auths-codec/src/observation.rs","sha256":"38328b0c71ff97a4196eeade8b4faa889527ff1f80bb168468bcd49082a3987e"},{"path":"core/crates/auths-composition/Cargo.toml","sha256":"331e13025eb82588b5269ed3975929eb41c823d588c49e4c296273d85c6fe80e"},{"path":"core/crates/auths-composition/src/lib.rs","sha256":"e42e3b0b6a9985b73c533aeb23799c638979aa27a9ce7d0f10a8d60340570fb1"},{"path":"core/crates/auths-model/Cargo.toml","sha256":"565c15302b0cc9270db1e28efa3862804846850ba933cc17aea8abcec4a65987"},{"path":"core/crates/auths-model/src/approval.rs","sha256":"54cf44a9ef747ec21546a4086aecfb130bc7803b0d646430e6082df51e6e305f"},{"path":"core/crates/auths-model/src/bounded.rs","sha256":"f90496abc0a06c028b4d850af6ddab7d850bfafeaa3d042f1b1246a41d8bbbc9"},{"path":"core/crates/auths-model/src/bounded_policy.rs","sha256":"306a8f049cc7cfc7635fe0e4de47eb7813eed63d3c14c3be2b51586aa4eea450"},{"path":"core/crates/auths-model/src/lib.rs","sha256":"e7cfe6bb9574c6b016aa63e70658c31e0b90903ec6479a49f4a2ceb64f5bad97"},{"path":"core/crates/auths-model/src/observation.rs","sha256":"b3ed3e3cc090afca2896a7d3de7988afccc1ee1ea0ebd91b51a8bc0f20ad8dbb"},{"path":"core/crates/auths-multikey/Cargo.toml","sha256":"858756c1197befcada06134742bffe8d58cf674cadd6c046bf710570e96efaf2"},{"path":"core/crates/auths-multikey/src/lib.rs","sha256":"f5177fffb11e40eeaaa665ba886c541fc1f24d5eacdd6983fb03dc20148733f0"},{"path":"core/crates/auths-ports/Cargo.toml","sha256":"596a9b0f5af3717c16a6d13f7054d8a106bcd9f01f5f72c2235dd2afcf0ab16c"},{"path":"core/crates/auths-ports/src/binding.rs","sha256":"a16c012d40aa4249e3ec54372b9611006d0bfe8c7dc3c741911c2194ad17736d"},{"path":"core/crates/auths-ports/src/diagnostics.rs","sha256":"aa596572503b5a65a918bb2ff38281c144ff53821ee914e9325c852828d852df"},{"path":"core/crates/auths-ports/src/lib.rs","sha256":"8da1debf86f9532df0660155d04298beb1ba3a1204508f8586e2e67cd2fb3449"},{"path":"core/crates/auths-ports/src/path.rs","sha256":"b68fc547b4e4d97a60cbbc1cc1939fc6b34a8233b81f840bd396914a707e3ea1"},{"path":"core/crates/auths-raw-key-core/Cargo.toml","sha256":"98c0bc8527a537512e43a74dd6ba9658c6f0cdc16610cf938e3f9b43785d836d"},{"path":"core/crates/auths-raw-key-core/src/lib.rs","sha256":"98c0500c41697aae28708ad0bf970b9a97583d96a3d2c18d23e7fa351e0f7d12"},{"path":"core/crates/auths-registries/Cargo.toml","sha256":"590e49e58b0622d9d6274fea46796dcdb07dec9550eff295cce6a6427ffa51e2"},{"path":"core/crates/auths-registries/src/lib.rs","sha256":"450d3886d85ee333b7e046317fb5b47cde62483d5f3e41d46265e2caf4c373ec"},{"path":"core/crates/auths-registries/src/template.rs","sha256":"1224039dd2b3ce6fa8357613d8cafbae40400493da7176da202b9ade62fa05e4"},{"path":"core/crates/auths-signature-core/Cargo.toml","sha256":"6bee2230eb30af1be0bd5c2d57bd3e1903497a70028d47290d4ac6e9e0e8bca0"},{"path":"core/crates/auths-signature-core/src/lib.rs","sha256":"6e3f9311ded5e49ea50d445eb21e6d8fa12442aa4362a73e0cb6fda15b7cd865"},{"path":"core/crates/auths-signature/Cargo.toml","sha256":"7f7b5682466ba439d8c59579022cb61068cad9fb4bd2d73e1cc21327c902b450"},{"path":"core/crates/auths-signature/src/lib.rs","sha256":"b3d9ac4cc3ba0797b9e1c09f2d6ac05089b25dac4e285a5af28c0165b33d925b"},{"path":"core/crates/auths-verifier/Cargo.toml","sha256":"c43358e06a33324b41a8b93e5cc7279c55f7d21f1f6cfaa539a3fc7b4c27a38f"},{"path":"core/crates/auths-verifier/src/approval.rs","sha256":"c3cae6a49e169051eb555bb092b1069a4d422516d6a2114623a89e5f31ff923f"},{"path":"core/crates/auths-verifier/src/causal.rs","sha256":"9635230f33b13a263573d319ac8a1976addbcc07677514a43e3c7bf28dc04587"},{"path":"core/crates/auths-verifier/src/lib.rs","sha256":"f22dec38dfa47ced8da4f605390da8453273bee1da010f57fd1fdfcb10e0b389"},{"path":"core/crates/auths-verifier/src/observation.rs","sha256":"0bb07f06a0f9524c88427df1c972b1de8ba038a9eeeb15d3134c25125ae84b1e"},{"path":"core/crates/auths-verifier/src/trace.rs","sha256":"2213d72023a1d9e0413a2cf2c51c3dad9e04775d86033a0caaa9d29a8f0036f8"},{"path":"exchange/crates/auths-proof-exchange-model/Cargo.toml","sha256":"34b2db64f93a288e942b5a3918d28cdcbef906e0dc9074ce848018d3d5f7a1fa"},{"path":"exchange/crates/auths-proof-exchange-model/src/lib.rs","sha256":"49fac5aff2339d3a57c41cb8bb2a82852538e8f77ecc4b157c88e264ff31fb55"},{"path":"exchange/crates/auths-proof-exchange-port/Cargo.toml","sha256":"7ff660f1b7579dc570c791090aeb450404fbbf44c92781e289f5ccdde746d739"},{"path":"exchange/crates/auths-proof-exchange-port/src/lib.rs","sha256":"b408fb40c6432edc1facb3d8b3e9433a033f8dc73fe2e0ba5a88c972ca675021"},{"path":"product/config/auths-config/Cargo.toml","sha256":"e4b568ab9f6d84f7d7e6d66443fe825f360db9c27bc7c31d6ddc0647ba3ab304"},{"path":"product/config/auths-config/src/lib.rs","sha256":"fecf00ea65cef9018fda9af2063326d7065b869266d0d9e73a4f06816f1102cc"},{"path":"product/errors/auths-errors/Cargo.toml","sha256":"3b3a199b6460ba75bda84475bb5accd35e1485448a3981038db85bf4772dd350"},{"path":"product/errors/auths-errors/src/lib.rs","sha256":"7feeb9069fa4003f94f1f07c1c94619cf1c883e0dbaaf2187f04d0f742264bdd"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/Cargo.toml","sha256":"716f1f2a117d6d69d8effe9ee9057e24ba3502f20af6a602b06facb638cdabed"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/api.rs","sha256":"9ea61dd7ddd93282b073b98e453e6b75b26dc49689c04e9782435d06a3a09e48"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/clock.rs","sha256":"73f0a6e0f5903883329fa6683f5888288f759512ac69e5c87efd2b6b87f7d79f"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/http.rs","sha256":"14c1fce14e24c984b2a275563a29b6326fb08367922b6e8d37ba38b9cb81aa2b"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/identity.rs","sha256":"186de11230c8b33375951c4368609f8976bf9795f171af3fd7fac26207a94361"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/lib.rs","sha256":"0b4617d044f5254a5ab22f5a2578f91cc025206a8c1845be39c1c56dcdf7a5df"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/names.rs","sha256":"41bb23572d6002e23ee103d6fe70ecd68764861c6f2e48a1c53af998270a4afa"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/sigv4.rs","sha256":"39fed883f4802e68d3b41a68fea0aba0737810996b33d13577de70faba004c29"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/store.rs","sha256":"fc60ee9c49b2f4f063c449b4c78100c5c4872779e94ca168f796603b380ef6e4"},{"path":"product/integrations/auths-custody/Cargo.toml","sha256":"1e14034185ad1ec24a977fd5f41d0abee219606245c046ce2a82287fadef448b"},{"path":"product/integrations/auths-custody/src/conformance.rs","sha256":"8ed1afd58f18fc6becc268908aa6419c9aa404c79da0197963eb2599df44acf6"},{"path":"product/integrations/auths-custody/src/key.rs","sha256":"70cbb0fd21b6f5652157845a22c35be2d0f6c05b3d138fc4b9bb6dbdc3d81c40"},{"path":"product/integrations/auths-custody/src/lib.rs","sha256":"8ee593c1f59b0fd2126bdda9138026f5bc531beb64d4489a99785842e7b98b43"},{"path":"product/operations/auths-operations/Cargo.toml","sha256":"73dde1e914ba5e1386f8d49c0d730423cc72ae77ec44c6554a6a75cc8e8922b1"},{"path":"product/operations/auths-operations/src/explanation.rs","sha256":"b4a39bcbd5712cb9e735ee7deeb281f3fa6af5ddca973735bf3d87dce427ef11"},{"path":"product/operations/auths-operations/src/lib.rs","sha256":"3f401a56555113b98f57bca172a2660eaecedf76247b83a3fdbb089c133a29cd"},{"path":"product/operations/auths-operations/src/render/json.rs","sha256":"2ae042639960afee123730e945d373bc5dda1d2b3af20ae16c939a7e99b9e418"},{"path":"product/operations/auths-operations/src/render/mod.rs","sha256":"b3b7f6fe473f49227ace5a68bfc3d8dc14b5db8dd9888fd9e207070337b1b8bf"},{"path":"product/operations/auths-operations/src/render/text.rs","sha256":"f216cf3bdb00e264523271b16e7059535ac6b1aabf271cebd7935af155e4bfec"},{"path":"product/policy/auths-bounded-policy/Cargo.toml","sha256":"babd5d200923137ead71d8c2528f847cea323ce98da942a1320b054436612c47"},{"path":"product/policy/auths-bounded-policy/src/arithmetic.rs","sha256":"75e43c5d4eab8d1f71c1daf53839f5f9fe45a400afc1f63a30c6f55ce3632627"},{"path":"product/policy/auths-bounded-policy/src/commitment.rs","sha256":"c5706f2d583454e1a7f570f7ada138d4d864bef0205dfae7c1296774f396bb3f"},{"path":"product/policy/auths-bounded-policy/src/eligibility.rs","sha256":"c9acdfb793074e687fc36efad506be27dbd99ffbf40387bc66c8de39ef238432"},{"path":"product/policy/auths-bounded-policy/src/identifier.rs","sha256":"0006a32bae9eb16c4178cf797df418d2b0a781f2bc6474b741dc1a908141831c"},{"path":"product/policy/auths-bounded-policy/src/kernel.rs","sha256":"99187c28b161ac70bee1afed60711f7f645adb4d1671a01863f9849b369811d5"},{"path":"product/policy/auths-bounded-policy/src/lib.rs","sha256":"76a18638b810e62e594d6e951504679305ce21841388e0c282ad51cd7841b91c"},{"path":"product/policy/auths-bounded-policy/src/receipt.rs","sha256":"3b9eae82f349956d3e7f29b57b254bff5ce67cc703e6cf43445ce2827676d1ad"},{"path":"product/policy/auths-bounded-policy/src/registry.rs","sha256":"4e251ea5833559841f8ee0bd9b66c0c01c39fa5e3a21720a19c4e8adbfcb99d0"},{"path":"product/profiles/auths-profile-api/Cargo.toml","sha256":"7ae85761f58625b5d678f961fd052eebf3e000ef565c7312e3ac857763c0017f"},{"path":"product/profiles/auths-profile-api/src/lib.rs","sha256":"a194b82b20bf8aa864c2334ef6c6aec30b2154ded972862252d5dcefa488ab95"},{"path":"product/profiles/auths-profile-mcp/Cargo.toml","sha256":"db264fc25242f7b7e4133cbe5782545b3107b406c87168ae072683cfb59eac66"},{"path":"product/profiles/auths-profile-mcp/src/arguments.rs","sha256":"a5de696586d507e2aee4a49fee99ef1ef4c51a2e46603f8838f1af6d9009833f"},{"path":"product/profiles/auths-profile-mcp/src/lib.rs","sha256":"d0f8b733a09ef8408336cdebc8948d6a5861012ce6878598b11be7084dfd4280"},{"path":"product/profiles/auths-profile-mcp/src/session.rs","sha256":"166c281fa66333388e4760d6098dad02d3359e1d5de4b8f93312c014f97abb03"},{"path":"product/qualification/auths-recipe-qualification/Cargo.toml","sha256":"b7b15b30b9a3d96d4f089d514266d3a892de6608d30707aa44be31cca89ca9fe"},{"path":"product/qualification/auths-recipe-qualification/src/canonical.rs","sha256":"30a9b50777f0dcb4b606abfee2467d5a975d9f6ad941ab6c13ca3df5b359f667"},{"path":"product/qualification/auths-recipe-qualification/src/closure.rs","sha256":"0ad6aee9bd981e2863fa725f209ec84031db2ff12f4c7ac3aaf5120f0bb86039"},{"path":"product/qualification/auths-recipe-qualification/src/commissioning.rs","sha256":"db135c55e4e3079a73253ebae275536523eb36b545d1c152b4d7dce3c6b76828"},{"path":"product/qualification/auths-recipe-qualification/src/commissioning/tests.rs","sha256":"4dde3736d206099b1bea4c14e0092c6c1287d1af9065958777d7c54331dd8686"},{"path":"product/qualification/auths-recipe-qualification/src/error.rs","sha256":"52d5cf720a1e4579008fdda90a3ac2c31f0b8db57985f121f65e54b4da2b7dd1"},{"path":"product/qualification/auths-recipe-qualification/src/evidence.rs","sha256":"ba45a7409d67a8af26ab811af306412014557477a101ab2a8eb0faf8f2bd4b91"},{"path":"product/qualification/auths-recipe-qualification/src/ids.rs","sha256":"e81a906d571497ab2da753e1532d4443706410e0b75fdd59a7d2d788c7aec403"},{"path":"product/qualification/auths-recipe-qualification/src/launch.rs","sha256":"805154ce931e3977f2a2a2c62909d90f7c0a22dc167bf4f1554dcf19316ffef8"},{"path":"product/qualification/auths-recipe-qualification/src/lib.rs","sha256":"0e24b0f81191df0d078c7f4d73ced784ba9472372bfcdff3c7d0e2fb1687b323"},{"path":"product/qualification/auths-recipe-qualification/src/model.rs","sha256":"3484eb0ec287b23d4682ade7b1b0f8d1335985b3fb180f06fc28716076957d5f"},{"path":"product/qualification/auths-recipe-qualification/src/release.rs","sha256":"ec478e53f70052e566aac7e15be2f9e1b1cd46837ac6990ae955fa864d311586"},{"path":"product/qualification/auths-recipe-qualification/src/vectors/mod.rs","sha256":"fa23a962fd90331152eed5edbcdf271955f7aed79b8da1e065bfe69a20b487a9"},{"path":"product/qualification/auths-recipe-qualification/src/vectors/schemas.rs","sha256":"c59feec2805621f341a90f81fc005e2c12f7a70f9d264fdeacccb2be4fe1c046"},{"path":"product/qualification/auths-recipe-qualification/src/vectors/verification.rs","sha256":"bdf5746fed4d10a7f577f7878619a917d29aa8b7d522f00d9f774e53eff4c8c1"},{"path":"product/qualification/auths-recipe-qualification/src/verify.rs","sha256":"646ff0e52e915174ad183768706e35e5ce2118b83475455310b930a77a7877f6"},{"path":"product/receipts/auths-receipts/Cargo.toml","sha256":"6001fa1375899953aafcb07c23a6da0c8f57ea7ec08bb9c950b12a60a8cc6f0f"},{"path":"product/receipts/auths-receipts/src/disclosure.rs","sha256":"ba9ed439be0a320c8a01f5b6e9b51361c1a37e076947490d8e4a484ba6bb119c"},{"path":"product/receipts/auths-receipts/src/lib.rs","sha256":"547a57c4160256719cafb7d0ab972d9fc80b0da14fbbce4148c70c414070ff36"},{"path":"product/runtime/auths-connections/Cargo.toml","sha256":"babeb6e1dda3dfb66291713ce1e43dce5c349833d0b50ea4dccbf986030026b2"},{"path":"product/runtime/auths-connections/src/credential.rs","sha256":"82921413bb053f0f6c7931fbd4e6a86c8cc1d8c6b51debd9c2cef33a8d5b1c51"},{"path":"product/runtime/auths-connections/src/kernel.rs","sha256":"a456af19526ef7b19278551fd8d97606b6e7aa5a195e70bdd85d1e0786090ce8"},{"path":"product/runtime/auths-connections/src/lib.rs","sha256":"79209249a0acba0e854d9937255ea0e30a9a6f8e1c2baad77ab83646d392de22"},{"path":"product/runtime/auths-connections/src/model.rs","sha256":"de34a089cac9702acb889b7602b3e4732306c9e61029ec892582b7e02b73fc77"},{"path":"product/runtime/auths-connections/src/registry.rs","sha256":"e57640e003e72ad3235c567c2bb944a262bd64e673f023b62ea091094cc7e946"},{"path":"product/runtime/auths-gateway-kernel/Cargo.toml","sha256":"34f864e67656af4ac7e5c7a347a23f01fc8ab31365b8e23c0ef474483b14a183"},{"path":"product/runtime/auths-gateway-kernel/src/construct.rs","sha256":"e9d65744bae273d65face4285e5d2da75c06a92ab48f7b8333d496604e31c63c"},{"path":"product/runtime/auths-gateway-kernel/src/lib.rs","sha256":"cfda6f8453426564c085475f183b6f790b438768a19668f1b65d33ba59dc8632"},{"path":"product/runtime/auths-gateway-kernel/src/order.rs","sha256":"e0045f877c4b7fe3860c291039853885064ddcdebba7c9b345ab65e81e646dda"},{"path":"product/runtime/auths-gateway-kernel/src/outcome.rs","sha256":"e9785b1afe70788c89b51b18655bcd5acff7b0c8e3d12fb79c6f05a202e67e6b"},{"path":"product/runtime/auths-gateway-kernel/src/ratio.rs","sha256":"7ace22264812e6fc1ef3a62afee402cf43494bb71ae0d3de219ad1b39d690bcb"},{"path":"product/runtime/auths-gateway-kernel/src/recovery.rs","sha256":"9f46dcd1685ab6e4d1ba04a3fc286a9f3afee8fb47829be1fbc670a7926a2dc6"},{"path":"product/runtime/auths-gateway-kernel/src/transition.rs","sha256":"cefb8f01d915880f6921f2501ff881ad94b9de61072c34d9cd19220992f97374"},{"path":"product/runtime/auths-gateway/Cargo.toml","sha256":"00b28be86921dcdc0ad90cce0c62c2961cafefe96ea6c2edf0e926c3d405ccad"},{"path":"product/runtime/auths-gateway/src/admin.rs","sha256":"0dee40a9fb67c5de10142fc37a7bbabdd8979fb0199fb26caf4bdb024e0a5a40"},{"path":"product/runtime/auths-gateway/src/app.rs","sha256":"6f80f63833ea0815bb44fbf3b0cc54624a08e9fb578b035819f2980dc04e8256"},{"path":"product/runtime/auths-gateway/src/audit.rs","sha256":"0edb2037eb7b5d6f13acfce85c54f62a82bf7fdd31bc7e626c4fec183cef61dd"},{"path":"product/runtime/auths-gateway/src/audit_tests.rs","sha256":"990969384a52d75bc2489d9d412a9e7dd814bca1c8f65c701d6205fae62a15d5"},{"path":"product/runtime/auths-gateway/src/bin/auths-gateway-harness.rs","sha256":"12b0c24d36b2e6a3be392d3c081a783b355fdd67dc5b54bacc0410e803116b8c"},{"path":"product/runtime/auths-gateway/src/bin/auths-gateway.rs","sha256":"3dba485deeb4d60f3f5603ad4ce9a0edf49a85c68c5c4ca072df73d2910da832"},{"path":"product/runtime/auths-gateway/src/binding.rs","sha256":"663b0ce878319511aa7d05722ab4ab2fa9be18817884ffb2ee9f131ff1e382d1"},{"path":"product/runtime/auths-gateway/src/bounds.rs","sha256":"38251ad6f22f9d07ef9a219c79fa265ca36f1526eca5f147d7efa46b52ad609d"},{"path":"product/runtime/auths-gateway/src/bounds_aggregate_tests.rs","sha256":"ab34f227b7c8692ba1da88ccb32bb3687a66adf8353d8282fae905d4a88eb612"},{"path":"product/runtime/auths-gateway/src/bounds_tests.rs","sha256":"74136bc570da7b9338b5a1a1ed9d3fd892c55135160964f9d3ac0e2cf5741375"},{"path":"product/runtime/auths-gateway/src/commissioning_budget.rs","sha256":"fab29da3269438cc62330f3eab7b5bd4dc482b4db8af243aae47df5d3aa1deb8"},{"path":"product/runtime/auths-gateway/src/commissioning_budget/tests.rs","sha256":"da104a1643c37515deec6397bca6db2054f2c9158ec3d230a1b1ec9c7d0f659f"},{"path":"product/runtime/auths-gateway/src/commissioning_floor.rs","sha256":"7fa6991c5ccd5ae1403be84b3da390323fab09f36e15ac01fd7a38ea350c6fdb"},{"path":"product/runtime/auths-gateway/src/commissioning_floor/tests.rs","sha256":"6b663d6e556adc0b455b81845bc4394d82c6c4de0c5f43e1310f3ddc6e4e40f7"},{"path":"product/runtime/auths-gateway/src/commissioning_session.rs","sha256":"24b48d5eaeaaa3c620e2dfc7ee1f9255fc4519a1eb404b8608cea7af6a910ee2"},{"path":"product/runtime/auths-gateway/src/commissioning_session/tests.rs","sha256":"37a097fc8a9261d3fffdaef3f905f40b22e3e6601bb5101fadd9414f963c0824"},{"path":"product/runtime/auths-gateway/src/connection.rs","sha256":"e8d24277d7e4a53610e091fe78b373b841245d8e59a2bc788716b76e7d912441"},{"path":"product/runtime/auths-gateway/src/credential_journal.rs","sha256":"7297fccaee5cd8622928e8e0a42bba50da7941970a6f682ecd300c41ee6509da"},{"path":"product/runtime/auths-gateway/src/echo_verify.rs","sha256":"6d453051665f823abd7354d5c50031d9524cf47d6092d2f09080ae814e3b9575"},{"path":"product/runtime/auths-gateway/src/engine.rs","sha256":"692ff372ffab10f27fcc45b7aa28457ca3fd6f9ca0ca06212f20f34c4431b491"},{"path":"product/runtime/auths-gateway/src/execution_witness.rs","sha256":"e8b1a8e41d5e3fa309760067849d390ef065feeb46701a83391832645a2f000c"},{"path":"product/runtime/auths-gateway/src/fuzzing.rs","sha256":"ed3b0028487eb546a3b0a91d115aa8f18bcea324b61620bfe8e35a9e6ab18758"},{"path":"product/runtime/auths-gateway/src/generation_floor.rs","sha256":"fe1510ec96ce0f67e9a78edbfa94b33eb7df64c0ac4d0a67901124dcd0164777"},{"path":"product/runtime/auths-gateway/src/harness.rs","sha256":"c87e479f3eb281960f6c9c80d43c7560d7ccb654b0154ec823d3fcec4884ac05"},{"path":"product/runtime/auths-gateway/src/lib.rs","sha256":"fad95d031f88072dd024c78facf0bb0267562b1ac743ddd7219fce47e64024f0"},{"path":"product/runtime/auths-gateway/src/listener.rs","sha256":"aa08239bcbc1fcb55e8a212fbdf6a84f12985b0d436dcb51dc58b06e59e435f2"},{"path":"product/runtime/auths-gateway/src/observed_tests.rs","sha256":"a22be071695f89ca2578a4d82fd80d9cb82289213c9bdb8f0470f6b2dc3d9201"},{"path":"product/runtime/auths-gateway/src/observer.rs","sha256":"562ffcaea071c3856e0708dc2fe33516917e145d2438aabb75af0a2b6ba01046"},{"path":"product/runtime/auths-gateway/src/onboarding.rs","sha256":"0dfd7d67e7f02f18a28d1c86ca1b7751d7463f5efcdbe3825de0ad8cbccb3891"},{"path":"product/runtime/auths-gateway/src/operator.rs","sha256":"c3c36954a3e86723df035b47f43b85fc8ab3a6292983522b6258d5c6b4e6c4e4"},{"path":"product/runtime/auths-gateway/src/pending_vectors/attempts.rs","sha256":"47ef3c8cb1c5504d47ae9a0088705ce6715fe86bac1671a34a56fb38a64d0dd3"},{"path":"product/runtime/auths-gateway/src/pending_vectors/bounds.rs","sha256":"e612217307e1da5b0eb5ee6582a7458bb064b8aa8a529fc6555b1b334127ab68"},{"path":"product/runtime/auths-gateway/src/pending_vectors/codes.rs","sha256":"e00670a5ef24eb856cc2c6dcda8e5a263842f55c76bb939c0c27bd9df37e5522"},{"path":"product/runtime/auths-gateway/src/pending_vectors/keys.rs","sha256":"f84c56f2ea9cb34b2b79c72d13fbf2c6585010ec1ed450af58a78c80c1ea1edd"},{"path":"product/runtime/auths-gateway/src/pending_vectors/mod.rs","sha256":"5de8340f0ef71a0b57a09e323fefe473d3160c6ae952b9ba46f714825fbacafc"},{"path":"product/runtime/auths-gateway/src/pending_vectors/outcomes.rs","sha256":"8ec07b9511b48913af36ac999d2aa0e82924289f6acb23ddaeb9f00f99815166"},{"path":"product/runtime/auths-gateway/src/pending_vectors/production.rs","sha256":"772d032e0a0d9c924fb6d6c188528db85a97e71c9e466ddc19eee277baf83614"},{"path":"product/runtime/auths-gateway/src/pending_vectors/recipes.rs","sha256":"51693208270231c25c3aef2a32151d5962114c71e86b88cb9df83181c7af83d9"},{"path":"product/runtime/auths-gateway/src/pre_entry.rs","sha256":"06ea78ca140468bfaba17d9ab04912ad68673954c3203c98fed28272ff2a00c0"},{"path":"product/runtime/auths-gateway/src/property_tests.rs","sha256":"939c081e2e154aaf10186754044bdd65608932c899b970a04a71d0afaa999a93"},{"path":"product/runtime/auths-gateway/src/qualification.rs","sha256":"c597c83de2b94f0374ae54e40a8b57c2a64ec6e254704dca32185f448a908aca"},{"path":"product/runtime/auths-gateway/src/qualification_simulation.rs","sha256":"4ee7cadfb5f46a92713c80f3e55f499cb074d04d8b21ea89d57762af38642bfa"},{"path":"product/runtime/auths-gateway/src/qualification_tests.rs","sha256":"a9178a2e58eea459d5e5dafc53a3999ea7c84dbbffefe6e5eb1f3d098827f028"},{"path":"product/runtime/auths-gateway/src/quorum_tests.rs","sha256":"a78380b019104d688c11a4410082c7e08ded3106aab099954c4f8a1b4ae0fd89"},{"path":"product/runtime/auths-gateway/src/readiness.rs","sha256":"911c3f11892f94641574375e2da4c671c802738f71082f12c39832331052d43d"},{"path":"product/runtime/auths-gateway/src/recipe.rs","sha256":"fecf9af67e7afc48d080e9f8f55f8ce28e49d0e08988717a27908bbda461d6b6"},{"path":"product/runtime/auths-gateway/src/recipe/lower.rs","sha256":"8088b8751ed831dbb48247af953c6290ac95e2a438ccd5bd65eff54be06a1fd1"},{"path":"product/runtime/auths-gateway/src/recipe/review.rs","sha256":"c3eb7d9fdd98dacf52750b14b67ad7b7faaecbbdeafff1e0b049f67d0a2d0139"},{"path":"product/runtime/auths-gateway/src/recipe/runtime.rs","sha256":"c286f0d15f974402822c0810d8e97f98411dc1c557755cc23e540d85e2bb42d9"},{"path":"product/runtime/auths-gateway/src/recipe/source.rs","sha256":"1af50298fb1461e1b24cbdf560d43124d6b1c4c529586c911b1c4797214a69ff"},{"path":"product/runtime/auths-gateway/src/recipe/tests.rs","sha256":"aac551a2481bbc60864c64079bc667dcb232e45a0f41a04073ed84ab5dbe1fce"},{"path":"product/runtime/auths-gateway/src/recipe/validate.rs","sha256":"3711b17605cb7b0d639bc1b180449231f5882a306cab20e2c7782155cc63b0d4"},{"path":"product/runtime/auths-gateway/src/scenario_tests.rs","sha256":"025b53473b3af6900e03bc2fee91aa63ed26a8778bc8c8296fe08f5540794c39"},{"path":"product/runtime/auths-gateway/src/separation.rs","sha256":"be9306848ca5d801767cf6aa14247c8618312ef0e202f00ce0c24c4844491061"},{"path":"product/runtime/auths-gateway/src/simulation_attestation.rs","sha256":"88705e5d45415f760f1e3c3a065c35c48f4f4065bf7b3feb7882246983814d6f"},{"path":"product/runtime/auths-gateway/src/store.rs","sha256":"884bcad4d70d53e12eae9c8517f6ecd0643068ee0be0370015119d04d6cc2516"},{"path":"product/runtime/auths-gateway/src/store_testkit.rs","sha256":"88d82fee42f1b8ef521e8deef0216e938ebeaad822eb2f5020e70b89d145ea70"},{"path":"product/runtime/auths-gateway/src/submit.rs","sha256":"fe2eacb5ad8152eeecbd232c47a356fc72db0098e34fda99532bdf6ef0cf895c"},{"path":"product/runtime/auths-gateway/src/support.rs","sha256":"9fd979029793a22b15d9776a7fc172476fd7c126a80d4080c65d720845becbcb"},{"path":"product/runtime/auths-gateway/src/transport.rs","sha256":"978fc9fb34a33b3db265b5d1c3ce11696a5b9f08529e46dd2a1e7bb62afb9220"},{"path":"product/runtime/auths-kernel-runtime/Cargo.toml","sha256":"926bcd0053e5edd703be8f0027ad009e2982db013c8174c1366edbf38b48087d"},{"path":"product/runtime/auths-kernel-runtime/src/lib.rs","sha256":"7108faae9ca4bc32dc093ddaf885ac8f74f3c9b8d317b7c7d0ed00d1d0ab5972"},{"path":"product/runtime/auths-lifecycle/Cargo.toml","sha256":"c5053c705f8d5554b44e432fe75287a2faf11d644e5a2552e45ad6cd94176af5"},{"path":"product/runtime/auths-lifecycle/src/codec.rs","sha256":"51c4b746749150e8bfcd8ff972b3f6c1ef40bec15583448ec1b471d9ad737dc0"},{"path":"product/runtime/auths-lifecycle/src/digest.rs","sha256":"55282cd7d8aba37713c2dcb5357c9877819edb72a30eadefb860d28d7d3a3eb7"},{"path":"product/runtime/auths-lifecycle/src/identifier.rs","sha256":"31620e8c16de68d3d2d3b84d6353c1a5b9d4151d8247f91fa389b906a8e660f1"},{"path":"product/runtime/auths-lifecycle/src/kernel.rs","sha256":"2abb8c094b36d35b364e74d78091d14c5d6f3d1eb6552cca3b5538dbd017ce23"},{"path":"product/runtime/auths-lifecycle/src/lib.rs","sha256":"afe5a345cd309b5a4f08ffba3170a6d7f16ff914892b3f2006d5208ed24ec736"},{"path":"product/runtime/auths-lifecycle/src/model.rs","sha256":"1af12bbeeeaa65ec02ddcebd7d2c8c92ec1e339fa40ae85b45ab9b01a722a4fa"},{"path":"product/runtime/auths-lifecycle/src/operation.rs","sha256":"78e6d05fcf5d7ea4f148032a3fa26fdfcab77eb346019effe927b08e0d64d732"},{"path":"product/runtime/auths-lifecycle/src/registry.rs","sha256":"53495fe6f7a77422593a41623e28716f1c140dcc1e00f87f6b0ffbfb93a5ef90"},{"path":"product/runtime/auths-lifecycle/src/sealed.rs","sha256":"2e0c03b5813c926c159598bb7890d1523825edbe57cd687d42a5dfb3374a0c19"},{"path":"product/runtime/auths-lifecycle/src/test_support.rs","sha256":"221d9a5c5ef8e1f9f8fd66927484eaf813571d0568470278ecd8fa08a5eec8cd"},{"path":"product/runtime/auths-lifecycle/src/transition.rs","sha256":"011805a28efdd541f44ccea54dd0e34a1e58f4004447ee58013703b4fb6b2822"},{"path":"product/runtime/auths-runtime/Cargo.toml","sha256":"dd29d80a8b4bb56c869f036a6c9998f6e6d1c0383ac5dc03fa42b24abe2a7ff7"},{"path":"product/runtime/auths-runtime/src/lib.rs","sha256":"132ca03d58c14905d3a822a4972f42a22a5ad33a45f2ba9ca44f3a57d810b4b0"},{"path":"product/runtime/auths-runtime/src/production.rs","sha256":"fd4eff4270c571c10fcff6cf27df28961ebf074de8a1a028f500fda1ca376820"},{"path":"product/sdk/auths-approval-quorum/Cargo.toml","sha256":"df904971fca87a24194c5816738a331588fe8f164acb5d70839a35dca5f57114"},{"path":"product/sdk/auths-approval-quorum/src/lib.rs","sha256":"72e4086088a1c0912e4e1a9e980f26a5c280bf5ab16ea39c9f0f58d5096ac2ce"},{"path":"product/sdk/auths-approval-quorum/src/remote.rs","sha256":"9fa029c7c63003adf260f8aec55160c545681c60c1bace0d934e7525862aac7b"},{"path":"product/sdk/auths-approval-quorum/src/remote_tests.rs","sha256":"8a09ce17cfee82a035a74edd535f3ebeb3db0e078784740d3997b17dbdb10197"},{"path":"product/sdk/auths-approval-quorum/src/tests.rs","sha256":"0acbf12be3e497dcc6c2d8f29c9af3b1a7ed8e11b75f6399570d4f217a785060"},{"path":"product/stores/auths-stores/Cargo.toml","sha256":"a32c4b76d17b264be5d40d24497ff237e1ed87822e8bab86229b3db93106dbe3"},{"path":"product/stores/auths-stores/src/gateway_attempt.rs","sha256":"218841602d3d9b23b44625f50e5b54cf275ccedc2d5c89f02d2482b8524472af"},{"path":"product/stores/auths-stores/src/lib.rs","sha256":"e721262edf8a9ab5568ddc27639176312d4a366203b5f73e2d7c11fde2c554e9"},{"path":"product/stores/auths-stores/src/lifecycle.rs","sha256":"3f2cecfda13fdcd7c4a944518646bcc8abd1237f900c0332d5822281f8f9f1cd"}],"schema":"auths.gateway-semantic-closure/1"} \ No newline at end of file +{"files":[{"path":"Cargo.lock","sha256":"5f4f5b3586760f84273b882fbcdc7e0eca1df0d70973dedf0ff046f8b7393cd3"},{"path":"Cargo.toml","sha256":"2cc6fc79bfa459cedad6237ed79064dfd13683232940d63d5778a2e994fbb30d"},{"path":"core/adapters/auths-did-keri/Cargo.toml","sha256":"86ba3e3f9a0a70d970568bfb3113b7ba7bbdd81c3eebbb52743dd574a0c0ecaa"},{"path":"core/adapters/auths-did-keri/src/lib.rs","sha256":"a75674842f8a7142004369ccd206ab43e476459293f0ff4bed4d4e659031b3e3"},{"path":"core/adapters/auths-did-key/Cargo.toml","sha256":"d5a3ae07ecde83f91eed4c3785051dd0f44eab6c891754f3309b6b40596707d7"},{"path":"core/adapters/auths-did-key/src/lib.rs","sha256":"b76a3f4528a725df53cfa9242e6e414e1d26caa48468aaed497e28b121f4497c"},{"path":"core/adapters/auths-raw-key/Cargo.toml","sha256":"f49616bc18c19e6aaa7e6a02ccebcdb9f5c1422c1278ef9869e0dbf22ceda7be"},{"path":"core/adapters/auths-raw-key/src/lib.rs","sha256":"45eec1b295dac3bed65cd79c942870b926b06b3f5d38eaebaeb6140ac69315fa"},{"path":"core/crates/auths-algebra-kernel/Cargo.toml","sha256":"0cb078915287b8c47d20fb97b6fa14135ed1c61c4985c4de2753855563c27bba"},{"path":"core/crates/auths-algebra-kernel/src/generated.rs","sha256":"ae4bcbef42a408c7ffa0c6a74a42f7de177a6f14479e51d205acf830bda05960"},{"path":"core/crates/auths-algebra-kernel/src/lib.rs","sha256":"6654667eeb9b353d6648954c9fd2e8838462a82ce6b2803eb49e1366892c68c6"},{"path":"core/crates/auths-assurance/Cargo.toml","sha256":"afcb12a97ddd09d7a264b9ecd3fcaefc865ff2c9b4539ee85b00883420ba333a"},{"path":"core/crates/auths-assurance/src/lib.rs","sha256":"0fb2ec844d674b25a9e20b1601452c89c2454901fa506adfa9bb38ef9a7fa213"},{"path":"core/crates/auths-author/Cargo.toml","sha256":"1e6f0e3bc079ddb558decf0db26b291c6e72fc47327b6df1b7650d41689b215f"},{"path":"core/crates/auths-author/src/lib.rs","sha256":"e14475f2f49715a1869d5fa6b11ff1fbb72497e39097e09f833b0bae7e5b3f2b"},{"path":"core/crates/auths-author/src/observations.rs","sha256":"dda7d6bfa6f4bd7e95a480ca283c2c0e996f69c5c15cb0c7197af328131a7066"},{"path":"core/crates/auths-authority/Cargo.toml","sha256":"4f68212938029f79ebd857b4f3038494eb85d0163d49f07e51376715cf959815"},{"path":"core/crates/auths-authority/src/lib.rs","sha256":"da88d5194de4e17449e69972c0fb042afa3c39798a8f570f30771e77c384f1eb"},{"path":"core/crates/auths-codec/Cargo.toml","sha256":"b164e44179704bcb76d32f7e25281ed17f738e434290997e979739ebe49b4f77"},{"path":"core/crates/auths-codec/src/approval.rs","sha256":"eb0a867ab26c151f9f947090dd81b5802541e818104ac2b363634e2c8f568005"},{"path":"core/crates/auths-codec/src/bounded_policy.rs","sha256":"5c84447f057e2bf356323c6d83cab4daf64fcce221051a0863350f414ad0fb85"},{"path":"core/crates/auths-codec/src/cbor.rs","sha256":"03f43d462fe39a45c7ad5ef487376ce109ae359b7874ec2b0200601ad0563361"},{"path":"core/crates/auths-codec/src/decode.rs","sha256":"41b1e08a76ba4fc841c80f81994e78a23f4692eab9262604080c36bb8d1be3bd"},{"path":"core/crates/auths-codec/src/encode.rs","sha256":"163dcb12f640eb63fbdb872e75bab1ee9e01571797cdf3a10b77cfd0b02a0c0b"},{"path":"core/crates/auths-codec/src/error.rs","sha256":"80c1e7fdd190a0d050c69fbcde9836a4702d9b98e8effd76bc659c3d75ea8175"},{"path":"core/crates/auths-codec/src/hash.rs","sha256":"db5e7773c8c1f6193c2494c95e3575d712c573e737ceb16b547f0f105efe1236"},{"path":"core/crates/auths-codec/src/lib.rs","sha256":"09688b7ffb9527cd89e3182ca556b2cbb0fb0c924d7e1e9889686b81b2bdf601"},{"path":"core/crates/auths-codec/src/observation.rs","sha256":"fb2d1151558b144a9d10dbc9a028c48f19c96344e396d0c292ff59be473b2149"},{"path":"core/crates/auths-codec/src/scope_decode_tests.rs","sha256":"61720a13ba4e2fefabcc492778348aaca5b3052e2570302de5ebc92efce12ab5"},{"path":"core/crates/auths-composition/Cargo.toml","sha256":"331e13025eb82588b5269ed3975929eb41c823d588c49e4c296273d85c6fe80e"},{"path":"core/crates/auths-composition/src/lib.rs","sha256":"e8a0f96ae904d831042f2284c5b8a7a8c9ccb030b4d6ac4b9912229039d4f535"},{"path":"core/crates/auths-composition/src/oracle.rs","sha256":"423c08f866797759fce7daeeb6316f15da870052a915504cbbd8954498cf942a"},{"path":"core/crates/auths-composition/src/summary.rs","sha256":"57ddc0376ae1182f73105147aa068d5b1e411444658f8da4ade56a5d0d4b4c6d"},{"path":"core/crates/auths-model/Cargo.toml","sha256":"565c15302b0cc9270db1e28efa3862804846850ba933cc17aea8abcec4a65987"},{"path":"core/crates/auths-model/src/approval.rs","sha256":"54cf44a9ef747ec21546a4086aecfb130bc7803b0d646430e6082df51e6e305f"},{"path":"core/crates/auths-model/src/bounded.rs","sha256":"f90496abc0a06c028b4d850af6ddab7d850bfafeaa3d042f1b1246a41d8bbbc9"},{"path":"core/crates/auths-model/src/bounded_policy.rs","sha256":"306a8f049cc7cfc7635fe0e4de47eb7813eed63d3c14c3be2b51586aa4eea450"},{"path":"core/crates/auths-model/src/identifier.rs","sha256":"fcfb49e42682de6358980e4d86ca7763bba6a9a04967a4a6022b9ca8157103de"},{"path":"core/crates/auths-model/src/lib.rs","sha256":"238d198437a9f4cc1ad180181d4409809071e8e92e1cc056c3b4431738ed4168"},{"path":"core/crates/auths-model/src/observation.rs","sha256":"0f0a8a4bd942867f168c0e411a8bca5d7f57e94065beaebe919b26b08ddd2108"},{"path":"core/crates/auths-model/src/principal_scheme_tests.rs","sha256":"d64588a32503cd70b954c21f8582e46a20292ec918ea8e3f7278c0b99c1528c9"},{"path":"core/crates/auths-model/src/scope_constructor_tests.rs","sha256":"a107fce37f38b5db2d9ae5c5585b49f011f88a5120c6a72c5a141da49f698c82"},{"path":"core/crates/auths-multikey/Cargo.toml","sha256":"858756c1197befcada06134742bffe8d58cf674cadd6c046bf710570e96efaf2"},{"path":"core/crates/auths-multikey/src/lib.rs","sha256":"f5177fffb11e40eeaaa665ba886c541fc1f24d5eacdd6983fb03dc20148733f0"},{"path":"core/crates/auths-ports/Cargo.toml","sha256":"596a9b0f5af3717c16a6d13f7054d8a106bcd9f01f5f72c2235dd2afcf0ab16c"},{"path":"core/crates/auths-ports/src/binding.rs","sha256":"a16c012d40aa4249e3ec54372b9611006d0bfe8c7dc3c741911c2194ad17736d"},{"path":"core/crates/auths-ports/src/diagnostics.rs","sha256":"aa596572503b5a65a918bb2ff38281c144ff53821ee914e9325c852828d852df"},{"path":"core/crates/auths-ports/src/lib.rs","sha256":"e7f7fdcb480de4d69d488af5234915542627eb2fbc987232c4b5c47363a491dc"},{"path":"core/crates/auths-ports/src/path.rs","sha256":"b68fc547b4e4d97a60cbbc1cc1939fc6b34a8233b81f840bd396914a707e3ea1"},{"path":"core/crates/auths-raw-key-core/Cargo.toml","sha256":"98c0bc8527a537512e43a74dd6ba9658c6f0cdc16610cf938e3f9b43785d836d"},{"path":"core/crates/auths-raw-key-core/src/lib.rs","sha256":"98c0500c41697aae28708ad0bf970b9a97583d96a3d2c18d23e7fa351e0f7d12"},{"path":"core/crates/auths-registries/Cargo.toml","sha256":"590e49e58b0622d9d6274fea46796dcdb07dec9550eff295cce6a6427ffa51e2"},{"path":"core/crates/auths-registries/src/lib.rs","sha256":"0e94b31ddb24d57c2d0d82f479fcc138a677b606b89c8f16a8e9dc5497afc5c5"},{"path":"core/crates/auths-registries/src/status_selection_tests.rs","sha256":"456d830b1c65db272f337e0dacc12aaaeefa99071ff3251d19b2f0417bf0a284"},{"path":"core/crates/auths-registries/src/template.rs","sha256":"1224039dd2b3ce6fa8357613d8cafbae40400493da7176da202b9ade62fa05e4"},{"path":"core/crates/auths-signature-core/Cargo.toml","sha256":"6bee2230eb30af1be0bd5c2d57bd3e1903497a70028d47290d4ac6e9e0e8bca0"},{"path":"core/crates/auths-signature-core/src/lib.rs","sha256":"d8f9465b337deabf3dedc4337223913aa637a10192d6b504281f28475a13ea11"},{"path":"core/crates/auths-signature/Cargo.toml","sha256":"7f7b5682466ba439d8c59579022cb61068cad9fb4bd2d73e1cc21327c902b450"},{"path":"core/crates/auths-signature/src/lib.rs","sha256":"b3d9ac4cc3ba0797b9e1c09f2d6ac05089b25dac4e285a5af28c0165b33d925b"},{"path":"core/crates/auths-verifier/Cargo.toml","sha256":"c43358e06a33324b41a8b93e5cc7279c55f7d21f1f6cfaa539a3fc7b4c27a38f"},{"path":"core/crates/auths-verifier/src/approval.rs","sha256":"2826a5227945a3e0ea000584f1e1c794bec3b313b13843f4284e0e716f830d33"},{"path":"core/crates/auths-verifier/src/causal.rs","sha256":"9635230f33b13a263573d319ac8a1976addbcc07677514a43e3c7bf28dc04587"},{"path":"core/crates/auths-verifier/src/lib.rs","sha256":"7d3ae3a95680018ae7d709b5fd64f1fa48ef838e3d389ee727b8087fbc4d9d50"},{"path":"core/crates/auths-verifier/src/observation.rs","sha256":"2b43ee60e1f105d33b325914ae723f91fe191675f27a9a9c04ea812c2fe27785"},{"path":"core/crates/auths-verifier/src/temporal_tests.rs","sha256":"c242d8bed72936ea7437e45ab88b98b28f0d82f9f92a6f750ef8b27fa71e8fef"},{"path":"core/crates/auths-verifier/src/trace.rs","sha256":"2213d72023a1d9e0413a2cf2c51c3dad9e04775d86033a0caaa9d29a8f0036f8"},{"path":"exchange/crates/auths-proof-exchange-model/Cargo.toml","sha256":"34b2db64f93a288e942b5a3918d28cdcbef906e0dc9074ce848018d3d5f7a1fa"},{"path":"exchange/crates/auths-proof-exchange-model/src/lib.rs","sha256":"49fac5aff2339d3a57c41cb8bb2a82852538e8f77ecc4b157c88e264ff31fb55"},{"path":"exchange/crates/auths-proof-exchange-port/Cargo.toml","sha256":"7ff660f1b7579dc570c791090aeb450404fbbf44c92781e289f5ccdde746d739"},{"path":"exchange/crates/auths-proof-exchange-port/src/lib.rs","sha256":"b408fb40c6432edc1facb3d8b3e9433a033f8dc73fe2e0ba5a88c972ca675021"},{"path":"product/config/auths-config/Cargo.toml","sha256":"e4b568ab9f6d84f7d7e6d66443fe825f360db9c27bc7c31d6ddc0647ba3ab304"},{"path":"product/config/auths-config/src/lib.rs","sha256":"fecf00ea65cef9018fda9af2063326d7065b869266d0d9e73a4f06816f1102cc"},{"path":"product/errors/auths-errors/Cargo.toml","sha256":"3b3a199b6460ba75bda84475bb5accd35e1485448a3981038db85bf4772dd350"},{"path":"product/errors/auths-errors/src/lib.rs","sha256":"7feeb9069fa4003f94f1f07c1c94619cf1c883e0dbaaf2187f04d0f742264bdd"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/Cargo.toml","sha256":"716f1f2a117d6d69d8effe9ee9057e24ba3502f20af6a602b06facb638cdabed"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/api.rs","sha256":"9ea61dd7ddd93282b073b98e453e6b75b26dc49689c04e9782435d06a3a09e48"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/clock.rs","sha256":"73f0a6e0f5903883329fa6683f5888288f759512ac69e5c87efd2b6b87f7d79f"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/http.rs","sha256":"14c1fce14e24c984b2a275563a29b6326fb08367922b6e8d37ba38b9cb81aa2b"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/identity.rs","sha256":"186de11230c8b33375951c4368609f8976bf9795f171af3fd7fac26207a94361"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/lib.rs","sha256":"0b4617d044f5254a5ab22f5a2578f91cc025206a8c1845be39c1c56dcdf7a5df"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/names.rs","sha256":"41bb23572d6002e23ee103d6fe70ecd68764861c6f2e48a1c53af998270a4afa"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/sigv4.rs","sha256":"39fed883f4802e68d3b41a68fea0aba0737810996b33d13577de70faba004c29"},{"path":"product/integrations/auths-credentials-aws-secrets-manager/src/store.rs","sha256":"fc60ee9c49b2f4f063c449b4c78100c5c4872779e94ca168f796603b380ef6e4"},{"path":"product/integrations/auths-custody/Cargo.toml","sha256":"1e14034185ad1ec24a977fd5f41d0abee219606245c046ce2a82287fadef448b"},{"path":"product/integrations/auths-custody/src/conformance.rs","sha256":"8ed1afd58f18fc6becc268908aa6419c9aa404c79da0197963eb2599df44acf6"},{"path":"product/integrations/auths-custody/src/key.rs","sha256":"70cbb0fd21b6f5652157845a22c35be2d0f6c05b3d138fc4b9bb6dbdc3d81c40"},{"path":"product/integrations/auths-custody/src/lib.rs","sha256":"8ee593c1f59b0fd2126bdda9138026f5bc531beb64d4489a99785842e7b98b43"},{"path":"product/operations/auths-operations/Cargo.toml","sha256":"73dde1e914ba5e1386f8d49c0d730423cc72ae77ec44c6554a6a75cc8e8922b1"},{"path":"product/operations/auths-operations/src/explanation.rs","sha256":"b4a39bcbd5712cb9e735ee7deeb281f3fa6af5ddca973735bf3d87dce427ef11"},{"path":"product/operations/auths-operations/src/lib.rs","sha256":"3f401a56555113b98f57bca172a2660eaecedf76247b83a3fdbb089c133a29cd"},{"path":"product/operations/auths-operations/src/render/json.rs","sha256":"2ae042639960afee123730e945d373bc5dda1d2b3af20ae16c939a7e99b9e418"},{"path":"product/operations/auths-operations/src/render/mod.rs","sha256":"b3b7f6fe473f49227ace5a68bfc3d8dc14b5db8dd9888fd9e207070337b1b8bf"},{"path":"product/operations/auths-operations/src/render/text.rs","sha256":"f216cf3bdb00e264523271b16e7059535ac6b1aabf271cebd7935af155e4bfec"},{"path":"product/policy/auths-bounded-policy/Cargo.toml","sha256":"babd5d200923137ead71d8c2528f847cea323ce98da942a1320b054436612c47"},{"path":"product/policy/auths-bounded-policy/src/arithmetic.rs","sha256":"75e43c5d4eab8d1f71c1daf53839f5f9fe45a400afc1f63a30c6f55ce3632627"},{"path":"product/policy/auths-bounded-policy/src/commitment.rs","sha256":"c5706f2d583454e1a7f570f7ada138d4d864bef0205dfae7c1296774f396bb3f"},{"path":"product/policy/auths-bounded-policy/src/eligibility.rs","sha256":"c9acdfb793074e687fc36efad506be27dbd99ffbf40387bc66c8de39ef238432"},{"path":"product/policy/auths-bounded-policy/src/identifier.rs","sha256":"0006a32bae9eb16c4178cf797df418d2b0a781f2bc6474b741dc1a908141831c"},{"path":"product/policy/auths-bounded-policy/src/kernel.rs","sha256":"00f66e91381dc53fbb5753dcb22276f41667529f584fe00770fe388b979a73f7"},{"path":"product/policy/auths-bounded-policy/src/lib.rs","sha256":"76a18638b810e62e594d6e951504679305ce21841388e0c282ad51cd7841b91c"},{"path":"product/policy/auths-bounded-policy/src/receipt.rs","sha256":"3b9eae82f349956d3e7f29b57b254bff5ce67cc703e6cf43445ce2827676d1ad"},{"path":"product/policy/auths-bounded-policy/src/registry.rs","sha256":"4e251ea5833559841f8ee0bd9b66c0c01c39fa5e3a21720a19c4e8adbfcb99d0"},{"path":"product/profiles/auths-profile-api/Cargo.toml","sha256":"7ae85761f58625b5d678f961fd052eebf3e000ef565c7312e3ac857763c0017f"},{"path":"product/profiles/auths-profile-api/src/lib.rs","sha256":"a194b82b20bf8aa864c2334ef6c6aec30b2154ded972862252d5dcefa488ab95"},{"path":"product/profiles/auths-profile-mcp/Cargo.toml","sha256":"db264fc25242f7b7e4133cbe5782545b3107b406c87168ae072683cfb59eac66"},{"path":"product/profiles/auths-profile-mcp/src/arguments.rs","sha256":"a5de696586d507e2aee4a49fee99ef1ef4c51a2e46603f8838f1af6d9009833f"},{"path":"product/profiles/auths-profile-mcp/src/lib.rs","sha256":"d0f8b733a09ef8408336cdebc8948d6a5861012ce6878598b11be7084dfd4280"},{"path":"product/profiles/auths-profile-mcp/src/session.rs","sha256":"166c281fa66333388e4760d6098dad02d3359e1d5de4b8f93312c014f97abb03"},{"path":"product/qualification/auths-recipe-qualification/Cargo.toml","sha256":"b7b15b30b9a3d96d4f089d514266d3a892de6608d30707aa44be31cca89ca9fe"},{"path":"product/qualification/auths-recipe-qualification/src/canonical.rs","sha256":"30a9b50777f0dcb4b606abfee2467d5a975d9f6ad941ab6c13ca3df5b359f667"},{"path":"product/qualification/auths-recipe-qualification/src/closure.rs","sha256":"0ad6aee9bd981e2863fa725f209ec84031db2ff12f4c7ac3aaf5120f0bb86039"},{"path":"product/qualification/auths-recipe-qualification/src/commissioning.rs","sha256":"1b106dd43a1196ef11d27fc0c45a84c1ffa0930bcf1f041dfae2e556b1603081"},{"path":"product/qualification/auths-recipe-qualification/src/commissioning/tests.rs","sha256":"4dde3736d206099b1bea4c14e0092c6c1287d1af9065958777d7c54331dd8686"},{"path":"product/qualification/auths-recipe-qualification/src/error.rs","sha256":"52d5cf720a1e4579008fdda90a3ac2c31f0b8db57985f121f65e54b4da2b7dd1"},{"path":"product/qualification/auths-recipe-qualification/src/evidence.rs","sha256":"ba45a7409d67a8af26ab811af306412014557477a101ab2a8eb0faf8f2bd4b91"},{"path":"product/qualification/auths-recipe-qualification/src/ids.rs","sha256":"e81a906d571497ab2da753e1532d4443706410e0b75fdd59a7d2d788c7aec403"},{"path":"product/qualification/auths-recipe-qualification/src/launch.rs","sha256":"805154ce931e3977f2a2a2c62909d90f7c0a22dc167bf4f1554dcf19316ffef8"},{"path":"product/qualification/auths-recipe-qualification/src/lib.rs","sha256":"0e24b0f81191df0d078c7f4d73ced784ba9472372bfcdff3c7d0e2fb1687b323"},{"path":"product/qualification/auths-recipe-qualification/src/model.rs","sha256":"3484eb0ec287b23d4682ade7b1b0f8d1335985b3fb180f06fc28716076957d5f"},{"path":"product/qualification/auths-recipe-qualification/src/release.rs","sha256":"ec478e53f70052e566aac7e15be2f9e1b1cd46837ac6990ae955fa864d311586"},{"path":"product/qualification/auths-recipe-qualification/src/vectors/mod.rs","sha256":"6b17592e0e2fdf17b6ed8f59d2bf3e2753b53f5936846f3c53f604178fcde034"},{"path":"product/qualification/auths-recipe-qualification/src/vectors/schemas.rs","sha256":"c59feec2805621f341a90f81fc005e2c12f7a70f9d264fdeacccb2be4fe1c046"},{"path":"product/qualification/auths-recipe-qualification/src/vectors/verification.rs","sha256":"bdf5746fed4d10a7f577f7878619a917d29aa8b7d522f00d9f774e53eff4c8c1"},{"path":"product/qualification/auths-recipe-qualification/src/verify.rs","sha256":"98b637af2aa07250e650c040ddb6a7c2f38d880b78271fc1f3c576493f42ba0b"},{"path":"product/receipts/auths-receipts/Cargo.toml","sha256":"6001fa1375899953aafcb07c23a6da0c8f57ea7ec08bb9c950b12a60a8cc6f0f"},{"path":"product/receipts/auths-receipts/src/disclosure.rs","sha256":"ba9ed439be0a320c8a01f5b6e9b51361c1a37e076947490d8e4a484ba6bb119c"},{"path":"product/receipts/auths-receipts/src/lib.rs","sha256":"547a57c4160256719cafb7d0ab972d9fc80b0da14fbbce4148c70c414070ff36"},{"path":"product/runtime/auths-connections/Cargo.toml","sha256":"babeb6e1dda3dfb66291713ce1e43dce5c349833d0b50ea4dccbf986030026b2"},{"path":"product/runtime/auths-connections/src/credential.rs","sha256":"82921413bb053f0f6c7931fbd4e6a86c8cc1d8c6b51debd9c2cef33a8d5b1c51"},{"path":"product/runtime/auths-connections/src/kernel.rs","sha256":"d53bf8df4e1343e8e798f0ab2d9d092059db7b266b0d1bad3ae4e6d463abce74"},{"path":"product/runtime/auths-connections/src/lib.rs","sha256":"79209249a0acba0e854d9937255ea0e30a9a6f8e1c2baad77ab83646d392de22"},{"path":"product/runtime/auths-connections/src/model.rs","sha256":"f6af1c15fc10a904eb598d30827d24ca202f52853a5a8d2af2164a5dc025959c"},{"path":"product/runtime/auths-connections/src/record_time_tests.rs","sha256":"201c61940d95f84ea4e125d672c6244f4cd1fefb414e9e583db509d2db5d175b"},{"path":"product/runtime/auths-connections/src/recovery_guard_tests.rs","sha256":"ce918bca22cd4f1d2d430951ba191e76ee5dc2b0fa145acf13da08ba52274a62"},{"path":"product/runtime/auths-connections/src/registry.rs","sha256":"e57640e003e72ad3235c567c2bb944a262bd64e673f023b62ea091094cc7e946"},{"path":"product/runtime/auths-connections/src/strict_order_tests.rs","sha256":"2aa297d2955cdaedc0abbc118ba1027c363803d4bc825091b2e1db1121dc865c"},{"path":"product/runtime/auths-connections/src/string_constructor_tests.rs","sha256":"7af0e6b75baef268c9b11ea8aa551e8e7793d26378b11455ead7dcb7f2493008"},{"path":"product/runtime/auths-gateway-kernel/Cargo.toml","sha256":"34f864e67656af4ac7e5c7a347a23f01fc8ab31365b8e23c0ef474483b14a183"},{"path":"product/runtime/auths-gateway-kernel/src/construct.rs","sha256":"ba592901a463c2cd81dc434ae62f33efeccc5e13f441a0dff65d60162a588b61"},{"path":"product/runtime/auths-gateway-kernel/src/counter_aggregation.rs","sha256":"4bc970895b118f71c074a091ede8d0c558ed43d912ae5d0aebdc03aa64a8f78c"},{"path":"product/runtime/auths-gateway-kernel/src/counter_preimages.rs","sha256":"d364f9c9955dbbda5e18dba547169a3ec61f5147153308b14eb85456bd04c175"},{"path":"product/runtime/auths-gateway-kernel/src/deadline.rs","sha256":"25c96a7ef2427f54930e90cf739e6149dc21de9454f5d6d20984f0d5735cca19"},{"path":"product/runtime/auths-gateway-kernel/src/entry_authorization.rs","sha256":"4ee6c6a014bfc246f34fbcbc65c020b3329377ac2cd262481060c480efede129"},{"path":"product/runtime/auths-gateway-kernel/src/frontier.rs","sha256":"09650383952c76180295ab471b4f9344e0714071c0f72ecd7d0e8081b447519d"},{"path":"product/runtime/auths-gateway-kernel/src/identity.rs","sha256":"38b6226778fee35abe163a20be35fe7099de7ebc1a24f94f8ee2c27132ed2c36"},{"path":"product/runtime/auths-gateway-kernel/src/lib.rs","sha256":"2707427b76ae35c7c44921433506dab1bad1306e2c59360756bf18e9c8d85aae"},{"path":"product/runtime/auths-gateway-kernel/src/order.rs","sha256":"e0045f877c4b7fe3860c291039853885064ddcdebba7c9b345ab65e81e646dda"},{"path":"product/runtime/auths-gateway-kernel/src/outcome.rs","sha256":"e9785b1afe70788c89b51b18655bcd5acff7b0c8e3d12fb79c6f05a202e67e6b"},{"path":"product/runtime/auths-gateway-kernel/src/ratio.rs","sha256":"7ace22264812e6fc1ef3a62afee402cf43494bb71ae0d3de219ad1b39d690bcb"},{"path":"product/runtime/auths-gateway-kernel/src/recovery.rs","sha256":"9f46dcd1685ab6e4d1ba04a3fc286a9f3afee8fb47829be1fbc670a7926a2dc6"},{"path":"product/runtime/auths-gateway-kernel/src/reservation_batch.rs","sha256":"25770ea6be3dddf1d771ed4650c9678323795b82479d761ff6bfbf57b875c67e"},{"path":"product/runtime/auths-gateway-kernel/src/reservation_retry.rs","sha256":"0feb8731a31b55bfcb4dececc6b79b76b2966e1bc8b4cb84ca4bca71eb75a319"},{"path":"product/runtime/auths-gateway-kernel/src/slot_record.rs","sha256":"da9b30cec8d728282e7eefb6f5dee1606b27902fd19d204792c2d5ebb5c8b33a"},{"path":"product/runtime/auths-gateway-kernel/src/transition.rs","sha256":"cefb8f01d915880f6921f2501ff881ad94b9de61072c34d9cd19220992f97374"},{"path":"product/runtime/auths-gateway/Cargo.toml","sha256":"00b28be86921dcdc0ad90cce0c62c2961cafefe96ea6c2edf0e926c3d405ccad"},{"path":"product/runtime/auths-gateway/src/admin.rs","sha256":"0dee40a9fb67c5de10142fc37a7bbabdd8979fb0199fb26caf4bdb024e0a5a40"},{"path":"product/runtime/auths-gateway/src/app.rs","sha256":"6f80f63833ea0815bb44fbf3b0cc54624a08e9fb578b035819f2980dc04e8256"},{"path":"product/runtime/auths-gateway/src/audit.rs","sha256":"0edb2037eb7b5d6f13acfce85c54f62a82bf7fdd31bc7e626c4fec183cef61dd"},{"path":"product/runtime/auths-gateway/src/audit_tests.rs","sha256":"990969384a52d75bc2489d9d412a9e7dd814bca1c8f65c701d6205fae62a15d5"},{"path":"product/runtime/auths-gateway/src/bin/auths-gateway-harness.rs","sha256":"12b0c24d36b2e6a3be392d3c081a783b355fdd67dc5b54bacc0410e803116b8c"},{"path":"product/runtime/auths-gateway/src/bin/auths-gateway.rs","sha256":"3dba485deeb4d60f3f5603ad4ce9a0edf49a85c68c5c4ca072df73d2910da832"},{"path":"product/runtime/auths-gateway/src/binding.rs","sha256":"663b0ce878319511aa7d05722ab4ab2fa9be18817884ffb2ee9f131ff1e382d1"},{"path":"product/runtime/auths-gateway/src/bounds.rs","sha256":"c5f35c5abae551697b18443cb2ce9b04798adc32741efb0d71e1c0ba9731cb42"},{"path":"product/runtime/auths-gateway/src/bounds_aggregate_tests.rs","sha256":"ab34f227b7c8692ba1da88ccb32bb3687a66adf8353d8282fae905d4a88eb612"},{"path":"product/runtime/auths-gateway/src/bounds_tests.rs","sha256":"74136bc570da7b9338b5a1a1ed9d3fd892c55135160964f9d3ac0e2cf5741375"},{"path":"product/runtime/auths-gateway/src/commissioning_budget.rs","sha256":"7dae7dab1fe16d99c274a9f31a4e4b8a6b69f01baa33649fb0235b7b2e5a3686"},{"path":"product/runtime/auths-gateway/src/commissioning_budget/tests.rs","sha256":"da104a1643c37515deec6397bca6db2054f2c9158ec3d230a1b1ec9c7d0f659f"},{"path":"product/runtime/auths-gateway/src/commissioning_floor.rs","sha256":"7fa6991c5ccd5ae1403be84b3da390323fab09f36e15ac01fd7a38ea350c6fdb"},{"path":"product/runtime/auths-gateway/src/commissioning_floor/tests.rs","sha256":"6b663d6e556adc0b455b81845bc4394d82c6c4de0c5f43e1310f3ddc6e4e40f7"},{"path":"product/runtime/auths-gateway/src/commissioning_session.rs","sha256":"e71331892e226da3b8ed1bb66274dbc8a8f7ffc065ade329f38e578d71b878bd"},{"path":"product/runtime/auths-gateway/src/commissioning_session/tests.rs","sha256":"37a097fc8a9261d3fffdaef3f905f40b22e3e6601bb5101fadd9414f963c0824"},{"path":"product/runtime/auths-gateway/src/connection.rs","sha256":"3ea2c7f6b233e395a2ec0463f526a1b01de3a29c6790c2eca36f8ffc95470400"},{"path":"product/runtime/auths-gateway/src/credential_journal.rs","sha256":"7297fccaee5cd8622928e8e0a42bba50da7941970a6f682ecd300c41ee6509da"},{"path":"product/runtime/auths-gateway/src/echo_verify.rs","sha256":"6d453051665f823abd7354d5c50031d9524cf47d6092d2f09080ae814e3b9575"},{"path":"product/runtime/auths-gateway/src/engine.rs","sha256":"548744767d26a73244412bdbd2c18bf5162ac3193b28550bf72fd73299b00c52"},{"path":"product/runtime/auths-gateway/src/execution_witness.rs","sha256":"e8b1a8e41d5e3fa309760067849d390ef065feeb46701a83391832645a2f000c"},{"path":"product/runtime/auths-gateway/src/fuzzing.rs","sha256":"ed3b0028487eb546a3b0a91d115aa8f18bcea324b61620bfe8e35a9e6ab18758"},{"path":"product/runtime/auths-gateway/src/generation_floor.rs","sha256":"fe1510ec96ce0f67e9a78edbfa94b33eb7df64c0ac4d0a67901124dcd0164777"},{"path":"product/runtime/auths-gateway/src/harness.rs","sha256":"625f25efcf80ea5e5083cc40dcbc137949d27a65574deb3aab63e5ea8c6d3da8"},{"path":"product/runtime/auths-gateway/src/lib.rs","sha256":"fad95d031f88072dd024c78facf0bb0267562b1ac743ddd7219fce47e64024f0"},{"path":"product/runtime/auths-gateway/src/listener.rs","sha256":"aa08239bcbc1fcb55e8a212fbdf6a84f12985b0d436dcb51dc58b06e59e435f2"},{"path":"product/runtime/auths-gateway/src/observed_tests.rs","sha256":"a22be071695f89ca2578a4d82fd80d9cb82289213c9bdb8f0470f6b2dc3d9201"},{"path":"product/runtime/auths-gateway/src/observer.rs","sha256":"562ffcaea071c3856e0708dc2fe33516917e145d2438aabb75af0a2b6ba01046"},{"path":"product/runtime/auths-gateway/src/onboarding.rs","sha256":"0dfd7d67e7f02f18a28d1c86ca1b7751d7463f5efcdbe3825de0ad8cbccb3891"},{"path":"product/runtime/auths-gateway/src/operator.rs","sha256":"c3c36954a3e86723df035b47f43b85fc8ab3a6292983522b6258d5c6b4e6c4e4"},{"path":"product/runtime/auths-gateway/src/pending_vectors/attempts.rs","sha256":"47ef3c8cb1c5504d47ae9a0088705ce6715fe86bac1671a34a56fb38a64d0dd3"},{"path":"product/runtime/auths-gateway/src/pending_vectors/bounds.rs","sha256":"e612217307e1da5b0eb5ee6582a7458bb064b8aa8a529fc6555b1b334127ab68"},{"path":"product/runtime/auths-gateway/src/pending_vectors/codes.rs","sha256":"e00670a5ef24eb856cc2c6dcda8e5a263842f55c76bb939c0c27bd9df37e5522"},{"path":"product/runtime/auths-gateway/src/pending_vectors/keys.rs","sha256":"f84c56f2ea9cb34b2b79c72d13fbf2c6585010ec1ed450af58a78c80c1ea1edd"},{"path":"product/runtime/auths-gateway/src/pending_vectors/mod.rs","sha256":"5de8340f0ef71a0b57a09e323fefe473d3160c6ae952b9ba46f714825fbacafc"},{"path":"product/runtime/auths-gateway/src/pending_vectors/outcomes.rs","sha256":"8ec07b9511b48913af36ac999d2aa0e82924289f6acb23ddaeb9f00f99815166"},{"path":"product/runtime/auths-gateway/src/pending_vectors/production.rs","sha256":"772d032e0a0d9c924fb6d6c188528db85a97e71c9e466ddc19eee277baf83614"},{"path":"product/runtime/auths-gateway/src/pending_vectors/recipes.rs","sha256":"51693208270231c25c3aef2a32151d5962114c71e86b88cb9df83181c7af83d9"},{"path":"product/runtime/auths-gateway/src/pre_entry.rs","sha256":"06ea78ca140468bfaba17d9ab04912ad68673954c3203c98fed28272ff2a00c0"},{"path":"product/runtime/auths-gateway/src/property_tests.rs","sha256":"939c081e2e154aaf10186754044bdd65608932c899b970a04a71d0afaa999a93"},{"path":"product/runtime/auths-gateway/src/qualification.rs","sha256":"9b778c970175a5ea57a04cfd8d381c45a907babf048caca77eb8465afe55e01e"},{"path":"product/runtime/auths-gateway/src/qualification_simulation.rs","sha256":"4ee7cadfb5f46a92713c80f3e55f499cb074d04d8b21ea89d57762af38642bfa"},{"path":"product/runtime/auths-gateway/src/qualification_tests.rs","sha256":"a9178a2e58eea459d5e5dafc53a3999ea7c84dbbffefe6e5eb1f3d098827f028"},{"path":"product/runtime/auths-gateway/src/quorum_tests.rs","sha256":"b454205a9ca2c553491b58442228a5bcfa18a9c932f104ef0302caccd4fe7715"},{"path":"product/runtime/auths-gateway/src/readiness.rs","sha256":"911c3f11892f94641574375e2da4c671c802738f71082f12c39832331052d43d"},{"path":"product/runtime/auths-gateway/src/recipe.rs","sha256":"fc2c6581d80f880d1052c8a6d05a5368d2467669c57ba900358d3ccf80d25f16"},{"path":"product/runtime/auths-gateway/src/recipe/lower.rs","sha256":"b7ed4742fff4ffa505b0edbe7f390ecb845b07fa5026ecdb24aa107b21ebf3a1"},{"path":"product/runtime/auths-gateway/src/recipe/review.rs","sha256":"c3eb7d9fdd98dacf52750b14b67ad7b7faaecbbdeafff1e0b049f67d0a2d0139"},{"path":"product/runtime/auths-gateway/src/recipe/runtime.rs","sha256":"c286f0d15f974402822c0810d8e97f98411dc1c557755cc23e540d85e2bb42d9"},{"path":"product/runtime/auths-gateway/src/recipe/source.rs","sha256":"1af50298fb1461e1b24cbdf560d43124d6b1c4c529586c911b1c4797214a69ff"},{"path":"product/runtime/auths-gateway/src/recipe/strict_json.rs","sha256":"59f6ab5e641d85f9429172023feed3d06566a87b700fbeee20fce79bd669ccb0"},{"path":"product/runtime/auths-gateway/src/recipe/tests.rs","sha256":"411271b06f8a53ad406aa15d7aeb3c5c437f237502034ec1e62221d843498c3f"},{"path":"product/runtime/auths-gateway/src/recipe/validate.rs","sha256":"3711b17605cb7b0d639bc1b180449231f5882a306cab20e2c7782155cc63b0d4"},{"path":"product/runtime/auths-gateway/src/scenario_tests.rs","sha256":"31ebfa05b77eb73065aee2a8f6e30d8153f59b6df184d12b1acad62f5ee8d87d"},{"path":"product/runtime/auths-gateway/src/separation.rs","sha256":"be9306848ca5d801767cf6aa14247c8618312ef0e202f00ce0c24c4844491061"},{"path":"product/runtime/auths-gateway/src/simulation_attestation.rs","sha256":"88705e5d45415f760f1e3c3a065c35c48f4f4065bf7b3feb7882246983814d6f"},{"path":"product/runtime/auths-gateway/src/store.rs","sha256":"fb1a92a02cea9b47d4b9552918ac2f58381133be0b9ed3b2117df5073e94f1ce"},{"path":"product/runtime/auths-gateway/src/store_testkit.rs","sha256":"88d82fee42f1b8ef521e8deef0216e938ebeaad822eb2f5020e70b89d145ea70"},{"path":"product/runtime/auths-gateway/src/submit.rs","sha256":"30837061c3b3dcc1d1d1ff2aa19f712eaa3bb634f74dc644a8f4a256295902ab"},{"path":"product/runtime/auths-gateway/src/support.rs","sha256":"9fd979029793a22b15d9776a7fc172476fd7c126a80d4080c65d720845becbcb"},{"path":"product/runtime/auths-gateway/src/transport.rs","sha256":"978fc9fb34a33b3db265b5d1c3ce11696a5b9f08529e46dd2a1e7bb62afb9220"},{"path":"product/runtime/auths-kernel-runtime/Cargo.toml","sha256":"926bcd0053e5edd703be8f0027ad009e2982db013c8174c1366edbf38b48087d"},{"path":"product/runtime/auths-kernel-runtime/src/lib.rs","sha256":"7108faae9ca4bc32dc093ddaf885ac8f74f3c9b8d317b7c7d0ed00d1d0ab5972"},{"path":"product/runtime/auths-lifecycle/Cargo.toml","sha256":"c5053c705f8d5554b44e432fe75287a2faf11d644e5a2552e45ad6cd94176af5"},{"path":"product/runtime/auths-lifecycle/src/codec.rs","sha256":"51c4b746749150e8bfcd8ff972b3f6c1ef40bec15583448ec1b471d9ad737dc0"},{"path":"product/runtime/auths-lifecycle/src/digest.rs","sha256":"55282cd7d8aba37713c2dcb5357c9877819edb72a30eadefb860d28d7d3a3eb7"},{"path":"product/runtime/auths-lifecycle/src/identifier.rs","sha256":"31620e8c16de68d3d2d3b84d6353c1a5b9d4151d8247f91fa389b906a8e660f1"},{"path":"product/runtime/auths-lifecycle/src/kernel.rs","sha256":"2abb8c094b36d35b364e74d78091d14c5d6f3d1eb6552cca3b5538dbd017ce23"},{"path":"product/runtime/auths-lifecycle/src/lib.rs","sha256":"afe5a345cd309b5a4f08ffba3170a6d7f16ff914892b3f2006d5208ed24ec736"},{"path":"product/runtime/auths-lifecycle/src/model.rs","sha256":"1af12bbeeeaa65ec02ddcebd7d2c8c92ec1e339fa40ae85b45ab9b01a722a4fa"},{"path":"product/runtime/auths-lifecycle/src/operation.rs","sha256":"78e6d05fcf5d7ea4f148032a3fa26fdfcab77eb346019effe927b08e0d64d732"},{"path":"product/runtime/auths-lifecycle/src/registry.rs","sha256":"53495fe6f7a77422593a41623e28716f1c140dcc1e00f87f6b0ffbfb93a5ef90"},{"path":"product/runtime/auths-lifecycle/src/sealed.rs","sha256":"2e0c03b5813c926c159598bb7890d1523825edbe57cd687d42a5dfb3374a0c19"},{"path":"product/runtime/auths-lifecycle/src/test_support.rs","sha256":"221d9a5c5ef8e1f9f8fd66927484eaf813571d0568470278ecd8fa08a5eec8cd"},{"path":"product/runtime/auths-lifecycle/src/transition.rs","sha256":"011805a28efdd541f44ccea54dd0e34a1e58f4004447ee58013703b4fb6b2822"},{"path":"product/runtime/auths-runtime/Cargo.toml","sha256":"dd29d80a8b4bb56c869f036a6c9998f6e6d1c0383ac5dc03fa42b24abe2a7ff7"},{"path":"product/runtime/auths-runtime/src/lib.rs","sha256":"132ca03d58c14905d3a822a4972f42a22a5ad33a45f2ba9ca44f3a57d810b4b0"},{"path":"product/runtime/auths-runtime/src/production.rs","sha256":"fd4eff4270c571c10fcff6cf27df28961ebf074de8a1a028f500fda1ca376820"},{"path":"product/sdk/auths-approval-quorum/Cargo.toml","sha256":"df904971fca87a24194c5816738a331588fe8f164acb5d70839a35dca5f57114"},{"path":"product/sdk/auths-approval-quorum/src/lib.rs","sha256":"72e4086088a1c0912e4e1a9e980f26a5c280bf5ab16ea39c9f0f58d5096ac2ce"},{"path":"product/sdk/auths-approval-quorum/src/remote.rs","sha256":"9fa029c7c63003adf260f8aec55160c545681c60c1bace0d934e7525862aac7b"},{"path":"product/sdk/auths-approval-quorum/src/remote_tests.rs","sha256":"8a09ce17cfee82a035a74edd535f3ebeb3db0e078784740d3997b17dbdb10197"},{"path":"product/sdk/auths-approval-quorum/src/tests.rs","sha256":"0acbf12be3e497dcc6c2d8f29c9af3b1a7ed8e11b75f6399570d4f217a785060"},{"path":"product/stores/auths-stores/Cargo.toml","sha256":"a32c4b76d17b264be5d40d24497ff237e1ed87822e8bab86229b3db93106dbe3"},{"path":"product/stores/auths-stores/src/gateway_attempt.rs","sha256":"81c5ed9dad20ef8d544299b111b496d4a2af3d234364482bc5f892de358fa0ad"},{"path":"product/stores/auths-stores/src/gateway_fence.rs","sha256":"b3286828c65b8d0d9203c1ce2381eef709b8cd1ae89b9b3f5ddcf87707f2a906"},{"path":"product/stores/auths-stores/src/lib.rs","sha256":"6cf1be4c3ea934531f920713db3b278b770cfa94c6b910e18c119bd5d70ff36a"},{"path":"product/stores/auths-stores/src/lifecycle.rs","sha256":"0ecbb634275b0e468e35bbd90f9271741b6bb582a22b03b0b08fc29cffadff9d"}],"schema":"auths.gateway-semantic-closure/1"} \ No newline at end of file diff --git a/product/runtime/auths-gateway/src/bounds.rs b/product/runtime/auths-gateway/src/bounds.rs index 2f4a4feba..a186af601 100644 --- a/product/runtime/auths-gateway/src/bounds.rs +++ b/product/runtime/auths-gateway/src/bounds.rs @@ -76,7 +76,7 @@ pub const MAX_LISTED_VALUES: usize = 16; /// Longest listed value, in bytes. pub const MAX_LISTED_VALUE_BYTES: usize = 64; /// Largest number of bounded links one authorized branch may carry. -pub const MAX_BOUNDED_LINKS: usize = 16; +pub const MAX_BOUNDED_LINKS: usize = auths_gateway_kernel::reservation_batch::MAX_COUNTERS_PER_KIND; const MAX_POLICY_BYTES: usize = auths_model::MAX_BOUNDED_POLICY_BYTES; @@ -539,22 +539,13 @@ pub(crate) struct BoundLink { /// One distinct count counter of a chain and its capacity: the smallest /// maximum count of the links whose subject it counts. -#[derive(Clone, Debug, Eq, PartialEq)] -pub(crate) struct CountCounter { - pub(crate) key: [u8; 32], - pub(crate) capacity: u64, -} +pub(crate) use auths_gateway_kernel::counter_aggregation::CounterCapacity as CountCounter; /// One distinct sum counter of a chain and its capacity: the smallest sum /// limit of the links that share it. Every action that charges it also /// charges its subject's count counter, so it holds at most `slots` slots /// in a window. -#[derive(Clone, Debug, Eq, PartialEq)] -pub(crate) struct SumCounter { - pub(crate) key: [u8; 32], - pub(crate) capacity: u64, - pub(crate) slots: u64, -} +pub(crate) use auths_gateway_kernel::counter_aggregation::SumCapacity as SumCounter; /// What admission reserves with the claim, and what the account-scope /// binding and an auditor read. @@ -589,24 +580,6 @@ pub(crate) struct SumRequirement { pub(crate) partition: Option, } -/// SHA-256 of `domain`, each component with an eight-byte big-endian length -/// prefix, then the window length and index. -fn counter_key(domain: &[u8], components: &[&[u8]], window_seconds: u64, index: u64) -> [u8; 32] { - let mut hash = Sha256::new(); - hash.update(domain); - for component in components { - hash.update( - u64::try_from(component.len()) - .unwrap_or(u64::MAX) - .to_be_bytes(), - ); - hash.update(component); - } - hash.update(window_seconds.to_be_bytes()); - hash.update(index.to_be_bytes()); - hash.finalize().into() -} - /// The count counter of `subject` in one fixed window. pub(crate) fn count_counter_key( namespace: &OperatorNamespace, @@ -614,16 +587,16 @@ pub(crate) fn count_counter_key( window_seconds: u64, index: u64, ) -> [u8; 32] { - counter_key( - b"auths.gateway-bounded-count/2\0", - &[ + Sha256::digest( + auths_gateway_kernel::counter_preimages::count_counter_preimage( namespace.as_str().as_bytes(), subject.as_str().as_bytes(), ARGUMENT_CEILING_EVALUATOR.as_bytes(), - ], - window_seconds, - index, + window_seconds, + index, + ), ) + .into() } /// The sum counter of `subject` and `partition` (empty when unpartitioned) @@ -635,35 +608,31 @@ pub(crate) fn sum_counter_key( window_seconds: u64, index: u64, ) -> [u8; 32] { - counter_key( - b"auths.gateway-bounded-sum/1\0", - &[ + Sha256::digest( + auths_gateway_kernel::counter_preimages::sum_counter_preimage( namespace.as_str().as_bytes(), subject.as_str().as_bytes(), ARGUMENT_CEILING_EVALUATOR.as_bytes(), partition.as_bytes(), - ], - window_seconds, - index, + window_seconds, + index, + ), ) + .into() } /// The key of slot `slot` of count counter `counter`. pub(crate) fn count_slot_key(counter: &[u8; 32], slot: u64) -> [u8; 32] { - slot_key(b"auths.gateway-bounded-count-slot/2\0", counter, slot) + Sha256::digest(auths_gateway_kernel::counter_preimages::count_slot_preimage(counter, slot)) + .into() } /// The key of slot `slot` of sum counter `counter`. pub(crate) fn sum_slot_key(counter: &[u8; 32], slot: u64) -> [u8; 32] { - slot_key(b"auths.gateway-bounded-sum-slot/1\0", counter, slot) -} - -fn slot_key(domain: &[u8], counter: &[u8; 32], slot: u64) -> [u8; 32] { - let mut hash = Sha256::new(); - hash.update(domain); - hash.update(counter); - hash.update(slot.to_be_bytes()); - hash.finalize().into() + Sha256::digest(auths_gateway_kernel::counter_preimages::sum_slot_preimage( + counter, slot, + )) + .into() } /// The verified text value of `argument`, or `argument-unavailable`. @@ -834,37 +803,31 @@ fn chain_counters( window_seconds: u64, index: u64, ) -> (Vec, Vec) { - let mut counts: Vec = Vec::new(); - for link in links { - let key = count_counter_key(namespace, &link.subject, window_seconds, index); - match counts.iter_mut().find(|counter| counter.key == key) { - Some(counter) => counter.capacity = counter.capacity.min(link.policy.max_count), - None => counts.push(CountCounter { - key, - capacity: link.policy.max_count, - }), - } - } - let mut sums: Vec = Vec::new(); - for (link, partition) in links.iter().zip(partitions) { - let Some(limit) = link.policy.sum_limit else { - continue; - }; - let count = count_counter_key(namespace, &link.subject, window_seconds, index); - let slots = counts - .iter() - .find(|counter| counter.key == count) - .map_or(0, |counter| counter.capacity); - let key = sum_counter_key(namespace, &link.subject, partition, window_seconds, index); - match sums.iter_mut().find(|counter| counter.key == key) { - Some(counter) => counter.capacity = counter.capacity.min(limit), - None => sums.push(SumCounter { - key, - capacity: limit, - slots, - }), - } - } + let contributions: Vec = links + .iter() + .map(|link| CountCounter { + key: count_counter_key(namespace, &link.subject, window_seconds, index), + capacity: link.policy.max_count, + }) + .collect(); + let mut counts = auths_gateway_kernel::counter_aggregation::aggregate(&contributions); + let sum_contributions: Vec = links + .iter() + .zip(partitions) + .filter_map(|(link, partition)| { + let limit = link.policy.sum_limit?; + let count = count_counter_key(namespace, &link.subject, window_seconds, index); + Some( + auths_gateway_kernel::counter_aggregation::linked_sum_contribution( + &counts, + &count, + sum_counter_key(namespace, &link.subject, partition, window_seconds, index), + limit, + ), + ) + }) + .collect(); + let mut sums = auths_gateway_kernel::counter_aggregation::aggregate_sum(&sum_contributions); counts.sort_by_key(|counter| counter.key); sums.sort_by_key(|counter| counter.key); (counts, sums) @@ -1288,3 +1251,179 @@ mod tests { assert_ne!(count_slot_key(&count, 0), count_slot_key(&count, 1)); } } + +#[cfg(test)] +mod commitment_preimage_parity { + use super::*; + + // Frozen pre-cutover incremental hashing, independent of the new byte builder. + fn previous(domain: &[u8], components: &[&[u8]], window: u64, index: u64) -> [u8; 32] { + let mut hash = Sha256::new(); + hash.update(domain); + for component in components { + hash.update( + u64::try_from(component.len()) + .unwrap_or(u64::MAX) + .to_be_bytes(), + ); + hash.update(component); + } + hash.update(window.to_be_bytes()); + hash.update(index.to_be_bytes()); + hash.finalize().into() + } + + #[test] + fn actual_counter_keys_preserve_namespace_subject_partition_and_window() { + for operator in ["operator", "stripe-receivables-test"] { + let namespace = OperatorNamespace::parse(operator).expect("namespace"); + for principal in ["raw:subject", "did:key:sample", "raw:λ"] { + let subject = PrincipalId::parse(principal).expect("principal"); + for value in [0, 1, 255, 256, u64::MAX] { + let parts = [ + operator.as_bytes(), + principal.as_bytes(), + ARGUMENT_CEILING_EVALUATOR.as_bytes(), + ]; + assert_eq!( + count_counter_key(&namespace, &subject, value, value), + previous(b"auths.gateway-bounded-count/2\0", &parts, value, value) + ); + for partition in ["", "account", "contains\0separator", "λ"] { + assert_eq!( + sum_counter_key(&namespace, &subject, partition, value, value), + previous( + b"auths.gateway-bounded-sum/1\0", + &[parts[0], parts[1], parts[2], partition.as_bytes()], + value, + value + ) + ); + } + } + } + } + } + + #[test] + fn actual_slot_keys_preserve_the_previous_incremental_hash_input() { + for counter in [[0; 32], [255; 32]] { + for slot in [0, 1, 255, 256, u64::MAX] { + let old = |domain: &[u8]| -> [u8; 32] { + let mut hash = Sha256::new(); + hash.update(domain); + hash.update(counter); + hash.update(slot.to_be_bytes()); + hash.finalize().into() + }; + assert_eq!( + count_slot_key(&counter, slot), + old(b"auths.gateway-bounded-count-slot/2\0") + ); + assert_eq!( + sum_slot_key(&counter, slot), + old(b"auths.gateway-bounded-sum-slot/1\0") + ); + } + } + } +} + +#[cfg(test)] +mod counter_aggregation_parity { + use super::*; + + fn original_chain_counters( + links: &[BoundLink], + partitions: &[String], + namespace: &OperatorNamespace, + window_seconds: u64, + index: u64, + ) -> (Vec, Vec) { + let mut counts: Vec = Vec::new(); + for link in links { + let key = count_counter_key(namespace, &link.subject, window_seconds, index); + match counts.iter_mut().find(|counter| counter.key == key) { + Some(counter) => counter.capacity = counter.capacity.min(link.policy.max_count), + None => counts.push(CountCounter { + key, + capacity: link.policy.max_count, + }), + } + } + let mut sums: Vec = Vec::new(); + for (link, partition) in links.iter().zip(partitions) { + let Some(limit) = link.policy.sum_limit else { + continue; + }; + let count = count_counter_key(namespace, &link.subject, window_seconds, index); + let slots = counts + .iter() + .find(|counter| counter.key == count) + .map_or(0, |counter| counter.capacity); + let key = sum_counter_key(namespace, &link.subject, partition, window_seconds, index); + match sums.iter_mut().find(|counter| counter.key == key) { + Some(counter) => counter.capacity = counter.capacity.min(limit), + None => sums.push(SumCounter { + key, + capacity: limit, + slots, + }), + } + } + counts.sort_by_key(|counter| counter.key); + sums.sort_by_key(|counter| counter.key); + (counts, sums) + } + + #[test] + fn actual_chain_derivation_preserves_sorted_count_sum_and_slot_results() { + let mut seed = 0x4155_5448_5343_4150u64; + for length in 0..=MAX_BOUNDED_LINKS { + for _ in 0..64 { + let mut links = Vec::new(); + let mut partitions = Vec::new(); + for _ in 0..length { + seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1); + let subject = ["agent:root", "agent:child", "agent:葉"] + [usize::try_from(seed % 3).expect("bounded subject index")]; + let mut policy = ArgumentCeilingPolicy::new("amount", 500, 60, 1 + seed % 256) + .expect("policy"); + if seed & 1 != 0 { + policy.sum_limit = Some(1 + seed % 1024); + } + links.push(BoundLink { + subject: PrincipalId::parse(subject).expect("subject"), + policy, + }); + partitions.push( + ["", "east", "west"] + [usize::try_from((seed >> 8) % 3).expect("bounded partition index")] + .to_owned(), + ); + } + for partition_count in [0, length / 2, length] { + let namespace = OperatorNamespace::parse("shared-budget").expect("namespace"); + for (window, index) in [(60, 0), (u64::MAX, u64::MAX)] { + assert_eq!( + chain_counters( + &links, + &partitions[..partition_count], + &namespace, + window, + index + ), + original_chain_counters( + &links, + &partitions[..partition_count], + &namespace, + window, + index + ) + ); + } + } + } + } + } +} diff --git a/product/runtime/auths-gateway/src/commissioning_budget.rs b/product/runtime/auths-gateway/src/commissioning_budget.rs index c36ae65a9..eac3f3e49 100644 --- a/product/runtime/auths-gateway/src/commissioning_budget.rs +++ b/product/runtime/auths-gateway/src/commissioning_budget.rs @@ -288,6 +288,7 @@ impl CommissioningBudget { { GatewayInsert::Inserted => Ok(initial), GatewayInsert::Exists { .. } => self.load(), + GatewayInsert::ClosedWindow { .. } => Err(CommissioningBudgetRefusal::Corrupt), } } diff --git a/product/runtime/auths-gateway/src/commissioning_session.rs b/product/runtime/auths-gateway/src/commissioning_session.rs index 9e0d02aa7..c1c55569f 100644 --- a/product/runtime/auths-gateway/src/commissioning_session.rs +++ b/product/runtime/auths-gateway/src/commissioning_session.rs @@ -221,6 +221,17 @@ impl CommissioningSession<'_> { Ok(action) } + pub(super) fn entry_bound( + &self, + action: &CommissionedAction, + ) -> Result { + self.check(action)?; + Ok(auths_gateway_kernel::deadline::EntryBound { + not_after: self.authority.entry_not_after(), + inclusive: false, + }) + } + pub(super) fn check(&self, action: &CommissionedAction) -> Result<(), &'static str> { let (now, trusted) = self.engine.qualification.commissioning_time(); self.authority diff --git a/product/runtime/auths-gateway/src/connection.rs b/product/runtime/auths-gateway/src/connection.rs index 15bda3cef..a32d50820 100644 --- a/product/runtime/auths-gateway/src/connection.rs +++ b/product/runtime/auths-gateway/src/connection.rs @@ -19,9 +19,6 @@ use std::num::NonZeroU64; use std::sync::Arc; use thiserror::Error; -/// The hash domain of the connection record's key. -const KEY_DOMAIN: &[u8] = b"auths.gateway-connection/1\0"; - /// Why the shared connection record could not be read or changed. #[derive(Clone, Copy, Debug, Eq, PartialEq, Error)] pub enum SharedConnectionError { @@ -63,7 +60,7 @@ impl LoadedConnection { /// Whether `other` holds exactly the same stored bytes. #[must_use] pub fn unchanged(&self, other: &Self) -> bool { - self.bytes == other.bytes + auths_gateway_kernel::construct::field_name_equal(&self.bytes, &other.bytes) } } @@ -71,10 +68,10 @@ impl LoadedConnection { #[must_use] pub fn connection_key(provider: &ProviderKind, alias: &ConnectionAlias) -> GatewayAttemptKey { let mut hash = Sha256::new(); - hash.update(KEY_DOMAIN); - hash.update(provider.as_str().as_bytes()); - hash.update([0]); - hash.update(alias.as_str().as_bytes()); + hash.update(auths_gateway_kernel::identity::connection_record_preimage( + provider.as_str().as_bytes(), + alias.as_str().as_bytes(), + )); GatewayAttemptKey::from_bytes(hash.finalize().into()) } @@ -392,12 +389,36 @@ pub fn authorizes_entry( workload_id: &str, profile: &auths_connections::ConnectionProfile, ) -> bool { - record.state() == ConnectionState::Active - && record - .allowed_workloads() - .iter() - .any(|allowed| allowed == workload_id) - && record.allowed_profiles().contains(profile) + use auths_gateway_kernel::entry_authorization::{EntryProfile, EntryState, entry_allows}; + let state = match record.state() { + ConnectionState::Active => EntryState::Active, + ConnectionState::Disabled => EntryState::Disabled, + ConnectionState::Revoked => EntryState::Revoked, + }; + let workloads: Vec> = record + .allowed_workloads() + .iter() + .map(|name| name.as_bytes().to_vec()) + .collect(); + let profiles: Vec = record + .allowed_profiles() + .iter() + .map(|allowed| EntryProfile { + id: allowed.id().as_str().as_bytes().to_vec(), + version: allowed.version(), + }) + .collect(); + let requested = EntryProfile { + id: profile.id().as_str().as_bytes().to_vec(), + version: profile.version(), + }; + entry_allows( + state, + &workloads, + &profiles, + workload_id.as_bytes(), + &requested, + ) } async fn blocking( @@ -417,6 +438,139 @@ async fn blocking( mod tests { use super::*; + fn entry_record( + state: ConnectionState, + workloads: Vec, + profiles: Vec, + ) -> ConnectionRecord { + ConnectionRecord::new( + ProviderKind::parse("stripe").expect("provider"), + ConnectionAlias::parse("billing").expect("alias"), + ConnectionId::parse("conn_AAAAAAAAAAAAAAAAAAAAAA").expect("connection"), + auths_connections::SemanticId::parse("auths.stripe.connection/1").expect("contract"), + auths_connections::SemanticId::parse("auths.stripe.connection-descriptor/1") + .expect("schema"), + b"descriptor".to_vec(), + [2; 32], + [3; 32], + NonZeroU64::new(1).expect("generation"), + state, + workloads, + profiles, + 10, + 10, + (state == ConnectionState::Revoked).then_some(10), + ) + .expect("valid record") + } + + #[test] + fn entry_authorization_preserves_complete_record_membership() { + use auths_connections::ConnectionProfile; + let names = ["Worker", "worker", "worker-b"]; + let mut profiles: Vec<_> = ["auths.test.a", "auths.test.b", "auths.test.c"] + .into_iter() + .flat_map(|id| { + [1, 2].map(|version| { + ConnectionProfile::new( + auths_connections::SemanticId::parse(id).expect("profile id"), + version, + ) + .expect("profile") + }) + }) + .collect(); + profiles.sort(); + let mut requested = profiles.clone(); + requested.push( + ConnectionProfile::new( + auths_connections::SemanticId::parse("auths.test.unknown").expect("id"), + 1, + ) + .expect("profile"), + ); + requested.push( + ConnectionProfile::new( + auths_connections::SemanticId::parse("auths.test.a").expect("id"), + u16::MAX, + ) + .expect("profile"), + ); + let mut accepted = 0; + let mut refused = 0; + for state in [ + ConnectionState::Active, + ConnectionState::Disabled, + ConnectionState::Revoked, + ] { + for workload_count in 1..=names.len() { + for profile_count in 1..=profiles.len() { + let record = entry_record( + state, + names[..workload_count] + .iter() + .map(|name| (*name).to_owned()) + .collect(), + profiles[..profile_count].to_vec(), + ); + for workload in ["Worker", "worker", "worker-b", "unlisted"] { + for profile in &requested { + // Frozen preceding expression, evaluated on a constructor-valid record. + let expected = record.state() == ConnectionState::Active + && record + .allowed_workloads() + .iter() + .any(|allowed| allowed == workload) + && record.allowed_profiles().contains(profile); + assert_eq!(authorizes_entry(&record, workload, profile), expected); + if expected { + accepted += 1; + } else { + refused += 1; + } + } + } + } + } + } + assert_eq!((accepted, refused), (126, 1602)); + } + + #[test] + fn loaded_record_comparison_preserves_exact_byte_identity() { + let profile = auths_connections::ConnectionProfile::new( + auths_connections::SemanticId::parse("auths.test.a").expect("profile id"), + 1, + ) + .expect("profile"); + let record = entry_record( + ConnectionState::Active, + vec!["worker".to_owned()], + vec![profile], + ); + let bytes = record.to_canonical_cbor().expect("canonical"); + let loaded = LoadedConnection { + record: record.clone(), + bytes: bytes.clone(), + }; + assert!(loaded.unchanged(&loaded)); + for index in 0..bytes.len() { + let mut changed = bytes.clone(); + changed[index] ^= 1; + let other = LoadedConnection { + record: record.clone(), + bytes: changed, + }; + assert_eq!(loaded.unchanged(&other), loaded.bytes == other.bytes); + assert!(!loaded.unchanged(&other)); + } + let truncated = LoadedConnection { + record, + bytes: bytes[..bytes.len() - 1].to_vec(), + }; + assert!(!loaded.unchanged(&truncated)); + } + #[test] fn the_key_separates_provider_and_alias() { let key = |provider: &str, alias: &str| { @@ -434,4 +588,32 @@ mod tests { &<[u8; 32]>::from(hash.finalize()) ); } + + #[test] + fn connection_keys_preserve_the_frozen_streaming_hash_caller() { + let tokens = [ + "a".to_owned(), + "ab".to_owned(), + "bc".to_owned(), + "a-b".to_owned(), + "stripe".to_owned(), + "billing-01".to_owned(), + "x".repeat(63), + "z".repeat(64), + ]; + for provider in &tokens { + for alias in &tokens { + let mut frozen = Sha256::new(); + frozen.update(b"auths.gateway-connection/1\0"); + frozen.update(provider.as_bytes()); + frozen.update([0]); + frozen.update(alias.as_bytes()); + let key = connection_key( + &ProviderKind::parse(provider.clone()).expect("valid provider"), + &ConnectionAlias::parse(alias.clone()).expect("valid alias"), + ); + assert_eq!(key.as_bytes(), &<[u8; 32]>::from(frozen.finalize())); + } + } + } } diff --git a/product/runtime/auths-gateway/src/engine.rs b/product/runtime/auths-gateway/src/engine.rs index 3d0370443..917dea495 100644 --- a/product/runtime/auths-gateway/src/engine.rs +++ b/product/runtime/auths-gateway/src/engine.rs @@ -360,6 +360,7 @@ struct Retirement { /// transport prepared for it. struct PreparedEntry { loaded: LoadedConnection, + entry_bound: auths_gateway_kernel::deadline::EntryBound, transport: GatewayHttpTransport, } @@ -1176,14 +1177,16 @@ impl GatewayEngine { /// hold the secret its credential generation names, and prepares the /// pinned transport. Nothing is stored. async fn prepare_entry(&self) -> Result { - self.prepare_entry_for(|| self.qualification.check()).await + self.prepare_entry_for(|| self.qualification.entry_bound()) + .await } /// Both authority paths perform exactly the same connection and transport /// checks; the ordinary path supplies only its qualification check. async fn prepare_entry_for( &self, - check_authority: impl FnOnce() -> Result<(), &'static str>, + check_authority: impl FnOnce() + -> Result, ) -> Result { let loaded = match self.connection.load().await { Ok(Some(loaded)) => loaded, @@ -1198,7 +1201,7 @@ impl GatewayEngine { } let descriptor = GatewayConnectionDescriptor::from_record(record, &self.recipe) .map_err(|_| "gateway.connection.recipe-mismatch")?; - check_authority()?; + let entry_bound = check_authority()?; if self.holds(record).await.is_err() { return Err("gateway.connection.credential-generation-missing"); } @@ -1211,6 +1214,7 @@ impl GatewayEngine { ) .map(|transport| PreparedEntry { loaded, + entry_bound, transport: transport.with_witness(Arc::clone(&self.execution_witness)), }) .map_err(|_| "gateway.transport.preparation"); @@ -1218,6 +1222,7 @@ impl GatewayEngine { GatewayHttpTransport::prepare(&self.recipe, descriptor.credential()) .map(|transport| PreparedEntry { loaded, + entry_bound, transport: transport.with_witness(Arc::clone(&self.execution_witness)), }) .map_err(|_| "gateway.transport.preparation") @@ -1401,7 +1406,7 @@ impl SubmitIo for EngineIo<'_> { .get() .ok_or("gateway.commissioning.binding-mismatch")?; self.engine - .prepare_entry_for(|| session.check(action)) + .prepare_entry_for(|| session.entry_bound(action)) .await? } None => self.engine.prepare_entry().await?, @@ -1492,9 +1497,35 @@ impl SubmitIo for EngineIo<'_> { .map(|prepared| *prepared.loaded.record().account_commitment()) } - fn within_entry_deadline(&self, evaluated_at: u64) -> bool { + fn within_entry_deadline( + &self, + evaluated_at: u64, + authority: auths_gateway_kernel::deadline::EntryBound, + ) -> bool { + use auths_gateway_kernel::deadline::{entry_time_allows, intersect_entry_bounds}; + let Some(prepared) = self.prepared.get() else { + return false; + }; + #[cfg(unix)] + let current = match self.commissioning { + Some(session) => self + .commissioned_action + .get() + .ok_or("gateway.commissioning.binding-mismatch") + .and_then(|action| session.entry_bound(action)), + None => self.engine.qualification.entry_bound(), + }; + #[cfg(not(unix))] + let current = self.engine.qualification.entry_bound(); + let Ok(current) = current else { + return false; + }; + let bound = intersect_entry_bounds( + authority, + intersect_entry_bounds(prepared.entry_bound, current), + ); self.clock() - .is_some_and(|now| now <= evaluated_at.saturating_add(ENTRY_DEADLINE_SECONDS)) + .is_some_and(|now| entry_time_allows(evaluated_at, now, bound)) && self.started.elapsed() <= Duration::from_secs(ENTRY_DEADLINE_SECONDS) } @@ -1630,6 +1661,9 @@ pub(crate) struct VerifiedCommand { /// The longest validity window, `expires_at` minus `not_before`, of any /// authorized action envelope. pub(crate) validity_seconds: u64, + /// Minimum native witness horizon and the fixed verification-to-entry cap. + /// Only native verification populates this in production. + pub(crate) entry_not_after: auths_gateway_kernel::deadline::EntryBound, /// The per-proof observer check's refusal: an observer of a satisfying /// observation overlaps a principal of the authority it conditions by /// key. Admission applies it last, after the retention rule and pre-entry @@ -1705,6 +1739,13 @@ pub(crate) fn verify_detailed( requirements: branches.requirements, canonical_action: action.canonical_action().clone(), validity_seconds: branches.validity_seconds, + entry_not_after: auths_gateway_kernel::deadline::EntryBound { + not_after: action + .authority_not_after() + .get() + .min(now.saturating_add(ENTRY_DEADLINE_SECONDS)), + inclusive: true, + }, observer_refusal, }) } diff --git a/product/runtime/auths-gateway/src/harness.rs b/product/runtime/auths-gateway/src/harness.rs index 63a35f8f1..3b7e4a6e0 100644 --- a/product/runtime/auths-gateway/src/harness.rs +++ b/product/runtime/auths-gateway/src/harness.rs @@ -769,8 +769,12 @@ impl SubmitIo for HarnessIo<'_> { None } - fn within_entry_deadline(&self, evaluated_at: u64) -> bool { - self.now <= evaluated_at.saturating_add(crate::recipe::ENTRY_DEADLINE_SECONDS) + fn within_entry_deadline( + &self, + evaluated_at: u64, + bound: auths_gateway_kernel::deadline::EntryBound, + ) -> bool { + auths_gateway_kernel::deadline::entry_time_allows(evaluated_at, self.now, bound) } async fn write( diff --git a/product/runtime/auths-gateway/src/qualification.rs b/product/runtime/auths-gateway/src/qualification.rs index 1a39a00b4..1d2e67c53 100644 --- a/product/runtime/auths-gateway/src/qualification.rs +++ b/product/runtime/auths-gateway/src/qualification.rs @@ -23,7 +23,7 @@ use std::time::{Duration, SystemTime, UNIX_EPOCH}; pub const QUALIFICATION_POLICY_REFUSED: &str = "gateway.install.qualification-policy"; /// The schema identifier of the production lifecycle store. -pub const POSTGRES_STORE_SCHEMA: &str = "auths.lifecycle.postgresql/6"; +pub const POSTGRES_STORE_SCHEMA: &str = "auths.lifecycle.postgresql/7"; /// The schema identifier of the development file store. pub const FILE_STORE_SCHEMA: &str = "auths.gateway-attempt/3"; @@ -477,6 +477,7 @@ impl QualificationGate { let unavailable = QualificationVerdict { state: RecipeQualificationState::Unqualified, refusal: Some(QualificationRefusal::Unavailable), + valid_through: None, }; let (Some(deployment), Some(held)) = (&self.deployment, self.held()) else { return unavailable; @@ -503,6 +504,29 @@ impl QualificationGate { } } + /// Temporal witness from the exact currently accepted qualification. + /// Development policy adds no qualification deadline. + pub(crate) fn entry_bound( + &self, + ) -> Result { + use auths_gateway_kernel::deadline::EntryBound; + if self.policy == QualificationPolicy::Optional { + return Ok(EntryBound { + not_after: u64::MAX, + inclusive: true, + }); + } + let verdict = self.verdict(); + match (verdict.refusal, verdict.valid_through) { + (None, Some(not_after)) if verdict.permits_lease() => Ok(EntryBound { + not_after, + inclusive: true, + }), + (Some(refusal), _) => Err(qualification_code(refusal)), + _ => Err(qualification_code(QualificationRefusal::Unavailable)), + } + } + /// Whether a credential may be leased now. /// /// # Errors diff --git a/product/runtime/auths-gateway/src/quorum_tests.rs b/product/runtime/auths-gateway/src/quorum_tests.rs index cbc6a7882..d77062c90 100644 --- a/product/runtime/auths-gateway/src/quorum_tests.rs +++ b/product/runtime/auths-gateway/src/quorum_tests.rs @@ -388,6 +388,87 @@ fn sdk_trusted_context(recipe: &CompiledRecipe) -> TrustedContext { .expect("SDK template") } +#[tokio::test] +async fn native_entry_horizon_uses_counted_approval_and_ignores_unlisted_approval() { + let recipe = recipe(); + let context = trusted_context(&recipe); + let quorum = proposal(&recipe, "entry-horizon", REQUIRED); + let template = &quorum.statements()[0]; + let with_expiry = |expires| { + ApprovalStatement::new( + template.approver().clone(), + template.requirement(), + template.media_type().clone(), + template.body_digest(), + template.permission().clone(), + template.requested_budget().cloned(), + template.attributes(), + template.audience().clone(), + template.challenge(), + ValidityWindow::new(template.validity().not_before(), Timestamp::new(expires)) + .expect("window"), + ) + }; + let approvals = vec![ + Member::named("manager-a").approve(&quorum, &with_expiry(NOW + 3)), + Member::named("manager-b").approve(&quorum, template), + Member::named("outsider").approve(&quorum, &with_expiry(NOW + 1)), + ]; + let proof = bundle( + &recipe, + "entry-horizon", + REQUIRED, + &["manager-a", "manager-b"], + ) + .with_approvals(approvals) + .expect("proof approvals"); + let action = encode_canonical_action(quorum.canonical()).expect("canonical action"); + let verified = crate::engine::verify_detailed( + &recipe, + &context, + NOW, + &encode_bundle(&proof).expect("proof bytes"), + &action, + ) + .expect("native quorum verification"); + assert_eq!(verified.entry_not_after.not_after, NOW + 3); + assert!(verified.entry_not_after.inclusive); + assert_eq!( + verified.approvers.len(), + 2, + "unlisted material is not a temporal authority witness" + ); + assert!(auths_gateway_kernel::deadline::entry_time_allows( + NOW, + NOW + 3, + verified.entry_not_after + )); + assert!(!auths_gateway_kernel::deadline::entry_time_allows( + NOW, + NOW + 4, + verified.entry_not_after + )); + let temp = tempfile::tempdir().expect("state"); + let harness = fresh_harness(temp.path()); + let io = crate::scenario_tests::TestIo::new(&harness.provider, verified).at_entry_time(NOW + 4); + let context = crate::submit::SubmitContext { + recipe: &harness.recipe, + attempts: &harness.store, + context: &harness.context, + observer: Some(&harness.observer), + }; + let result = crate::submit::run(&context, &io).await; + assert_eq!( + result, + crate::engine::not_entered("gateway.attempt.entry-deadline") + ); + assert_eq!( + harness.provider.counts().0, + 0, + "the native witness expires while queued" + ); +} + #[test] fn the_action_and_every_statement_share_the_default_window() { let quorum = proposal(&recipe(), "window", REQUIRED); diff --git a/product/runtime/auths-gateway/src/recipe.rs b/product/runtime/auths-gateway/src/recipe.rs index 00ba824c5..a2ba7e0b3 100644 --- a/product/runtime/auths-gateway/src/recipe.rs +++ b/product/runtime/auths-gateway/src/recipe.rs @@ -24,6 +24,7 @@ mod lower; mod review; mod runtime; mod source; +mod strict_json; mod validate; #[cfg(test)] @@ -113,12 +114,7 @@ impl LogicalOperationId { } fn valid_token(value: &str, maximum: usize) -> bool { - !value.is_empty() - && value.len() <= maximum - && value.is_ascii() - && value.bytes().enumerate().all(|(index, byte)| { - byte.is_ascii_alphanumeric() || (index > 0 && matches!(byte, b'.' | b'_' | b'-')) - }) + auths_gateway_kernel::identity::valid_token(value.as_bytes(), maximum) } /// One supported credential injection requirement. The operator connection, @@ -528,8 +524,8 @@ impl CompiledRecipe { return Err(GatewayRecipeError::InvalidSource); } let source: RecipeSource = - serde_json::from_slice(source_bytes).map_err(|_| GatewayRecipeError::InvalidSource)?; - let lock: ProfileLockFile = serde_json::from_slice(lock_bytes) + strict_json::from_slice(source_bytes).map_err(|_| GatewayRecipeError::InvalidSource)?; + let lock: ProfileLockFile = strict_json::from_slice(lock_bytes) .map_err(|_| GatewayRecipeError::InvalidProfileLock)?; if source.schema != RECIPE_SOURCE_SCHEMA { return Err(GatewayRecipeError::InvalidSource); diff --git a/product/runtime/auths-gateway/src/recipe/lower.rs b/product/runtime/auths-gateway/src/recipe/lower.rs index d90713cdf..54c0343fa 100644 --- a/product/runtime/auths-gateway/src/recipe/lower.rs +++ b/product/runtime/auths-gateway/src/recipe/lower.rs @@ -35,8 +35,8 @@ pub(super) struct Plans { pub(super) denied: Vec, } -struct Lowering<'a> { - fields: &'a BTreeMap, +struct Lowering { + field_names: Vec>, origin: Vec, headers: HeaderPlan, } @@ -124,11 +124,9 @@ fn form_encoded(text: &str) -> Vec { append_form_encoded(Vec::new(), text.as_bytes()) } -impl Lowering<'_> { +impl Lowering { fn index(&self, name: &str) -> Result { - self.fields - .keys() - .position(|field| field == name) + auths_gateway_kernel::construct::field_index(&self.field_names, name.as_bytes()) .ok_or(GatewayRecipeError::InvalidSource) } @@ -345,7 +343,7 @@ pub(super) fn plans( fields: &BTreeMap, ) -> Result { let lowering = Lowering { - fields, + field_names: fields.keys().map(|name| name.as_bytes().to_vec()).collect(), origin: source.origin.as_bytes().to_vec(), headers: header_plan(source, fields)?, }; diff --git a/product/runtime/auths-gateway/src/recipe/strict_json.rs b/product/runtime/auths-gateway/src/recipe/strict_json.rs new file mode 100644 index 000000000..e0a17eeb5 --- /dev/null +++ b/product/runtime/auths-gateway/src/recipe/strict_json.rs @@ -0,0 +1,109 @@ +//! Reject duplicate members before either the typed source or lock parser can +//! collapse an object into a map. The caller bounds the complete byte input; +//! `serde_json`'s standard recursion limit applies to both parsing passes. + +use serde::de::{self, DeserializeOwned, MapAccess, SeqAccess, Visitor}; +use serde::{Deserialize, Deserializer}; +use std::collections::BTreeSet; +use std::fmt; + +struct UniqueMembers; +struct UniqueVisitor; + +impl<'de> Deserialize<'de> for UniqueMembers { + fn deserialize>(deserializer: D) -> Result { + deserializer.deserialize_any(UniqueVisitor)?; + Ok(Self) + } +} + +impl<'de> Visitor<'de> for UniqueVisitor { + type Value = (); + + fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str("JSON with unique object members") + } + + fn visit_bool(self, _value: bool) -> Result<(), E> { + Ok(()) + } + fn visit_i64(self, _value: i64) -> Result<(), E> { + Ok(()) + } + fn visit_u64(self, _value: u64) -> Result<(), E> { + Ok(()) + } + fn visit_f64(self, _value: f64) -> Result<(), E> { + Ok(()) + } + fn visit_str(self, _value: &str) -> Result<(), E> { + Ok(()) + } + fn visit_string(self, _value: String) -> Result<(), E> { + Ok(()) + } + fn visit_unit(self) -> Result<(), E> { + Ok(()) + } + + fn visit_seq>(self, mut sequence: A) -> Result<(), A::Error> { + while sequence.next_element::()?.is_some() {} + Ok(()) + } + + fn visit_map>(self, mut object: A) -> Result<(), A::Error> { + let mut names = BTreeSet::new(); + while let Some(name) = object.next_key::()? { + if !names.insert(name) { + return Err(de::Error::custom("duplicate object member")); + } + object.next_value::()?; + } + Ok(()) + } +} + +/// Parses one bounded source/lock document after checking decoded member-name +/// uniqueness at every nesting level, including escaped spellings of a name. +pub(super) fn from_slice(input: &[u8]) -> Result { + let mut parser = serde_json::Deserializer::from_slice(input); + UniqueMembers::deserialize(&mut parser)?; + parser.end()?; + serde_json::from_slice(input) +} + +#[cfg(test)] +mod tests { + use super::from_slice; + use serde_json::{Value, json}; + + #[test] + fn duplicate_names_are_refused_at_every_depth() { + for input in [ + r#"{"a":1,"a":2}"#, + r#"{"fields":{"invoice":1,"invoice":2}}"#, + r#"{"body":[{"x":1,"x":2}]}"#, + r#"{"a":1,"\u0061":2}"#, + r#"{"x":{"a":1,"a":1}}"#, + ] { + assert!(from_slice::(input.as_bytes()).is_err()); + } + } + + #[test] + fn distinct_scopes_types_and_whitespace_keep_their_meaning() { + let input = br#" {"a":{"x":1},"b":{"x":2},"list":[null,true,3,"text"]} "#; + assert_eq!( + from_slice::(input).unwrap(), + json!({"a":{"x":1},"b":{"x":2},"list":[null,true,3,"text"]}) + ); + assert!(from_slice::(br#"{"a":1} {"b":2}"#).is_err()); + assert!(from_slice::(br#"{"a":1"#).is_err()); + } + + #[test] + fn recursion_limit_is_retained() { + let input = format!("{}0{}", "[".repeat(200), "]".repeat(200)); + assert!(from_slice::(input.as_bytes()).is_err()); + } +} diff --git a/product/runtime/auths-gateway/src/recipe/tests.rs b/product/runtime/auths-gateway/src/recipe/tests.rs index fca7edb73..b2f30b564 100644 --- a/product/runtime/auths-gateway/src/recipe/tests.rs +++ b/product/runtime/auths-gateway/src/recipe/tests.rs @@ -1360,3 +1360,22 @@ proptest::proptest! { } } } + +#[test] +fn compiler_refuses_duplicate_members_in_source_and_profile_lock() { + let (recipe, lock) = fixture("airtable"); + let source_text = std::str::from_utf8(recipe).unwrap(); + let source_value: Value = serde_json::from_slice(recipe).unwrap(); + let service = serde_json::to_string(&source_value["service"]).unwrap(); + let duplicate_source = source_text.replacen('{', &format!("{{\"service\":{service},"), 1); + assert_eq!( + CompiledRecipe::compile(duplicate_source.as_bytes(), lock).unwrap_err(), + GatewayRecipeError::InvalidSource + ); + let lock_text = std::str::from_utf8(lock).unwrap(); + let duplicate_lock = lock_text.replacen('{', "{\"service\":\"duplicate\",", 1); + assert_eq!( + CompiledRecipe::compile(recipe, duplicate_lock.as_bytes()).unwrap_err(), + GatewayRecipeError::InvalidProfileLock + ); +} diff --git a/product/runtime/auths-gateway/src/scenario_tests.rs b/product/runtime/auths-gateway/src/scenario_tests.rs index c2c147152..908589bb1 100644 --- a/product/runtime/auths-gateway/src/scenario_tests.rs +++ b/product/runtime/auths-gateway/src/scenario_tests.rs @@ -66,6 +66,8 @@ struct RecordingStore { inner: Arc, stages: Mutex>, lose_response_record: AtomicBool, + lose_claim_ack: AtomicBool, + lose_sweep_ack: AtomicBool, } impl RecordingStore { @@ -74,6 +76,8 @@ impl RecordingStore { inner, stages: Mutex::new(Vec::new()), lose_response_record: AtomicBool::new(false), + lose_claim_ack: AtomicBool::new(false), + lose_sweep_ack: AtomicBool::new(false), }) } @@ -112,6 +116,9 @@ impl GatewayAttemptStore for RecordingStore { self.record(&entry.record); } } + if self.lose_claim_ack.swap(false, Ordering::SeqCst) { + return Err(GatewayAttemptError::Unavailable); + } } Ok(inserted) } @@ -120,6 +127,9 @@ impl GatewayAttemptStore for RecordingStore { self.inner.insert(entry)?; if entry.kind == GatewayRecordKind::Attempt { self.record(&entry.record); + if self.lose_claim_ack.swap(false, Ordering::SeqCst) { + return Err(GatewayAttemptError::Unavailable); + } } Ok(()) } @@ -152,7 +162,12 @@ impl GatewayAttemptStore for RecordingStore { } fn sweep_expired(&self, now: u64, limit: usize) -> Result { - self.inner.sweep_expired(now, limit) + let deleted = self.inner.sweep_expired(now, limit)?; + if self.lose_sweep_ack.swap(false, Ordering::SeqCst) { + Err(GatewayAttemptError::Unavailable) + } else { + Ok(deleted) + } } } @@ -169,6 +184,7 @@ pub(crate) struct TestIo<'a, P> { pub(crate) recipe: Option<&'a CompiledRecipe>, pub(crate) clock: AtomicU64, deadline_advance: u64, + final_clock: Option, secret: Vec, account: [u8; 32], leases: AtomicUsize, @@ -189,12 +205,18 @@ impl<'a, P> TestIo<'a, P> { recipe: None, clock: AtomicU64::new(NOW), deadline_advance: 0, + final_clock: None, secret: b"rk_test_not-a-real-credential".to_vec(), account: account_commitment("acct_TESTPLATFORM1"), leases: AtomicUsize::new(0), } } + pub(crate) fn at_entry_time(mut self, now: u64) -> Self { + self.final_clock = Some(now); + self + } + pub(crate) fn leases(&self) -> usize { self.leases.load(Ordering::SeqCst) } @@ -238,9 +260,20 @@ impl SubmitIo for TestIo<'_, P> { Some(self.account) } - fn within_entry_deadline(&self, evaluated_at: u64) -> bool { - self.clock.load(Ordering::SeqCst) + self.deadline_advance - <= evaluated_at + crate::recipe::ENTRY_DEADLINE_SECONDS + fn within_entry_deadline( + &self, + evaluated_at: u64, + bound: auths_gateway_kernel::deadline::EntryBound, + ) -> bool { + self.final_clock + .or_else(|| { + self.clock + .load(Ordering::SeqCst) + .checked_add(self.deadline_advance) + }) + .is_some_and(|now| { + auths_gateway_kernel::deadline::entry_time_allows(evaluated_at, now, bound) + }) } async fn write( @@ -337,6 +370,11 @@ pub(crate) fn admitted( requirements, canonical_action, validity_seconds, + entry_not_after: auths_gateway_kernel::deadline::EntryBound { + not_after: now + .saturating_add(validity_seconds.min(crate::recipe::ENTRY_DEADLINE_SECONDS)), + inclusive: true, + }, observer_refusal: None, }) } @@ -1981,6 +2019,40 @@ async fn conformance_child_process() { { std::thread::yield_now(); } + if mode == "fence" { + let raw = store.raw(); + let (deleted, inserted) = tokio::task::spawn_blocking(move || { + let mut deleted = 0; + let mut inserted = 0; + for index in 0..RACE_OPERATIONS { + if process == 0 { + deleted += raw.sweep_expired(100, 1).expect("bounded collection"); + } else { + let claim = attempt_entry( + GatewayAttemptKey::from_bytes(test_key("fence-process-claim", index, None)), + b"claim", + ); + let slot = slot_entry( + GatewayRecordKind::CountSlot, + test_key("fence-process-slot", index, None), + b"slot", + 100, + ); + let result = raw.insert_all(&[claim, slot]).expect("admission"); + inserted += usize::from(result == GatewayInsert::Inserted); + assert!(matches!( + result, + GatewayInsert::Exists { .. } | GatewayInsert::ClosedWindow { .. } + )); + } + } + (deleted, inserted) + }) + .await + .expect("fence race"); + println!("RACE {deleted} {inserted}"); + return; + } if mode == "batch" { let raw = store.raw(); let won = tokio::task::spawn_blocking(move || { @@ -2085,9 +2157,374 @@ async fn conformance_sweep_bounds(backend: Backend) { .expect("sweep checks"); } +/// Publishing a cutoff closes the window before any bounded sweep deletes a +/// slot. Reopening the store and an older clock cannot clear that fact. +async fn conformance_collection_fence(backend: Backend) { + let store = TestAttempts::open(backend); + let raw = store.raw(); + tokio::task::spawn_blocking(move || { + let old = slot_entry( + GatewayRecordKind::CountSlot, + test_key("fence-old", 0, None), + b"slot", + 100, + ); + raw.insert(&old).expect("old slot"); + assert_eq!(raw.sweep_expired(100, 0), Ok(0)); + assert!( + raw.load(old.kind, &old.key) + .expect("retained slot") + .is_some() + ); + }) + .await + .expect("publish cutoff"); + let raw = store.raw(); + tokio::task::spawn_blocking(move || { + let claim = attempt_entry( + GatewayAttemptKey::from_bytes(test_key("fence-claim", 0, None)), + b"claim", + ); + let count = slot_entry( + GatewayRecordKind::CountSlot, + test_key("fence-count", 0, None), + b"slot", + 100, + ); + let sum = slot_entry( + GatewayRecordKind::SumSlot, + test_key("fence-sum", 0, None), + b"sum", + 100, + ); + for closed in [&count, &sum] { + assert_eq!( + raw.insert_all(&[claim.clone(), closed.clone()]), + Ok(GatewayInsert::ClosedWindow { + collected_through: 100 + }) + ); + assert!(raw.load(claim.kind, &claim.key).expect("load").is_none()); + } + assert_eq!(raw.sweep_expired(100, 10), Ok(1)); + assert_eq!( + raw.sweep_expired(1, 0), + Ok(0), + "a stale collector cannot lower the cutoff" + ); + assert_eq!( + raw.insert_all(&[claim.clone(), count]), + Ok(GatewayInsert::ClosedWindow { + collected_through: 100 + }) + ); + let later = slot_entry( + GatewayRecordKind::SumSlot, + test_key("fence-later", 0, None), + b"sum", + 101, + ); + assert_eq!(raw.insert_all(&[claim, later]), Ok(GatewayInsert::Inserted)); + }) + .await + .expect("closed and open windows"); +} + +/// A full one-slot window has no second winner on either side of a racing +/// collector: the old slot excludes the contender before collection, and the +/// durable cutoff excludes it afterwards. +async fn conformance_collection_admission_race(backend: Backend) { + let store = TestAttempts::open(backend); + for round in 0..16 { + let (first, second) = (store.raw(), store.raw()); + tokio::task::spawn_blocking(move || { + let expiry = 100 + u64::try_from(round).expect("bounded round"); + let slot = slot_entry( + GatewayRecordKind::CountSlot, + test_key("fence-race-slot", round, None), + b"slot", + expiry, + ); + first.insert(&slot).expect("full window"); + let claim = attempt_entry( + GatewayAttemptKey::from_bytes(test_key("fence-race-claim", round, None)), + b"claim", + ); + let barrier = std::sync::Barrier::new(2); + std::thread::scope(|scope| { + let collect = scope.spawn(|| { + barrier.wait(); + first.sweep_expired(expiry, 10) + }); + barrier.wait(); + let contender = second.insert_all(&[claim.clone(), slot]); + assert!( + matches!( + contender, + Ok(GatewayInsert::Exists { .. } | GatewayInsert::ClosedWindow { .. }) + ), + "a collected slot must never reopen: {contender:?}" + ); + assert_eq!(collect.join().expect("collector"), Ok(1)); + }); + assert!( + second + .load(claim.kind, &claim.key) + .expect("no partial claim") + .is_none() + ); + }) + .await + .expect("collection/admission race"); + } +} + +async fn conformance_collection_from_two_processes(backend: Backend) { + let store = TestAttempts::open(backend); + let raw = store.raw(); + tokio::task::spawn_blocking(move || { + for index in 0..RACE_OPERATIONS { + raw.insert(&slot_entry( + GatewayRecordKind::CountSlot, + test_key("fence-process-slot", index, None), + b"slot", + 100, + )) + .expect("full window"); + } + }) + .await + .expect("prefill"); + let mut deleted = 0; + let mut inserted = 0; + for line in spawn_children("fence", &store, backend) { + let counts: Vec = line + .split(' ') + .map(|value| value.parse().expect("count")) + .collect(); + deleted += counts[0]; + inserted += counts[1]; + } + assert_eq!(deleted, RACE_OPERATIONS); + assert_eq!( + inserted, 0, + "a different process cannot reopen a collected window" + ); + let raw = store.raw(); + tokio::task::spawn_blocking(move || { + for index in 0..RACE_OPERATIONS { + let claim = GatewayAttemptKey::from_bytes(test_key("fence-process-claim", index, None)); + assert!( + raw.load(GatewayRecordKind::Attempt, &claim) + .expect("load") + .is_none() + ); + } + raw.sweep_expired(1, 0).expect("stale collector"); + let slot = slot_entry( + GatewayRecordKind::SumSlot, + test_key("fence-process-stale", 0, None), + b"sum", + 100, + ); + assert_eq!( + raw.insert_all(&[slot]), + Ok(GatewayInsert::ClosedWindow { + collected_through: 100 + }) + ); + }) + .await + .expect("retained cutoff"); +} + +async fn conformance_closed_window_has_no_execution_handle(backend: Backend) { + let record = Record::open("airtable", backend); + let mut command = record.airtable(ORIGINAL, "Approved"); + command.bound = Some(crate::bounds::BoundAdmission { + links: Vec::new(), + argument: 0, + window_seconds: 60, + window_index: NOW / 60, + window_end: NOW + 60, + counts: vec![crate::bounds::CountCounter { + key: test_key("fence-driver-counter", 0, None), + capacity: 1, + }], + sums: Vec::new(), + }); + let raw = record.store.raw(); + tokio::task::spawn_blocking(move || raw.sweep_expired(NOW + 120, 0)) + .await + .expect("collector") + .expect("publish cutoff"); + let provider = RecordProvider::new(Delivery::Respond, Reading::Faithful); + let io = TestIo::new(&provider, command.clone()); + let result = run( + record.store.attempts(), + &record.recipe, + &record.observer, + &io, + ) + .await; + assert_eq!( + result, + crate::engine::not_entered("gateway.policy.window-exhausted") + ); + assert_eq!(io.leases(), 0); + assert_eq!(provider.writes(), 0); + let retained = record.snapshot(&command).await; + assert_eq!(retained.stage(), GatewayAttemptStage::NotEntered); + assert!(retained.counters().is_empty()); +} + +async fn conformance_lost_acknowledgements(backend: Backend) { + let record = Record::open("airtable", backend); + let raw = RecordingStore::new(record.store.raw()); + raw.lose_claim_ack.store(true, Ordering::SeqCst); + let attempts = GatewayAttempts::new(raw.clone()); + let command = record.airtable(ORIGINAL, "Approved"); + let provider = RecordProvider::new(Delivery::Respond, Reading::Faithful); + let io = TestIo::new(&provider, command.clone()); + let _ = run(&attempts, &record.recipe, &record.observer, &io).await; + assert_eq!( + io.leases(), + 0, + "a lost claim acknowledgement grants no handle" + ); + assert_eq!(provider.writes(), 0); + let reopened = record.store.reopen(); + let retry = TestIo::new(&provider, command); + assert_eq!( + run(&reopened, &record.recipe, &record.observer, &retry).await, + replay_refused() + ); + assert_eq!( + retry.leases(), + 1, + "recovery may lease for its read-only observation" + ); + assert_eq!(provider.reads(), 1); + assert_eq!( + provider.writes(), + 0, + "lost acknowledgements cannot grant a write" + ); + raw.lose_sweep_ack.store(true, Ordering::SeqCst); + tokio::task::spawn_blocking(move || { + assert_eq!( + raw.sweep_expired(100, 0), + Err(GatewayAttemptError::Unavailable) + ); + }) + .await + .expect("lost sweep acknowledgement"); + let raw = record.store.raw(); + tokio::task::spawn_blocking(move || { + let slot = slot_entry( + GatewayRecordKind::SumSlot, + test_key("lost-sweep-ack", 0, None), + b"slot", + 100, + ); + assert_eq!( + raw.insert_all(&[slot]), + Ok(GatewayInsert::ClosedWindow { + collected_through: 100 + }) + ); + }) + .await + .expect("retained cutoff"); +} + /// A connection record committed through one store instance is what every /// other instance sharing the store reads next, and a stale compare-and-swap /// through another instance is a conflict. +async fn conformance_expired_entry_preserves_capacity(backend: Backend) { + use auths_gateway_kernel::deadline::EntryBound; + for (now, inclusive) in [(NOW + 6, true), (NOW + 5, false), (NOW - 1, true)] { + let record = Record::open("airtable", backend); + let mut command = record.airtable(ORIGINAL, "Approved"); + command.entry_not_after = EntryBound { + not_after: NOW + 5, + inclusive, + }; + command.bound = Some(crate::bounds::BoundAdmission { + links: Vec::new(), + argument: 0, + window_seconds: 60, + window_index: NOW / 60, + window_end: NOW + 60, + counts: vec![crate::bounds::CountCounter { + key: test_key("expired-entry-capacity", 0, None), + capacity: 1, + }], + sums: Vec::new(), + }); + let provider = RecordProvider::new(Delivery::Respond, Reading::Faithful); + let mut io = TestIo::new(&provider, command.clone()); + io.final_clock = Some(now); + let result = run( + record.store.attempts(), + &record.recipe, + &record.observer, + &io, + ) + .await; + assert_eq!( + result, + crate::engine::not_entered("gateway.attempt.entry-deadline") + ); + assert_eq!( + provider.writes(), + 0, + "an expired or rolled-back clock cannot enter" + ); + let retained = record.snapshot(&command).await; + assert_eq!(retained.stage(), GatewayAttemptStage::NotEntered); + assert_eq!( + retained.counters().len(), + 1, + "admission capacity stays consumed" + ); + let retry = TestIo::new(&provider, command); + assert_eq!( + run( + record.store.attempts(), + &record.recipe, + &record.observer, + &retry + ) + .await, + replay_refused() + ); + assert_eq!(retry.leases(), 0); + } + // Equality remains useful for an inclusive native-authority endpoint. + let record = Record::open("airtable", backend); + let mut command = record.airtable(ORIGINAL, "Approved"); + command.entry_not_after = EntryBound { + not_after: NOW + 5, + inclusive: true, + }; + let provider = RecordProvider::new(Delivery::Respond, Reading::Faithful); + let mut io = TestIo::new(&provider, command); + io.final_clock = Some(NOW + 5); + let _ = run( + record.store.attempts(), + &record.recipe, + &record.observer, + &io, + ) + .await; + assert_eq!( + provider.writes(), + 1, + "an inclusive endpoint admits its exact final second" + ); +} + async fn conformance_shared_connection_record(backend: Backend) { let store = TestAttempts::open(backend); let (first, second) = (store.raw(), store.raw()); @@ -2136,6 +2573,16 @@ async fn conformance_shared_connection_record(backend: Backend) { !matches!(first.load(GatewayRecordKind::Attempt, &key), Ok(Some(_))), "a key is read only as its own kind" ); + assert_eq!( + first.load(GatewayRecordKind::Attempt, &key), + Err(GatewayAttemptError::Corrupt) + ); + let wrong_kind = attempt_entry(key, b"claim"); + assert_eq!( + first.insert_all(std::slice::from_ref(&wrong_kind)), + Ok(GatewayInsert::Exists { index: 0 }) + ); + assert_eq!(first.insert(&wrong_kind), Err(GatewayAttemptError::Replay)); }) .await .expect("connection checks"); @@ -2151,7 +2598,13 @@ async fn store_conformance(backend: Backend) { conformance_concurrent_claims_from_two_processes(backend).await; conformance_batches_from_two_processes(backend).await; conformance_sweep_bounds(backend).await; + conformance_collection_fence(backend).await; + conformance_collection_admission_race(backend).await; + conformance_collection_from_two_processes(backend).await; + conformance_closed_window_has_no_execution_handle(backend).await; + conformance_lost_acknowledgements(backend).await; conformance_shared_connection_record(backend).await; + conformance_expired_entry_preserves_capacity(backend).await; } #[tokio::test] @@ -2159,6 +2612,49 @@ async fn file_store_passes_attempt_store_conformance() { store_conformance(Backend::File).await; } +#[test] +fn file_store_refuses_lost_or_invalid_collection_state() { + for fault in [ + "missing", + "malformed", + "obsolete", + "oversized", + "missing-lock", + ] { + let directory = tempfile::tempdir().expect("directory"); + let root = std::fs::canonicalize(directory.path()) + .expect("canonical") + .join("attempts"); + let store = FileGatewayAttemptStore::open(&root).expect("fresh store"); + store.sweep_expired(100, 0).expect("durable cutoff"); + drop(store); + let marker = root.join(".collection.json"); + match fault { + "missing" => std::fs::remove_file(&marker).expect("remove marker"), + "malformed" => std::fs::write(&marker, b"{}").expect("malformed marker"), + "obsolete" => std::fs::write( + &marker, + br#"{"schema":"auths.gateway-file-store/0","collected_through":null}"#, + ) + .expect("obsolete marker"), + "oversized" => std::fs::write(&marker, [0_u8; 513]).expect("oversized marker"), + "missing-lock" => { + std::fs::remove_file(root.join(".replace.lock")).expect("remove lock"); + } + _ => unreachable!("closed fault table"), + } + for _ in 0..2 { + assert!( + matches!( + FileGatewayAttemptStore::open(&root), + Err(GatewayAttemptError::Corrupt) + ), + "{fault} security state must never reset to a fresh store" + ); + } + } +} + #[tokio::test] #[ignore = "needs the TLS PostgreSQL fixture"] async fn postgres_store_passes_attempt_store_conformance() { diff --git a/product/runtime/auths-gateway/src/semantic_closure.rs b/product/runtime/auths-gateway/src/semantic_closure.rs index d78159007..632978f45 100644 --- a/product/runtime/auths-gateway/src/semantic_closure.rs +++ b/product/runtime/auths-gateway/src/semantic_closure.rs @@ -10,7 +10,7 @@ /// SHA-256 of the schema, a NUL byte, and `semantic-closure.json`. /// Regenerate through `semantic_closure_is_current` with `AUTHS_UPDATE_FIXTURES=1`. pub const GATEWAY_SEMANTIC_CLOSURE_SHA256: &str = - "5de8b12ec7c774cb49f8292b350c7ebe9f294a7f565cd311b2ca5c748db9ea64"; + "d665dab52fc03c4b4d67ec536bbc0e5499593919d06329f6bd06e0d8d4e567da"; #[cfg(test)] mod tests { diff --git a/product/runtime/auths-gateway/src/store.rs b/product/runtime/auths-gateway/src/store.rs index 745f786a6..d3c0aa36b 100644 --- a/product/runtime/auths-gateway/src/store.rs +++ b/product/runtime/auths-gateway/src/store.rs @@ -18,14 +18,16 @@ use crate::{ }; use auths_gateway_kernel::transition::{self, AttemptView, Link, Reading, Stage}; use auths_lifecycle::StoreError; -use auths_stores::{GatewayRecordInsert, PostgresLifecycleStore}; +use auths_stores::{ + GatewayRecordInsert, PostgresLifecycleStore, advance_gateway_collection, gateway_window_open, +}; use base64ct::{Base64, Encoding as _}; use serde::{Deserialize, Serialize}; use sha2::{Digest as _, Sha256}; use std::{ collections::BTreeMap, fs::{self, File, OpenOptions}, - io::Write as _, + io::{Read as _, Write as _}, path::{Component, Path, PathBuf}, sync::Arc, }; @@ -40,6 +42,9 @@ const BATCH_SCHEMA: &str = "auths.gateway-file-batch/1"; const SLOT_FILE_SCHEMA: &str = "auths.gateway-file-slot/1"; const BATCH_FILE: &str = ".batch.json"; const LOCK_FILE: &str = ".replace.lock"; +const COLLECTION_FILE: &str = ".collection.json"; +const FILE_STORE_SCHEMA: &str = "auths.gateway-file-store/1"; +const MAX_COLLECTION_FILE_BYTES: usize = 512; /// A load that keeps finding a crashed batch gives up after this many /// rollbacks rather than spin. const MAX_RECOVERY_ROUNDS: usize = 8; @@ -859,12 +864,11 @@ impl GatewayAttemptKey { /// Derives the key of `operation_id` in `namespace`. #[must_use] pub fn for_operation(namespace: &OperatorNamespace, operation_id: &LogicalOperationId) -> Self { - let mut hash = Sha256::new(); - hash.update(b"auths.gateway-logical-operation/1\0"); - hash.update(namespace.as_str().as_bytes()); - hash.update([0]); - hash.update(operation_id.as_str().as_bytes()); - Self(hash.finalize().into()) + let preimage = auths_gateway_kernel::identity::logical_operation_preimage( + namespace.as_str().as_bytes(), + operation_id.as_str().as_bytes(), + ); + Self(Sha256::digest(preimage).into()) } /// Uses `bytes`, a key derived under another record kind's hash domain. @@ -920,6 +924,11 @@ pub enum GatewayInsert { /// The index, in the caller's order, of an entry whose key existed. index: usize, }, + /// At least one slot belongs to a closed window; nothing was inserted. + ClosedWindow { + /// The shared durable cutoff checked atomically with this batch. + collected_through: u64, + }, } /// Durable storage of opaque gateway records of five closed kinds. @@ -930,12 +939,15 @@ pub enum GatewayInsert { /// sweeps of expired slots only, and fail-closed reads that never report /// unreadable state as absent. pub trait GatewayAttemptStore: Send + Sync { - /// Inserts every entry, or none when any key already exists. + /// Inserts every entry only when every key is absent and every slot's + /// expiry is strictly after the shared durable collection cutoff. The + /// cutoff check and insertion have one ordered linearization point. /// /// # Errors /// Returns [`GatewayAttemptError::Corrupt`] for an entry outside its - /// bounds and [`GatewayAttemptError::Unavailable`] when storage fails; - /// nothing is inserted in either case. + /// bounds and [`GatewayAttemptError::Unavailable`] when storage fails. + /// An unavailable result may follow an all-or-none commit whose + /// acknowledgement was lost; it must never produce an execution handle. fn insert_all( &self, entries: &[GatewayRecordEntry], @@ -945,11 +957,13 @@ pub trait GatewayAttemptStore: Send + Sync { /// /// # Errors /// Returns [`GatewayAttemptError::Replay`] when the key already exists, - /// including a record left by a crashed claim. + /// including a record left by a crashed claim, and + /// [`GatewayAttemptError::InvalidTransition`] for a slot in a closed window. fn insert(&self, entry: &GatewayRecordEntry) -> Result<(), GatewayAttemptError> { match self.insert_all(std::slice::from_ref(entry))? { GatewayInsert::Inserted => Ok(()), GatewayInsert::Exists { .. } => Err(GatewayAttemptError::Replay), + GatewayInsert::ClosedWindow { .. } => Err(GatewayAttemptError::InvalidTransition), } } @@ -979,7 +993,9 @@ pub trait GatewayAttemptStore: Send + Sync { ) -> Result<(), GatewayAttemptError>; /// Deletes at most `limit` count and sum slots whose expiry is at or - /// before `now`, and returns how many were deleted. + /// before `now`, and returns how many were deleted. Durably advances a + /// shared monotone cutoff before deletion (or atomically with it), even + /// when `limit` is zero. Claims and the cutoff are never collected. /// /// # Errors /// Returns [`GatewayAttemptError::Unavailable`] when storage fails. @@ -1028,6 +1044,13 @@ struct SlotFile { record_b64: String, } +#[derive(Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct CollectionFile { + schema: String, + collected_through: Option, +} + /// Where a conformance test stops a batch, to leave the state a crash at /// that step would leave. Production batches never stop early. #[derive(Clone, Copy, Debug, Eq, PartialEq)] @@ -1046,7 +1069,8 @@ impl FileGatewayAttemptStore { /// /// # Errors /// Rejects symlinks, broad permissions, foreign ownership, a malformed - /// batch file, and I/O errors. + /// batch file, obsolete unmarked state, missing security metadata or + /// lock state, and I/O errors. It initializes only a fresh empty directory. pub fn open(root: impl Into) -> Result { let root = root.into(); if !is_normalized_absolute(&root) { @@ -1069,10 +1093,102 @@ impl FileGatewayAttemptStore { _ => GatewayAttemptError::UnsafeDirectory, })?; let store = Self { root }; + store.initialize_collection()?; store.recover()?; Ok(store) } + fn initialize_collection(&self) -> Result<(), GatewayAttemptError> { + let (lock, fresh) = if self.root.join(COLLECTION_FILE).exists() { + ( + Self::lock_options() + .open(self.root.join(LOCK_FILE)) + .map_err(|error| { + if error.kind() == std::io::ErrorKind::NotFound { + GatewayAttemptError::Corrupt + } else { + GatewayAttemptError::Unavailable + } + })?, + false, + ) + } else { + match Self::lock_options() + .create_new(true) + .open(self.root.join(LOCK_FILE)) + { + Ok(lock) => (lock, true), + Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => ( + Self::lock_options() + .open(self.root.join(LOCK_FILE)) + .map_err(|_| GatewayAttemptError::Unavailable)?, + false, + ), + Err(_) => return Err(GatewayAttemptError::Unavailable), + } + }; + rustix::fs::flock(&lock, rustix::fs::FlockOperation::LockExclusive) + .map_err(|_| GatewayAttemptError::Unavailable)?; + if self.root.join(COLLECTION_FILE).exists() { + if fresh { + return Err(GatewayAttemptError::Corrupt); + } + self.collection_cutoff()?; + return Ok(()); + } + if !fresh { + return Err(GatewayAttemptError::Corrupt); + } + // An unmarked nonempty store is obsolete or lost security state. + // Never interpret a missing cutoff as an empty collection history. + for entry in fs::read_dir(&self.root).map_err(|_| GatewayAttemptError::Unavailable)? { + let entry = entry.map_err(|_| GatewayAttemptError::Unavailable)?; + if entry.file_name().to_str() != Some(LOCK_FILE) { + return Err(GatewayAttemptError::Corrupt); + } + } + let bytes = canonical(&CollectionFile { + schema: FILE_STORE_SCHEMA.to_owned(), + collected_through: None, + })?; + self.pending(&bytes)? + .persist_noclobber(self.root.join(COLLECTION_FILE)) + .map_err(|_| GatewayAttemptError::Unavailable)?; + sync_directory(&self.root) + } + + fn collection_cutoff(&self) -> Result, GatewayAttemptError> { + let bytes = Self::read_file(&self.root.join(COLLECTION_FILE), MAX_COLLECTION_FILE_BYTES)? + .ok_or(GatewayAttemptError::Corrupt)?; + let state: CollectionFile = + serde_json::from_slice(&bytes).map_err(|_| GatewayAttemptError::Corrupt)?; + if state.schema != FILE_STORE_SCHEMA || canonical(&state)? != bytes { + return Err(GatewayAttemptError::Corrupt); + } + if state + .collected_through + .is_some_and(|cutoff| i64::try_from(cutoff).is_err()) + { + return Err(GatewayAttemptError::Corrupt); + } + Ok(state.collected_through) + } + + fn publish_collection(&self, now: u64) -> Result<(), GatewayAttemptError> { + i64::try_from(now).map_err(|_| GatewayAttemptError::Corrupt)?; + let next = advance_gateway_collection(self.collection_cutoff()?, now); + let bytes = canonical(&CollectionFile { + schema: FILE_STORE_SCHEMA.to_owned(), + collected_through: Some(next), + })?; + self.pending(&bytes)? + .persist(self.root.join(COLLECTION_FILE)) + .map_err(|_| GatewayAttemptError::Unavailable)?; + // No deletion can begin until both the replacement file and its + // directory entry have been synchronized successfully. + sync_directory(&self.root) + } + fn file_name(kind: GatewayRecordKind, key: &GatewayAttemptKey) -> String { let prefix = match kind { GatewayRecordKind::Attempt => "claim-", @@ -1088,13 +1204,42 @@ impl FileGatewayAttemptStore { self.root.join(Self::file_name(kind, key)) } + fn key_exists(&self, key: &GatewayAttemptKey) -> Result { + for kind in [ + GatewayRecordKind::Attempt, + GatewayRecordKind::CountSlot, + GatewayRecordKind::SumSlot, + GatewayRecordKind::Connection, + GatewayRecordKind::CommissioningBudget, + ] { + match fs::symlink_metadata(self.path_for(kind, key)) { + Ok(_) => return Ok(true), + Err(error) if error.kind() == std::io::ErrorKind::NotFound => {} + Err(_) => return Err(GatewayAttemptError::Unavailable), + } + } + Ok(false) + } + fn read_file(path: &Path, maximum: usize) -> Result>, GatewayAttemptError> { - let bytes = match fs::read(path) { - Ok(bytes) => bytes, + let file = match File::open(path) { + Ok(file) => file, Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None), Err(_) => return Err(GatewayAttemptError::Unavailable), }; - if bytes.is_empty() || bytes.len() > maximum { + let maximum = u64::try_from(maximum).map_err(|_| GatewayAttemptError::Corrupt)?; + let metadata = file + .metadata() + .map_err(|_| GatewayAttemptError::Unavailable)?; + if !metadata.is_file() || metadata.len() > maximum { + return Err(GatewayAttemptError::Corrupt); + } + let read_limit = maximum.checked_add(1).ok_or(GatewayAttemptError::Corrupt)?; + let mut bytes = Vec::new(); + file.take(read_limit) + .read_to_end(&mut bytes) + .map_err(|_| GatewayAttemptError::Unavailable)?; + if bytes.is_empty() || u64::try_from(bytes.len()).map_or(true, |length| length > maximum) { return Err(GatewayAttemptError::Corrupt); } Ok(Some(bytes)) @@ -1134,15 +1279,19 @@ impl FileGatewayAttemptStore { Ok(pending) } - fn lock(&self, operation: rustix::fs::FlockOperation) -> Result { + fn lock_options() -> OpenOptions { let mut options = OpenOptions::new(); - options.read(true).write(true).create(true).truncate(false); + options.read(true).write(true); #[cfg(unix)] { use std::os::unix::fs::OpenOptionsExt as _; options.mode(0o600); } - let lock = options + options + } + + fn lock(&self, operation: rustix::fs::FlockOperation) -> Result { + let lock = Self::lock_options() .open(self.root.join(LOCK_FILE)) .map_err(|_| GatewayAttemptError::Unavailable)?; rustix::fs::flock(&lock, operation).map_err(|_| GatewayAttemptError::Unavailable)?; @@ -1152,6 +1301,7 @@ impl FileGatewayAttemptStore { /// Serializes mutations across every process on this host. fn exclusive(&self) -> Result { let lock = self.lock(rustix::fs::FlockOperation::LockExclusive)?; + self.collection_cutoff()?; self.recover_locked()?; Ok(lock) } @@ -1163,6 +1313,7 @@ impl FileGatewayAttemptStore { fn shared(&self) -> Result { for _ in 0..MAX_RECOVERY_ROUNDS { let lock = self.lock(rustix::fs::FlockOperation::LockShared)?; + self.collection_cutoff()?; if !self.root.join(BATCH_FILE).exists() { return Ok(lock); } @@ -1226,8 +1377,18 @@ impl FileGatewayAttemptStore { }) .collect::, GatewayAttemptError>>()?; let _lock = self.exclusive()?; - for (index, (name, _)) in files.iter().enumerate() { - if self.root.join(name).exists() { + let cutoff = self.collection_cutoff()?; + for entry in entries { + if let Some(expiry) = entry.expires_at + && !gateway_window_open(expiry, cutoff) + { + return Ok(GatewayInsert::ClosedWindow { + collected_through: cutoff.ok_or(GatewayAttemptError::Corrupt)?, + }); + } + } + for (index, entry) in entries.iter().enumerate() { + if self.key_exists(&entry.key)? { return Ok(GatewayInsert::Exists { index }); } } @@ -1310,6 +1471,14 @@ impl GatewayAttemptStore for FileGatewayAttemptStore { validate_batch(std::slice::from_ref(entry))?; let bytes = Self::file_bytes(entry)?; let _lock = self.exclusive()?; + if let Some(expiry) = entry.expires_at + && !gateway_window_open(expiry, self.collection_cutoff()?) + { + return Err(GatewayAttemptError::InvalidTransition); + } + if self.key_exists(&entry.key)? { + return Err(GatewayAttemptError::Replay); + } match self .pending(&bytes)? .persist_noclobber(self.path_for(entry.kind, &entry.key)) @@ -1329,13 +1498,17 @@ impl GatewayAttemptStore for FileGatewayAttemptStore { ) -> Result>, GatewayAttemptError> { let _lock = self.shared()?; let path = self.path_for(kind, key); - if kind.expires() { + let record = if kind.expires() { Self::read_file(&path, MAX_SLOT_FILE_BYTES)? .map(|bytes| Self::decode_slot(&bytes).map(|(_, record)| record)) .transpose() } else { Self::read_file(&path, MAX_RECORD_BYTES) + }?; + if record.is_none() && self.key_exists(key)? { + return Err(GatewayAttemptError::Corrupt); } + Ok(record) } fn replace( @@ -1364,6 +1537,7 @@ impl GatewayAttemptStore for FileGatewayAttemptStore { fn sweep_expired(&self, now: u64, limit: usize) -> Result { let _lock = self.exclusive()?; + self.publish_collection(now)?; let mut names: Vec = fs::read_dir(&self.root) .map_err(|_| GatewayAttemptError::Unavailable)? .map(|entry| { @@ -1471,6 +1645,9 @@ impl GatewayAttemptStore for PostgresGatewayAttemptStore { match self.store()?.insert_gateway_records(&mechanism) { Ok(GatewayRecordInsert::Inserted) => Ok(GatewayInsert::Inserted), Ok(GatewayRecordInsert::Exists { index }) => Ok(GatewayInsert::Exists { index }), + Ok(GatewayRecordInsert::ClosedWindow { collected_through }) => { + Ok(GatewayInsert::ClosedWindow { collected_through }) + } Err(error) => Err(postgres_error(error)), } } @@ -2044,7 +2221,8 @@ fn sync_directory(root: &Path) -> Result<(), GatewayAttemptError> { const COUNT_SLOT_SCHEMA: &str = "auths.gateway-bounded-count/2"; const SUM_SLOT_SCHEMA: &str = "auths.gateway-bounded-sum/1"; /// A claim that keeps losing slot races gives up after this many rounds and -/// stores nothing. +/// grants no execution handle. Storage may have committed before reporting +/// an error; retries must retain the same logical operation identity. const MAX_CLAIM_ROUNDS: usize = 32; /// Slot record `auths.gateway-bounded-count/2`. @@ -2110,17 +2288,13 @@ fn frontier( bound: u64, slot_key: fn(&[u8; 32], u64) -> [u8; 32], ) -> Result { - let (mut low, mut high) = (0_u64, bound); - while low < high { - let middle = low + (high - low) / 2; - let key = GatewayAttemptKey(slot_key(counter, middle)); - if store.load(kind, &key)?.is_some() { - low = middle + 1; - } else { - high = middle; - } + let mut search = auths_gateway_kernel::frontier::FrontierSearch::new(bound); + while let Some(slot) = search.probe() { + let key = GatewayAttemptKey(slot_key(counter, slot)); + let occupied = store.load(kind, &key)?.is_some(); + search = search.observe(occupied); } - Ok(low) + Ok(search.candidate()) } /// The cumulative sum stored in slot `slot` of sum counter `counter`. An @@ -2136,14 +2310,19 @@ fn cumulative( .ok_or(GatewayAttemptError::Corrupt)?; let record: SumSlotRecord = serde_json::from_slice(&bytes).map_err(|_| GatewayAttemptError::Corrupt)?; - if record.schema != SUM_SLOT_SCHEMA - || record.counter != hex::encode(counter) - || record.slot != slot - || record.amount > record.cumulative - { - return Err(GatewayAttemptError::Corrupt); - } - Ok(record.cumulative) + auths_gateway_kernel::slot_record::validate_cumulative( + record.schema.as_bytes(), + SUM_SLOT_SCHEMA.as_bytes(), + record.counter.as_bytes(), + counter, + slot, + auths_gateway_kernel::slot_record::SumValues { + slot: record.slot, + amount: record.amount, + cumulative: record.cumulative, + }, + ) + .ok_or(GatewayAttemptError::Corrupt) } /// Stores `base` alone as `not-entered` with `code`. @@ -2177,28 +2356,31 @@ fn claim_batch( totals: &[u64], ) -> Result<(Record, Vec, Vec), GatewayAttemptError> { use crate::bounds::{count_slot_key, sum_slot_key}; + use auths_gateway_kernel::reservation_batch::{SlotEntry, build_batch}; + let batch = build_batch( + *key.as_bytes(), + &bound.counts, + counts, + &bound.sums, + sums, + totals, + bound.argument, + ) + .ok_or(GatewayAttemptError::Corrupt)?; let mut record = base.clone(); - let mut counters: Vec = bound - .counts - .iter() - .zip(counts) - .map(|(counter, slot)| GatewayCounterEntry { - kind: GatewayCounterKind::Count, - counter: counter.key, - slot: *slot, - }) - .chain( - bound - .sums - .iter() - .zip(sums) - .map(|(counter, slot)| GatewayCounterEntry { - kind: GatewayCounterKind::Sum, - counter: counter.key, - slot: *slot, - }), - ) - .collect(); + let mut counters = Vec::new(); + for entry in &batch { + let (kind, counter, slot) = match entry { + SlotEntry::Claim { .. } => continue, + SlotEntry::Count { counter, slot } => (GatewayCounterKind::Count, *counter, *slot), + SlotEntry::Sum { counter, slot, .. } => (GatewayCounterKind::Sum, *counter, *slot), + }; + counters.push(GatewayCounterEntry { + kind, + counter, + slot, + }); + } counters.sort_unstable(); record.counters = counters .iter() @@ -2211,63 +2393,90 @@ fn claim_batch( record.snapshot(false)?; let stored = encode(&record)?; let claim = hex::encode(key.as_bytes()); - let mut entries = Vec::with_capacity(1 + counts.len() + sums.len()); - entries.push(GatewayRecordEntry { - kind: GatewayRecordKind::Attempt, - key, - record: stored.clone(), - expires_at: None, - }); - for (counter, slot) in bound.counts.iter().zip(counts) { - let slot_record = CountSlotRecord { - schema: COUNT_SLOT_SCHEMA.to_owned(), - counter: hex::encode(counter.key), - slot: *slot, - window_seconds: bound.window_seconds, - window_index: bound.window_index, - window_end: bound.window_end, - namespace: base.namespace.clone(), - operation_id: base.operation_id.clone(), - claim: claim.clone(), - }; - entries.push(GatewayRecordEntry { - kind: GatewayRecordKind::CountSlot, - key: GatewayAttemptKey(count_slot_key(&counter.key, *slot)), - record: canonical(&slot_record)?, - expires_at: Some(bound.expires_at()), - }); - } - for ((counter, slot), total) in bound.sums.iter().zip(sums).zip(totals) { - let slot_record = SumSlotRecord { - schema: SUM_SLOT_SCHEMA.to_owned(), - counter: hex::encode(counter.key), - slot: *slot, - amount: bound.argument, - cumulative: total - .checked_add(bound.argument) - .ok_or(GatewayAttemptError::Corrupt)?, - window_seconds: bound.window_seconds, - window_index: bound.window_index, - window_end: bound.window_end, - namespace: base.namespace.clone(), - operation_id: base.operation_id.clone(), - claim: claim.clone(), - }; - entries.push(GatewayRecordEntry { - kind: GatewayRecordKind::SumSlot, - key: GatewayAttemptKey(sum_slot_key(&counter.key, *slot)), - record: canonical(&slot_record)?, - expires_at: Some(bound.expires_at()), - }); + let mut entries = Vec::with_capacity(batch.len()); + for entry in batch { + match entry { + SlotEntry::Claim { key: claim_key } => entries.push(GatewayRecordEntry { + kind: GatewayRecordKind::Attempt, + key: GatewayAttemptKey(claim_key), + record: stored.clone(), + expires_at: None, + }), + SlotEntry::Count { counter, slot } => { + let slot_record = CountSlotRecord { + schema: COUNT_SLOT_SCHEMA.to_owned(), + counter: hex::encode(counter), + slot, + window_seconds: bound.window_seconds, + window_index: bound.window_index, + window_end: bound.window_end, + namespace: base.namespace.clone(), + operation_id: base.operation_id.clone(), + claim: claim.clone(), + }; + entries.push(GatewayRecordEntry { + kind: GatewayRecordKind::CountSlot, + key: GatewayAttemptKey(count_slot_key(&counter, slot)), + record: canonical(&slot_record)?, + expires_at: Some(bound.expires_at()), + }); + } + SlotEntry::Sum { + counter, + slot, + amount, + cumulative, + } => { + let slot_record = SumSlotRecord { + schema: SUM_SLOT_SCHEMA.to_owned(), + counter: hex::encode(counter), + slot, + amount, + cumulative, + window_seconds: bound.window_seconds, + window_index: bound.window_index, + window_end: bound.window_end, + namespace: base.namespace.clone(), + operation_id: base.operation_id.clone(), + claim: claim.clone(), + }; + entries.push(GatewayRecordEntry { + kind: GatewayRecordKind::SumSlot, + key: GatewayAttemptKey(sum_slot_key(&counter, slot)), + record: canonical(&slot_record)?, + expires_at: Some(bound.expires_at()), + }); + } + } } Ok((record, stored, entries)) } +/// Parallel capacity views for the pure reservation decision. Compute them +/// once per reservation, retaining them across every slot-conflict retry. +struct ReservationLimits { + counts: Vec, + sums: Vec, + slots: Vec, +} + +fn reservation_limits(bound: &crate::bounds::BoundAdmission) -> ReservationLimits { + ReservationLimits { + counts: bound + .counts + .iter() + .map(|counter| counter.capacity) + .collect(), + sums: bound.sums.iter().map(|counter| counter.capacity).collect(), + slots: bound.sums.iter().map(|counter| counter.slots).collect(), + } +} + /// Finds each counter's frontier, then inserts the claim and one slot per /// count and sum counter in one all-or-none batch. A full counter stores /// the claim alone as `not-entered`; a lost race advances that counter and /// retries, at most [`MAX_CLAIM_ROUNDS`] times. The count and sum checks are -/// the translated leaves `chain_counts_admit` and `chain_sums_admit`. +/// combined by the translated complete `reservation_admission` decision. fn reserve_with_claim( store: &dyn GatewayAttemptStore, key: GatewayAttemptKey, @@ -2275,7 +2484,7 @@ fn reserve_with_claim( bound: &crate::bounds::BoundAdmission, ) -> Result { use crate::bounds::{count_slot_key, sum_slot_key}; - use auths_bounded_policy::kernel::{chain_counts_admit, chain_sums_admit}; + use auths_bounded_policy::kernel::{ReservationCode, reservation_admission}; let mut counts = bound .counts .iter() @@ -2310,47 +2519,61 @@ fn reserve_with_claim( Some(previous) => cumulative(store, &counter.key, previous), }) .collect::, _>>()?; - let count_capacities: Vec = bound - .counts - .iter() - .map(|counter| counter.capacity) - .collect(); - let sum_capacities: Vec = bound.sums.iter().map(|counter| counter.capacity).collect(); + let limits = reservation_limits(bound); for _ in 0..MAX_CLAIM_ROUNDS { - let sum_slots_left = sums - .iter() - .zip(&bound.sums) - .all(|(slot, counter)| *slot < counter.slots); - if !chain_counts_admit(&counts, &count_capacities) || !sum_slots_left { - return store_exhausted(store, key, base, "gateway.policy.window-exhausted"); - } - if !chain_sums_admit(&totals, bound.argument, &sum_capacities) { - return store_exhausted(store, key, base, "gateway.policy.sum-exhausted"); + match reservation_admission( + &counts, + &limits.counts, + &sums, + &limits.slots, + &totals, + &limits.sums, + bound.argument, + ) { + ReservationCode::WindowExhausted => { + return store_exhausted(store, key, base, "gateway.policy.window-exhausted"); + } + ReservationCode::SumExhausted => { + return store_exhausted(store, key, base, "gateway.policy.sum-exhausted"); + } + ReservationCode::Admit => {} } let (record, stored, entries) = claim_batch(key, base, bound, &counts, &sums, &totals)?; match store.insert_all(&entries)? { + GatewayInsert::ClosedWindow { .. } => { + return store_exhausted(store, key, base, "gateway.policy.window-exhausted"); + } GatewayInsert::Inserted => { return Ok(Reserved::Claimed { stored, record: Box::new(record), }); } - GatewayInsert::Exists { index: 0 } => return Err(GatewayAttemptError::Replay), GatewayInsert::Exists { index } => { - let position = index - 1; - if let Some(slot) = counts.get_mut(position) { - *slot += 1; - } else { - let position = position - counts.len(); - let (Some(slot), Some(total), Some(counter)) = ( - sums.get_mut(position), - totals.get_mut(position), - bound.sums.get(position), - ) else { - return Err(GatewayAttemptError::Corrupt); - }; - *total = cumulative(store, &counter.key, *slot)?; - *slot += 1; + use auths_gateway_kernel::reservation_retry::{RetryTarget, retry_target}; + match retry_target(index, &counts, &sums, totals.len(), bound.sums.len()) { + RetryTarget::Replay => return Err(GatewayAttemptError::Replay), + RetryTarget::Corrupt => return Err(GatewayAttemptError::Corrupt), + RetryTarget::Count { position, next } => { + *counts + .get_mut(position) + .ok_or(GatewayAttemptError::Corrupt)? = next; + } + RetryTarget::Sum { + position, + read_slot, + next, + } => { + let counter = bound + .sums + .get(position) + .ok_or(GatewayAttemptError::Corrupt)?; + let total = cumulative(store, &counter.key, read_slot)?; + *totals + .get_mut(position) + .ok_or(GatewayAttemptError::Corrupt)? = total; + *sums.get_mut(position).ok_or(GatewayAttemptError::Corrupt)? = next; + } } } } @@ -2365,7 +2588,10 @@ impl GatewayAttempts { /// Slots are never released, and a replay consumes none. /// /// # Errors - /// An existing claim is `Replay`; a store failure stores nothing. + /// An existing claim is `Replay`. A store error grants no execution + /// handle and may follow a committed batch with a lost acknowledgement. + /// Retrying preserves the logical operation identity and cannot reclaim + /// ownership of a batch that already committed. pub(crate) async fn claim_bounded( &self, request: &ClosedProviderRequest, @@ -2400,3 +2626,402 @@ impl GatewayAttempts { }) } } + +#[cfg(test)] +mod logical_identity_framing_tests { + use super::*; + + #[test] + fn extracted_preimage_preserves_operation_keys() { + let maximum_namespace = "n".repeat(64); + let maximum_operation = "o".repeat(128); + for namespace in [ + "operator", + "stripe-receivables-test", + maximum_namespace.as_str(), + ] { + for operation in [ + "payment-1", + "allocation-pi_example", + maximum_operation.as_str(), + ] { + let parsed_namespace = OperatorNamespace::parse(namespace).unwrap(); + let parsed_operation = LogicalOperationId::parse(operation).unwrap(); + let mut reference = Sha256::new(); + reference.update(b"auths.gateway-logical-operation/1\0"); + reference.update(namespace.as_bytes()); + reference.update([0]); + reference.update(operation.as_bytes()); + let expected: [u8; 32] = reference.finalize().into(); + assert_eq!( + GatewayAttemptKey::for_operation(&parsed_namespace, &parsed_operation), + GatewayAttemptKey(expected) + ); + } + } + } +} + +#[cfg(test)] +mod complete_batch_parity { + use super::*; + + fn original_claim_batch( + key: GatewayAttemptKey, + base: &Record, + bound: &crate::bounds::BoundAdmission, + counts: &[u64], + sums: &[u64], + totals: &[u64], + ) -> Result<(Record, Vec, Vec), GatewayAttemptError> { + use crate::bounds::{count_slot_key, sum_slot_key}; + let mut record = base.clone(); + let mut counters: Vec = bound + .counts + .iter() + .zip(counts) + .map(|(counter, slot)| GatewayCounterEntry { + kind: GatewayCounterKind::Count, + counter: counter.key, + slot: *slot, + }) + .chain( + bound + .sums + .iter() + .zip(sums) + .map(|(counter, slot)| GatewayCounterEntry { + kind: GatewayCounterKind::Sum, + counter: counter.key, + slot: *slot, + }), + ) + .collect(); + counters.sort_unstable(); + record.counters = counters + .iter() + .map(|entry| CounterWire { + kind: entry.kind, + counter: hex::encode(entry.counter), + slot: entry.slot, + }) + .collect(); + record.snapshot(false)?; + let stored = encode(&record)?; + let claim = hex::encode(key.as_bytes()); + let mut entries = Vec::with_capacity(1 + counts.len() + sums.len()); + entries.push(GatewayRecordEntry { + kind: GatewayRecordKind::Attempt, + key, + record: stored.clone(), + expires_at: None, + }); + for (counter, slot) in bound.counts.iter().zip(counts) { + let slot_record = CountSlotRecord { + schema: COUNT_SLOT_SCHEMA.to_owned(), + counter: hex::encode(counter.key), + slot: *slot, + window_seconds: bound.window_seconds, + window_index: bound.window_index, + window_end: bound.window_end, + namespace: base.namespace.clone(), + operation_id: base.operation_id.clone(), + claim: claim.clone(), + }; + entries.push(GatewayRecordEntry { + kind: GatewayRecordKind::CountSlot, + key: GatewayAttemptKey(count_slot_key(&counter.key, *slot)), + record: canonical(&slot_record)?, + expires_at: Some(bound.expires_at()), + }); + } + for ((counter, slot), total) in bound.sums.iter().zip(sums).zip(totals) { + let slot_record = SumSlotRecord { + schema: SUM_SLOT_SCHEMA.to_owned(), + counter: hex::encode(counter.key), + slot: *slot, + amount: bound.argument, + cumulative: total + .checked_add(bound.argument) + .ok_or(GatewayAttemptError::Corrupt)?, + window_seconds: bound.window_seconds, + window_index: bound.window_index, + window_end: bound.window_end, + namespace: base.namespace.clone(), + operation_id: base.operation_id.clone(), + claim: claim.clone(), + }; + entries.push(GatewayRecordEntry { + kind: GatewayRecordKind::SumSlot, + key: GatewayAttemptKey(sum_slot_key(&counter.key, *slot)), + record: canonical(&slot_record)?, + expires_at: Some(bound.expires_at()), + }); + } + Ok((record, stored, entries)) + } + + fn base() -> Record { + Record { + schema: SCHEMA.to_owned(), + namespace: "batch-parity".to_owned(), + operation_id: "operation-1".to_owned(), + action_commitment: hex::encode([3; 32]), + recipe_digest: hex::encode([4; 32]), + nonce: hex::encode([5; 16]), + evaluated_at: 100, + stage: GatewayAttemptStage::Attempting, + refusal: None, + counters: Vec::new(), + response_status: None, + response_digest: None, + response_locator: None, + observation_plan: None, + observation_match: None, + observation_fact: None, + provider_evidence: None, + pre_entry: None, + } + } + + #[test] + fn complete_shipping_batch_preserves_all_records_keys_and_expiries() { + for count in 0..=crate::bounds::MAX_BOUNDED_LINKS { + for sum in 0..=crate::bounds::MAX_BOUNDED_LINKS { + let bound = crate::bounds::BoundAdmission { + links: Vec::new(), + argument: 5, + window_seconds: 60, + window_index: 1, + window_end: 120, + counts: (0..count) + .map(|index| crate::bounds::CountCounter { + key: [u8::try_from(index).expect("small index"); 32], + capacity: u64::MAX, + }) + .collect(), + sums: (0..sum) + .map(|index| crate::bounds::SumCounter { + key: [128 + u8::try_from(index).expect("small index"); 32], + capacity: u64::MAX, + slots: u64::MAX, + }) + .collect(), + }; + let counts: Vec<_> = (0..count) + .map(|index| u64::try_from(index).expect("small index")) + .collect(); + let sums: Vec<_> = (0..sum) + .map(|index| u64::try_from(index).expect("small index")) + .collect(); + let totals = vec![10; sum]; + let key = GatewayAttemptKey([42; 32]); + let actual = + claim_batch(key, &base(), &bound, &counts, &sums, &totals).expect("batch"); + let expected = original_claim_batch(key, &base(), &bound, &counts, &sums, &totals) + .expect("old batch"); + assert_eq!( + encode(&actual.0).expect("record"), + encode(&expected.0).expect("old record") + ); + assert_eq!(actual.1, expected.1); + assert_eq!(actual.2, expected.2); + assert_eq!(actual.2.len(), 1 + count + sum); + } + } + } + + #[test] + fn mismatched_vectors_cannot_omit_a_required_slot() { + let bound = crate::bounds::BoundAdmission { + links: Vec::new(), + argument: 1, + window_seconds: 60, + window_index: 1, + window_end: 120, + counts: vec![crate::bounds::CountCounter { + key: [1; 32], + capacity: 2, + }], + sums: vec![crate::bounds::SumCounter { + key: [2; 32], + capacity: 2, + slots: 2, + }], + }; + for (counts, sums, totals) in [ + (vec![], vec![0], vec![0]), + (vec![0], vec![], vec![0]), + (vec![0], vec![0], vec![]), + ] { + assert!(matches!( + claim_batch( + GatewayAttemptKey([42; 32]), + &base(), + &bound, + &counts, + &sums, + &totals + ), + Err(GatewayAttemptError::Corrupt) + )); + } + } +} + +#[cfg(test)] +mod cumulative_record_parity { + use super::*; + + fn inject_decoded(store: &FileGatewayAttemptStore, key: GatewayAttemptKey, record: Vec) { + let entry = GatewayRecordEntry { + kind: GatewayRecordKind::SumSlot, + key, + record, + expires_at: Some(60), + }; + fs::write( + store.path_for(GatewayRecordKind::SumSlot, &key), + FileGatewayAttemptStore::file_bytes(&entry).expect("slot expiry envelope"), + ) + .expect("inject decoded fixture"); + } + + // Frozen pre-cutover reader: includes storage lookup and serde decoding, + // so parity exercises the shipping adapter as well as the pure predicate. + fn original_cumulative( + store: &dyn GatewayAttemptStore, + counter: &[u8; 32], + slot: u64, + ) -> Result { + let key = GatewayAttemptKey(crate::bounds::sum_slot_key(counter, slot)); + let bytes = store + .load(GatewayRecordKind::SumSlot, &key)? + .ok_or(GatewayAttemptError::Corrupt)?; + let record: SumSlotRecord = + serde_json::from_slice(&bytes).map_err(|_| GatewayAttemptError::Corrupt)?; + if record.schema != SUM_SLOT_SCHEMA + || record.counter != hex::encode(counter) + || record.slot != slot + || record.amount > record.cumulative + { + return Err(GatewayAttemptError::Corrupt); + } + Ok(record.cumulative) + } + + #[test] + fn shipping_cumulative_reader_preserves_exact_decoded_acceptance() { + let directory = tempfile::tempdir().expect("temporary state"); + let store = FileGatewayAttemptStore::open( + fs::canonicalize(directory.path()) + .expect("canonical") + .join("state"), + ) + .expect("store"); + let counter = [0xab; 32]; + let canonical = hex::encode(counter); + let mut accepted = 0; + let mut refused = 0; + for expected_slot in [0, 1, u64::MAX] { + let key = GatewayAttemptKey(crate::bounds::sum_slot_key(&counter, expected_slot)); + for schema in [SUM_SLOT_SCHEMA, "wrong"] { + for stored_counter in [canonical.as_str(), "wrong", &canonical.to_uppercase()] { + for slot in [0, 1, u64::MAX] { + for amount in [0, 1, u64::MAX] { + for total in [0, 1, u64::MAX] { + let record = SumSlotRecord { + schema: schema.to_owned(), + counter: stored_counter.to_owned(), + slot, + amount, + cumulative: total, + window_seconds: 60, + window_index: 0, + window_end: 60, + namespace: "test".to_owned(), + operation_id: "test".to_owned(), + claim: "00".repeat(32), + }; + inject_decoded( + &store, + key, + serde_json::to_vec(&record).expect("encode"), + ); + let expected = if schema == SUM_SLOT_SCHEMA + && stored_counter == canonical + && slot == expected_slot + && amount <= total + { + accepted += 1; + Ok(total) + } else { + refused += 1; + Err(GatewayAttemptError::Corrupt) + }; + assert_eq!( + original_cumulative(&store, &counter, expected_slot), + expected + ); + assert_eq!(cumulative(&store, &counter, expected_slot), expected); + } + } + } + } + } + } + assert_eq!((accepted, refused), (18, 468)); + } + + #[test] + fn shipping_cumulative_reader_refuses_missing_and_malformed_records() { + let directory = tempfile::tempdir().expect("temporary state"); + let store = FileGatewayAttemptStore::open( + fs::canonicalize(directory.path()) + .expect("canonical") + .join("state"), + ) + .expect("store"); + let counter = [0; 32]; + let key = GatewayAttemptKey(crate::bounds::sum_slot_key(&counter, 0)); + assert_eq!( + cumulative(&store, &counter, 0), + Err(GatewayAttemptError::Corrupt) + ); + let valid = serde_json::to_string(&SumSlotRecord { + schema: SUM_SLOT_SCHEMA.to_owned(), + counter: hex::encode(counter), + slot: 0, + amount: 3, + cumulative: 7, + window_seconds: 60, + window_index: 0, + window_end: 60, + namespace: "test".to_owned(), + operation_id: "test".to_owned(), + claim: "00".repeat(32), + }) + .expect("valid baseline"); + inject_decoded(&store, key, valid.as_bytes().to_vec()); + assert_eq!(cumulative(&store, &counter, 0), Ok(7)); + // Every mutation retains all other required fields, so it must fail + // for the mutated property rather than for an unrelated missing field. + for malformed in [ + "not-json".to_owned(), + valid.replacen("\"schema\":", "\"schema\":\"wrong\",\"schema\":", 1), + valid.replacen("\"slot\":0", "\"slot\":18446744073709551616", 1), + valid.replacen("\"amount\":3", "\"amount\":-1", 1), + valid.replacen('{', "{\"unknown\":true,", 1), + ] { + inject_decoded(&store, key, malformed.into_bytes()); + assert_eq!( + cumulative(&store, &counter, 0), + Err(GatewayAttemptError::Corrupt) + ); + assert_eq!( + cumulative(&store, &counter, 0), + original_cumulative(&store, &counter, 0) + ); + } + } +} diff --git a/product/runtime/auths-gateway/src/submit.rs b/product/runtime/auths-gateway/src/submit.rs index 1c8031e78..1eb9ecf4e 100644 --- a/product/runtime/auths-gateway/src/submit.rs +++ b/product/runtime/auths-gateway/src/submit.rs @@ -87,7 +87,11 @@ pub(crate) trait SubmitIo { /// Whether entry is still within the deadline after `evaluated_at`, on /// the gateway clock and on the monotonic clock started with the /// submission. - fn within_entry_deadline(&self, evaluated_at: u64) -> bool; + fn within_entry_deadline( + &self, + evaluated_at: u64, + bound: auths_gateway_kernel::deadline::EntryBound, + ) -> bool; /// Sends the one write under `lease`. async fn write( @@ -394,7 +398,10 @@ impl Run<'_, I> { None => false, }), SubmitAction::CheckDeadline => { - SubmitEvent::Deadline(self.io.within_entry_deadline(self.evaluated_at)) + SubmitEvent::Deadline(self.verified.as_ref().is_some_and(|verified| { + self.io + .within_entry_deadline(self.evaluated_at, verified.entry_not_after) + })) } SubmitAction::Send => SubmitEvent::Write(self.send().await), SubmitAction::RecordResponse => { diff --git a/product/stores/auths-stores/migrations/postgres_lifecycle_v6.sql b/product/stores/auths-stores/migrations/postgres_lifecycle_v7.sql similarity index 82% rename from product/stores/auths-stores/migrations/postgres_lifecycle_v6.sql rename to product/stores/auths-stores/migrations/postgres_lifecycle_v7.sql index ed41d489c..5fb02e4d6 100644 --- a/product/stores/auths-stores/migrations/postgres_lifecycle_v6.sql +++ b/product/stores/auths-stores/migrations/postgres_lifecycle_v7.sql @@ -1,13 +1,13 @@ CREATE TABLE auths_lifecycle_store_meta ( singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton), - schema_version INTEGER NOT NULL CHECK (schema_version = 6), + schema_version INTEGER NOT NULL CHECK (schema_version = 7), contract_id TEXT NOT NULL CHECK ( - contract_id = 'auths.lifecycle.transactional-store/4' + contract_id = 'auths.lifecycle.transactional-store/5' ) ); INSERT INTO auths_lifecycle_store_meta (singleton, schema_version, contract_id) -VALUES (TRUE, 6, 'auths.lifecycle.transactional-store/4'); +VALUES (TRUE, 7, 'auths.lifecycle.transactional-store/5'); CREATE TABLE auths_lifecycle_records ( workflow_id TEXT PRIMARY KEY CHECK ( @@ -68,3 +68,10 @@ CREATE TABLE auths_gateway_records ( CREATE INDEX auths_gateway_records_expiry ON auths_gateway_records (expires_at) WHERE record_kind IN ('count-slot', 'sum-slot'); + +CREATE TABLE auths_gateway_collection ( + singleton BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (singleton), + collected_through BIGINT NULL CHECK (collected_through IS NULL OR collected_through >= 0) +); + +INSERT INTO auths_gateway_collection (singleton, collected_through) VALUES (TRUE, NULL); diff --git a/product/stores/auths-stores/src/gateway_attempt.rs b/product/stores/auths-stores/src/gateway_attempt.rs index d5d3732b4..776323fda 100644 --- a/product/stores/auths-stores/src/gateway_attempt.rs +++ b/product/stores/auths-stores/src/gateway_attempt.rs @@ -6,8 +6,9 @@ //! owns every record format, its stages, and which replacements are valid. use crate::lifecycle::{PostgresLifecycleStore, map_postgres_error}; +use crate::{advance_gateway_collection, gateway_window_open}; use auths_lifecycle::StoreError; -use postgres::IsolationLevel; +use postgres::{IsolationLevel, Transaction}; use sha2::{Digest as _, Sha256}; /// Largest gateway record the schema accepts. @@ -131,6 +132,33 @@ pub enum GatewayRecordInsert { /// The index, in the caller's order, of an entry whose key existed. index: usize, }, + /// A slot expires at or before the shared collection cutoff; no entry + /// was inserted, even if that slot's former row has already been deleted. + ClosedWindow { + /// The durable cutoff observed inside the insertion transaction. + collected_through: u64, + }, +} + +fn collection_cutoff( + sql: &mut Transaction<'_>, + exclusive: bool, +) -> Result, StoreError> { + let query = if exclusive { + "SELECT collected_through FROM auths_gateway_collection + WHERE singleton = TRUE FOR UPDATE" + } else { + "SELECT collected_through FROM auths_gateway_collection + WHERE singleton = TRUE FOR SHARE" + }; + let row = sql + .query_opt(query, &[]) + .map_err(|error| map_postgres_error(&error))? + .ok_or(StoreError::Corrupt)?; + let cutoff: Option = row.try_get(0).map_err(|_| StoreError::Corrupt)?; + cutoff + .map(|value| u64::try_from(value).map_err(|_| StoreError::Corrupt)) + .transpose() } impl PostgresLifecycleStore { @@ -141,7 +169,9 @@ impl PostgresLifecycleStore { /// # Errors /// /// Returns a bound failure before any database call, and a closed store - /// error when the database is unavailable. + /// error when the database is unavailable. An error may follow a commit + /// whose acknowledgement was lost; callers must not infer absent keys or + /// grant an execution handle from that error. pub fn insert_gateway_records( &self, entries: &[GatewayRecordEntry], @@ -155,6 +185,18 @@ impl PostgresLifecycleStore { .isolation_level(IsolationLevel::ReadCommitted) .start() .map_err(|error| map_postgres_error(&error))?; + // The shared row lock orders this conditional batch against every + // collector. It is held until all inserts commit or roll back. + let cutoff = collection_cutoff(&mut sql, false)?; + for entry in entries { + if let Some(expiry) = entry.expires_at + && !gateway_window_open(expiry, cutoff) + { + let collected_through = cutoff.ok_or(StoreError::Corrupt)?; + sql.rollback().map_err(|error| map_postgres_error(&error))?; + return Ok(GatewayRecordInsert::ClosedWindow { collected_through }); + } + } for index in order { let entry = &entries[index]; let digest: [u8; 32] = Sha256::digest(&entry.record).into(); @@ -301,7 +343,8 @@ impl PostgresLifecycleStore { /// Deletes at most `limit` slots whose expiry is at or before `now`, /// through the expiry index, and returns how many were deleted. Attempts - /// and connection records are never swept. + /// and connection records are never swept. The same transaction publishes + /// a monotone collection cutoff, even when `limit` is zero. /// /// # Errors /// @@ -312,10 +355,23 @@ impl PostgresLifecycleStore { now: u64, limit: usize, ) -> Result { - let now = i64::try_from(now).map_err(|_| StoreError::LimitExceeded)?; + let now_sql = i64::try_from(now).map_err(|_| StoreError::LimitExceeded)?; let limit = i64::try_from(limit).map_err(|_| StoreError::LimitExceeded)?; let mut client = self.pool.get().map_err(|_| StoreError::PoolExhausted)?; - let deleted = client + let mut sql = client + .build_transaction() + .isolation_level(IsolationLevel::ReadCommitted) + .start() + .map_err(|error| map_postgres_error(&error))?; + let previous = collection_cutoff(&mut sql, true)?; + let next = i64::try_from(advance_gateway_collection(previous, now)) + .map_err(|_| StoreError::Corrupt)?; + sql.execute( + "UPDATE auths_gateway_collection SET collected_through = $1 WHERE singleton = TRUE", + &[&next], + ) + .map_err(|error| map_postgres_error(&error))?; + let deleted = sql .execute( "DELETE FROM auths_gateway_records WHERE record_key IN ( @@ -324,9 +380,12 @@ impl PostgresLifecycleStore { ORDER BY expires_at LIMIT $2 )", - &[&now, &limit], + &[&now_sql, &limit], ) .map_err(|error| map_postgres_error(&error))?; + // Both effects become visible at this commit. A lost acknowledgement + // may leave both committed, never deletion without its durable fence. + sql.commit().map_err(|error| map_postgres_error(&error))?; usize::try_from(deleted).map_err(|_| StoreError::Corrupt) } } @@ -361,7 +420,7 @@ mod tests { bounded(&vec![0; MAX_GATEWAY_RECORD_BYTES + 1]), Err(StoreError::LimitExceeded) ); - let schema = include_str!("../migrations/postgres_lifecycle_v6.sql"); + let schema = include_str!("../migrations/postgres_lifecycle_v7.sql"); assert!( schema.contains("octet_length(record_bytes) BETWEEN 1 AND 262144"), "the schema bound and the Rust bound are the same" diff --git a/product/stores/auths-stores/src/gateway_fence.rs b/product/stores/auths-stores/src/gateway_fence.rs new file mode 100644 index 000000000..24634bc3c --- /dev/null +++ b/product/stores/auths-stores/src/gateway_fence.rs @@ -0,0 +1,23 @@ +//! Pure collection-fence decisions shared by both gateway stores. + +/// Whether a slot may be inserted after the durable collection +/// cutoff. The caller must read the durable cutoff in the same critical +/// section or transaction that inserts the batch. +#[must_use] +pub fn gateway_window_open(expires_at: u64, collected_through: Option) -> bool { + match collected_through { + None => true, + Some(cutoff) => expires_at > cutoff, + } +} + +/// Advances the durable collection cutoff without allowing an older worker's +/// clock sample to move it backwards. Publication must precede deletion, or +/// be committed atomically with it. +#[must_use] +pub fn advance_gateway_collection(current: Option, requested: u64) -> u64 { + match current { + Some(previous) if previous > requested => previous, + _ => requested, + } +} diff --git a/product/stores/auths-stores/src/lib.rs b/product/stores/auths-stores/src/lib.rs index 89543419d..ba68a00bf 100644 --- a/product/stores/auths-stores/src/lib.rs +++ b/product/stores/auths-stores/src/lib.rs @@ -3,12 +3,14 @@ #![forbid(unsafe_code)] mod gateway_attempt; +mod gateway_fence; mod lifecycle; pub use gateway_attempt::{ GatewayRecordEntry, GatewayRecordInsert, GatewayRecordKind, MAX_GATEWAY_BATCH_ENTRIES, MAX_GATEWAY_RECORD_BYTES, validate_gateway_batch, }; +pub use gateway_fence::{advance_gateway_collection, gateway_window_open}; pub use lifecycle::{ InMemoryLifecycleStore, LifecycleCapacityRuleV1, LifecycleStoreConfigurationError, PersistentLifecycleStore, PostgresLifecycleStore, PostgresPoolConfig, PostgresServerName, diff --git a/product/stores/auths-stores/src/lifecycle.rs b/product/stores/auths-stores/src/lifecycle.rs index d289f80da..0684f6b12 100644 --- a/product/stores/auths-stores/src/lifecycle.rs +++ b/product/stores/auths-stores/src/lifecycle.rs @@ -34,9 +34,9 @@ use tokio_postgres_rustls::MakeRustlsConnect; const DATABASE_MAGIC: &[u8; 8] = b"AUTHSLF1"; const MAX_DATABASE_BYTES: usize = 256 * 1024 * 1024; const MAX_RECORD_BYTES: usize = auths_lifecycle::MAX_LIFECYCLE_RECORD_BYTES; -const SCHEMA_VERSION: i32 = 6; -const CONTRACT_ID: &str = "auths.lifecycle.transactional-store/4"; -const POSTGRES_SCHEMA: &str = include_str!("../migrations/postgres_lifecycle_v6.sql"); +const SCHEMA_VERSION: i32 = 7; +const CONTRACT_ID: &str = "auths.lifecycle.transactional-store/5"; +const POSTGRES_SCHEMA: &str = include_str!("../migrations/postgres_lifecycle_v7.sql"); /// One closed capacity rule configured by a domain registration. #[derive(Clone, Debug, Eq, PartialEq)] @@ -533,7 +533,7 @@ impl PostgresStoreSummary { /// Returns the physical schema identity. #[must_use] pub const fn schema_id(self) -> &'static str { - "auths.lifecycle.postgresql/6" + "auths.lifecycle.postgresql/7" } /// Returns the transactional store contract identity. @@ -705,7 +705,7 @@ impl PostgresLifecycleStore { } let state = self.pool.state(); Ok(PostgresStoreHealth { - schema_version: 6, + schema_version: 7, pool_connections: state.connections, pool_idle_connections: state.idle_connections, }) @@ -1033,7 +1033,8 @@ fn initialize_or_verify_schema( to_regclass('auths_lifecycle_records') IS NOT NULL, to_regclass('auths_recovery_references') IS NOT NULL, to_regclass('auths_recovery_leases') IS NOT NULL, - to_regclass('auths_gateway_records') IS NOT NULL", + to_regclass('auths_gateway_records') IS NOT NULL, + to_regclass('auths_gateway_collection') IS NOT NULL", &[], ) .map_err(|_| LifecycleStoreConfigurationError::DatabaseUnavailable)?; @@ -1052,14 +1053,18 @@ fn initialize_or_verify_schema( let gateway_records_exist: bool = tables .try_get(4) .map_err(|_| LifecycleStoreConfigurationError::DatabaseSchemaMismatch)?; + let gateway_collection_exists: bool = tables + .try_get(5) + .map_err(|_| LifecycleStoreConfigurationError::DatabaseSchemaMismatch)?; match ( metadata_exists, records_exist, references_exist, leases_exist, gateway_records_exist, + gateway_collection_exists, ) { - (false, false, false, false, false) => { + (false, false, false, false, false, false) => { let existing: i64 = client .query_one( "SELECT count(*) @@ -1076,7 +1081,7 @@ fn initialize_or_verify_schema( .batch_execute(POSTGRES_SCHEMA) .map_err(|_| LifecycleStoreConfigurationError::DatabaseUnavailable)?; } - (true, true, true, true, true) => {} + (true, true, true, true, true, true) => {} _ => return Err(LifecycleStoreConfigurationError::DatabaseSchemaMismatch), } verify_store_contract(client)?; @@ -1123,6 +1128,19 @@ fn verify_store_contract(client: &mut Client) -> Result<(), LifecycleStoreConfig if schema_version != SCHEMA_VERSION || contract_id != CONTRACT_ID { return Err(LifecycleStoreConfigurationError::DatabaseSchemaMismatch); } + let cutoff = client + .query_opt( + "SELECT collected_through FROM auths_gateway_collection WHERE singleton = TRUE", + &[], + ) + .map_err(|_| LifecycleStoreConfigurationError::DatabaseUnavailable)? + .ok_or(LifecycleStoreConfigurationError::DatabaseSchemaMismatch)?; + let cutoff: Option = cutoff + .try_get(0) + .map_err(|_| LifecycleStoreConfigurationError::DatabaseSchemaMismatch)?; + if cutoff.is_some_and(|value| value < 0) { + return Err(LifecycleStoreConfigurationError::DatabaseSchemaMismatch); + } Ok(()) } diff --git a/product/stores/auths-stores/tests/postgres_lifecycle.rs b/product/stores/auths-stores/tests/postgres_lifecycle.rs index a393cee7c..d70a93ef5 100644 --- a/product/stores/auths-stores/tests/postgres_lifecycle.rs +++ b/product/stores/auths-stores/tests/postgres_lifecycle.rs @@ -104,7 +104,8 @@ fn clean() { let mut client = admin_client(); client .batch_execute( - "DROP TABLE IF EXISTS auths_gateway_records; + "DROP TABLE IF EXISTS auths_gateway_collection; + DROP TABLE IF EXISTS auths_gateway_records; DROP TABLE IF EXISTS auths_recovery_leases; DROP TABLE IF EXISTS auths_recovery_references; DROP TABLE IF EXISTS auths_lifecycle_records; diff --git a/product/stores/auths-stores/tests/postgres_tls/README.md b/product/stores/auths-stores/tests/postgres_tls/README.md index c895aac86..382f62a6c 100644 --- a/product/stores/auths-stores/tests/postgres_tls/README.md +++ b/product/stores/auths-stores/tests/postgres_tls/README.md @@ -7,13 +7,17 @@ across three independent store instances. Run from the repository root: ```text +mkdir -p target/test-support/auths-stores/postgres-tls docker compose -f product/stores/auths-stores/tests/postgres_tls/compose.yaml up -d --wait AUTHS_POSTGRES_URL='host=localhost port=55438 dbname=auths_lifecycle user=auths password=local-fixture-password sslmode=require' \ -AUTHS_POSTGRES_CA_PEM="$PWD/product/stores/auths-stores/tests/postgres_tls/generated/ca.crt" \ +AUTHS_POSTGRES_CA_PEM="$PWD/target/test-support/auths-stores/postgres-tls/ca.crt" \ AUTHS_POSTGRES_SERVER_NAME=localhost \ cargo test -p auths-stores --test postgres_lifecycle -- --ignored docker compose -f product/stores/auths-stores/tests/postgres_tls/compose.yaml down -v ``` +Create the host directory before Docker starts so the runner retains ownership +of `target/` and can compile the test binaries. + The certificates and database are disposable. The harness records no customer data, credentials, actions, or receipt payloads. diff --git a/product/stores/auths-stores/tests/postgres_tls/compose.yaml b/product/stores/auths-stores/tests/postgres_tls/compose.yaml index 62fb890c8..21062f72d 100644 --- a/product/stores/auths-stores/tests/postgres_tls/compose.yaml +++ b/product/stores/auths-stores/tests/postgres_tls/compose.yaml @@ -6,7 +6,8 @@ services: user: root entrypoint: ["/bin/bash", "/fixture/generate-certificates.sh"] volumes: - - .:/fixture + - .:/fixture:ro + - ../../../../../target/test-support/auths-stores/postgres-tls:/certificates postgres: image: postgres:17.10-bookworm @@ -22,11 +23,11 @@ services: - -c - ssl=on - -c - - ssl_cert_file=/fixture/generated/server.crt + - ssl_cert_file=/certificates/server.crt - -c - - ssl_key_file=/fixture/generated/server.key + - ssl_key_file=/certificates/server.key - -c - - ssl_ca_file=/fixture/generated/ca.crt + - ssl_ca_file=/certificates/ca.crt - -c - synchronous_commit=on - -c @@ -39,7 +40,7 @@ services: ports: - "55438:5432" volumes: - - .:/fixture:ro + - ../../../../../target/test-support/auths-stores/postgres-tls:/certificates:ro - postgres-data:/var/lib/postgresql/data volumes: diff --git a/product/stores/auths-stores/tests/postgres_tls/generate-certificates.sh b/product/stores/auths-stores/tests/postgres_tls/generate-certificates.sh index 9c294cc4f..d98d3f004 100644 --- a/product/stores/auths-stores/tests/postgres_tls/generate-certificates.sh +++ b/product/stores/auths-stores/tests/postgres_tls/generate-certificates.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -output=/fixture/generated +output=/certificates mkdir -p "$output" rm -f "$output/ca.crt" "$output/ca.key" "$output/server.crt" "$output/server.csr" "$output/server.key" "$output/server.ext" diff --git a/qualification/families/airtable-record-update-v1/contract.json b/qualification/families/airtable-record-update-v1/contract.json index 73749c6dd..ce8585080 100644 --- a/qualification/families/airtable-record-update-v1/contract.json +++ b/qualification/families/airtable-record-update-v1/contract.json @@ -1 +1 @@ -{"api_release":"web-api-v0-reviewed-2026-10-07","corpus_manifest_sha256":"47f191e58efd16b0de63082484f7df56367c9f4842b9110a7cb2a7a1a5fe38e2","declarations":{"idempotency_sha256":"74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b","observation_sha256":"9dd79dd204fa13a2df3c667d106c66c0526d174a2c018631e2b2f6b897eaf311","recovery_sha256":"7081a92b4cd2d13dab5e7c30e640675a252b62bca20d340e14d62d9c8c048eca","retention_sha256":"4a4b5048c97b16e041af55b032c0b8ac20f5142c4bbcbf31b31c6674770a70d0"},"environment_class":"disposable-live-resources","manual_assumptions":["Airtable supplies no idempotency key for this PATCH; durable gateway admission prevents a second entry.","Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only a fresh GET with the exact replacement and echo can reconcile a lost response.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths.","The reviewed fixed Airtable base and table contain only owner-authorized disposable qualification records."],"oracle_version":"auths-reviewed-reference-v2","provider":"airtable","schema":"auths.provider-contract/1"} \ No newline at end of file +{"api_release":"web-api-v0-reviewed-2026-10-07","corpus_manifest_sha256":"e63cd3cf6553d987fcd36a15b80e33a6fa4cf28719746fa96579ee15c0a9d959","declarations":{"idempotency_sha256":"74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b","observation_sha256":"9dd79dd204fa13a2df3c667d106c66c0526d174a2c018631e2b2f6b897eaf311","recovery_sha256":"7081a92b4cd2d13dab5e7c30e640675a252b62bca20d340e14d62d9c8c048eca","retention_sha256":"4a4b5048c97b16e041af55b032c0b8ac20f5142c4bbcbf31b31c6674770a70d0"},"environment_class":"disposable-live-resources","manual_assumptions":["Airtable supplies no idempotency key for this PATCH; durable gateway admission prevents a second entry.","Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only a fresh GET with the exact replacement and echo can reconcile a lost response.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths.","The reviewed fixed Airtable base and table contain only owner-authorized disposable qualification records."],"oracle_version":"auths-reviewed-reference-v2","provider":"airtable","schema":"auths.provider-contract/1"} \ No newline at end of file diff --git a/qualification/families/airtable-record-update-v1/corpus-manifest.json b/qualification/families/airtable-record-update-v1/corpus-manifest.json index 2e8ea18b1..3d681f032 100644 --- a/qualification/families/airtable-record-update-v1/corpus-manifest.json +++ b/qualification/families/airtable-record-update-v1/corpus-manifest.json @@ -1 +1 @@ -{"compiled_corpus_schema":"auths.qualification-corpus/3","decision_record_sha256":"32241d9b4811a55abcdd224ef567df3857dbec34d761ef7a35d1044cdfa52d9f","family":"airtable-record-update-v1","maximum_credential_leases":64,"packet_plan_schema":"auths.qualification-packet-plan/4","phases":["offline","commissioning","live"],"profile_lock_sha256":"af7f984509ab11a3676cacc85eda2fa638c25bf91f7bfedf3ff3c119e47f3c41","public_packet_schema":"auths.qualification-public-packets/4","resource_count":16,"schema":"auths.qualification-reviewed-plan/1","source_files":{"airtable_record.py":"d5bf4d750fee75f02200d180f8654f426fe738bc86a281f1d015f391cc5e67fa","airtable_resources.py":"094f7d5c52a4557261c25fba6d5f1e4938091d946a05a422417b6dea22b7e76f","application_probe.py":"5e2dd6a91eb0a2acf2df1079cead5bd67ae5d6743abce6e48201e7326f63daa2","artifact_wait.py":"56efcf5a34103955e43c1d3be7fd58843efdc8095187d74dc890cf3342863f55","author_operator.py":"f3c66e5f6636bfdf317dc87915255f22a97466a34cbb5053b55cdf6e05d6921f","author_packets.py":"84d550b0f82c8501000ffde07ea13720f09caa9079b2c885f65a1f5cc08c2110","author_socket.py":"3d6a031c01d7d9a58213a8368f45b68c25081d059a8ff3cba4fe47c0f75a77fd","close_proposal.py":"9a6927722ada8eaba720ff13168101244880da3fe6f2c95f653bc3840ef81756","commission.py":"f4495d6e3d2b9c50e72e339e9571eacd9b3628ebebe7c86c601b94e785a5c9fd","common.py":"604d3d6598648fbc09611e663b4048b22fa748d0f6c6f1dbbceca5d83c02a2ce","controller_socket.py":"10519cc775e963360870eac51c7fcac1ffb988b04d5de89dac1dbf3524ba6531","custody_fault.py":"f5e95620a1bb3fccc733be13c6ab68b6e84c0b134a6b54252766e4e57410907f","expand.py":"892cf7b04c3847336f150926bfbf3e82665e9e2bc1b154be42e4f57d1922b816","family_corpus.py":"a3662539a9a130f5272cbd8b3750be3ebb46d4ad903aba7afa10880f99a2f601","family_harness.py":"0e0a42be6cf75dfb3f674b26cbdfbb4c473edea71083dfaad89ecb40dec039ba","family_operations.py":"3741c3fdbcc4ef884d36abc113706281b6dd409d90e6bbb3a4866b4a3d29beb6","fresh_evidence.py":"cb54ea66a4775c5af76fbc36c4f8c8a007c553de2b2303e80fd744aee1c54d2f","installed_submit.mjs":"9d57a91c4a052fbb9103582689ee99a6d087758dcfee00defa4c762b87187468","installed_submit.py":"f9151c2dffa1a02327b0ba05bdeb180654918a2b913195185a6649d010783dc7","journey_session.py":"3c807ce45dcabe3b39d63333872af3746fe9276aacf5eba30bf903b51d80dfef","measure.py":"b620be174bc012bc6b29f95e558fce1b6fb2cc99b5fa5a0f0c933c88696b4ca0","native_observation.py":"580fa1db01a6fa7691d618f123f9117ce39b25e6478460ceac46c1e650d6b454","network_fault.py":"94340720d8601f79ac77b95d1e855be25195c19b67db3103bbf054d82c02472b","packet_plan.py":"cf993ba17ba40bd528a08d446bfc7c2e8cf0291f3e202337bcfdafa4ab269a7c","production_environment.py":"607a0bc37396a5a86da1d408b384ee4a54d920b849009717587150242bd47d73","production_journey.py":"db7f6dc7f0fdc1b5acff1339cdf5bf7f11f3ba826aeca626a76d761bec0121a8","production_setup.py":"eac6cda2c2bff17364e72512b70ecfc3b6dad8c70088c1fe83d59f4ebaa395a0","provider_readback.py":"d576768208985b3544f146597d181d796f2a5e2eca5026dae3fa15cadcfe65b2","resource_io.py":"18d9b11674cc9f0df6c6050b375e476675735927bed03f5a94d78674d4a35885","resource_summary.py":"c75f3f23017529ce10197c09649e2d60b3c240b8b58992786b824e85869668e0","retained_author.py":"bfd01c7df44f5f525326dfbda13b5ebc6b854f15787a8b2923de883fe20fdcf9","sign_release.py":"d0aa7697cc6889538dfd54f9101a5b7bc2e8f7aede729da2d382b6466781df99","stripe_platform.py":"2da918e72f0ec3aed4f5a80701748e0d37c71292806bfa38c74ffbe69055c4ec","stripe_resources.py":"2e050b4f5f8654cfb3a7cf9ddaa73b3515a039d5b37071d2d9c0dbafe2561489","tls_fault.py":"10e125f9623bc32a420a1d83e6d46fe30aa1ca8ff4da97a3e2422fc0e11ec42d"},"source_recipe_sha256":"c0f21ff1d3c8e344fee20a9a0c25bb14a264417ed53418ad536789a6096fb16e"} \ No newline at end of file +{"compiled_corpus_schema":"auths.qualification-corpus/3","decision_record_sha256":"32241d9b4811a55abcdd224ef567df3857dbec34d761ef7a35d1044cdfa52d9f","family":"airtable-record-update-v1","maximum_credential_leases":64,"packet_plan_schema":"auths.qualification-packet-plan/4","phases":["offline","commissioning","live"],"profile_lock_sha256":"af7f984509ab11a3676cacc85eda2fa638c25bf91f7bfedf3ff3c119e47f3c41","public_packet_schema":"auths.qualification-public-packets/4","resource_count":16,"schema":"auths.qualification-reviewed-plan/1","source_files":{"airtable_record.py":"d5bf4d750fee75f02200d180f8654f426fe738bc86a281f1d015f391cc5e67fa","airtable_resources.py":"094f7d5c52a4557261c25fba6d5f1e4938091d946a05a422417b6dea22b7e76f","application_probe.py":"5e2dd6a91eb0a2acf2df1079cead5bd67ae5d6743abce6e48201e7326f63daa2","artifact_wait.py":"56efcf5a34103955e43c1d3be7fd58843efdc8095187d74dc890cf3342863f55","author_operator.py":"f3c66e5f6636bfdf317dc87915255f22a97466a34cbb5053b55cdf6e05d6921f","author_packets.py":"84d550b0f82c8501000ffde07ea13720f09caa9079b2c885f65a1f5cc08c2110","author_socket.py":"3d6a031c01d7d9a58213a8368f45b68c25081d059a8ff3cba4fe47c0f75a77fd","close_proposal.py":"9a6927722ada8eaba720ff13168101244880da3fe6f2c95f653bc3840ef81756","commission.py":"f4495d6e3d2b9c50e72e339e9571eacd9b3628ebebe7c86c601b94e785a5c9fd","common.py":"604d3d6598648fbc09611e663b4048b22fa748d0f6c6f1dbbceca5d83c02a2ce","controller_socket.py":"10519cc775e963360870eac51c7fcac1ffb988b04d5de89dac1dbf3524ba6531","custody_fault.py":"f5e95620a1bb3fccc733be13c6ab68b6e84c0b134a6b54252766e4e57410907f","expand.py":"9b6dea7793241a767065ac0456bfef5c01cfce3f1121278240eb77fc42ea7e54","family_corpus.py":"a3662539a9a130f5272cbd8b3750be3ebb46d4ad903aba7afa10880f99a2f601","family_harness.py":"0e0a42be6cf75dfb3f674b26cbdfbb4c473edea71083dfaad89ecb40dec039ba","family_operations.py":"3741c3fdbcc4ef884d36abc113706281b6dd409d90e6bbb3a4866b4a3d29beb6","fresh_evidence.py":"cb54ea66a4775c5af76fbc36c4f8c8a007c553de2b2303e80fd744aee1c54d2f","installed_submit.mjs":"9d57a91c4a052fbb9103582689ee99a6d087758dcfee00defa4c762b87187468","installed_submit.py":"f9151c2dffa1a02327b0ba05bdeb180654918a2b913195185a6649d010783dc7","journey_session.py":"3c807ce45dcabe3b39d63333872af3746fe9276aacf5eba30bf903b51d80dfef","measure.py":"b620be174bc012bc6b29f95e558fce1b6fb2cc99b5fa5a0f0c933c88696b4ca0","native_observation.py":"23efdf1cd29004b1b153a0de1938604df932e2ccf1efd1257342abff9ca77730","network_fault.py":"94340720d8601f79ac77b95d1e855be25195c19b67db3103bbf054d82c02472b","packet_plan.py":"cf993ba17ba40bd528a08d446bfc7c2e8cf0291f3e202337bcfdafa4ab269a7c","production_environment.py":"607a0bc37396a5a86da1d408b384ee4a54d920b849009717587150242bd47d73","production_journey.py":"db7f6dc7f0fdc1b5acff1339cdf5bf7f11f3ba826aeca626a76d761bec0121a8","production_setup.py":"eac6cda2c2bff17364e72512b70ecfc3b6dad8c70088c1fe83d59f4ebaa395a0","provider_readback.py":"d576768208985b3544f146597d181d796f2a5e2eca5026dae3fa15cadcfe65b2","resource_io.py":"18d9b11674cc9f0df6c6050b375e476675735927bed03f5a94d78674d4a35885","resource_summary.py":"c75f3f23017529ce10197c09649e2d60b3c240b8b58992786b824e85869668e0","retained_author.py":"bfd01c7df44f5f525326dfbda13b5ebc6b854f15787a8b2923de883fe20fdcf9","sign_release.py":"d0aa7697cc6889538dfd54f9101a5b7bc2e8f7aede729da2d382b6466781df99","stripe_platform.py":"2da918e72f0ec3aed4f5a80701748e0d37c71292806bfa38c74ffbe69055c4ec","stripe_resources.py":"2e050b4f5f8654cfb3a7cf9ddaa73b3515a039d5b37071d2d9c0dbafe2561489","tls_fault.py":"10e125f9623bc32a420a1d83e6d46fe30aa1ca8ff4da97a3e2422fc0e11ec42d"},"source_recipe_sha256":"c0f21ff1d3c8e344fee20a9a0c25bb14a264417ed53418ad536789a6096fb16e"} \ No newline at end of file diff --git a/qualification/families/airtable-record-update-v1/record.json b/qualification/families/airtable-record-update-v1/record.json index 85a389e83..8a03a1fd2 100644 --- a/qualification/families/airtable-record-update-v1/record.json +++ b/qualification/families/airtable-record-update-v1/record.json @@ -1 +1 @@ -{"custody_descriptor":"aws-secrets-manager-v1 with immutable versions and a customer-managed key","excluded_claims":["Gateway enforcement of the personal access token resource configuration.","Global exactly-once effects across other actors or deployments.","Provider availability, settlement, or indefinite retention."],"not_applicable":[{"capability":"account-binding","reason":"The recipe declares no account-binding probe."},{"capability":"budget","reason":"This recipe declares no numeric count/sum budget."},{"capability":"ceiling","reason":"The field-update profile carries no numeric amount or relative ceiling."},{"capability":"credential-guard","reason":"This recipe declares no provider credential guard."},{"capability":"denied-reads","reason":"The recipe declares no denied credential reads; token scope is an operator assumption."},{"capability":"idempotency","reason":"This PATCH declares no provider idempotency key."},{"capability":"observer-rotation","reason":"The qualified reference configures no signing observer."},{"capability":"response-locator","reason":"Observation uses the verified record ID, not a write-response locator."},{"capability":"version-pin","reason":"Airtable Web API v0 has no immutable response version pin."}],"provider_kind":"airtable","residual_assumptions":["Airtable supplies no idempotency key for this PATCH; durable gateway admission prevents a second entry.","Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only a fresh GET with the exact replacement and echo can reconcile a lost response.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths.","The reviewed fixed Airtable base and table contain only owner-authorized disposable qualification records."],"store_descriptor":"postgresql-v1 schema 6 shared by two isolated gateway processes","validity_days":30} \ No newline at end of file +{"custody_descriptor":"aws-secrets-manager-v1 with immutable versions and a customer-managed key","excluded_claims":["Gateway enforcement of the personal access token resource configuration.","Global exactly-once effects across other actors or deployments.","Provider availability, settlement, or indefinite retention."],"not_applicable":[{"capability":"account-binding","reason":"The recipe declares no account-binding probe."},{"capability":"budget","reason":"This recipe declares no numeric count/sum budget."},{"capability":"ceiling","reason":"The field-update profile carries no numeric amount or relative ceiling."},{"capability":"credential-guard","reason":"This recipe declares no provider credential guard."},{"capability":"denied-reads","reason":"The recipe declares no denied credential reads; token scope is an operator assumption."},{"capability":"idempotency","reason":"This PATCH declares no provider idempotency key."},{"capability":"observer-rotation","reason":"The qualified reference configures no signing observer."},{"capability":"response-locator","reason":"Observation uses the verified record ID, not a write-response locator."},{"capability":"version-pin","reason":"Airtable Web API v0 has no immutable response version pin."}],"provider_kind":"airtable","residual_assumptions":["Airtable supplies no idempotency key for this PATCH; durable gateway admission prevents a second entry.","Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only a fresh GET with the exact replacement and echo can reconcile a lost response.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths.","The reviewed fixed Airtable base and table contain only owner-authorized disposable qualification records."],"store_descriptor":"postgresql-v1 schema 7 shared by two isolated gateway processes","validity_days":30} \ No newline at end of file diff --git a/qualification/families/stripe-platform-refund-v1/contract.json b/qualification/families/stripe-platform-refund-v1/contract.json index a75c721e4..607bf0a23 100644 --- a/qualification/families/stripe-platform-refund-v1/contract.json +++ b/qualification/families/stripe-platform-refund-v1/contract.json @@ -1 +1 @@ -{"api_release":"2025-03-31.basil","corpus_manifest_sha256":"5b55fc440715d9f18993910f9680d679371512f31748321b019c88f1e3b5de79","declarations":{"idempotency_sha256":"425a0dca2f279765debfc847c4a01bff60fea5be68dd9d761ae6bb60ce0b8a7b","observation_sha256":"d0ce5a34d987821c69c0a839d9ed66805c625f8324dd42031fcccf0752a8821e","recovery_sha256":"bf2303abce165c175360ac975586431bbc4cf03167489ea317a27de2f0b04abb","retention_sha256":"846c2164e26d1144d9aa146034b4f7ea4dc305136a59ffd94f999d19f2c360ee"},"environment_class":"provider-test-mode","manual_assumptions":["Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","Stripe idempotency is tested only inside the declared 86400-second retention interval.","Stripe test mode and the installed platform are checked by the declared guard on each lease.","The 50-percent payment basis is a read, not an atomic provider balance reservation.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths."],"oracle_version":"auths-reviewed-reference-v2","provider":"stripe","schema":"auths.provider-contract/1"} \ No newline at end of file +{"api_release":"2025-03-31.basil","corpus_manifest_sha256":"c2ce4db11c9f4c4fe2678a0cecf6fdd92fa663a60b322f2c8b1594e262440e4c","declarations":{"idempotency_sha256":"425a0dca2f279765debfc847c4a01bff60fea5be68dd9d761ae6bb60ce0b8a7b","observation_sha256":"d0ce5a34d987821c69c0a839d9ed66805c625f8324dd42031fcccf0752a8821e","recovery_sha256":"bf2303abce165c175360ac975586431bbc4cf03167489ea317a27de2f0b04abb","retention_sha256":"846c2164e26d1144d9aa146034b4f7ea4dc305136a59ffd94f999d19f2c360ee"},"environment_class":"provider-test-mode","manual_assumptions":["Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","Stripe idempotency is tested only inside the declared 86400-second retention interval.","Stripe test mode and the installed platform are checked by the declared guard on each lease.","The 50-percent payment basis is a read, not an atomic provider balance reservation.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths."],"oracle_version":"auths-reviewed-reference-v2","provider":"stripe","schema":"auths.provider-contract/1"} \ No newline at end of file diff --git a/qualification/families/stripe-platform-refund-v1/corpus-manifest.json b/qualification/families/stripe-platform-refund-v1/corpus-manifest.json index f41d69523..30be1b4b9 100644 --- a/qualification/families/stripe-platform-refund-v1/corpus-manifest.json +++ b/qualification/families/stripe-platform-refund-v1/corpus-manifest.json @@ -1 +1 @@ -{"compiled_corpus_schema":"auths.qualification-corpus/3","decision_record_sha256":"a72c557b69103a52eb477deb8364ded53cd58407b9ba7ab33ccbda74389fec1e","family":"stripe-platform-refund-v1","maximum_credential_leases":64,"packet_plan_schema":"auths.qualification-packet-plan/4","phases":["offline","commissioning","live"],"profile_lock_sha256":"99901e36cb7c4f5882897603c874698d582e859b5d6b08d53cd80975e89aa01c","public_packet_schema":"auths.qualification-public-packets/4","resource_count":16,"schema":"auths.qualification-reviewed-plan/1","source_files":{"airtable_record.py":"d5bf4d750fee75f02200d180f8654f426fe738bc86a281f1d015f391cc5e67fa","airtable_resources.py":"094f7d5c52a4557261c25fba6d5f1e4938091d946a05a422417b6dea22b7e76f","application_probe.py":"5e2dd6a91eb0a2acf2df1079cead5bd67ae5d6743abce6e48201e7326f63daa2","artifact_wait.py":"56efcf5a34103955e43c1d3be7fd58843efdc8095187d74dc890cf3342863f55","author_operator.py":"f3c66e5f6636bfdf317dc87915255f22a97466a34cbb5053b55cdf6e05d6921f","author_packets.py":"84d550b0f82c8501000ffde07ea13720f09caa9079b2c885f65a1f5cc08c2110","author_socket.py":"3d6a031c01d7d9a58213a8368f45b68c25081d059a8ff3cba4fe47c0f75a77fd","close_proposal.py":"9a6927722ada8eaba720ff13168101244880da3fe6f2c95f653bc3840ef81756","commission.py":"f4495d6e3d2b9c50e72e339e9571eacd9b3628ebebe7c86c601b94e785a5c9fd","common.py":"604d3d6598648fbc09611e663b4048b22fa748d0f6c6f1dbbceca5d83c02a2ce","controller_socket.py":"10519cc775e963360870eac51c7fcac1ffb988b04d5de89dac1dbf3524ba6531","custody_fault.py":"f5e95620a1bb3fccc733be13c6ab68b6e84c0b134a6b54252766e4e57410907f","expand.py":"892cf7b04c3847336f150926bfbf3e82665e9e2bc1b154be42e4f57d1922b816","family_corpus.py":"a3662539a9a130f5272cbd8b3750be3ebb46d4ad903aba7afa10880f99a2f601","family_harness.py":"0e0a42be6cf75dfb3f674b26cbdfbb4c473edea71083dfaad89ecb40dec039ba","family_operations.py":"3741c3fdbcc4ef884d36abc113706281b6dd409d90e6bbb3a4866b4a3d29beb6","fresh_evidence.py":"cb54ea66a4775c5af76fbc36c4f8c8a007c553de2b2303e80fd744aee1c54d2f","installed_submit.mjs":"9d57a91c4a052fbb9103582689ee99a6d087758dcfee00defa4c762b87187468","installed_submit.py":"f9151c2dffa1a02327b0ba05bdeb180654918a2b913195185a6649d010783dc7","journey_session.py":"3c807ce45dcabe3b39d63333872af3746fe9276aacf5eba30bf903b51d80dfef","measure.py":"b620be174bc012bc6b29f95e558fce1b6fb2cc99b5fa5a0f0c933c88696b4ca0","native_observation.py":"580fa1db01a6fa7691d618f123f9117ce39b25e6478460ceac46c1e650d6b454","network_fault.py":"94340720d8601f79ac77b95d1e855be25195c19b67db3103bbf054d82c02472b","packet_plan.py":"cf993ba17ba40bd528a08d446bfc7c2e8cf0291f3e202337bcfdafa4ab269a7c","production_environment.py":"607a0bc37396a5a86da1d408b384ee4a54d920b849009717587150242bd47d73","production_journey.py":"db7f6dc7f0fdc1b5acff1339cdf5bf7f11f3ba826aeca626a76d761bec0121a8","production_setup.py":"eac6cda2c2bff17364e72512b70ecfc3b6dad8c70088c1fe83d59f4ebaa395a0","provider_readback.py":"d576768208985b3544f146597d181d796f2a5e2eca5026dae3fa15cadcfe65b2","resource_io.py":"18d9b11674cc9f0df6c6050b375e476675735927bed03f5a94d78674d4a35885","resource_summary.py":"c75f3f23017529ce10197c09649e2d60b3c240b8b58992786b824e85869668e0","retained_author.py":"bfd01c7df44f5f525326dfbda13b5ebc6b854f15787a8b2923de883fe20fdcf9","sign_release.py":"d0aa7697cc6889538dfd54f9101a5b7bc2e8f7aede729da2d382b6466781df99","stripe_platform.py":"2da918e72f0ec3aed4f5a80701748e0d37c71292806bfa38c74ffbe69055c4ec","stripe_resources.py":"2e050b4f5f8654cfb3a7cf9ddaa73b3515a039d5b37071d2d9c0dbafe2561489","tls_fault.py":"10e125f9623bc32a420a1d83e6d46fe30aa1ca8ff4da97a3e2422fc0e11ec42d"},"source_recipe_sha256":"b1972d556f28433932a449636755077f7ee485ef90cca412f153bc7f18881368"} \ No newline at end of file +{"compiled_corpus_schema":"auths.qualification-corpus/3","decision_record_sha256":"a72c557b69103a52eb477deb8364ded53cd58407b9ba7ab33ccbda74389fec1e","family":"stripe-platform-refund-v1","maximum_credential_leases":64,"packet_plan_schema":"auths.qualification-packet-plan/4","phases":["offline","commissioning","live"],"profile_lock_sha256":"99901e36cb7c4f5882897603c874698d582e859b5d6b08d53cd80975e89aa01c","public_packet_schema":"auths.qualification-public-packets/4","resource_count":16,"schema":"auths.qualification-reviewed-plan/1","source_files":{"airtable_record.py":"d5bf4d750fee75f02200d180f8654f426fe738bc86a281f1d015f391cc5e67fa","airtable_resources.py":"094f7d5c52a4557261c25fba6d5f1e4938091d946a05a422417b6dea22b7e76f","application_probe.py":"5e2dd6a91eb0a2acf2df1079cead5bd67ae5d6743abce6e48201e7326f63daa2","artifact_wait.py":"56efcf5a34103955e43c1d3be7fd58843efdc8095187d74dc890cf3342863f55","author_operator.py":"f3c66e5f6636bfdf317dc87915255f22a97466a34cbb5053b55cdf6e05d6921f","author_packets.py":"84d550b0f82c8501000ffde07ea13720f09caa9079b2c885f65a1f5cc08c2110","author_socket.py":"3d6a031c01d7d9a58213a8368f45b68c25081d059a8ff3cba4fe47c0f75a77fd","close_proposal.py":"9a6927722ada8eaba720ff13168101244880da3fe6f2c95f653bc3840ef81756","commission.py":"f4495d6e3d2b9c50e72e339e9571eacd9b3628ebebe7c86c601b94e785a5c9fd","common.py":"604d3d6598648fbc09611e663b4048b22fa748d0f6c6f1dbbceca5d83c02a2ce","controller_socket.py":"10519cc775e963360870eac51c7fcac1ffb988b04d5de89dac1dbf3524ba6531","custody_fault.py":"f5e95620a1bb3fccc733be13c6ab68b6e84c0b134a6b54252766e4e57410907f","expand.py":"9b6dea7793241a767065ac0456bfef5c01cfce3f1121278240eb77fc42ea7e54","family_corpus.py":"a3662539a9a130f5272cbd8b3750be3ebb46d4ad903aba7afa10880f99a2f601","family_harness.py":"0e0a42be6cf75dfb3f674b26cbdfbb4c473edea71083dfaad89ecb40dec039ba","family_operations.py":"3741c3fdbcc4ef884d36abc113706281b6dd409d90e6bbb3a4866b4a3d29beb6","fresh_evidence.py":"cb54ea66a4775c5af76fbc36c4f8c8a007c553de2b2303e80fd744aee1c54d2f","installed_submit.mjs":"9d57a91c4a052fbb9103582689ee99a6d087758dcfee00defa4c762b87187468","installed_submit.py":"f9151c2dffa1a02327b0ba05bdeb180654918a2b913195185a6649d010783dc7","journey_session.py":"3c807ce45dcabe3b39d63333872af3746fe9276aacf5eba30bf903b51d80dfef","measure.py":"b620be174bc012bc6b29f95e558fce1b6fb2cc99b5fa5a0f0c933c88696b4ca0","native_observation.py":"23efdf1cd29004b1b153a0de1938604df932e2ccf1efd1257342abff9ca77730","network_fault.py":"94340720d8601f79ac77b95d1e855be25195c19b67db3103bbf054d82c02472b","packet_plan.py":"cf993ba17ba40bd528a08d446bfc7c2e8cf0291f3e202337bcfdafa4ab269a7c","production_environment.py":"607a0bc37396a5a86da1d408b384ee4a54d920b849009717587150242bd47d73","production_journey.py":"db7f6dc7f0fdc1b5acff1339cdf5bf7f11f3ba826aeca626a76d761bec0121a8","production_setup.py":"eac6cda2c2bff17364e72512b70ecfc3b6dad8c70088c1fe83d59f4ebaa395a0","provider_readback.py":"d576768208985b3544f146597d181d796f2a5e2eca5026dae3fa15cadcfe65b2","resource_io.py":"18d9b11674cc9f0df6c6050b375e476675735927bed03f5a94d78674d4a35885","resource_summary.py":"c75f3f23017529ce10197c09649e2d60b3c240b8b58992786b824e85869668e0","retained_author.py":"bfd01c7df44f5f525326dfbda13b5ebc6b854f15787a8b2923de883fe20fdcf9","sign_release.py":"d0aa7697cc6889538dfd54f9101a5b7bc2e8f7aede729da2d382b6466781df99","stripe_platform.py":"2da918e72f0ec3aed4f5a80701748e0d37c71292806bfa38c74ffbe69055c4ec","stripe_resources.py":"2e050b4f5f8654cfb3a7cf9ddaa73b3515a039d5b37071d2d9c0dbafe2561489","tls_fault.py":"10e125f9623bc32a420a1d83e6d46fe30aa1ca8ff4da97a3e2422fc0e11ec42d"},"source_recipe_sha256":"b1972d556f28433932a449636755077f7ee485ef90cca412f153bc7f18881368"} \ No newline at end of file diff --git a/qualification/families/stripe-platform-refund-v1/record.json b/qualification/families/stripe-platform-refund-v1/record.json index 04792bbc4..a605b0c37 100644 --- a/qualification/families/stripe-platform-refund-v1/record.json +++ b/qualification/families/stripe-platform-refund-v1/record.json @@ -1 +1 @@ -{"custody_descriptor":"aws-secrets-manager-v1 with immutable versions and a customer-managed key","excluded_claims":["Connected-account selection or restrictions.","Global exactly-once effects across other actors or deployments.","Provider availability, settlement, or indefinite retention."],"not_applicable":[{"capability":"observer-rotation","reason":"The qualified reference configures no signing observer."},{"capability":"recovery","reason":"An unrecorded refund response has no verified response locator; loss remains unknown."}],"provider_kind":"stripe","residual_assumptions":["Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","Stripe idempotency is tested only inside the declared 86400-second retention interval.","Stripe test mode and the installed platform are checked by the declared guard on each lease.","The 50-percent payment basis is a read, not an atomic provider balance reservation.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths."],"store_descriptor":"postgresql-v1 schema 6 shared by two isolated gateway processes","validity_days":30} \ No newline at end of file +{"custody_descriptor":"aws-secrets-manager-v1 with immutable versions and a customer-managed key","excluded_claims":["Connected-account selection or restrictions.","Global exactly-once effects across other actors or deployments.","Provider availability, settlement, or indefinite retention."],"not_applicable":[{"capability":"observer-rotation","reason":"The qualified reference configures no signing observer."},{"capability":"recovery","reason":"An unrecorded refund response has no verified response locator; loss remains unknown."}],"provider_kind":"stripe","residual_assumptions":["Fresh matching state and the action-derived echo are required; HTTP success is not effect confirmation.","Only the closed run-owned resource ledger is in scope; every cleanup must be freshly confirmed.","Stripe idempotency is tested only inside the declared 86400-second retention interval.","Stripe test mode and the installed platform are checked by the declared guard on each lease.","The 50-percent payment basis is a read, not an atomic provider balance reservation.","The provider is independently operated; availability and concurrent outside writes are not controlled by Auths."],"store_descriptor":"postgresql-v1 schema 7 shared by two isolated gateway processes","validity_days":30} \ No newline at end of file diff --git a/qualification/reference/expand.py b/qualification/reference/expand.py index 716859a5d..20e30d162 100644 --- a/qualification/reference/expand.py +++ b/qualification/reference/expand.py @@ -94,7 +94,7 @@ def expand(args): target = tuple_value['target'] require(target['os'] == 'linux' and target['arch'] == 'x86_64' and target['store_kind'] == 'postgresql-v1' - and target['store_schema'] == 'auths.lifecycle.postgresql/6' + and target['store_schema'] == 'auths.lifecycle.postgresql/7' and target['credential_store_kind'] == 'aws-secrets-manager-v1', 'qualification.reference.production-target') require(sha256(read(args.candidate, 256 * 1024 * 1024)) == target['gateway_build_sha256'], diff --git a/qualification/reference/generate_families.py b/qualification/reference/generate_families.py index 06dbe1f6b..c1a3f23bb 100644 --- a/qualification/reference/generate_families.py +++ b/qualification/reference/generate_families.py @@ -86,7 +86,7 @@ def generate(check=False): record = {'provider_kind': 'stripe' if stripe else 'airtable', 'validity_days': 30, 'not_applicable': [{'capability': name, 'reason': reason} for name, reason in sorted(reasons.items())], 'custody_descriptor': 'aws-secrets-manager-v1 with immutable versions and a customer-managed key', - 'store_descriptor': 'postgresql-v1 schema 6 shared by two isolated gateway processes', + 'store_descriptor': 'postgresql-v1 schema 7 shared by two isolated gateway processes', 'residual_assumptions': assumptions, 'excluded_claims': sorted(['Global exactly-once effects across other actors or deployments.', 'Provider availability, settlement, or indefinite retention.', diff --git a/qualification/reference/native_observation.py b/qualification/reference/native_observation.py index 000c5b45c..3c2a64ce9 100644 --- a/qualification/reference/native_observation.py +++ b/qualification/reference/native_observation.py @@ -78,7 +78,7 @@ def interrupted_state(tuple_value, reviewed, trusted_context_sha256, support): and support['deployment'] == 'production' and support['credential_store_kind'] == target['credential_store_kind'] and target['store_kind'] == 'postgresql-v1' - and target['store_schema'] == 'auths.lifecycle.postgresql/6' + and target['store_schema'] == 'auths.lifecycle.postgresql/7' and target['credential_store_kind'] == 'aws-secrets-manager-v1', 'qualification.observation.interrupted-tuple') qualification = support['qualification'] diff --git a/qualification/reference/tests/test_native_observation.py b/qualification/reference/tests/test_native_observation.py index 64d2170c2..35636d481 100644 --- a/qualification/reference/tests/test_native_observation.py +++ b/qualification/reference/tests/test_native_observation.py @@ -83,7 +83,7 @@ def support(self): self.tuple.update(profile_lock_sha256='3' * 64, gateway_semantic_closure_sha256='4' * 64, target={'gateway_package': 'auths-gateway', 'gateway_version': 'synthetic-only', 'gateway_build_sha256': '5' * 64, 'store_kind': 'postgresql-v1', - 'store_schema': 'auths.lifecycle.postgresql/6', 'credential_store_kind': 'aws-secrets-manager-v1'}) + 'store_schema': 'auths.lifecycle.postgresql/7', 'credential_store_kind': 'aws-secrets-manager-v1'}) key = sha256(b'auths.gateway-logical-operation/1\0' + self.arguments['operator_namespace'].encode() + b'\0' + self.arguments['operation_id'].encode()) return {'schema': 'auths.gateway-support-bundle/1', 'gateway_package': 'auths-gateway', diff --git a/qualification/reference/tests/test_reference.py b/qualification/reference/tests/test_reference.py index 2808c47a6..fd14f5780 100644 --- a/qualification/reference/tests/test_reference.py +++ b/qualification/reference/tests/test_reference.py @@ -211,7 +211,7 @@ def test_binding_is_rederived_and_altered_source_or_native_observations_refuse(s tuple_value['recipe_family'] = stripe.FAMILY tuple_value['compiled_recipe_sha256'] = DIGEST tuple_value['target']['gateway_build_sha256'] = sha256((work / 'candidate').read_bytes()) - tuple_value['target']['store_schema'] = 'auths.lifecycle.postgresql/6' + tuple_value['target']['store_schema'] = 'auths.lifecycle.postgresql/7' (work / 'tuple.json').write_bytes(canonical(tuple_value)) tuple_digest = sha256(b'auths.qualification-tuple/1\0' + canonical(tuple_value)) for member_name in ['conformance', 'differential']: diff --git a/release/semantic-freeze-versions.toml b/release/semantic-freeze-versions.toml index 3bd67ba26..f6248d400 100644 --- a/release/semantic-freeze-versions.toml +++ b/release/semantic-freeze-versions.toml @@ -1,4 +1,4 @@ -freeze_version = 387 +freeze_version = 418 # Semantic identity counters live outside the xtask source tree deliberately. # The formal source closure binds xtask's executable code, while the semantic @@ -6,8 +6,9 @@ freeze_version = 387 # made the two generated artifacts hash each other and therefore unable to # converge. This file is a reviewed release input, never an automatic output. [entries] -"auths.core.protocol" = 36 -"auths.frozen-bytes/architecture/dependency-graph.json" = 79 +"auths.frozen-bytes/core/fixtures/crypto" = 1 +"auths.core.protocol" = 58 +"auths.frozen-bytes/architecture/dependency-graph.json" = 80 "auths.frozen-bytes/bindings/wasm/auths-proof-wasm/identity-abi-v1.json" = 4 "auths.frozen-bytes/bounded-domains.toml" = 2 "auths.frozen-bytes/core/conformance/v1/manifest.json" = 2 @@ -16,10 +17,10 @@ freeze_version = 387 "auths.frozen-bytes/core/fixtures/v1/manifest.json" = 15 "auths.frozen-bytes/core/formal-vectors/v1/manifest.json" = 1 "auths.frozen-bytes/demos/benchmarks/profiles/release.toml" = 1 -"auths.frozen-bytes/formal/assurance-manifest-v1.toml" = 59 -"auths.frozen-bytes/formal/qualification/aeneas/generated" = 19 -"auths.frozen-bytes/formal/qualification/aeneas/qualification.toml" = 16 -"auths.frozen-bytes/formal/qualification/aeneas/source-closure.json" = 99 +"auths.frozen-bytes/formal/assurance-manifest-v1.toml" = 90 +"auths.frozen-bytes/formal/qualification/aeneas/generated" = 40 +"auths.frozen-bytes/formal/qualification/aeneas/qualification.toml" = 37 +"auths.frozen-bytes/formal/qualification/aeneas/source-closure.json" = 129 "auths.frozen-bytes/product/conformance/v1/mechanism-profile-conformance.json" = 1 "auths.frozen-bytes/product/conformance/v1/simplified-product-waist.json" = 4 "auths.frozen-bytes/product/fixtures/v1/bounded-policy/manifest.json" = 3 @@ -45,9 +46,9 @@ freeze_version = 387 "auths.frozen-bytes/product/integrations/auths-stripe/fixtures/subscription-create/v1/manifest.sha256.json" = 1 "auths.frozen-bytes/product/integrations/auths-stripe/fixtures/subscription-modify/v1/manifest.sha256.json" = 1 "auths.frozen-bytes/product/integrations/auths-stripe/fixtures/v1/manifest.sha256.json" = 1 -"auths.identity.protocol" = 135 +"auths.identity.protocol" = 145 "auths.modular-components" = 22 -"auths.portable-abi-bindings" = 122 +"auths.portable-abi-bindings" = 139 "auths.product.bounded-domains" = 19 "auths.product.bounded-policy" = 6 "auths.product.configuration-commitments" = 1 @@ -56,15 +57,15 @@ freeze_version = 387 "auths.product.external-custody" = 5 "auths.product.facade" = 26 "auths.product.github-issue-address-v2" = 4 -"auths.product.lifecycle" = 16 +"auths.product.lifecycle" = 21 "auths.product.mcp-closed-execution" = 31 "auths.product.mechanism-profile-conformance" = 12 "auths.product.operations" = 5 -"auths.product.public-sdk-contract" = 132 +"auths.product.public-sdk-contract" = 134 "auths.product.receipts" = 13 -"auths.product.release-assurance" = 7 +"auths.product.release-assurance" = 9 "auths.product.simplified-waist" = 19 "auths.product.vocabulary" = 26 "auths.release.benchmark-contract" = 1 "auths.release.evolution-contract" = 79 -"auths.release.public-surface" = 387 +"auths.release.public-surface" = 418 diff --git a/release/semantic-freeze.json b/release/semantic-freeze.json index 879cd4eff..f76211927 100644 --- a/release/semantic-freeze.json +++ b/release/semantic-freeze.json @@ -1,6 +1,6 @@ { "schema": "auths.semantic-freeze/1", - "freezeVersion": 387, + "freezeVersion": 418, "publicSurface": { "rustRoots": [ "auths", @@ -73,7 +73,7 @@ "entries": [ { "id": "auths.core.protocol", - "version": 36, + "version": 58, "classification": "frozen-meaning", "categories": [ "protocol-versions", @@ -90,11 +90,11 @@ "core/crates/auths-verifier/src", "core/spec/v1" ], - "sha256": "d260741b40e9bd447d35c76cb3efb1b036f17bea883e51332a5202c52a4e2565" + "sha256": "253741f2a3567baa143c7bffc618571377862d98f19b2add033f2823f14a3852" }, { "id": "auths.frozen-bytes/architecture/dependency-graph.json", - "version": 79, + "version": 80, "classification": "frozen-bytes", "categories": [ "canonical-generated-evidence" @@ -102,7 +102,7 @@ "owners": [ "architecture/dependency-graph.json" ], - "sha256": "83fed3f0d16736b93df13412e43e500f91840effd660aa17fb07ad79974c3d8f" + "sha256": "3b10dbc7da25f2b315d7cb708baa0f3010b94fdfd3d16d3adfe50b82e6c25553" }, { "id": "auths.frozen-bytes/bindings/wasm/auths-proof-wasm/identity-abi-v1.json", @@ -152,6 +152,18 @@ ], "sha256": "9229bee508acde9e58b7932cdedb500586f9171f3f855f3af0eb959f08decb3e" }, + { + "id": "auths.frozen-bytes/core/fixtures/crypto", + "version": 1, + "classification": "frozen-bytes", + "categories": [ + "canonical-generated-evidence" + ], + "owners": [ + "core/fixtures/crypto" + ], + "sha256": "611803916b1ce333c6cfb7e77770a0efc65b35dc6bc0f6ca028b4772cfe70b0d" + }, { "id": "auths.frozen-bytes/core/fixtures/identity/v1/vectors.json", "version": 1, @@ -202,7 +214,7 @@ }, { "id": "auths.frozen-bytes/formal/assurance-manifest-v1.toml", - "version": 59, + "version": 90, "classification": "frozen-bytes", "categories": [ "canonical-generated-evidence" @@ -210,11 +222,11 @@ "owners": [ "formal/assurance-manifest-v1.toml" ], - "sha256": "5f68f8b25a0294042ccfa121a2a13fbfcb5d3200f31bc55995c05f538d216cae" + "sha256": "36204503eacc586b351e92ec679aa755b31876133f36c744d5e4f3b4d1ab3937" }, { "id": "auths.frozen-bytes/formal/qualification/aeneas/generated", - "version": 19, + "version": 40, "classification": "frozen-bytes", "categories": [ "canonical-generated-evidence" @@ -222,11 +234,11 @@ "owners": [ "formal/qualification/aeneas/generated" ], - "sha256": "37024149c5f4ad4a2587a8f0f2e636d1e332fdd379195dd2e24de03069be3ddc" + "sha256": "fd34765b0282dc2007a4874be187f8352d3363e6f8554cf01a86c835aac05e98" }, { "id": "auths.frozen-bytes/formal/qualification/aeneas/qualification.toml", - "version": 16, + "version": 37, "classification": "frozen-bytes", "categories": [ "canonical-generated-evidence" @@ -234,11 +246,11 @@ "owners": [ "formal/qualification/aeneas/qualification.toml" ], - "sha256": "9938d4c91f7c7839d3e5363fb6536730b62981e545bc9867507324cb2c3c17d6" + "sha256": "022b8c1f136794952423d37d25a2fb21046ed3e83b367f30d67d3d7c3f870324" }, { "id": "auths.frozen-bytes/formal/qualification/aeneas/source-closure.json", - "version": 99, + "version": 129, "classification": "frozen-bytes", "categories": [ "canonical-generated-evidence" @@ -246,7 +258,7 @@ "owners": [ "formal/qualification/aeneas/source-closure.json" ], - "sha256": "e827f63ea742ae566103c0c06aec972ca2e86a6db250484f6e2554c887092091" + "sha256": "2c394037f4bad37cce07ac08fd1dd33d67b2726490ad357dc32a24cd475861e0" }, { "id": "auths.frozen-bytes/product/conformance/v1/mechanism-profile-conformance.json", @@ -550,7 +562,7 @@ }, { "id": "auths.identity.protocol", - "version": 135, + "version": 145, "classification": "frozen-meaning", "categories": [ "identity-protocol-versions", @@ -573,7 +585,7 @@ "core/fixtures/identity/v1/vectors.json", "core/spec/identity/v1" ], - "sha256": "97ad902db8be0f8cee8feced98239f617dbabbbb138117027bd2085c1765f25d" + "sha256": "305333d064c3527e3c6f58a59fdb832185061c29ed8482559847dff8f60eada8" }, { "id": "auths.modular-components", @@ -611,7 +623,7 @@ }, { "id": "auths.portable-abi-bindings", - "version": 122, + "version": 139, "classification": "frozen-meaning", "categories": [ "portable-abi", @@ -631,7 +643,7 @@ "core/crates/auths-model/src/lib.rs", "core/spec/v1/auths-proof.cddl" ], - "sha256": "45b4ff9be945f6ba91c34b5684770629133fbcb27da6b26eb14b4347114d4e40" + "sha256": "b1a1c48122dc680bbed49b9bf4f1e9d880794443354497921833ce923add4638" }, { "id": "auths.product.bounded-domains", @@ -784,7 +796,7 @@ }, { "id": "auths.product.lifecycle", - "version": 16, + "version": 21, "classification": "frozen-meaning", "categories": [ "reservation-state", @@ -796,12 +808,12 @@ "owners": [ "product/fixtures/v1/lifecycle/registry.toml", "product/runtime/auths-lifecycle/src", - "product/stores/auths-stores/migrations/postgres_lifecycle_v6.sql", + "product/stores/auths-stores/migrations/postgres_lifecycle_v7.sql", "product/stores/auths-stores/src/lifecycle.rs", "product/stores/auths-stores/tests/postgres_lifecycle.rs", "product/stores/auths-stores/tests/postgres_tls" ], - "sha256": "c331eb406c523401d940e8c67fce96200465720920fc74196b2cdbfa11b345d0" + "sha256": "a5e01b7925c96a641dc002dc6260d79c2590c41c24eac15bb817d2b748cee451" }, { "id": "auths.product.mcp-closed-execution", @@ -871,7 +883,7 @@ }, { "id": "auths.product.public-sdk-contract", - "version": 132, + "version": 134, "classification": "frozen-meaning", "categories": [ "rust-sdk-contract", @@ -889,7 +901,7 @@ "product/runtime/auths-runtime/src", "product/sdk/auths-sdk/src" ], - "sha256": "ef9aef08748796e70049ddc486945110f5b4c5ce55c945f39ccee9ffe6b26c50" + "sha256": "54d71b2f84be3669261d1489da8062cba2e43d13ed7ff81ef9a4c3ba5e2019bb" }, { "id": "auths.product.receipts", @@ -907,7 +919,7 @@ }, { "id": "auths.product.release-assurance", - "version": 7, + "version": 9, "classification": "frozen-meaning", "categories": [ "immutable-candidate-binding", @@ -1011,7 +1023,7 @@ }, { "id": "auths.release.public-surface", - "version": 387, + "version": 418, "classification": "release-metadata", "categories": [ "package-names", @@ -1104,7 +1116,7 @@ "xtask/src/release_launch.rs", "xtask/src/semantic_freeze.rs" ], - "sha256": "18ad9bc04f006e9516e683703327f4e71af9a00da2eb5cd311966ee0369b9e8c" + "sha256": "83967f2a4c2ac0c801ca1b7757e4ac49e53008b848f02f32054b3e9e460d3eb2" } ] } diff --git a/xtask/ci-plan/src/lib.rs b/xtask/ci-plan/src/lib.rs index 1e81bbe63..283b2ec12 100644 --- a/xtask/ci-plan/src/lib.rs +++ b/xtask/ci-plan/src/lib.rs @@ -2136,7 +2136,7 @@ fn local_formal_rust_source_paths_from_values( root_names.dedup(); let mut root_ids = BTreeSet::new(); for name in root_names { - let package_name = name.replace('_', "-"); + let package_name = formal_shipping_package(&name); let ids = ids_by_name .get(&package_name) .ok_or_else(|| format!("formal source root package is absent: {name}"))?; @@ -2323,7 +2323,7 @@ fn semantic_formal_cargo_inputs_from_values( } let mut roots = BTreeSet::new(); for name in translation_roots { - let package_name = name.replace('_', "-"); + let package_name = formal_shipping_package(name); let ids = ids_by_name .get(&package_name) .ok_or_else(|| format!("translation root package is absent: {name}"))?; @@ -2396,6 +2396,17 @@ fn semantic_formal_cargo_inputs_from_values( }) } +/// The reviewed non-shipping selector has exactly one shipping dependency. +/// Its source is hashed in qualification.source_files and its temporary lock +/// is checked against the shipping lock before translation. Other roots must +/// still resolve to actual workspace packages. +fn formal_shipping_package(crate_name: &str) -> String { + match crate_name { + "auths_profile_construction" => "auths-connections".to_owned(), + _ => crate_name.replace('_', "-"), + } +} + fn normalized_package_identity(root: &Path, package: &Value) -> Result { let manifest_path = PathBuf::from(required_json_string(package, "manifest_path")?); let manifest = manifest_path @@ -2615,6 +2626,22 @@ fn append_file(path: &Path, bytes: &[u8]) -> Result<(), String> { mod tests { use super::*; + #[test] + fn formal_selector_has_only_its_reviewed_shipping_dependency() { + assert_eq!( + formal_shipping_package("auths_profile_construction"), + "auths-connections" + ); + assert_eq!( + formal_shipping_package("auths_connections"), + "auths-connections" + ); + assert_eq!( + formal_shipping_package("unreviewed_selector"), + "unreviewed-selector" + ); + } + #[test] fn parses_rename_and_delete_without_losing_old_paths() { let changes = parse_name_status(b"R100\0docs/old.md\0docs/new.md\0D\0core/old.rs\0") diff --git a/xtask/src/checks.rs b/xtask/src/checks.rs index 2cb69e34f..b16d41c15 100644 --- a/xtask/src/checks.rs +++ b/xtask/src/checks.rs @@ -175,6 +175,18 @@ pub(crate) fn bindings_check() -> Result<(), String> { } pub(crate) fn bindings_conformance() -> Result<(), String> { + command_in( + "node", + &[ + "--experimental-strip-types", + "--test", + "bindings/independent/typescript/ed25519-encoding.test.ts", + "bindings/independent/typescript/p256-corpus.test.ts", + ], + &root(), + None, + )?; + command_in("npm", &["test"], &root().join("bindings/typescript"), None)?; npm_package_smoke()?; let go_cache = root().join("target/go-build-cache"); diff --git a/xtask/src/formal.rs b/xtask/src/formal.rs index a906b3c49..a546195b4 100644 --- a/xtask/src/formal.rs +++ b/xtask/src/formal.rs @@ -359,6 +359,10 @@ pub(crate) fn ci_formal_proof_fast() -> Result<(), String> { formal_qualification::validate_source_closure(&root())?; let (formal_root, _) = prepare_formal_translation(false, false)?; for target in [ + "Auths.Codec.Refinement", + "Auths.Codec.Encoder", + "Auths.Product.Refinement.CollectionFence", + "Auths.Product.Refinement.EntryDeadline", "Auths.Refinement.Production", "Auths.Refinement.Observation", "Auths.Product.Refinement", @@ -502,6 +506,15 @@ pub(crate) fn ci_formal_lean_authoritative() -> Result<(), String> { let (formal_root, attenuation_dimensions) = prepare_formal_translation(false, false)?; clear_repository_lean_outputs(&formal_root)?; build_and_audit_formal(&formal_root, update)?; + // Replay the public theorem closure into an empty kernel environment. + // This catches environment manipulation; it is separate from checking + // theorem meaning and the transitive axiom allowlist above. + command_in( + "lake", + &["env", "leanchecker", "--fresh", "Auths.Theorems"], + &formal_root, + None, + )?; formal_qualification::validate(&root(), &attenuation_dimensions)?; run_formal_semantic_checks(&formal_root, true, false)?; write_formal_phase_result("lean", &closure_digest, "executed-clean", 0)?; @@ -1361,6 +1374,7 @@ pub(crate) struct LeanAssuranceDeclaration { kind: String, statement: String, axioms: Vec, + statement_constants: Vec, } fn lean_statement_inventory_sha256(audit: &LeanAssuranceAudit) -> String { @@ -1383,6 +1397,13 @@ fn lean_statement_inventory_sha256(audit: &LeanAssuranceAudit) -> String { digest.update(axiom.as_bytes()); digest.update([0]); } + let mut constants = declaration.statement_constants.clone(); + constants.sort(); + digest.update([0xfe]); + for constant in constants { + digest.update(constant.as_bytes()); + digest.update([0]); + } digest.update([0xff]); } hex::encode(digest.finalize()) @@ -1473,6 +1494,7 @@ pub(crate) fn formal_assurance_audit(formal_root: &Path, update: bool) -> Result } } let expected_source_closure = semantic_source_closure_paths(formal_root)?; + let expected_closure_digest = semantic_source_closure_digest(&expected_source_closure)?; let mut reviewed = BTreeSet::new(); let mut claim_ids = BTreeSet::new(); for claim in &manifest.claims { @@ -1568,8 +1590,8 @@ pub(crate) fn formal_assurance_audit(formal_root: &Path, update: bool) -> Result claim.lean_declaration )); } - let closure_digest = semantic_source_closure_digest(&claim.semantic_source_closure)?; - if closure_digest != claim.semantic_source_closure_sha256 { + let closure_digest = &expected_closure_digest; + if *closure_digest != claim.semantic_source_closure_sha256 { return Err(format!( "formal claim {} semantic source closure drifted: expected {}, found {closure_digest}", claim.lean_declaration, claim.semantic_source_closure_sha256 @@ -1669,6 +1691,11 @@ pub(crate) fn formal_assurance_audit(formal_root: &Path, update: bool) -> Result } } + // All claims have the identical, independently resolved path set. Hash it + // once per snapshot, then reject mutation during the complete claim audit. + if semantic_source_closure_digest(&expected_source_closure)? != expected_closure_digest { + return Err("Lean semantic source closure changed during assurance audit".to_owned()); + } let compiled_names: BTreeSet<_> = compiled.keys().cloned().collect(); if reviewed != compiled_names { return Err(format!( @@ -1802,7 +1829,316 @@ pub(crate) fn synchronize_formal_assurance_manifest( } }; claim.lean_statement_sha256 = statement_digest; + if declaration.name == "Auths.Product.StrictOrder.Refinement.ordered_implies_pairwise" + || declaration.name + == "Auths.Product.StrictOrder.Refinement.ordered_implies_no_duplicates" + { + claim.claim_text = "The independent adjacent-chain model earns global pairwise ordering and duplicate absence under the displayed primitive relation laws.".to_owned(); + claim.scope = "Every list and Boolean comparison relation with the displayed transitivity/irreflexivity properties. This is a model law; separate source refinement earns the model predicate.".to_owned(); + } + + if declaration.name + == "Auths.Product.RecordTimes.Refinement.state_change_preserves_valid_time" + || declaration.name + == "Auths.Product.RecordTimes.Refinement.data_change_preserves_valid_time" + { + claim.claim_text = "The independent record-time model proves that the stated administrative state/time conditions preserve complete lifetime and revocation-timestamp validity.".to_owned(); + claim.scope = "Every natural-number lifetime, optional revocation timestamp and actual state carrier satisfying the displayed independent before-state and administrative conditions. Separate source refinements earn those conditions; this does not claim the whole native caller was translated.".to_owned(); + } + claim.formal_review.clone_from(&manifest.statement_review); + if declaration.name == "Auths.Codec.readHead_encodeHead" { + claim.claim_text = "The independent CBOR head grammar reads every valid shortest head encoding and preserves arbitrary following bytes.".to_owned(); + claim.scope = "The pure natural-number byte model: major tags below eight and arguments below 2^64. This model theorem alone is not a refinement of the shipping encoder or a complete protocol-object codec claim.".to_owned(); + } + if declaration + .name + .starts_with("Auths.Product.CollectionFence.") + { + claim.claim_text = format!( + "The independent collection-fence history model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated property") + ); + claim.scope = "Arbitrary finite model histories with any number of workers, collection, admission, crashes, recovery, and acknowledgement loss. This is the cutoff invariant, not a proof of the complete counter-admission algorithm or backend/driver correspondence.".to_owned(); + } + if declaration.name.starts_with("Auths.Product.EntryDeadline.") { + claim.claim_text = format!( + "The independent entry-deadline model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated property") + ); + claim.scope = "Finite lists of independent natural-number upper endpoints, preserving inclusive and exclusive boundaries. This is endpoint algebra; it does not establish that an actual verification or installed gate supplied every required bound.".to_owned(); + } + if declaration.name.starts_with("Auths.Composition.Model.") { + claim.claim_text = format!( + "The independent finite child-sequence model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated property") + ); + claim.scope = "Natural-number counts and minimum diagnostics over arbitrary finite child-outcome lists, with explicit treatment of structural invalidity. This is the independent aggregation specification, not complete plan traversal, registry/stage, callback or verifier soundness.".to_owned(); + } + if declaration.name.starts_with("Auths.Composition.Examples.") { + claim.claim_text = format!( + "A kernel-checked execution of the shipping summary operations establishes the concrete {} witness.", + declaration.name.rsplit('.').next().unwrap_or("stated") + ); + claim.scope = "The exact bounded child outcomes and threshold in this statement, including successful, denied and indeterminate cases. The Lean harness calls the actual translated push and finalizer operations; it does not assert plan validation, callback ordering or full verifier acceptance.".to_owned(); + claim.claim_status = "qualified".to_owned(); + } + if declaration.name == "Auths.Composition.Refinement.saturating_add_exact" { + claim.claim_text = "The pinned Aeneas unsigned-word saturating-add model equals the minimum of the word maximum and the natural-number sum.".to_owned(); + claim.scope = "Every pair of unsigned machine-word model values on either supported width. This proves a property of the pinned standard-library model; it is not a new opaque Auths algorithm or a complete verifier theorem.".to_owned(); + } + if declaration + .name + .starts_with("auths_composition.alloc.vec.Vec.") + { + claim.claim_text = format!( + "The transparent positive bounded-vector adapter proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated identity") + ); + claim.scope = "Every vector in the pinned usize-bounded carrier. Both conversion round trips, injectivity and exact deref delegation preserve all elements and their order. This is standard-container model equivalence, not an Auths authorization decision.".to_owned(); + } + if matches!( + declaration.name.as_str(), + "Auths.Composition.Work.event_count" | "Auths.Composition.Work.leaf_order" + ) { + claim.claim_text = format!( + "The independent recursive plan model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated property") + ); + claim.scope = "Every finite independent plan and arbitrary total stateful branch function. Counting events gives the node count; recording proof references gives the exact leaf order. Separate source corollaries establish the shipping evaluator connection under explicit callback contracts.".to_owned(); + } + if matches!( + declaration.name.as_str(), + "Auths.Composition.Bounds.node_bound" | "Auths.Composition.Bounds.bounded_events" + ) { + claim.claim_text = format!( + "The independent nonempty plan model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated bound") + ); + claim.scope = "All finite plans with no empty compound node. Node count is bounded by depth times leaf count; the explicit depth-16 and 128-leaf premises give 2048 events. This is a structural semantic-event bound, not a complete verifier, callback, allocation or host-stack bound.".to_owned(); + } + if declaration + .name + .starts_with("Auths.Composition.PlanExamples.") + { + claim.claim_text = format!( + "A kernel-checked execution of the complete shipping inner plan evaluator establishes the {} witness.", + declaration.name.rsplit('.').next().unwrap_or("stated") + ); + claim.scope = "The concrete represented two- or three-leaf plan and explicit stateful callbacks in this statement, including exact outcomes, callback counts and post-order events for all/any/k. Native tests mirror the mixed-outcome cases through the public validating wrapper. This is not a complete proof or cryptographic acceptance witness.".to_owned(); + claim.claim_status = "qualified".to_owned(); + claim.rust_symbols = vec!["auths_composition::evaluate_node".to_owned()]; + claim.evidence.retain(|item| { + !matches!( + item.kind, + FormalEvidenceKind::MechanicalTranslation | FormalEvidenceKind::SourceClosure + ) + }); + claim.evidence.push(FormalEvidence { + kind: FormalEvidenceKind::MechanicalTranslation, + artifact: COMPOSITION_TRANSLATION.to_owned(), + sha256: String::new(), + }); + claim.evidence.push(FormalEvidence { + kind: FormalEvidenceKind::SourceClosure, + artifact: "formal/qualification/aeneas/source-closure.json".to_owned(), + sha256: String::new(), + }); + } + if [ + "Auths.Composition.ValidationCapacity.", + "Auths.Composition.ValidationProgress.", + "Auths.Composition.ValidationShape.", + "Auths.Composition.ValidationComplete.", + "Auths.Composition.ValidationSoundness.", + ] + .iter() + .any(|prefix| declaration.name.starts_with(prefix)) + { + claim.claim_text = format!( + "The independent structural plan model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated property") + ); + claim.scope = "Arbitrary finite independent plans and natural limits. The validity relation is stated independently as operator/width/depth validity and distinct bounded leaves. The checker is proved sound and complete for it; progress preserves the exact set and forbids reuse. Separate public-source refinements discharge the shipping validation bridge. These are structural results, not full leaf-proof authorization or complete verifier work bounds.".to_owned(); + } + if declaration.name.starts_with("Auths.Composition.SetModel.") + || declaration.name == "Auths.Composition.Collect.push_exact" + || declaration.name == "Auths.Composition.ValidationLeaves.word_max_exact" + || declaration.name == "Auths.Composition.Order.reference_key_injective" + { + claim.claim_text = format!( + "The reviewed standard-container model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated identity") + ); + claim.scope = "The displayed bounded sequence/set carrier, capacity and lawful-order premises. These lemmas prove exact semantic properties of the transparent container and numeric models. They do not prove Rust standard-library allocation, balancing, runtime cost or host behavior; the compiled source bridge lists that library boundary explicitly.".to_owned(); + } + if declaration + .name + .starts_with("Auths.Composition.ValidationExamples.") + { + claim.claim_text = format!( + "The independent structural validity contract establishes the concrete {} witness.", + declaration.name.rsplit('.').next().unwrap_or("stated") + ); + claim.scope = "The exact finite plan and limits in the statement. Model validity/refusal lemmas support separately qualified public-source execution witnesses; no leaf-proof or cryptographic authority claim follows from structural validity alone.".to_owned(); + } + if declaration.name.starts_with("Auths.Crypto.Encoding.") { + claim.claim_text = format!( + "The independent numeric encoding model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated property") + ); + claim.scope = "The displayed bytes, bounded base-256 digits, natural coordinates and sign propositions. These transparent arithmetic/representation lemmas support the separately qualified shipping encoding guards. No curve recovery, signature equation, primitive-security or complete-verifier claim follows from this helper statement.".to_owned(); + } + if declaration.name.starts_with("Auths.Support.UnitCallback.") { + claim.claim_text = format!( + "The transparent unit-output ABI adapter proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the stated round trip") + ); + claim.scope = "Every typed Result value, including failure, divergence and success, with arbitrary state. Erasing and restoring the unit output are mutual inverses. This is a representation theorem, not a substitute callback algorithm or an authorization claim.".to_owned(); + } + if [ + "Auths.Crypto.ByteLex.", + "Auths.Crypto.CoordinateModel.", + "Auths.Crypto.LowContract.half_order_exact", + "Auths.Crypto.WeakContract.zero_value", + "Auths.Crypto.WeakContract.one_value", + "Auths.Crypto.WeakContract.minus_one_value", + "Auths.Crypto.WeakContract.order_eight_a_value", + "Auths.Crypto.WeakContract.order_eight_b_value", + "Auths.Crypto.Strict.Acceptance.", + ] + .iter() + .any(|prefix| declaration.name.starts_with(prefix)) + { + claim.claim_text = format!( + "The independent numeric/relational signature model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the displayed property") + ); + claim.scope = "The displayed bounded bytes or arbitrary finite byte lists and explicit primitive specification functions. Byte order equals unsigned numeric order at equal width; constants have the declared values; accepted-input relations are independent of source success and characterize the transparent model in both directions. This is model/representation evidence, not cryptographic primitive correctness, native adapter binding, full dispatch or complete E5 assurance.".to_owned(); + } + if declaration.name == "Auths.StatusSelection.Search.search_loop" { + claim.claim_text = "The transparent pinned standard-search model terminates on a positive, bounded sorted interval with sufficient fuel; its exact success Boolean is target membership in that interval and its returned index stays within the interval endpoint.".to_owned(); + claim.scope = "Reviewed standard-library model proof for arbitrary finite String lists under a genuine ordering invariant, index bounds and sufficient fuel. It proves no Rust standard-library machine code or sorting constructor. Actual Auths contains/visibility/port source binding is earned by separate audited statements; evidence authenticity, constructor validity and complete E2/M6 remain open.".to_owned(); + } + if declaration.name == "Auths.StatusSelection.Algebra.evaluateScan_eq_evaluate" { + claim.claim_text = "For every finite input, subject equality operation, view and policy, the operational accumulator equals the independent filter/max/tie-set status specification, including the complete decision and horizon.".to_owned(); + claim.scope = "Pure semantic equivalence without an input-validity or desired-result premise. The proof uses attained maxima, complete tie sets, associative record combination and exact minimum horizons. This module imports no generated Rust. Native source binding is earned only by separately audited port statements; anchor-view source correspondence, evidence authenticity and full E2/M6 remain open.".to_owned(); + } + if [ + "Auths.StatusSelection.byte_array_comparison", + "Auths.StatusSelection.native_floor_view", + "Auths.StatusSelection.unknown_issuer_visible", + "AuthsStatusSelection.lt_default_delegates", + "AuthsStatusSelection.gt_default_delegates", + "AuthsStatusSelection.max_default_delegates", + ] + .contains(&declaration.name.as_str()) + { + claim.claim_text = "The displayed independent issuer-visibility law, exact first-rule representation bridge, standard byte-array model or unconditional dictionary projection holds.".to_owned(); + claim.scope = "Only the displayed model or representation/standard-interface statement. The semantic visibility model has no generated-Rust import. These are not proofs of signature authenticity, complete selector/filter-max equivalence, anchor selection, constructor validity or full E2/M6.".to_owned(); + } + if [ + "Auths.TemporalWitness.assurance_permits_iff", + "Auths.TemporalWitness.successful_horizon_bounded", + "AuthsTemporalWitness.lt_default_delegates", + "Auths.TemporalWitness.Examples.selected_expiry_admitted", + "Auths.TemporalWitness.Examples.missing_requirement_refused", + "Auths.TemporalWitness.Examples.missing_observation_refused", + "Auths.TemporalWitness.Examples.unbounded_requirement_needs_no_observation", + "Auths.TemporalWitness.Examples.overflowing_expiry_saturates", + ] + .contains(&declaration.name.as_str()) + { + claim.claim_text = "The independent expiry/status model or exact standard dictionary bridge proves the displayed property or boundary witness.".to_owned(); + claim.scope = "Only the displayed independent finite-list expiry semantics, explicit status-result algebra, numeric examples or unconditional partial_cmp delegation. The model has no generated-Rust import. Pure model witnesses are not claimed as native executions; native parity separately uses actual validated Rust constructors. Evidence selection, full verification and runtime consumption remain open.".to_owned(); + } + if [ + "AuthsSuiteAdapters.ed_error_to_from", + "AuthsSuiteAdapters.ed_error_from_to", + "AuthsSuiteAdapters.p256_error_to_from", + "AuthsSuiteAdapters.p256_error_from_to", + "AuthsSuiteAdapters.ed25519_delegates", + "AuthsSuiteAdapters.p256_delegates", + ] + .contains(&declaration.name.as_str()) + { + claim.claim_text = "The compiled suite component bridge proves exact delegation or a complete error-constructor isomorphism.".to_owned(); + claim.scope = "Exactly the displayed owning function, importing binding and exhaustive three-constructor error conversions. Delegation is unconditional apart from the explicit foreign implementation parameter; the native owning algorithms remain transparent and separately proved. These bridge results introduce no assumed Auths algorithm, primitive law, constructor/registry validity or complete E5 claim.".to_owned(); + } + if declaration.name == "Auths.Crypto.NativeExamples.forwarding_contract" + || declaration.name == "Auths.Crypto.P256Examples.forwarding_contract" + { + claim.claim_text = "The explicitly supplied forwarding mock satisfies its stated call-binding contracts.".to_owned(); + claim.scope = "Only the displayed mock implementation, decoder, signature representation and message/signature equality predicate. This is an inhabited-contract witness; it makes no claim that any cryptographic library is correct or that any signature is authentic.".to_owned(); + } + if [ + "Auths.Crypto.BufferAllocation.signed_bounds_iff", + "Auths.Crypto.CommitmentFrames.application_length", + "Auths.Crypto.CommitmentFrames.identifier_length", + "Auths.Crypto.CommitmentFrames.application_unambiguous", + "Auths.Crypto.CommitmentFrames.identifier_unambiguous", + "Auths.Crypto.CommitmentFrames.application_identifier_separate", + "Auths.Crypto.CommitmentFrames.signing_application_separate", + "Auths.Crypto.CommitmentFrames.signing_identifier_separate", + "Auths.Crypto.CommitmentRefinement.identifier_tag_word", + "Auths.Crypto.Sha256Examples.forwarding_contract", + ] + .contains(&declaration.name.as_str()) + { + claim.claim_text = format!( + "The independent commitment/representation model proves {}.", + declaration + .name + .rsplit('.') + .next() + .unwrap_or("the displayed property") + ); + claim.scope = "Exactly the displayed finite byte lists, valid frame relations, scalar representation or explicit mock contract. Length framing binds equal inputs at the byte level and separates signing/application/identifier domains. This is model/representation evidence; it does not establish hash injectivity, cryptographic security, native library correctness, caller integration or complete E5.".to_owned(); + } let proof_kind = if declaration.module.contains(".Refinement") { FormalEvidenceKind::LeanRefinement } else { @@ -1946,47 +2282,47 @@ fn declaration_source_path(declaration: &LeanAssuranceDeclaration) -> Result Result, String> { validate_lake_dependency_worktrees(formal_root)?; let workspace_root = root(); - let mut pending = vec![formal_root.join("Auths/AssuranceAudit.lean")]; + let entry = formal_root.join("Auths/AssuranceAudit.lean"); + let output = command_output_in( + "lake", + &[ + "env", + "lean", + "--run", + "tools/SourceClosure.lean", + &formal_root.display().to_string(), + &entry.display().to_string(), + ], + formal_root, + None, + )?; + let dependencies: Vec = serde_json::from_str(output.trim()) + .map_err(|error| format!("invalid pinned-Lean source closure: {error}"))?; let mut visited = BTreeSet::new(); - while let Some(path) = pending.pop() { - let path = fs::canonicalize(&path).map_err(|error| { - format!("could not resolve Lean source {}: {error}", path.display()) - })?; + for dependency in dependencies { + let path = fs::canonicalize(&dependency) + .map_err(|error| format!("could not resolve Lean dependency {dependency}: {error}"))?; + if !is_repository_lean_dependency(formal_root, &path) { + return Err(format!( + "pinned-Lean source closure contains a non-repository source: {dependency}" + )); + } let relative = path .strip_prefix(&workspace_root) .map_err(|error| format!("Lean source escaped workspace: {error}"))? .to_string_lossy() .replace('\\', "/"); if !visited.insert(relative) { - continue; - } - let formal_relative = path - .strip_prefix(formal_root) - .map_err(|error| format!("Lean source escaped formal root: {error}"))? - .to_string_lossy() - .into_owned(); - let dependencies = command_output_in( - "lake", - &["env", "lean", "--src-deps", formal_relative.as_str()], - formal_root, - None, - )?; - for dependency in dependencies.lines().filter(|line| !line.trim().is_empty()) { - let candidate = PathBuf::from(dependency.trim()); - let candidate = if candidate.is_absolute() { - candidate - } else { - formal_root.join(candidate) - }; - let Ok(candidate) = fs::canonicalize(candidate) else { - continue; - }; - if is_repository_lean_dependency(formal_root, &candidate) { - pending.push(candidate); - } + return Err(format!( + "pinned-Lean source closure repeats source {dependency}" + )); } } + if !visited.contains("formal/Auths/AssuranceAudit.lean") { + return Err("pinned-Lean source closure omits the assurance audit root".to_owned()); + } for relative in [ + "formal/tools/SourceClosure.lean", "formal/algebra-contract-v1.toml", "formal/lakefile.toml", "formal/lake-manifest.json", @@ -2098,10 +2434,31 @@ struct ProductionRefinementMetadata { const AUTHORITY_TRANSLATION: &str = "formal/qualification/aeneas/generated/authority/Funs.lean"; const MODEL_TRANSLATION: &str = "formal/qualification/aeneas/generated/model/Funs.lean"; const GATEWAY_TRANSLATION: &str = "formal/qualification/aeneas/generated/gateway/Funs.lean"; +const PROFILE_CONSTRUCTION_TRANSLATION: &str = + "formal/qualification/aeneas/generated/profile_construction/Funs.lean"; const CONNECTIONS_TRANSLATION: &str = "formal/qualification/aeneas/generated/connections/Funs.lean"; +const CODEC_TRANSLATION: &str = "formal/qualification/aeneas/generated/codec/Funs.lean"; +const STORES_TRANSLATION: &str = "formal/qualification/aeneas/generated/stores/Funs.lean"; const BOUNDED_POLICY_TRANSLATION: &str = "formal/qualification/aeneas/generated/bounded_policy/Funs.lean"; +const STATUS_SELECTION_TRANSLATION: &str = + "formal/qualification/aeneas/generated/status_selection/Funs.lean"; + +const TEMPORAL_TRANSLATION: &str = + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean"; + +const SUITE_ADAPTER_TRANSLATION: &str = + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean"; + +const P256_TRANSLATION: &str = "formal/qualification/aeneas/generated/p256/Funs.lean"; + +const SHA256_TRANSLATION: &str = "formal/qualification/aeneas/generated/sha256/Funs.lean"; + +const SIGNATURE_TRANSLATION: &str = "formal/qualification/aeneas/generated/signature/Funs.lean"; + +const COMPOSITION_TRANSLATION: &str = "formal/qualification/aeneas/generated/composition/Funs.lean"; + /// Qualified refinement metadata together with the generated translation the /// claim must cite: the authority evaluators live in the authority crate's /// translation, the observation predicates in the model crate's, and the @@ -2109,8 +2466,73 @@ const BOUNDED_POLICY_TRANSLATION: &str = fn qualified_refinement_metadata( declaration: &str, ) -> Option<(ProductionRefinementMetadata, &'static str)> { - production_refinement_metadata(declaration) - .map(|metadata| (metadata, AUTHORITY_TRANSLATION)) + expanded_batch_refinement_metadata(declaration) + .map(|(metadata, gateway)| { + ( + metadata, + if gateway { + GATEWAY_TRANSLATION + } else { + "formal/qualification/aeneas/generated/scope_codec/Funs.lean" + }, + ) + }) + .or_else(|| { + scope_constructor_refinement_metadata(declaration).map(|metadata| { + ( + metadata, + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + ) + }) + }) + .or_else(|| { + status_selection_refinement_metadata(declaration) + .map(|metadata| (metadata, STATUS_SELECTION_TRANSLATION)) + }) + .or_else(|| { + temporal_refinement_metadata(declaration) + .map(|metadata| (metadata, TEMPORAL_TRANSLATION)) + }) + .or_else(|| { + suite_adapter_refinement_metadata(declaration) + .map(|metadata| (metadata, SUITE_ADAPTER_TRANSLATION)) + }) + .or_else(|| { + native_p256_refinement_metadata(declaration) + .map(|metadata| (metadata, P256_TRANSLATION)) + }) + .or_else(|| { + hash_boundary_refinement_metadata(declaration).map(|metadata| { + ( + metadata, + if declaration.starts_with("Auths.Crypto.Sha256") { + SHA256_TRANSLATION + } else { + CODEC_TRANSLATION + }, + ) + }) + }) + .or_else(|| { + native_signature_refinement_metadata(declaration) + .map(|metadata| (metadata, SIGNATURE_TRANSLATION)) + }) + .or_else(|| { + strict_signature_refinement_metadata(declaration) + .map(|metadata| (metadata, SIGNATURE_TRANSLATION)) + }) + .or_else(|| { + signature_encoding_refinement_metadata(declaration) + .map(|metadata| (metadata, SIGNATURE_TRANSLATION)) + }) + .or_else(|| { + composition_refinement_metadata(declaration) + .map(|metadata| (metadata, COMPOSITION_TRANSLATION)) + }) + .or_else(|| { + production_refinement_metadata(declaration) + .map(|metadata| (metadata, AUTHORITY_TRANSLATION)) + }) .or_else(|| { observation_refinement_metadata(declaration) .map(|metadata| (metadata, MODEL_TRANSLATION)) @@ -2133,88 +2555,2006 @@ fn qualified_refinement_metadata( connections_refinement_metadata(declaration) .map(|metadata| (metadata, CONNECTIONS_TRANSLATION)) }) + .or_else(|| { + connection_frame_refinement_metadata(declaration) + .map(|metadata| (metadata, GATEWAY_TRANSLATION)) + }) + .or_else(|| { + profile_construction_refinement_metadata(declaration) + .map(|metadata| (metadata, PROFILE_CONSTRUCTION_TRANSLATION)) + }) + .or_else(|| { + codec_refinement_metadata(declaration).map(|metadata| (metadata, CODEC_TRANSLATION)) + }) + .or_else(|| { + collection_fence_refinement_metadata(declaration) + .map(|metadata| (metadata, STORES_TRANSLATION)) + }) + .or_else(|| { + entry_deadline_refinement_metadata(declaration) + .map(|metadata| (metadata, GATEWAY_TRANSLATION)) + }) } -fn approval_refinement_metadata(declaration: &str) -> Option { - const COMMON: &str = "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted."; - const BOUNDARY: &str = "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem."; - const RESIDUAL: &[&str] = &[COMMON, BOUNDARY]; - const APPROVER_VERDICT: &str = "auths_model::approval::approver_verdict"; - const COUNTS: &str = "auths_model::approval::approval_counts"; - const CONTAIN: &str = "auths_model::approval::principal_ids_contain"; - const SUBSET: &str = "auths_model::approval::principal_ids_subset"; - const COVERS: &str = "auths_model::approval::approval_requirement_covers"; - const RETAINED: &str = "auths_model::approval::approval_requirement_retained"; - const ATTENUATE: &str = "auths_model::approval::approval_requirements_attenuate"; - let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { - "Auths.Refinement.Approval.translated_approver_verdict_refines_model" => ( - "The mechanically translated approver verdict returns exactly the model's approverVerdict over the abstracted outcomes.", - &[APPROVER_VERDICT], - "The terminating scan of per-approval outcomes for one approver: counted when some outcome is counted, pending when none is and some is pending, ignored otherwise.", +fn expanded_batch_refinement_metadata( + declaration: &str, +) -> Option<(ProductionRefinementMetadata, bool)> { + let (claim_text, rust_symbol, gateway) = match declaration { + "Auths.Product.ConnectionEntry.Refinement.profile_allowed_exact" => ( + "The complete actual profile-membership loop returns exactly membership of the full identifier-byte/version pair for every represented list and requested profile. Neither membership nor valid record construction is assumed.", + "auths_gateway_kernel::entry_authorization::profile_allowed", + true, ), - "Auths.Refinement.Approval.translated_approval_counts_refines_model" => ( - "The mechanically translated distinct counting returns exactly the model's counted and pending approver counts, whose threshold decision is the model's decideCounts.", - &[COUNTS, APPROVER_VERDICT], - "The terminating loop over a requirement's listed approvers, each counted once, for every outcome list and every u16 threshold.", + "Auths.Product.ConnectionEntry.Refinement.entry_allows_exact" => ( + "The complete actual connection-entry predicate returns exactly the independent conjunction of active state, exact workload membership and exact profile identifier/version membership, with no desired-result Boolean premise.", + "auths_gateway_kernel::entry_authorization::entry_allows", + true, ), - "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model" => ( - "The mechanically translated principal-list membership returns exactly the model's list membership.", - &[CONTAIN], - "The terminating scan of a principal slice for one principal, compared by UTF-8 bytes bridged to String equality.", + "Auths.Product.ConnectionEntry.Refinement.source_entry_requires_active_workload_profile" => { + ( + "Every actual positive connection-entry result earns active state and exact workload and profile/version membership. Credential leases, shared-record reloads, byte-to-record decoding and execution entry remain separate.", + "auths_gateway_kernel::entry_authorization::entry_allows", + true, + ) + } + "Auths.Product.ConnectionEntry.Refinement.source_disabled_refused" => ( + "The actual connection-entry predicate refuses every disabled state for all workload/profile lists and requests, even if both memberships hold.", + "auths_gateway_kernel::entry_authorization::entry_allows", + true, ), - "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model" => ( - "The mechanically translated principal-list inclusion returns exactly the model's list subset.", - &[SUBSET, CONTAIN], - "Every principal of the narrower slice occurring in the wider slice.", + "Auths.Product.ConnectionEntry.Refinement.source_revoked_refused" => ( + "The actual connection-entry predicate refuses every revoked state for all workload/profile lists and requests, even if both memberships hold.", + "auths_gateway_kernel::entry_authorization::entry_allows", + true, ), - "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model" => ( - "The mechanically translated cover check returns exactly the model's covers: approvers a subset and a threshold no lower.", - &[COVERS, SUBSET, CONTAIN], - "One child and one parent approval requirement.", + "Auths.Product.CounterAggregation.Refinement.count_capacity_spec" => ( + "The complete actual count-capacity lookup is total and returns exactly the independent first-key capacity, with zero for an absent key, on every represented input including duplicate keys.", + "auths_gateway_kernel::counter_aggregation::count_capacity", + true, ), - "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model" => ( - "The mechanically translated retention loop returns exactly the model's existence of a covering child requirement.", - &[RETAINED, COVERS], - "The terminating scan of a child requirement list for one parent requirement.", + "Auths.Product.CounterAggregation.Refinement.linked_sum_contribution_exact" => ( + "The actual sum contribution receives exactly the count-key lookup capacity as its slot bound while retaining its own sum ID and capacity. Both IDs are explicit inputs; their authenticated derivation is separate.", + "auths_gateway_kernel::counter_aggregation::linked_sum_contribution", + true, ), - "Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model" => ( - "The mechanically translated approval-requirement-v1 attenuation law returns exactly the model's requirementsAttenuate.", - &[ATTENUATE, RETAINED, COVERS, SUBSET], - "Every parent requirement covered by some child requirement, over requirement lists of any length.", + "Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum" => ( + "Composing the actual count aggregation and linked sum constructor earns the exact independent per-key minimum as the sum slot bound on the admitted sixteen-link domain. Input uniqueness and a precomputed minimum are not assumed; caller ID derivation remains separate.", + "auths_gateway_kernel::counter_aggregation::linked_sum_contribution", + true, + ), + "Auths.Product.SlotRecord.Refinement.counter_hex_matches_spec" => ( + "The complete actual lowercase counter-hex comparison returns exactly the independent full-length digit-pair identity predicate on every represented input; no canonicality or successful comparison is assumed.", + "auths_gateway_kernel::slot_record::counter_hex_matches", + true, + ), + "Auths.Product.SlotRecord.Refinement.validate_cumulative_exact" => ( + "The complete actual decoded cumulative-slot validator is total and returns exactly the independent schema/counter/slot/delta relation on every represented input. JSON parsing and storage integrity remain separate.", + "auths_gateway_kernel::slot_record::validate_cumulative", + true, + ), + "Auths.Product.SlotRecord.Refinement.source_accepted_binds_record" => ( + "Every accepted actual decoded cumulative record binds the exact schema bytes, canonical lowercase counter ID, requested slot and delta bounded by the returned cumulative value; no accepted identity is assumed.", + "auths_gateway_kernel::slot_record::validate_cumulative", + true, + ), + "Auths.Product.SlotRecord.Refinement.source_invalid_record_refused" => ( + "Every actual decoded record outside the independent exact identity and numeric relation returns None. Malformed storage bytes and backend semantics remain separate boundaries.", + "auths_gateway_kernel::slot_record::validate_cumulative", + true, + ), + "Auths.Product.SlotBatch.Refinement.count_loop_exact" => ( + "The actual count-slot construction loop appends exactly every counter/frontier pair in input order on its checked size/alignment domain. This scoped helper result does not alone claim complete construction.", + "auths_gateway_kernel::reservation_batch::build_batch", + true, + ), + "Auths.Product.SlotBatch.Refinement.sum_loop_exact" => ( + "The actual sum-slot construction loop appends exactly the independent sum descriptions, or returns no batch on overflow after any prefix, on its checked size/alignment domain.", + "auths_gateway_kernel::reservation_batch::build_batch", + true, + ), + "Auths.Product.SlotBatch.Refinement.build_exact" => ( + "The complete actual slot-batch constructor is total on every represented input and returns exactly the independent claim/count/sum descriptions, rejecting shape/cardinality mismatches and cumulative overflow without any desired-result or length precondition.", + "auths_gateway_kernel::reservation_batch::build_batch", + true, + ), + "Auths.Product.SlotBatch.Refinement.source_claim_first" => ( + "Every successful actual batch begins with the exact logical-operation claim key; no claim-first result is assumed.", + "auths_gateway_kernel::reservation_batch::build_batch", + true, + ), + "Auths.Product.SlotBatch.Refinement.source_complete_entry_count" => ( + "Every successful actual batch contains exactly one claim and all required count/sum entries, with at most 33 descriptions; malformed vector shapes cannot silently truncate the reservation.", + "auths_gateway_kernel::reservation_batch::build_batch", + true, + ), + "Auths.Product.SlotBatch.Refinement.source_invalid_shape_refused" => ( + "Every actual batch construction with an invalid length/cardinality shape returns None. It creates no partial descriptor batch; execution authority and actual backend atomicity are separate.", + "auths_gateway_kernel::reservation_batch::build_batch", + true, ), - _ => return None, - }; - Some(ProductionRefinementMetadata { - claim_text, - rust_symbols, - scope, - residual_assumptions: RESIDUAL, - translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, - }) -} -fn bounded_policy_link_refinement_metadata( - declaration: &str, -) -> Option { - const UNCONDITIONAL: &str = "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, and the listed foundational axioms are trusted; the theorem has no premise."; - const BOUNDARY: &str = "Decoding the bounded-policy extension, computing the digest of the parent's extension bytes, and the verifier's stage orchestration are outside this theorem."; - const RESIDUAL: &[&str] = &[UNCONDITIONAL, BOUNDARY]; - const DIGEST_EQUAL: &str = "auths_model::bounded_policy::digest_equal"; - let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { - "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model" => ( - "The mechanically translated digest comparison returns exactly the equality of the digests' byte values.", - &[DIGEST_EQUAL], - "Every pair of 32-byte digests.", + "Auths.Product.ReservationRetry.Refinement.retry_target_exact" => ( + "The actual batch-conflict interpreter returns exactly the independent claim/count/sum retry plan on every represented input, including invalid indices, missing parallel arrays and counter overflow; no bounds or successful result are assumed.", + "auths_gateway_kernel::reservation_retry::retry_target", + true, ), - "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model" => { - ( - "The mechanically translated parent-link check returns exactly the model's link rule: a kept extension links exactly its parent's extension digest, and an added one carries no link.", - &[ - "auths_model::bounded_policy::bounded_policy_link_accepts", - DIGEST_EQUAL, - ], - "Every optional child link and optional parent digest.", - ) + "Auths.Product.ReservationRetry.Refinement.source_claim_conflict_is_replay" => ( + "Every conflict on the actual logical claim entry returns Replay for all frontier and metadata inputs; it never becomes a count/sum retry.", + "auths_gateway_kernel::reservation_retry::retry_target", + true, + ), + "Auths.Product.ReservationRetry.Refinement.source_count_progress_safe" => ( + "Every actual count retry points to the exact conflicting count entry, advances exactly one and remains within the u64 word domain.", + "auths_gateway_kernel::reservation_retry::retry_target", + true, + ), + "Auths.Product.ReservationRetry.Refinement.source_sum_progress_safe" => ( + "Every actual sum retry points to the exact conflicting sum entry and existing slot, checks all parallel array bounds, and advances exactly one within the u64 word domain.", + "auths_gateway_kernel::reservation_retry::retry_target", + true, + ), + + "Auths.Product.CounterAggregation.Refinement.sum_position_spec" => ( + "The actual sum-counter first-position lookup terminates and returns the exact first matching public ID or absence on every represented slice.", + "auths_gateway_kernel::counter_aggregation::sum_position", + true, + ), + "Auths.Product.CounterAggregation.Refinement.contribute_sum_spec" => ( + "The actual sum contribution update returns exactly the independent minimum-capacity update while retaining the first slot bound; no successful result or uniqueness premise is assumed.", + "auths_gateway_kernel::counter_aggregation::contribute_sum", + true, + ), + "Auths.Product.CounterAggregation.Refinement.aggregate_sum_spec" => ( + "The complete actual sum-aggregation loop returns exactly the independent finite contribution fold, including first slot bounds, on the admitted gateway chain size domain.", + "auths_gateway_kernel::counter_aggregation::aggregate_sum", + true, + ), + "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_unique" => ( + "Every actual complete sum aggregation earns unique shared counter IDs from its own empty initial state.", + "auths_gateway_kernel::counter_aggregation::aggregate_sum", + true, + ), + "Auths.Product.CounterAggregation.Refinement.source_sum_aggregate_capacities" => ( + "Every actual complete sum aggregation returns the exact independent pointwise minimum capacity for every shared ID. Retention of the first slot bound is established separately by the complete result; authenticated caller coupling and atomic runtime admission remain open.", + "auths_gateway_kernel::counter_aggregation::aggregate_sum", + true, + ), + + "Auths.Product.CounterAggregation.Refinement.counter_equal_spec" => ( + "The actual public counter-ID comparator returns exactly byte identity for every pair of typed 32-byte IDs.", + "auths_gateway_kernel::counter_aggregation::counter_equal", + true, + ), + "Auths.Product.CounterAggregation.Refinement.counter_position_spec" => ( + "The actual first-position lookup terminates and returns the exact first key position or absence on every represented counter slice.", + "auths_gateway_kernel::counter_aggregation::counter_position", + true, + ), + "Auths.Product.CounterAggregation.Refinement.contribute_spec" => ( + "The actual contribution update returns exactly the independent first-key minimum-capacity update under the displayed allocation bound, without a uniqueness or desired-result premise.", + "auths_gateway_kernel::counter_aggregation::contribute", + true, + ), + "Auths.Product.CounterAggregation.Refinement.aggregate_spec" => ( + "The complete actual aggregation loop returns the independent finite contribution fold on the admitted gateway chain size domain.", + "auths_gateway_kernel::counter_aggregation::aggregate", + true, + ), + "Auths.Product.CounterAggregation.Refinement.source_aggregate_unique" => ( + "Every complete native aggregation earns unique counter IDs from its actual empty initial state; no caller-supplied uniqueness invariant is assumed.", + "auths_gateway_kernel::counter_aggregation::aggregate", + true, + ), + "Auths.Product.CounterAggregation.Refinement.source_aggregate_capacities" => ( + "Every complete native aggregation returns exactly the independent pointwise minimum-capacity update for every shared counter ID; later contributions cannot multiply an ancestor budget.", + "auths_gateway_kernel::counter_aggregation::aggregate", + true, + ), + + "Auths.Product.CounterFrames.Refinement.word_exact" => ( + "The actual framing helper appends the exact eight-byte big-endian u64 word within the displayed allocation bound.", + "auths_gateway_kernel::counter_preimages::append_word", + true, + ), + "Auths.Product.CounterFrames.Refinement.component_exact" => ( + "The actual component helper appends the exact checked eight-byte length and unchanged bytes within the displayed allocation bound.", + "auths_gateway_kernel::counter_preimages::append_component", + true, + ), + "Auths.Product.CounterFrames.Refinement.coordinates_exact" => ( + "The actual coordinate helper appends the exact window and window index as two big-endian u64 words.", + "auths_gateway_kernel::counter_preimages::append_coordinates", + true, + ), + "Auths.Product.CounterFrames.Refinement.count_exact" => ( + "The actual count-counter builder returns exactly the independent domain-separated framing on the production namespace, subject and evaluator size domain.", + "auths_gateway_kernel::counter_preimages::count_counter_preimage", + true, + ), + "Auths.Product.CounterFrames.Refinement.sum_exact" => ( + "The actual sum-counter builder returns exactly the independent framing including the partition on the production size domain.", + "auths_gateway_kernel::counter_preimages::sum_counter_preimage", + true, + ), + "Auths.Product.CounterFrames.Refinement.count_slot_exact" => ( + "The actual count-slot builder returns exactly the count-slot domain, typed 32-byte counter and big-endian slot word on every represented input.", + "auths_gateway_kernel::counter_preimages::count_slot_preimage", + true, + ), + "Auths.Product.CounterFrames.Refinement.sum_slot_exact" => ( + "The actual sum-slot builder returns exactly the sum-slot domain, typed 32-byte counter and big-endian slot word on every represented input.", + "auths_gateway_kernel::counter_preimages::sum_slot_preimage", + true, + ), + "Auths.Product.CounterFrames.Refinement.count_source_binds_inputs" => ( + "Any two actual count-counter builds whose bytes agree have identical namespace, subject, evaluator, window and window index. This concerns exact preimages, not SHA-256 collisions.", + "auths_gateway_kernel::counter_preimages::count_counter_preimage", + true, + ), + "Auths.Product.CounterFrames.Refinement.sum_source_binds_inputs" => ( + "Any two actual sum-counter builds whose bytes agree have identical namespace, subject, evaluator, partition, window and window index. This concerns exact preimages, not SHA-256 collisions.", + "auths_gateway_kernel::counter_preimages::sum_counter_preimage", + true, + ), + + "Auths.Product.Frontier.Refinement.start_exact" => ( + "The actual slot-frontier constructor returns precisely the independent initial interval on every u64 bound.", + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new", + true, + ), + "Auths.Product.Frontier.Refinement.probe_exact" => ( + "The actual frontier probe terminates safely and returns exactly the independent midpoint or terminal absence on every represented source state.", + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe", + true, + ), + "Auths.Product.Frontier.Refinement.observe_exact" => ( + "The actual occupied/free-read transition terminates safely and returns exactly the independent frontier transition; no caller-provided validity or result premise is assumed.", + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe", + true, + ), + "Auths.Product.Frontier.Refinement.candidate_exact" => ( + "The actual candidate projection returns precisely the independent lower endpoint.", + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate", + true, + ), + + "Auths.PrincipalConstructor.parse_exact" => ( + "The actual PrincipalId constructor returns the exact accepted string or InvalidPrincipal refusal on every represented Rust string, combining Unicode character/byte bounds with the independent URI-scheme grammar; no success premise is assumed.", + "auths_model::{auths_model::PrincipalId}::parse", + false, + ), + "Auths.Product.OperationIdentity.Refinement.source_preimage_binds_identity" => ( + "Native successful namespace validation earns unambiguous separators, so equal actual logical-operation preimages bind the exact namespace and operation bytes on the real size domain; this is not a claim of collision-free hashes.", + "auths_gateway_kernel::identity::logical_operation_preimage", + true, + ), + "Auths.PrincipalScheme.scheme_refines" => ( + "The actual bounded ASCII principal-scheme scanner terminates and returns exactly the independent first-letter, scheme-tail, colon and nonempty-remainder grammar.", + "auths_model::identifier::principal_scheme_valid", + false, + ), + "Auths.ScopeConstructor.accepted_rule_valid" => ( + "Every successfully decoded actual status trust rule carries a constructor-valid scope.", + "auths_codec::decode::status_trust_rule", + false, + ), + "Auths.ScopeConstructor.accepted_trust_valid" => ( + "Every successfully decoded actual status trust collection preserves constructor-valid scopes for every rule, with no rule position excluded.", + "auths_codec::decode::status_trust", + false, + ), + "Auths.ScopeConstructor.decoded_trust_principal" => ( + "Actual successful trust-field decoding earns every ordering invariant for the actual principal port, whose complete decision and horizon equal the independent all-view specification.", + "auths_codec::decode::status_trust", + false, + ), + "Auths.ScopeConstructor.decoded_trust_grant" => ( + "Actual successful trust-field decoding earns every ordering invariant for the actual grant port, whose complete decision and horizon equal the independent all-view specification.", + "auths_codec::decode::status_trust", + false, + ), + "Auths.Product.SchemaIndex.Refinement.field_name_equal_spec" => ( + "The actual field-name comparison terminates and returns exact byte equality on every represented input pair.", + "auths_gateway_kernel::construct::field_name_equal", + true, + ), + "Auths.Product.SchemaIndex.Refinement.field_index_spec" => ( + "The actual indexed field lookup terminates and returns exactly the independent first-match schema position or absence.", + "auths_gateway_kernel::construct::field_index", + true, + ), + "Auths.Product.OperationIdentity.Refinement.logical_preimage_exact" => ( + "The actual logical-operation preimage has the exact registered domain, validated namespace, NUL separator and logical operation bytes on the stated constructor-valid size domain.", + "auths_gateway_kernel::identity::logical_operation_preimage", + true, + ), + "Auths.Product.OperationIdentity.Refinement.token_exact" => ( + "The actual bounded token validator terminates and returns exactly the independent ASCII first/rest grammar and byte limit.", + "auths_gateway_kernel::identity::valid_token", + true, + ), + _ => return None, + }; + Some(( + ProductionRefinementMetadata { + claim_text, + rust_symbols: match rust_symbol { + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new" => { + &[ + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::new", + ] + } + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe" => { + &[ + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::probe", + ] + } + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe" => { + &[ + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::observe", + ] + } + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate" => { + &[ + "auths_gateway_kernel::frontier::{auths_gateway_kernel::frontier::FrontierSearch}::candidate", + ] + } + + "auths_model::{auths_model::PrincipalId}::parse" => { + &["auths_model::{auths_model::PrincipalId}::parse"] + } + "auths_model::identifier::principal_scheme_valid" => { + &["auths_model::identifier::principal_scheme_valid"] + } + "auths_codec::decode::status_trust_rule" => { + &["auths_codec::decode::status_trust_rule"] + } + "auths_codec::decode::status_trust" => &["auths_codec::decode::status_trust"], + "auths_gateway_kernel::construct::field_name_equal" => { + &["auths_gateway_kernel::construct::field_name_equal"] + } + "auths_gateway_kernel::construct::field_index" => { + &["auths_gateway_kernel::construct::field_index"] + } + "auths_gateway_kernel::identity::logical_operation_preimage" => { + &["auths_gateway_kernel::identity::logical_operation_preimage"] + } + "auths_gateway_kernel::identity::valid_token" => { + &["auths_gateway_kernel::identity::valid_token"] + } + "auths_gateway_kernel::counter_preimages::append_word" => { + &["auths_gateway_kernel::counter_preimages::append_word"] + } + "auths_gateway_kernel::counter_preimages::append_component" => { + &["auths_gateway_kernel::counter_preimages::append_component"] + } + "auths_gateway_kernel::counter_preimages::append_coordinates" => { + &["auths_gateway_kernel::counter_preimages::append_coordinates"] + } + "auths_gateway_kernel::counter_preimages::count_counter_preimage" => { + &["auths_gateway_kernel::counter_preimages::count_counter_preimage"] + } + "auths_gateway_kernel::counter_preimages::sum_counter_preimage" => { + &["auths_gateway_kernel::counter_preimages::sum_counter_preimage"] + } + "auths_gateway_kernel::counter_preimages::count_slot_preimage" => { + &["auths_gateway_kernel::counter_preimages::count_slot_preimage"] + } + "auths_gateway_kernel::counter_preimages::sum_slot_preimage" => { + &["auths_gateway_kernel::counter_preimages::sum_slot_preimage"] + } + "auths_gateway_kernel::counter_aggregation::counter_equal" => { + &["auths_gateway_kernel::counter_aggregation::counter_equal"] + } + "auths_gateway_kernel::counter_aggregation::counter_position" => { + &["auths_gateway_kernel::counter_aggregation::counter_position"] + } + "auths_gateway_kernel::counter_aggregation::contribute" => { + &["auths_gateway_kernel::counter_aggregation::contribute"] + } + "auths_gateway_kernel::counter_aggregation::aggregate" => { + &["auths_gateway_kernel::counter_aggregation::aggregate"] + } + "auths_gateway_kernel::counter_aggregation::sum_position" => { + &["auths_gateway_kernel::counter_aggregation::sum_position"] + } + "auths_gateway_kernel::counter_aggregation::contribute_sum" => { + &["auths_gateway_kernel::counter_aggregation::contribute_sum"] + } + "auths_gateway_kernel::counter_aggregation::aggregate_sum" => { + &["auths_gateway_kernel::counter_aggregation::aggregate_sum"] + } + "auths_gateway_kernel::reservation_retry::retry_target" => { + &["auths_gateway_kernel::reservation_retry::retry_target"] + } + "auths_gateway_kernel::entry_authorization::profile_allowed" => { + &["auths_gateway_kernel::entry_authorization::profile_allowed"] + } + "auths_gateway_kernel::entry_authorization::entry_allows" => { + &["auths_gateway_kernel::entry_authorization::entry_allows"] + } + "auths_gateway_kernel::counter_aggregation::count_capacity" => { + &["auths_gateway_kernel::counter_aggregation::count_capacity"] + } + "auths_gateway_kernel::counter_aggregation::linked_sum_contribution" => { + if declaration + == "Auths.Product.CounterAggregation.Refinement.source_sum_slots_share_count_minimum" + { + &[ + "auths_gateway_kernel::counter_aggregation::aggregate", + "auths_gateway_kernel::counter_aggregation::linked_sum_contribution", + ] + } else { + &["auths_gateway_kernel::counter_aggregation::linked_sum_contribution"] + } + } + "auths_gateway_kernel::slot_record::counter_hex_matches" => { + &["auths_gateway_kernel::slot_record::counter_hex_matches"] + } + "auths_gateway_kernel::slot_record::validate_cumulative" => { + &["auths_gateway_kernel::slot_record::validate_cumulative"] + } + "auths_gateway_kernel::reservation_batch::build_batch" => { + &["auths_gateway_kernel::reservation_batch::build_batch"] + } + _ => return None, + }, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + residual_assumptions: &[ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas boundary and the inventoried transparent standard interfaces. No Auths body in the qualified unit is opaque and no generated function body is rewritten.", + "Decoder success premises state partial-correctness safety and earn scope invariants; they are not assumed authorization decisions or total-parser claims. The source scheme/token and field-index leaves state complete results on their displayed domains. Preimage size premises state the displayed production caller bounds. Counter and slot builders match pre-hash bytes; hashing callers have native parity evidence and SHA-256 security remains a separate primitive contract. No hash injectivity or signature security is asserted.", + "Independent history/schema/framing models establish only their own declared semantics until source/store/compiler/driver correspondence is composed. These source components do not close complete byte decoding, canonical round trips, registry authentication, staged verification, JSON implementation correctness, complete concurrent admission, backend durability or runtime entry. Remaining E1-E5/M6 obligations remain explicit in AP-SPEC-069.", + ], + scope: "The exact displayed source component. Trust-collection-to-status composition preserves each rule, all views and the complete selector result; remaining snapshot authenticity and full verifier composition are separate. The schema lookup is consumed by shipping lowering, and logical identity leaves are consumed by shipping constructors/key hashing; those caller/JSON/primitive boundaries still need their own full correspondence. Count and sum aggregation cover every contribution, first-key capacity minima, unique IDs and preservation of the first sum slot bound. They do not yet prove the authenticated caller mapping or count/sum coupling. Retry claims cover exact conflict interpretation, guarded indices, checked arithmetic and read-before-advance planning; actual cumulative-record decoding, canonical record serialization, whole caller/driver assembly and backend/caller linearization remain separate. Batch-description claims cover actual bounded complete construction, claim-first order and cumulative-overflow refusal. Native byte parity supports the shipping serialization and decoded cumulative-reader cutovers. Decoded-record identity and numeric checks are source-proved; complete serde/caller correspondence remains open. Connection entry source claims cover explicit state/workload/profile projections; the runtime projection, complete record decoder, reload and lease/write correspondence remain separate. Native constructor-valid record parity supports that projection, and the reload byte comparator consumes the existing exact-byte primitive. The frontier source claims cover the pure search methods. Their proof-owned answer trace is not the actual runtime I/O loop; store-read mapping, append-only-prefix semantics and atomic reservation linearization remain separate.", + }, + gateway, + )) +} + +fn scope_constructor_refinement_metadata( + declaration: &str, +) -> Option { + if matches!( + declaration, + "Auths.ScopeConstructor.accepted_scope_valid" + | "Auths.ScopeConstructor.decoded_scope_covers" + ) { + return Some(ProductionRefinementMetadata { + claim_text: if declaration.ends_with("decoded_scope_covers") { + "An actual successful scope decode earns the ordering invariant required by the actual scope-coverage function, whose complete Boolean result matches independent scope semantics. The translation-context bridge preserves each enum variant and the exact listed vector." + } else { + "Every successful actual status-scope decode returns OwnAnchor, AnyAnchor, or a nonempty, bounded, unique and ordered listed-anchor scope. The actual constructor earns the invariant on every successful listed-scope path." + }, + rust_symbols: &["auths_codec::decode::status_scope"], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + residual_assumptions: &[ + "Trust Lean's kernel, pinned source translation and reviewed standard-library interfaces. All Auths decoder and constructor bodies are transparent; no Auths algorithm or ordering outcome is opaque.", + "The premise records actual successful decoding for a legitimate partial-correctness safety property. It is not a total parser, resource-bound, all-input rejection, identifier-language completeness or canonical round-trip theorem. Separate positive/refusal source witnesses guard against vacuous acceptance claims. Full verification, evidence authentication and runtime/history consumption remain open.", + ], + scope: "Source decoder success implies a structurally valid scope. Listed output invariants are earned from the actual constructor rather than assumed from a carrier type. This closes no whole E1/E2/M6 milestone.", + }); + } + if declaration.starts_with("Auths.ScopeConstructor.DecodeExamples.") { + return match declaration { + "Auths.ScopeConstructor.DecodeExamples.sorts_unsorted_list" + | "Auths.ScopeConstructor.DecodeExamples.refuses_duplicate_list" + | "Auths.ScopeConstructor.DecodeExamples.accepts_own" + | "Auths.ScopeConstructor.DecodeExamples.accepts_any" + | "Auths.ScopeConstructor.DecodeExamples.refuses_unknown_tag" + | "Auths.ScopeConstructor.DecodeExamples.refuses_truncation" + | "Auths.ScopeConstructor.DecodeExamples.accepts_listed" + | "Auths.ScopeConstructor.DecodeExamples.refuses_empty_list" + | "Auths.ScopeConstructor.DecodeExamples.refuses_invalid_id" + | "Auths.ScopeConstructor.DecodeExamples.refuses_collection_limit" => { + Some(ProductionRefinementMetadata { + claim_text: "The actual status-scope decoder returns the displayed exact typed value or refusal and final cursor on the concrete wire carrier. Own/any/tag/truncation cases quantify every represented limit configuration; listed cases exercise actual identifier parsing and constructor validation.", + rust_symbols: &["auths_codec::decode::status_scope"], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + residual_assumptions: &[ + "Trust Lean's kernel and the pinned source translation boundary with reviewed standard-library interfaces. Kernel-proved evaluation rules preserve every original operation on every input; no native_decide, platform-width axiom or opaque Auths algorithm is used.", + "These are concrete positive/refusal witnesses, not complete byte-parser coverage or authorization decisions. Successful field decoding is not canonical caller acceptance, evidence authentication, full verification or runtime/history consumption.", + ], + scope: "Exact source decoder results and cursor for the displayed wire carriers, including valid own/any/listed, unknown tag, truncation, empty list, invalid identifier and configured collection limit.", + }) + } + _ => None, + }; + } + let claim_text = match declaration { + "Auths.ScopeConstructor.constructed_principal_selection" + | "Auths.ScopeConstructor.constructed_grant_selection" => { + "The actual constructor earns the ordering conditions for the actual principal or grant status port in every view when its constructed list is assigned to each supplied rule. The complete port result equals the independent filter/max/tie-set specification; no source-success or caller-ordering premise is assumed." + } + "Auths.ScopeConstructor.constructor_refines" => { + "The actual scope constructor terminates and returns exactly the complete typed result of independent nonempty, maximum-length and uniqueness validation, sorting every admitted list." + } + "Auths.ScopeConstructor.constructor_validity" => { + "Every successful actual construction earns ordered scope lookup, preserves exactly the original list as a permutation and enforces the 1024-element limit; every failure is the exact typed invalid-snapshot error on an inadmissible list." + } + "Auths.ScopeConstructor.constructed_lookup" => { + "Successful actual construction feeds the actual Auths binary-search wrapper and yields exact membership in the original list, with no caller ordering or desired-success premise." + } + "Auths.ScopeConstructor.Examples.accepts_unsorted" => { + "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." + } + "Auths.ScopeConstructor.Examples.rejects_duplicate" => { + "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." + } + "Auths.ScopeConstructor.Examples.rejects_empty" => { + "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." + } + "Auths.ScopeConstructor.Examples.rejects_oversized" => { + "The actual scope constructor has the displayed exact sorted acceptance or typed refusal result; the oversized example quantifies every represented list exceeding the limit." + } + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols: &["auths_model::{auths_model::StatusScopeAnchors}::new"], + residual_assumptions: &[ + "Trust Lean's kernel, pinned Rust/Charon/Aeneas compilation and the reviewed standard-library interface models. All Auths constructor, duplicate-loop, comparison and decoder helper bodies in this unit are transparent translated source; no desired Auths result is an opaque premise.", + "The ordinary-sort interface delegates to the already reviewed stable key-sort model through a pure stateless identity key. The actual String comparator law, identity-key behavior, sorted permutation, uniqueness and native binary-search membership are kernel checked. This is not a proof of Rust standard-library machine code, arbitrary stateful FnMut sorting, host allocation or physical work.", + "These constructor claims admit arbitrary represented finite String vectors, including invalid scope lengths and duplicates. Full identifier-constructor validity, complete byte-decoder acceptance/rejection and round trips, rule/snapshot constructor composition, evidence authentication, closed dispatch, full verification and runtime/history consumption remain E1/E2/E4/M6 obligations.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + scope: "Exact constructor result and constructor-earned native lookup under reviewed standard semantics. Decoder extraction supplies the actual constructor closure but decoder correctness is not claimed by these statements. No whole E1/E2/E4/M6 milestone is closed.", + }) +} + +fn status_selection_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed standard-library models. Every Auths helper, getter, comparison and selector body in this unit is translated with no opaque Auths algorithm. Standard dictionary adapters have unconditional compiled delegation equalities; no generated function body is rewritten.", + "Inputs are represented finite bounded slices and 64-bit values. The loop remaining-list relation is an internal representation invariant established at entry. Totality is in qualified Result semantics, not a full verifier work bound, physical memory, host-clock or transport guarantee.", + "Operational approval-view claims retain their original boundary. The separate semantic bridge proves filter/max/tie-set adequacy. All-view source claims additionally require ordered listed-anchor scopes, and their examples discharge that condition. Derivation of that representation invariant from the actual constructor, evidence authentication, registry dispatch, caller witness selection, complete verification and runtime entry/history consumption remain separate AP-SPEC-069 obligations. No whole E2/E4/M3/M6 milestone is closed.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.StatusSelection.Search.scope_contains" => ( + "The actual listed-anchor contains wrapper terminates and returns exact list membership on an ordered represented scope.", + &["auths_model::{auths_model::StatusScopeAnchors}::contains"], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.visibility_refines" => ( + "The actual issuer visibility function terminates and matches the independent per-issuer scope rules in every view on ordered listed scopes.", + &["auths_model::status_issuer_visible"], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.principal_method_all_views" => ( + "The actual principal port terminates and returns the independent filter/max/tie-set decision and horizon in every view on ordered listed scopes.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.grant_method_all_views" => ( + "The actual grant port terminates and returns the independent filter/max/tie-set decision and horizon in every view on ordered listed scopes.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant", + ], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.AnchorExamples.first_listed_anchor" => ( + "The actual sorted-scope lookup has the displayed exact present or absent result on the concrete two-anchor carrier.", + &["auths_model::{auths_model::StatusScopeAnchors}::contains"], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.AnchorExamples.last_listed_anchor" => ( + "The actual sorted-scope lookup has the displayed exact present or absent result on the concrete two-anchor carrier.", + &["auths_model::{auths_model::StatusScopeAnchors}::contains"], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.AnchorExamples.unlisted_anchor_refused" => ( + "The actual sorted-scope lookup has the displayed exact present or absent result on the concrete two-anchor carrier.", + &["auths_model::{auths_model::StatusScopeAnchors}::contains"], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.AnchorExamples.own_anchor_active" => ( + "The actual principal port admits active status through its issuer own anchor and hides that same evidence from a different anchor, with the displayed exact horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + "Auths.StatusSelection.AnchorExamples.other_anchor_hidden" => ( + "The actual principal port admits active status through its issuer own anchor and hides that same evidence from a different anchor, with the displayed exact horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "The displayed source contract or concrete witness. General all-view results require the legitimate ordered-scope representation invariant, not an assumed source result; this checkpoint does not yet derive that invariant from the actual sorting/validation constructor. Standard search follows the pinned size/base/half transitions and has a kernel-checked total membership proof on ordered scopes. Evidence authenticity, complete constructor closure, closed dispatch, full verification and runtime/history consumption remain separate E1/E2/E4/M6 obligations. Synthetic evidence carriers in examples assert selection, not authenticity.", + ), + + "Auths.StatusSelection.principal_method_approver_independent" => ( + "The actual principal approval-view port terminates and returns the exact independent filter/max/tie-set decision and horizon, without a source-success premise.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Every represented input and policy in the approval view. The independent model filters candidates, exact methods and trusted issuers, refuses any rollback, and uses the complete maximum-sequence tie set. Its kernel-checked operational equivalence has no validity or desired-result premise. Anchor-view source refinement, evidence authentication, registry dispatch and complete verifier/runtime consumption remain open.", + ), + "Auths.StatusSelection.grant_method_approver_independent" => ( + "The actual grant approval-view port terminates and returns the exact independent filter/max/tie-set decision and horizon, without a source-success premise.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant", + ], + "Every represented input and policy in the approval view. The independent model filters candidates, exact methods and trusted issuers, refuses any rollback, and uses the complete maximum-sequence tie set. Its kernel-checked operational equivalence has no validity or desired-result premise. Anchor-view source refinement, evidence authentication, registry dispatch and complete verifier/runtime consumption remain open.", + ), + + "Auths.StatusSelection.sequence_floor_refines" => ( + "The actual first-rule scan terminates and returns the independent first exact method/issuer rule sequence floor.", + &["auths_registries::status_sequence_floor"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.approver_visibility_refines" => ( + "The actual approval-view visibility scan terminates and agrees with every matching issuer rule having universal scope.", + &["auths_model::status_issuer_visible"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.freshness_exact" => ( + "The actual snapshot-required freshness helper returns Active iff observation ordering, inclusive expiry and maximum age hold.", + &["auths_registries::{auths_registries::ExactStatusMethod}::freshness"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.principal_loop_refines" => ( + "The actual principal status loop terminates and preserves every field of the implementation-facing approval-view accumulator.", + &["auths_registries::select_principal_from_snapshot"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.principal_selector_approver_refines" => ( + "The actual principal selector agrees with the implementation-facing approval-view scan, including all policy/header/result fields.", + &["auths_registries::select_principal_from_snapshot"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.principal_method_approver_refines" => ( + "The shipping principal port method returns the exact typed approval-view scan result without a caller-supplied desired result.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.grant_loop_refines" => ( + "The actual grant status loop terminates and preserves every field of the implementation-facing approval-view accumulator.", + &["auths_registries::select_grant_from_snapshot"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.grant_selector_approver_refines" => ( + "The actual grant selector agrees with the implementation-facing approval-view scan, including all policy/header/result fields.", + &["auths_registries::select_grant_from_snapshot"], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.grant_method_approver_refines" => ( + "The shipping grant port method returns the exact typed approval-view scan result without a caller-supplied desired result.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant", + ], + "Only each displayed component contract: exact first matching rule for arbitrary finite rule lists, approval-view visibility, snapshot-required freshness, or every field of the terminating approval-view operational scan. These operational statements alone do not assert declarative adequacy; the separate semantic bridge proves it without an input validity premise. No desired source result, authenticated-evidence conclusion or complete verifier outcome is a premise. These partial-family statements cannot satisfy the spec's complete E2 gates.", + ), + "Auths.StatusSelection.Examples.active_selected_horizon" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.revoked_selected_horizon" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.stale_selected_refused" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.rollback_despite_newer" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.newer_discards_old_stale_revocation" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.latest_ties_conservatively_revoke" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.wrong_method_refused" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.missing_uses_snapshot_window" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + "Auths.StatusSelection.Examples.unknown_issuer_refused" => ( + "The actual pure principal selector has the displayed exact accepted/refused decision and horizon.", + &[ + "auths_registries::{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal", + ], + "Only the displayed concrete approval-view native port input, complete status decision and horizon. The synthetic signature carriers are shape-valid, not authenticity witnesses. Evidence authentication is a separate caller obligation; no complete authorization, constructor closure, registry dispatch or provider effect is claimed.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn temporal_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and reviewed transparent standard models. All Auths helper, getter, comparison and loop bodies in this slice are mechanically translated. The scoped PartialOrd adapter projects the actual partial_cmp field to the pinned standard body with an unconditional compiled delegation equality; no Auths algorithm is an opaque premise.", + "Inputs are represented bounded slices, 64-bit timestamps, explicit immutable contexts and selected records. The loop's remaining-list relation is an internal representation invariant; the entry helper establishes it without a caller premise. Totality concerns the qualified Result semantics, not wall-clock execution time, host memory or the complete verifier work bound.", + "These expiry-only results do not establish evidence authenticity, native evaluator selection, satisfaction of every required policy, observation-time ordering, the complete verifier, action/approval/connection horizon intersection or actual runtime/transport consumption. Those remain separate AP-SPEC-069 obligations. No physical-clock or complete E2/E4/M6 claim is introduced.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.TemporalWitness.status_horizon_exact" => ( + "The shipping status-horizon helper returns the exact inclusive deadline or StaleStatus refusal.", + &["auths_verifier::status_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.status_horizon_accepts_iff" => ( + "The shipping status-horizon helper accepts exactly its supplied current inclusive horizon.", + &["auths_verifier::status_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.status_horizon_stale_refused" => ( + "The shipping status-horizon helper refuses a deadline before the supplied evaluation time.", + &["auths_verifier::status_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.status_decision_accepts_iff" => ( + "The shipping status-decision helper admits exactly Active.", + &["auths_verifier::status_decision"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.Status.decision_refines" => ( + "Every shipping status decision preserves the independent complete principal/grant result and stable failure class.", + &["auths_verifier::status_decision"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.assurance_loop_refines" => ( + "The actual assurance-horizon loop terminates and refines the independent selected-expiry model.", + &["auths_verifier::assurance_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.assurance_entry_refines" => ( + "The shipping assurance-horizon helper returns exactly the independent selected-expiry result from the maximum word bound.", + &["auths_verifier::assurance_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.successful_native_horizon_exact" => ( + "A successful shipping assurance-horizon result is the exact independent selected-expiry result.", + &["auths_verifier::assurance_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.native_horizon_permits_iff" => ( + "A successful shipping assurance horizon admits exactly the maximum word bound and every selected expiry.", + &["auths_verifier::assurance_horizon"], + "Every represented status/selected-assurance input and supplied time. The independent model distinguishes missing requirement/observation failures, unbounded rules, minimum selected deadlines and exact saturating 64-bit addition. Only selected records contribute. The status result distinguishes principal and grant refusals. No desired implementation result or witness-selection conclusion is assumed; this is the expiry component, not the complete verifier or driver.", + ), + "Auths.TemporalWitness.Examples.inclusive_status_endpoint" => ( + "The shipping temporal helper has the displayed exact admitted or refused boundary witness.", + &["auths_verifier::status_horizon"], + "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry.", + ), + "Auths.TemporalWitness.Examples.expired_status_refused" => ( + "The shipping temporal helper has the displayed exact admitted or refused boundary witness.", + &["auths_verifier::status_horizon"], + "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry.", + ), + "Auths.TemporalWitness.Examples.revoked_principal_refused" => ( + "The shipping temporal helper has the displayed exact admitted or refused boundary witness.", + &["auths_verifier::status_decision"], + "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry.", + ), + "Auths.TemporalWitness.Examples.revoked_grant_refused" => ( + "The shipping temporal helper has the displayed exact admitted or refused boundary witness.", + &["auths_verifier::status_decision"], + "Only the displayed native status/time input and exact result. These witnesses have no primitive implementation contract or assumed desired outcome. The native constructor admits the represented StatusEvaluation fields. They do not establish complete authorization or I/O entry.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn suite_adapter_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and inventoried transparent standard models. The suite adapter's Auths imports are exact delegations to transparent qualified local owners, with exhaustive error reboxing and inverse proofs. The closed owner table checks Rust/Lean identities and actual kernel statement constants; no opaque firstparty algorithm is assumed.", + "The displayed primitive contracts remain the exact foreign decoder/parser/equation conditions of the owning native APIs. No implementation instance, cryptographic axiom, library correctness, curve arithmetic, unforgeability or constant-time claim is introduced. Mock witnesses check call and field binding only.", + "These methods do not inspect their private suite-ID field. Its represented byte carrier is broader than constructor-valid runtime values, so these results do not establish constructor validity, canonical/installed IDs, registry selection, principal binding, caller unsigned-object/descriptor construction, complete verification, every commitment or whole E5/M6.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.SuiteAdapters.ed_public_refines" => ( + "The actual Ed25519 suite adapter forwards exact input fields to the qualified owning API and preserves the independent complete result.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", + ], + "Every represented suite instance and SignatureInput under the displayed primitive contracts. Key, complete signing preimage and signature are projected from the exact named input fields; all three core refusal classes map to the correct port errors. Self.id is not inspected by this method; constructor validity, installed suite identity and registry selection are separate obligations.", + ), + "Auths.Crypto.SuiteAdapters.ed_accepts_iff" => ( + "The actual Ed25519 suite adapter accepts iff the independent accepted-input relation holds.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", + ], + "Every represented suite/input under the displayed primitive contracts. This composes source field projection and exact error conversion with the mechanically translated owning public API. No opaque Auths algorithm or desired suite result is a premise. Constructor and registry-selection validity, principal binding, caller preimage construction and whole E5 remain separate.", + ), + "Auths.Crypto.SuiteAdapterExamples.ed_exact_fields_admitted" => ( + "The actual Ed25519 adapter retains the concrete exact fields on a useful admitted path.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", + ], + "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims.", + ), + "Auths.Crypto.SuiteAdapterExamples.ed_changed_message_refused" => ( + "The actual Ed25519 adapter refuses the displayed changed signing preimage with the correct port error.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", + ], + "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims.", + ), + "Auths.Crypto.SuiteAdapters.p256_public_refines" => ( + "The actual P-256/SHA-256 suite adapter forwards exact input fields to the qualified owning API and preserves the independent complete result.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify", + ], + "Every represented suite instance and SignatureInput under the displayed primitive contracts. Key, complete signing preimage and signature are projected from the exact named input fields; all three core refusal classes map to the correct port errors. Self.id is not inspected by this method; constructor validity, installed suite identity and registry selection are separate obligations.", + ), + "Auths.Crypto.SuiteAdapters.p256_accepts_iff" => ( + "The actual P-256/SHA-256 suite adapter accepts iff the independent accepted-input relation holds.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify", + ], + "Every represented suite/input under the displayed primitive contracts. This composes source field projection and exact error conversion with the mechanically translated owning public API. No opaque Auths algorithm or desired suite result is a premise. Constructor and registry-selection validity, principal binding, caller preimage construction and whole E5 remain separate.", + ), + "Auths.Crypto.SuiteAdapterExamples.p256_exact_fields_admitted" => ( + "The actual P-256/SHA-256 adapter retains the concrete exact fields on a useful admitted path.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify", + ], + "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims.", + ), + "Auths.Crypto.SuiteAdapterExamples.p256_changed_message_refused" => ( + "The actual P-256/SHA-256 adapter refuses the displayed changed signing preimage with the correct port error.", + &[ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify", + ], + "Only the displayed explicit forwarding mock, literal constructor-compatible private-ID carrier and input bytes. These are field/call-binding witnesses, not authentic signatures, constructor/registry refinement, primitive correctness or authorization claims.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn native_p256_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Trust Lean's kernel, the pinned Rust/Charon/Aeneas/Lean compiler boundary, permitted foundations and the inventoried transparent standard models. The native monomorphic unit preserves every body, signature, generic, layout, source span and call/type ID. Its reviewed naming ledger retains original concrete identities; only 31 foreign export aliases and two unique Auths helper name-only specialization suffixes are adapted.", + "Where present, the selected library point decoder, scalar parser and P-256/SHA-256 equation satisfy the exact displayed functional contracts. Foreign types and calls are explicit associated types/projections, with no default/global instance or extra axiom. These contracts contain no Auths encoding, low-S, wrapper, or desired complete suite result. The native library implementation, elliptic-curve arithmetic, constant time, signature unforgeability and hash security are not proved here.", + "The actual public and private Auths functions are mechanically translated, including native primitive adapters and the explicit key-validation result match. Suite/principal dispatch, caller unsigned-object/descriptor construction, every commitment, complete verification and whole AP-SPEC-069 E5/M6 remain separate obligations. Mock witnesses establish byte/call binding only and assert no authenticity.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.P256Encoding.guard_refines" => ( + "The native P-256 unit enforces exactly the independent compressed key-form predicate.", + &["auths_signature_core::p256_key_encoding_is_canonical"], + "Every represented byte slice, with no cryptographic premise: length 33 and initial tag 2 or 3. Point recovery and curve validity remain separate foreign operations.", + ), + "Auths.Crypto.P256LowScan.loop_refines" => ( + "The native P-256 scalar loop terminates and compares exactly the stated suffixes.", + &["auths_signature_core::p256_signature_is_low_s"], + "Every 64-byte array and index/remaining count summing to 32, including all array and arithmetic bounds. This is the source-linked monomorphic loop component.", + ), + "Auths.Crypto.P256LowContract.guard_refines" => ( + "The native P-256 low-S guard returns exactly the independent secp256r1 half-order condition.", + &["auths_signature_core::p256_signature_is_low_s"], + "Every 64-byte form without a primitive contract. Numeric big-endian s is at most floor(n/2); scalar validity and the signature equation remain separate.", + ), + "Auths.Crypto.P256LowContract.r_bytes_irrelevant" => ( + "The native P-256 low-S decision is independent of the r bytes.", + &["auths_signature_core::p256_signature_is_low_s"], + "Every pair of 64-byte forms with identical final 32 bytes. This is source input noninterference, not signature validity.", + ), + "Auths.Crypto.P256Native.decode_leaf_refines" => ( + "The actual native P-256 point adapter forwards exactly its input and preserves the specified decoder outcome.", + &["auths_signature_core::decode_p256_point"], + "Every represented key slice and explicit P256Primitives implementation satisfying the displayed three foreign functional contracts. No Auths key guard or desired suite result occurs in those contracts.", + ), + "Auths.Crypto.P256Native.parse_leaf_refines" => ( + "The actual native P-256 scalar adapter forwards the complete fixed-width signature bytes.", + &["auths_signature_core::parse_p256_signature"], + "Every represented 64-byte array under the displayed foreign contracts. The exact byte list reaches the selected foreign from_slice operation and its returned parse outcome is preserved.", + ), + "Auths.Crypto.P256Native.equation_leaf_refines" => ( + "The actual native P-256 equation adapter binds the selected key, complete message and parsed signature.", + &["auths_signature_core::verify_p256_equation"], + "Every key/message/signature carrier of the explicit implementation under the displayed P-256/SHA-256 functional equation contract. No curve arithmetic or cryptographic security is proved.", + ), + "Auths.Crypto.P256Native.decode_refines" => ( + "The actual monomorphic P-256 key path refines compressed-form validation followed by the specified native decoder.", + &[ + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::decode_p256_point", + ], + "Every represented key slice under explicit foreign contracts. The concrete form guard, exact decoder bytes, successful key and InvalidKey refusal precedence are fixed by the translated shipping source.", + ), + "Auths.Crypto.P256Native.public_verify_refines" => ( + "The public P-256/SHA-256 verification API refines the independent complete suite result and refusal precedence.", + &[ + "auths_signature_core::verify_p256_sha256", + "auths_signature_core::verify_p256_sha256_with", + ], + "Every represented key/message/signature slice and explicit implementation satisfying the named foreign decoder/parser/equation contracts. Covers the actual public wrapper, native adapters, compressed form, owned 64-byte copy, scalar parse, concrete numeric low-S guard and exact message. Primitive correctness, arithmetic, authenticity and dispatch remain outside this statement.", + ), + "Auths.Crypto.P256Native.public_accepts_iff" => ( + "The actual public P-256 API accepts iff the independent P256Accepts relation holds under its explicit primitive contracts.", + &["auths_signature_core::verify_p256_sha256"], + "Every represented byte input. The relation independently requires compressed form, decoded point, exactly 64 signature bytes, parsed scalar, numeric low-S and exact-message equation. Neither source success nor the complete desired suite result is assumed.", + ), + "Auths.Crypto.P256Native.public_validate_refines" => ( + "The public P-256 key-validation API returns exactly the independent key decision and stable error.", + &[ + "auths_signature_core::validate_p256_key", + "auths_signature_core::decode_p256_key", + ], + "Every represented key slice under the named foreign contracts. The shipping validator now projects its result with an explicit match; no unit callback, callback assumption or modeled Auths function is used.", + ), + "Auths.Crypto.P256Examples.public_call_forwards_exact_bytes" => ( + "The public native P-256 wrapper forwards the exact stated key, message and signature through an explicit mock.", + &["auths_signature_core::verify_p256_sha256"], + "Only the displayed forwardingPrimitive and byte forms. This is a useful inhabited-contract/call-binding witness, not a P-256 signature, curve membership or authenticity claim.", + ), + "Auths.Crypto.P256Examples.changed_message_is_refused" => ( + "The public P-256 wrapper refuses the displayed changed message through the explicit forwarding mock.", + &["auths_signature_core::verify_p256_sha256"], + "Only the displayed changed message and explicit mock. It checks message binding, not primitive correctness or authenticity.", + ), + "Auths.Crypto.P256Examples.changed_key_is_refused" => ( + "The public P-256 wrapper refuses the displayed changed compressed-form key through the forwarding mock.", + &["auths_signature_core::verify_p256_sha256"], + "Only the displayed changed key and explicit mock. It checks that the decoded key reaches the equation, not curve validity.", + ), + "Auths.Crypto.P256Examples.changed_signature_is_refused" => ( + "The public P-256 wrapper refuses the displayed changed signature bytes through the forwarding mock.", + &["auths_signature_core::verify_p256_sha256"], + "Only the displayed changed low-S form and explicit mock. It checks that the parser result and complete signature bytes are retained, not cryptographic security.", + ), + "Auths.Crypto.P256Examples.malformed_key_refused_without_primitive_contract" => ( + "The public P-256 wrapper refuses the empty key without a foreign primitive contract.", + &["auths_signature_core::verify_p256_sha256"], + "Every supplied message/signature and arbitrary explicit primitive implementation, with the exact empty key. No foreign call correctness premise is required for this early source refusal.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn framing_totality_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations, and inventoried transparent standard-library models. Physical memory availability, allocation failure/abort and allocator implementation remain the named host/library boundary; totality is over the qualified Result semantics, not a guarantee of available physical memory.", + "The admissible domain is stated independently with numeric byte/word-length and signed/unsigned allocation limits. Neither an accepted-result flag nor the desired source result is a premise. All branches, checked arithmetic, scalar conversions and append lengths are related to the mechanically translated shipping framer.", + "These framing claims establish no cryptographic primitive correctness or security, caller unsigned-object/descriptor construction, all protocol-object codecs, all commitment call sites, provider meaning or complete AP-SPEC-069 E5. Successful preimage exactness and input binding are separate audited results in the same closure.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.FramingTotality.identifier_total" => ( + "The shipping identifier framer terminates on every represented input and classifies success versus typed LimitExceeded against independent numeric bounds.", + &["auths_codec::hash::identifier_preimage"], + "All nine registered tags, every represented payload and actual 32/64-bit capacity bounds: eight-byte payload length and total frame length 20 plus payload fitting both unsigned and signed pointer-size limits.", + ), + "Auths.Crypto.FramingTotality.identifier_accepts_iff" => ( + "The shipping identifier framer admits exactly the independent numeric domain; no deny-all implementation satisfies this equivalence.", + &["auths_codec::hash::identifier_preimage"], + "All nine registered tags, every represented payload and actual 32/64-bit capacity bounds: eight-byte payload length and total frame length 20 plus payload fitting both unsigned and signed pointer-size limits.", + ), + "Auths.Crypto.FramingTotality.identifier_refuses_iff" => ( + "The shipping identifier framer returns LimitExceeded exactly outside the independent numeric domain.", + &["auths_codec::hash::identifier_preimage"], + "All nine registered tags, every represented payload and actual 32/64-bit capacity bounds: eight-byte payload length and total frame length 20 plus payload fitting both unsigned and signed pointer-size limits.", + ), + "Auths.Crypto.FramingTotality.application_total" => ( + "The shipping application framer terminates on every represented input and classifies success versus typed LimitExceeded against independent numeric bounds.", + &["auths_codec::hash::commitment_preimage"], + "Every represented UTF-8 domain/payload: nonempty domain at most 128 bytes, eight-byte payload length and total frame length 28 plus domain/payload fitting unsigned and signed pointer-size limits.", + ), + "Auths.Crypto.FramingTotality.application_accepts_iff" => ( + "The shipping application framer admits exactly the independent numeric domain; no deny-all implementation satisfies this equivalence.", + &["auths_codec::hash::commitment_preimage"], + "Every represented UTF-8 domain/payload: nonempty domain at most 128 bytes, eight-byte payload length and total frame length 28 plus domain/payload fitting unsigned and signed pointer-size limits.", + ), + "Auths.Crypto.FramingTotality.application_refuses_iff" => ( + "The shipping application framer returns LimitExceeded exactly outside the independent numeric domain.", + &["auths_codec::hash::commitment_preimage"], + "Every represented UTF-8 domain/payload: nonempty domain at most 128 bytes, eight-byte payload length and total frame length 28 plus domain/payload fitting unsigned and signed pointer-size limits.", + ), + "Auths.Crypto.FramingTotality.signing_total" => ( + "The shipping signing framer terminates on every represented input and classifies success versus typed LimitExceeded against independent numeric bounds.", + &["auths_codec::hash::signing_preimage"], + "All six signing tags, every profile/version/payload: two-byte profile length, eight-byte payload length and total frame length 21 plus profile/payload fitting unsigned and signed pointer-size limits. Empty profiles are admitted where these bounds permit them; object-specific caller policy remains separate.", + ), + "Auths.Crypto.FramingTotality.signing_accepts_iff" => ( + "The shipping signing framer admits exactly the independent numeric domain; no deny-all implementation satisfies this equivalence.", + &["auths_codec::hash::signing_preimage"], + "All six signing tags, every profile/version/payload: two-byte profile length, eight-byte payload length and total frame length 21 plus profile/payload fitting unsigned and signed pointer-size limits. Empty profiles are admitted where these bounds permit them; object-specific caller policy remains separate.", + ), + "Auths.Crypto.FramingTotality.signing_refuses_iff" => ( + "The shipping signing framer returns LimitExceeded exactly outside the independent numeric domain.", + &["auths_codec::hash::signing_preimage"], + "All six signing tags, every profile/version/payload: two-byte profile length, eight-byte payload length and total frame length 21 plus profile/payload fitting unsigned and signed pointer-size limits. Empty profiles are admitted where these bounds permit them; object-specific caller policy remains separate.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn hash_boundary_refinement_metadata(declaration: &str) -> Option { + if let Some(metadata) = framing_totality_refinement_metadata(declaration) { + return Some(metadata); + } + const RESIDUAL: &[&str] = &[ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, permitted foundations and listed transparent standard models. Vec capacity is abstract: physical allocation, OS memory availability and allocator correctness remain outside the claim. The concrete signed-capacity guard is translated before allocation.", + "The SHA-256 unit monomorphizes the actual source without semantic cfg changes. Eleven exact foreign export-name paths and cache copies are normalized; a ledger retains their original identities. Every Auths name and every body, signature, generic, layout, source span and call/type ID is checked unchanged. The two selected foreign calls are explicit implementation projections; no global instance, crypto axiom or opaque Auths algorithm is introduced.", + "Where present, exact total digest/output contracts are displayed theorem premises. This does not establish the SHA-256 algorithm or output-library implementation, collision resistance, preimage resistance, caller unsigned-object construction, every commitment, all-input framing totality or complete AP-SPEC-069 E5. Mock examples establish call binding only.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.CommitmentValidity.application_accepted_frame_valid" => ( + "Every accepted shipping application preimage supplies the independent valid-frame premises.", + &["auths_codec::hash::commitment_preimage"], + "Every represented domain, payload and accepted result: nonempty domain at most 128 bytes, 64-bit payload length and valid byte carriers. Acceptance alone establishes these premises; no caller-supplied validity flag is trusted.", + ), + "Auths.Crypto.CommitmentValidity.identifier_accepted_frame_valid" => ( + "Every accepted shipping identifier preimage supplies the independent valid-frame premises.", + &["auths_codec::hash::identifier_preimage"], + "Every registered identifier tag, represented payload and accepted result. The tag is within its two-byte range, the payload length fits eight bytes, and every frame byte is valid.", + ), + "Auths.Crypto.CommitmentValidity.accepted_application_inputs_bind" => ( + "Equal accepted shipping application preimages bind exactly the same domain and payload.", + &["auths_codec::hash::commitment_preimage"], + "Every pair of represented domains, payloads and accepted outputs. Equality is at the complete preimage-byte level and implies equality of both original inputs, with no separately assumed frame-validity premise. This does not assert hash injectivity or collision resistance.", + ), + "Auths.Crypto.CommitmentValidity.accepted_identifier_inputs_bind" => ( + "Equal accepted shipping identifier preimages bind exactly the same registered tag and payload.", + &["auths_codec::hash::identifier_preimage"], + "All nine registered tags and every pair of represented payloads and accepted outputs. Equality is at the complete preimage-byte level and implies equality of both original inputs. This does not assert hash injectivity or collision resistance.", + ), + "Auths.Crypto.CommitmentValidity.application_output_length" => ( + "Every accepted shipping application preimage has the exact framed output length.", + &["auths_codec::hash::commitment_preimage"], + "Every accepted result: output length equals 28 plus the UTF-8 domain byte length plus payload length. This is a successful-result length theorem, not an all-input allocation/work or physical-memory guarantee.", + ), + "Auths.Crypto.CommitmentValidity.identifier_output_length" => ( + "Every accepted shipping identifier preimage has the exact framed output length.", + &["auths_codec::hash::identifier_preimage"], + "Every registered tag and accepted result: output length equals 20 plus payload length. This is a successful-result length theorem, not an all-input allocation/work or physical-memory guarantee.", + ), + + "Auths.Crypto.BufferAllocation.buffer_refines" => ( + "The shipping preimage buffer guard returns exactly the signed-capacity decision and an empty buffer or typed limit refusal.", + &["auths_codec::hash::preimage_buffer"], + "Every represented usize capacity. Admission is equivalent to fitting the signed pointer-size maximum before Vec allocation. This proves the abstract allocation request guard/result, not physical allocation success, memory exhaustion handling or the standard allocator implementation.", + ), + "Auths.Crypto.BufferAllocation.accepted_empty" => ( + "A successful shipping preimage buffer starts with no bytes.", + &["auths_codec::hash::preimage_buffer"], + "Every represented capacity and accepted buffer. This is a successful-result projection used by exact framing proofs, not a whole-function resource bound.", + ), + "Auths.Crypto.BufferAllocation.accepted_capacity_fits" => ( + "A successful shipping preimage buffer request fits the signed pointer-size capacity range.", + &["auths_codec::hash::preimage_buffer"], + "Every represented capacity and successful result. A usize sum alone is insufficient; the actual signed conversion has succeeded before the standard allocator is called.", + ), + "Auths.Crypto.CommitmentRefinement.application_preimage_exact" => ( + "Every successful shipping application-commitment preimage contains exactly the independent prefix, protocol, domain and payload frames.", + &["auths_codec::hash::commitment_preimage"], + "Every represented domain/payload slice and successful result. Includes exact big-endian widths, length framing and all domain/payload bytes. This is successful-output exactness; it does not establish complete totality, all admissible-input acceptance, caller canonicalization, business meaning or hash collision resistance.", + ), + "Auths.Crypto.CommitmentRefinement.identifier_preimage_exact" => ( + "Every successful shipping content-identifier preimage contains exactly its independent registered tag and payload frame.", + &["auths_codec::hash::identifier_preimage"], + "Every represented payload, successful output and all nine registered identifier tags. Includes the fixed identifier prefix, protocol, exact tag, 64-bit payload length and complete payload bytes. Caller unsigned-object encoding and complete totality remain separate obligations.", + ), + "Auths.Crypto.Sha256Native.raw_hash_refines" => ( + "The shipping native one-shot SHA-256 wrapper forwards exactly its supplied bytes and returns the specified fixed-width digest under explicit foreign contracts.", + &["auths_codec::hash::raw_sha256"], + "Every represented input slice and explicit Sha256Primitives implementation satisfying the displayed Contract for the supplied SHA-256 specification function. Covers the actual digest call, selected Into<[u8;32]> conversion and translated Digest constructor. Primitive functional correctness and output conversion remain explicit premises; collision resistance, preimage resistance, caller integration and complete E5 are not proved.", + ), + "Auths.Crypto.CommitmentExamples.empty_domain_refused" => ( + "The actual application framing rejects the empty domain for arbitrary payloads.", + &["auths_codec::hash::commitment_preimage"], + "Every represented payload and the exact empty domain. No allocator or cryptographic primitive correctness premise is used.", + ), + "Auths.Crypto.CommitmentExamples.oversized_domain_refused" => ( + "The actual application framing rejects the displayed 129-byte domain for arbitrary payloads.", + &["auths_codec::hash::commitment_preimage"], + "Every represented payload and the exact oversized ASCII domain. This is a concrete refusal witness, not the complete domain-bound classification.", + ), + "Auths.Crypto.CommitmentExamples.application_sample_admitted" => ( + "A concrete useful application frame is accepted by the actual shipping source.", + &["auths_codec::hash::commitment_preimage"], + "Only the displayed demo domain and two payload bytes. This prevents a deny-all implementation from satisfying the successful-output theorem; it is not an authorization or hash-security claim.", + ), + "Auths.Crypto.CommitmentExamples.every_identifier_tag_admitted" => ( + "Every registered identifier tag accepts the concrete payload through the actual shipping framing source.", + &["auths_codec::hash::identifier_preimage"], + "All nine registered tags and the exact displayed two-byte payload. This is a family of useful acceptance witnesses, not general encoding/decoding or hash-security completeness.", + ), + "Auths.Crypto.Sha256Examples.exact_input_reaches_selected_digest" => ( + "The actual native hash wrapper forwards the stated input through an explicit byte-echo mock.", + &["auths_codec::hash::raw_sha256"], + "Only the displayed explicit forwardingPrimitive, exact input and repeated output. The mock is not SHA-256, no global instance is installed, and no cryptographic correctness or security is claimed.", + ), + "Auths.Crypto.Sha256Examples.changed_input_reaches_selected_digest" => ( + "The actual native hash wrapper forwards a changed input to the selected explicit byte-echo mock.", + &["auths_codec::hash::raw_sha256"], + "Only the displayed changed input and explicit mock. It witnesses exact input forwarding and retained output conversion, not hash collision resistance or primitive correctness.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn native_signature_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Trust the pinned Rust/Charon/Aeneas/Lean compiler boundary, Lean kernel, allowed foundations and inventoried transparent standard models. The public Ed25519 wrapper and every Auths helper/closure body are translated. A reviewed section declaration generalizes only the explicit foreign implementation parameter and preserves every generated function body.", + "The foreign decoder, signature constructor and strict equation have explicit exact total functional contracts in the displayed theorem; no implementation instance, cryptographic axiom or primitive correctness is installed globally. The proof does not establish curve arithmetic, unforgeability, constant-time behavior or that the pinned libraries satisfy these contracts.", + "P-256 public native-wrapper binding, suite/principal dispatch, exact caller unsigned-object construction and complete commitments remain separate obligations. These component claims do not complete AP-SPEC-069 E5 or authorization-to-execution assurance. Explicit mocks supply call-binding witnesses only, never authentic signature evidence.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.Native.decode_leaf_refines" => ( + "The actual Ed25519 library-decoding adapter returns the exact specified decoded key under its explicit primitive contract.", + &["auths_signature_core::decode_ed25519_point"], + "Every 32-byte array, explicit foreign implementation, decoder specification, signature representation and equation satisfying the displayed Ed25519Contract. This proves the adapter and Result-to-Option projection; it does not prove point recovery.", + ), + "Auths.Crypto.Native.equation_leaf_refines" => ( + "The actual Ed25519 equation adapter constructs the specified signature and passes the exact key and message to the selected foreign verification call.", + &["auths_signature_core::verify_ed25519_equation"], + "Every implementation key, message slice and 64-byte signature under the explicit constructor and equation contracts. The exact native call sequence and Result-to-bool projection are proved; curve arithmetic, S validity, equation security and library implementation correctness remain explicit primitive obligations.", + ), + "Auths.Crypto.Native.public_verify_refines" => ( + "The public Ed25519 verification API returns exactly the independent suite model under explicit foreign primitive contracts.", + &["auths_signature_core::verify_ed25519"], + "Every represented key/message/signature slice, including malformed inputs, under the displayed Ed25519Contract. Covers the actual public wrapper, generated closure dictionaries, concrete guards, exact byte forwarding, stable error classes and precedence, with a total result. No global primitive instance is installed.", + ), + "Auths.Crypto.Native.public_verify_accepts_iff" => ( + "The public Ed25519 verification API succeeds iff the independent suite acceptance relation holds under explicit foreign primitive contracts.", + &["auths_signature_core::verify_ed25519"], + "Every represented key/message/signature slice and explicit implementation satisfying Ed25519Contract. The independent relation requires exact widths, canonical/non-weak key and R, decoded key and the exact-message equation. This proves both acceptance and refusal through the public wrapper, not the primitive contracts or authorization.", + ), + "Auths.Crypto.Native.public_validate_refines" => ( + "The public Ed25519 key validator returns exactly the independent canonical point-decoding result under explicit primitive contracts.", + &[ + "auths_signature_core::validate_ed25519_key", + "auths_signature_core::decode_ed25519_key", + ], + "Every represented key byte slice under the displayed foreign decoder contract, including typed malformed-key refusals and exact successful Unit projection. A canonical weak encoding may pass key-format validation; it cannot thereby pass strict signature verification.", + ), + "Auths.Crypto.NativeExamples.public_call_forwards_exact_bytes" => ( + "A kernel-checked explicit mock witnesses useful exact-byte forwarding through the actual public Ed25519 API.", + &["auths_signature_core::verify_ed25519"], + "Only the displayed explicit forwardingPrimitive implementation and exact public byte forms. The mock deliberately recognizes one message/signature pair; it is no cryptographic implementation, global instance, authentic signature witness or authorization claim.", + ), + "Auths.Crypto.NativeExamples.changed_message_is_refused" => ( + "The actual public Ed25519 wrapper refuses a changed message against an explicit exact-byte forwarding mock.", + &["auths_signature_core::verify_ed25519"], + "Only the stated changed message and explicit mock. The result detects message substitution through the real wrapper; it is call-binding evidence, not cryptographic unforgeability.", + ), + "Auths.Crypto.NativeExamples.malformed_key_refused_without_primitive_contract" => ( + "The public Ed25519 wrapper refuses the empty key without a primitive-correctness or termination premise.", + &["auths_signature_core::verify_ed25519"], + "Every explicit foreign implementation, arbitrary message/signature slices, and the exact empty key. The concrete width refusal precedes all foreign calls. This is not a full malformed-input classification on its own.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn strict_signature_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and pinned transparent array/slice/range/word/FnOnce models are trusted. These strict-glue claims add no opaque Auths algorithm or global primitive axiom. Native public wrappers have separately inventoried explicit foreign interfaces; standard Result/array/slice and callback-or-primitive-dictionary operations retain their named library boundary.", + "Where present, exact total primitive call contracts are explicit theorem premises. They cover point recovery, scalar parsing and the selected exact-message signature equation; they do not cover Auths canonical, weak-point, fixed-width or low-S decisions, which are concrete proved source. The claims do not prove the primitive contracts, curve arithmetic, unforgeability or constant time.", + "The extracted parameterized functions are used by the native entry points. The concrete public-wrapper correspondence is a separate audited conditional result; these parameterized claims alone do not establish suite/principal dispatch, caller unsigned-object construction, complete commitment integration or AP-SPEC-069 E5 as a whole. No complete-verifier or authorization-to-execution claim follows from these component results.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.LowScan.loop_refines" => ( + "The shipping P-256 scalar comparison loop terminates and returns the exact suffix comparison.", + &["auths_signature_core::p256_signature_is_low_s"], + "Every 64-byte array and index/remaining count summing to 32. Both scalar and bound reads are in range, additions cannot overflow, and the result equals the finite byte-order model. This is the bounded loop component.", + ), + "Auths.Crypto.LowContract.guard_refines" => ( + "The shipping P-256 low-S guard is total and equals the exact numeric half-order condition.", + &["auths_signature_core::p256_signature_is_low_s"], + "Every represented 64-byte signature form, including zero/out-of-range r or s. The result is true iff the big-endian unsigned s bytes encode at most floor(n/2), for the stated secp256r1 order. Scalar validity and the equation remain primitive contracts.", + ), + "Auths.Crypto.LowContract.r_bytes_irrelevant" => ( + "The shipping low-S decision is independent of every encoded r byte.", + &["auths_signature_core::p256_signature_is_low_s"], + "Every pair of represented 64-byte arrays with identical last 32 bytes. This is exact input noninterference of the scalar upper-bound decision, not signature validity.", + ), + "Auths.Crypto.CoordinateScan.loop_refines" => ( + "The shipping Ed25519 coordinate scan is total and compares exactly the remaining coordinate bytes.", + &["auths_signature_core::ed25519_same_coordinate"], + "Every pair of represented 32-byte arrays and an index/remaining count summing to 31. The result is exact prefix equality; no point-validity assumption is used.", + ), + "Auths.Crypto.CoordinateContract.guard_refines" => ( + "The shipping sign-masked Ed25519 coordinate comparator is total and returns exactly equality of independent numeric ordinates.", + &["auths_signature_core::ed25519_same_coordinate"], + "Every pair of 32-byte arrays, including malformed point forms. The sign bit is ignored and all 255 coordinate bits are preserved. This does not identify distinct non-weak public keys or validate a curve point.", + ), + "Auths.Crypto.WeakContract.guard_refines" => ( + "The shipping Ed25519 weak-coordinate filter is total and equals the independent numeric weak-coordinate set.", + &[ + "auths_signature_core::ed25519_has_small_order_coordinate", + "auths_signature_core::ed25519_same_coordinate", + ], + "Every 32-byte array. The set is y=0,1,p-1 and the two declared order-eight ordinates. Combining it with the separately proved canonical form selects the eight canonical weak encodings; invalid negative-zero forms are rejected by the form guard. No group-arithmetic or cryptographic-security claim is introduced.", + ), + "Auths.Crypto.RContract.guard_refines" => ( + "The shipping Ed25519 R-form guard is total and accepts exactly a canonical non-weak encoded first point.", + &[ + "auths_signature_core::ed25519_signature_r_is_allowed", + "auths_signature_core::ed25519_has_small_order_coordinate", + ], + "Every represented 64-byte signature form. The first 32 bytes are recovered losslessly and checked for numeric field/sign canonicality and the declared weak-coordinate set. Scalar range and the signature equation remain primitive responsibilities.", + ), + "Auths.Crypto.Strict.SuiteRefinement.key_encoding_refines" => ( + "The shipping Ed25519 key-form decoder is total and refines the independent length/coordinate/sign contract with exact bytes and errors.", + &[ + "auths_signature_core::ed25519_key_encoding", + "auths_signature_core::ed25519_point_encoding_is_canonical", + ], + "Every bounded byte slice. Success returns the identical 32 bytes with canonical field/sign form; every other form is InvalidKey. Point recovery is a subsequent primitive call.", + ), + "Auths.Crypto.Strict.SuiteRefinement.decode_ed25519_refines" => ( + "The shipping parameterized Ed25519 key decoder agrees exactly with form validation followed by the named point decoder.", + &[ + "auths_signature_core::decode_ed25519_key_with", + "auths_signature_core::ed25519_key_encoding", + ], + "Every bounded key slice and explicit point-decoder instance. Its exact total call contract is a theorem premise; error precedence and the bytes passed to it are fixed. This does not prove the native library decoder.", + ), + "Auths.Crypto.Strict.SuiteRefinement.decode_p256_refines" => ( + "The shipping parameterized P-256 decoder agrees exactly with compressed-form validation followed by the named point decoder.", + &[ + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::p256_key_encoding_is_canonical", + ], + "Every bounded key slice and explicit point-decoder instance under its displayed total exact call contract. Length/tag refusal precedes point decoding; recovery and curve validity remain primitive responsibilities.", + ), + "Auths.Crypto.Strict.SuiteRefinement.verify_ed25519_refines" => ( + "The complete shipping parameterized Ed25519 glue refines the independent key, width, weak-point, R-form and equation model with exact refusal precedence.", + &[ + "auths_signature_core::verify_ed25519_with", + "auths_signature_core::ed25519_key_encoding", + "auths_signature_core::ed25519_signature_r_is_allowed", + "auths_signature_core::ed25519_has_small_order_coordinate", + ], + "Every bounded key/message/signature slice and native decoder/equation dictionaries. Only the displayed exact total point-decoder and equation contracts are premises. Canonical and weak-point guards are proved concrete source algorithms. The exact original message and signature reach the primitive on the admitted path.", + ), + "Auths.Crypto.Strict.SuiteRefinement.verify_p256_refines" => ( + "The complete shipping parameterized P-256 glue refines independent compressed-form, signature-width, parser, numeric low-S and equation semantics.", + &[ + "auths_signature_core::verify_p256_sha256_with", + "auths_signature_core::decode_p256_key_with", + "auths_signature_core::p256_signature_is_low_s", + ], + "Every bounded key/message/signature slice and explicit point/scalar-parser/equation instances under their exact total call contracts. The scalar upper bound is a proved concrete byte comparison, not an assumed low-S callback. Parse failures retain precedence and the original message is passed unchanged.", + ), + "Auths.Crypto.Strict.SourceAcceptance.ed_source_accepts_iff" => ( + "The shipping parameterized Ed25519 verifier succeeds iff the independent accepted-input relation holds.", + &["auths_signature_core::verify_ed25519_with"], + "Every bounded input under the displayed exact total primitive contracts. The relation separately binds key/signature bytes, canonical/non-weak forms, a decoded point and its exact-message equation. Both soundness and useful acceptance are proved; no source-verifier success is assumed.", + ), + "Auths.Crypto.Strict.SourceAcceptance.p256_source_accepts_iff" => ( + "The shipping parameterized P-256 verifier succeeds iff the independent accepted-input relation holds.", + &["auths_signature_core::verify_p256_sha256_with"], + "Every bounded input under the displayed point-decoder, scalar-parser and equation contracts. The relation independently requires the compressed form, exact 64-byte width, numeric s at most floor(n/2), decoder/parser results and the exact-message equation. It proves both soundness and acceptance.", + ), + "Auths.Crypto.Strict.Examples.zero_s_form_allowed" => ( + "A kernel-checked execution establishes the zero_s_form_allowed source-guard witness.", + &["auths_signature_core::p256_signature_is_low_s"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.half_s_form_allowed" => ( + "A kernel-checked execution establishes the half_s_form_allowed source-guard witness.", + &["auths_signature_core::p256_signature_is_low_s"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.above_half_s_refused" => ( + "A kernel-checked execution establishes the above_half_s_refused source-guard witness.", + &["auths_signature_core::p256_signature_is_low_s"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.maximum_s_refused" => ( + "A kernel-checked execution establishes the maximum_s_refused source-guard witness.", + &["auths_signature_core::p256_signature_is_low_s"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.identity_coordinate_is_weak" => ( + "A kernel-checked execution establishes the identity_coordinate_is_weak source-guard witness.", + &["auths_signature_core::ed25519_has_small_order_coordinate"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.published_key_coordinate_is_not_weak" => ( + "A kernel-checked execution establishes the published_key_coordinate_is_not_weak source-guard witness.", + &["auths_signature_core::ed25519_has_small_order_coordinate"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.weak_r_form_refused" => ( + "A kernel-checked execution establishes the weak_r_form_refused source-guard witness.", + &["auths_signature_core::ed25519_signature_r_is_allowed"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + "Auths.Crypto.Strict.Examples.public_r_form_allowed" => ( + "A kernel-checked execution establishes the public_r_form_allowed source-guard witness.", + &["auths_signature_core::ed25519_signature_r_is_allowed"], + "Only the exact public byte form and guard output stated here. An allowed form, including zero s or an arbitrary r, is not a valid signature or an authorization claim; the library parser/equation remain separate.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn signature_encoding_refinement_metadata( + declaration: &str, +) -> Option { + const ED: &str = "auths_signature_core::ed25519_point_encoding_is_canonical"; + const P256: &str = "auths_signature_core::p256_key_encoding_is_canonical"; + const RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the pinned array/slice/range/word models and the listed foundational axioms are trusted. This extraction has no opaque Auths function, custom external primitive model or additional axiom.", + "These are total encoding-form guards. Ed25519 point recovery, weak-point rejection, scalar/signature parsing and the signature equation; P-256 field/curve recovery, scalar parsing, low-S enforcement and verification; actual suite/adapter dispatch and protocol preimage selection remain separate obligations. This does not complete AP-SPEC-069 E5 or prove cryptographic security.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Crypto.Encoding.Ed25519.guard_refines" => ( + "The shipping Ed25519 compressed-point encoding guard is total and returns exactly the independent base-256 coordinate/sign criterion.", + &[ED], + "Every represented 32-byte array. Success iff its sign-masked little-endian y-coordinate is below 2^255-19 and a set sign bit is not paired with y=1 or y=p-1. No assumption about a source guard result, curve membership, key strength, signature validity or message authenticity is made.", + ), + "Auths.Crypto.Encoding.P256.guard_refines" => ( + "The shipping P-256 compressed SEC1 encoding guard is total and returns exactly the independent length/tag criterion.", + &[P256], + "Every represented bounded slice, including empty and malformed lengths. Success iff length is exactly 33 and the first byte is 2 or 3. Point recovery is a separate library operation; form acceptance alone does not validate a curve point.", + ), + "Auths.Crypto.Encoding.Scan.loop_refines" => ( + "The actual shipping Ed25519 scan loop terminates and agrees with a finite left fold over exactly the remaining bytes.", + &[ED], + "Every 32-byte array, Boolean accumulator pair and translated range with start+remaining=end and end at most 31. The proof establishes all reads are in bounds and fixes the exact result; this is a loop component theorem.", + ), + "Auths.Crypto.Encoding.RootFlags.root_flags" => ( + "The actual shipping Ed25519 scan returns flags with exact independent numeric meanings for the upper-coordinate bytes.", + &[ED], + "Every represented 32-byte array. The maximum flag iff the upper-coordinate value is 128*256^30-1, and the zero flag iff it is zero. This is the scan component, not full key or signature validation.", + ), + "Auths.Crypto.Encoding.Examples.rfc_key_encoding_accepted" => ( + "A kernel-checked execution establishes the concrete rfc_key_encoding_accepted encoding witness.", + &[ED], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + "Auths.Crypto.Encoding.Examples.field_alias_refused" => ( + "A kernel-checked execution establishes the concrete field_alias_refused encoding witness.", + &[ED], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + "Auths.Crypto.Encoding.Examples.negative_zero_refused" => ( + "A kernel-checked execution establishes the concrete negative_zero_refused encoding witness.", + &[ED], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + "Auths.Crypto.Encoding.Examples.canonical_identity_encoding_accepted" => ( + "A kernel-checked execution establishes the concrete canonical_identity_encoding_accepted encoding witness.", + &[ED], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + "Auths.Crypto.Encoding.Examples.compressed_form_accepted" => ( + "A kernel-checked execution establishes the concrete compressed_form_accepted encoding witness.", + &[P256], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + "Auths.Crypto.Encoding.Examples.uncompressed_tag_refused" => ( + "A kernel-checked execution establishes the concrete uncompressed_tag_refused encoding witness.", + &[P256], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + "Auths.Crypto.Encoding.Examples.short_compressed_refused" => ( + "A kernel-checked execution establishes the concrete short_compressed_refused encoding witness.", + &[P256], + "The exact represented bytes in the statement, accepted or refused by the actual shipping guard through its qualified refinement. These public encoding examples assert neither curve-point validity nor signature authorization.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn composition_refinement_metadata(declaration: &str) -> Option { + const FACADE_RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the listed foundations and reviewed standard-container models are trusted. The explicit unit-output dictionary adapter is a proved Result isomorphism; it restores the component erased at the concrete FnMut ABI and does not change a generated Auths function body.", + "The facade proof discharges the actual stateless observer and retains the displayed exact total branch callback contract. Invalid structure is refused without any callback premise. These are complete composition entry-point results, not proofs of branch implementations, signatures, registry/stage composition, sealed authorization projection, or complete verifier resource bounds; AP-SPEC-069 E2 remains open.", + ]; + let facade: Option<(&str, &[&str], &str)> = match declaration { + "Auths.Composition.Facade.event_outcome_exact" => Some(( + "The shipping event accessor returns exactly the independent event outcome.", + &["auths_composition::{auths_composition::EvaluationEvent}::outcome"], + "Every proof or aggregate event, with arbitrary references, counts and branch result. No premise is required.", + )), + "Auths.Composition.Facade.observer_mut_exact" => Some(( + "The shipping anonymous observer callback preserves exactly its state and discards the event.", + &[ + "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut", + ], + "Every branch callback dictionary, unit observer state and event. The branch callback is not invoked and no correctness or totality contract is required.", + )), + "Auths.Composition.Facade.observer_once_exact" => Some(( + "The shipping one-use observer callback returns exactly unit.", + &[ + "auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_once", + "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut", + ], + "Every branch callback dictionary, unit observer state and event. The state-return ABI adapter is separate and has both general Result round-trip proofs.", + )), + "Auths.Composition.Facade.evaluate_refines" => Some(( + "The complete shipping public facade agrees with independent structural validation and three-valued plan evaluation.", + &[ + "auths_composition::evaluate", + "auths_composition::evaluate_observed", + ], + "Every finite represented plan, arbitrary branch state and protocol-sized limits. An exact total stateful branch callback contract is explicit. Validation success/refusal and the exact result/final branch state are fixed; the actual stateless observer contract is discharged by the proof.", + )), + "Auths.Composition.Facade.invalid_plan_preserves_callback" => Some(( + "The shipping public facade refuses independently invalid plans before calling the branch.", + &[ + "auths_composition::evaluate", + "auths_composition::evaluate_observed", + ], + "Every independently invalid represented plan under protocol-sized limits and arbitrary native callback and initial state. No callback correctness or totality premise is needed. The result is AuthorizationPlanInvalid with the exact initial state.", + )), + "Auths.Composition.FacadeExamples.conjunction_authorizes" => Some(( + "A kernel-checked execution establishes the concrete conjunction_authorizes public-facade witness.", + &["auths_composition::evaluate"], + "The displayed two- or three-leaf plan, protocol-sized limits, actual stateful callback and initial state. Acceptance, indeterminacy or structural refusal fixes the exact final state. These are composition witnesses, not complete proof-authenticity or verifier witnesses.", + )), + "Auths.Composition.FacadeExamples.duplicate_refused" => Some(( + "A kernel-checked execution establishes the concrete duplicate_refused public-facade witness.", + &["auths_composition::evaluate"], + "The displayed two- or three-leaf plan, protocol-sized limits, actual stateful callback and initial state. Acceptance, indeterminacy or structural refusal fixes the exact final state. These are composition witnesses, not complete proof-authenticity or verifier witnesses.", + )), + "Auths.Composition.FacadeExamples.threshold_indeterminate" => Some(( + "A kernel-checked execution establishes the concrete threshold_indeterminate public-facade witness.", + &["auths_composition::evaluate"], + "The displayed two- or three-leaf plan, protocol-sized limits, actual stateful callback and initial state. Acceptance, indeterminacy or structural refusal fixes the exact final state. These are composition witnesses, not complete proof-authenticity or verifier witnesses.", + )), + _ => None, + }; + if let Some((claim_text, rust_symbols, scope)) = facade { + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: FACADE_RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + const PUBLIC_RESIDUAL: &[&str] = &[ + "The Lean kernel, pinned Rust/Charon/Aeneas/Lean toolchain, reviewed naming and positive-vector representation, listed foundations, and explicit standard-library models are trusted. BTreeSet is a reviewed semantic container boundary for Global and copied ProofRef values with a proved lawful byte order; its tree implementation and physical allocation behavior are not proved.", + "Protocol limits are explicit numeric premises. Successful evaluation requires the displayed exact stateful callback contracts; invalid-plan refusal needs none. This slice covers public structural validation and composition, not callback implementations, cryptography, registry/stage composition, sealed action projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", + ]; + let public: Option<(&str, &[&str], &str)> = match declaration { + "Auths.Composition.Order.reference_comparison" => Some(( + "The shipping derived ProofRef comparator returns exactly lexicographic order of its byte values.", + &[ + "auths_model::{impl core::cmp::Ord for auths_model::ProofRef}::cmp", + "auths_model::{impl core::cmp::Ord for auths_model::Digest}::cmp", + ], + "Every pair of fixed-width ProofRef carriers. The proof unfolds both translated derived comparators and the reviewed fixed-array comparison model; it introduces no opaque Auths ordering predicate.", + )), + "Auths.Composition.Collect.collect_exact" => Some(( + "The shipping validation collection loop terminates and preserves the exact ordered reference sequence.", + &["auths_model::{auths_model::AuthorizationPlan}::validate"], + "Every consuming set iterator and initial positive bounded vector whose combined length fits usize. The result sequence is the initial sequence followed by every remaining iterator element. This is the collection loop, not a proof of every operation in the containing Rust function.", + )), + "Auths.Composition.ValidationLeaves.proof_leaf_exact" => Some(( + "The shipping proof-leaf validator agrees exactly with the independent duplicate, depth and leaf-capacity decisions.", + &["auths_model::{auths_model::AuthorizationPlan}::validate::walk"], + "Every reference, word depth, maximum-depth state, limits record and ordered set with one slot of usize headroom. The postcondition fixes the exact refusal category or successful set/depth meaning. It is a leaf component result.", + )), + "Auths.Composition.ValidationRefinement.walk_refines" => Some(( + "The complete shipping recursive plan validator refines the independent structural checker.", + &[ + "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", + ], + "Every finite represented plan, limits with leaf/branching caps at most 128 and depth cap at most 16, a current depth at most 17, and an ordered reference set within its declared leaf cap. The exact refusal reason or successful seen-reference set and maximum-depth state are preserved, including first-failure order.", + )), + "Auths.Composition.ValidationPublic.validator_refines" => Some(( + "The public shipping validator is total and agrees with the independent checker and returned shape relation.", + &[ + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk", + "auths_model::{auths_model::AuthorizationPlan}::validate::walk_members", + ], + "Every finite represented plan and explicit protocol-sized limits record. The validator preserves the exact refusal category; success returns an ordered vector with exactly the model reference set and computed maximum depth. The private source collection uses the actual consuming iterator; physical allocations remain the standard-library boundary.", + )), + "Auths.Composition.ValidationPublic.public_evaluator_refines" => Some(( + "The complete public shipping composition evaluator returns exactly independent validation followed by three-valued evaluation.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_composition::evaluate_node", + ], + "Every finite represented plan and initial callback state under protocol-sized limits. Exact total stateful callback contracts are explicit premises. Both valid and invalid structures are covered; refused plans preserve both states. Successful evaluation preserves all/any/k outcomes, source-order callbacks and postorder aggregate events.", + )), + "Auths.Composition.ValidationContract.source_accepts_iff_valid" => Some(( + "The public shipping validator accepts exactly the independently structurally valid bounded plans.", + &["auths_model::{auths_model::AuthorizationPlan}::validate"], + "Every finite represented plan and explicit protocol-sized limits. Valid is defined without a checker result: valid nonempty operators and thresholds, per-node width, total structural depth, distinct leaves and total leaf count. The iff proves both soundness and useful acceptance; it assumes no source-validation result.", + )), + "Auths.Composition.ValidationContract.valid_public_evaluator_refines" => Some(( + "Every independently valid bounded plan reaches the public shipping evaluator with exactly the independent result and both callback states.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_composition::evaluate_node", + ], + "Every independently valid finite represented plan and arbitrary initial state under protocol-sized limits. The exact total native/model branch and observer call contracts are explicit; the proof discharges the actual source validator through structural validity instead of assuming validation succeeds.", + )), + "Auths.Composition.ValidationContract.invalid_plan_preserves_callbacks" => Some(( + "The public shipping evaluator rejects every structurally invalid plan before either callback.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "Every invalid finite represented plan, protocol-sized limits and arbitrary native callbacks and initial states. No callback correctness or totality premise is required. The result is AuthorizationPlanInvalid with both callback states unchanged.", + )), + "Auths.Composition.ValidationContract.public_event_bound" => Some(( + "The public shipping evaluator emits at most 2048 events for every independently valid protocol-bounded plan.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + "auths_composition::evaluate_node", + ], + "Every independently valid plan under depth at most 16 and at most 128 distinct leaves, with exact total branch and counting-observer contracts. This is a semantic event bound, not a bound on callback cost, allocation, stack or the complete verifier.", + )), + "Auths.Composition.ValidationExamples.public_conjunction" => Some(( + "A kernel-checked public composition execution establishes the public_conjunction witness.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance.", + )), + "Auths.Composition.ValidationExamples.duplicate_refused" => Some(( + "A kernel-checked public composition execution establishes the duplicate_refused witness.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance.", + )), + "Auths.Composition.ValidationExamples.zero_threshold_refused" => Some(( + "A kernel-checked public composition execution establishes the zero_threshold_refused witness.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance.", + )), + "Auths.Composition.ValidationExamples.public_threshold_indeterminate" => Some(( + "A kernel-checked public composition execution establishes the public_threshold_indeterminate witness.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance.", + )), + "Auths.Composition.ValidationExamples.narrow_refused" => Some(( + "A kernel-checked public composition execution establishes the narrow_refused witness.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance.", + )), + "Auths.Composition.ValidationExamples.shallow_refused" => Some(( + "A kernel-checked public composition execution establishes the shallow_refused witness.", + &[ + "auths_composition::evaluate_observed", + "auths_model::{auths_model::AuthorizationPlan}::validate", + ], + "The exact represented two- or three-leaf plan, declared limits and actual stateful callbacks in this statement. Positive and indeterminate results preserve every event; duplicate, threshold, width and depth refusals preserve both callback states. These witnesses do not establish leaf proof authenticity or full verifier acceptance.", + )), + _ => None, + }; + if let Some((claim_text, rust_symbols, scope)) = public { + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: PUBLIC_RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + const PLAN_RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed qualified discriminant names and isomorphic positive bounded-vector model, standard-library models, and listed foundational axioms are trusted. The official recursive-loop extraction flag changes no Rust semantics.", + "The statements quantify over explicit native and model callbacks and require their exact stateful call contracts. They prove the inner plan evaluator, not the implementation of leaf verification, public plan validation, stage/registry composition, sealed result projection, full verifier work/stack bounds, or AP-SPEC-069 E2 as a whole.", + ]; + let plan = match declaration { + "Auths.Composition.Traversal.evaluator_refines" => Some(( + "The complete shipping inner plan evaluator returns exactly the independent recursive plan semantics, including final branch state and post-order observer state.", + "Every finite represented plan, every initial branch/observer state, and every pair of total stateful callbacks satisfying the explicit exact call contracts. All/any/k nodes evaluate all children in source order, with exact counts, diagnostics and aggregate events. This theorem also covers typed shapes that public validation refuses; it does not assert their acceptance.", + )), + "Auths.Composition.Work.source_event_count" => Some(( + "The shipping inner evaluator terminates and invokes the counting observer exactly once per plan node.", + "Every finite represented plan, arbitrary initial branch state and natural observer count, under the explicit total branch and counting-observer contracts. The exact increment is the independently defined node count. This counts semantic events; it is not a bound on callback cost, host allocation, stack, or complete verifier work.", + )), + "Auths.Composition.Work.source_leaf_order" => Some(( + "The shipping inner evaluator records exactly the plan's leaf sequence in order, preserving the supplied prefix.", + "Every finite represented plan and initial state, under the explicit total branch and leaf-recording observer contracts. Denied or already-authorized intermediate children do not suppress later leaves. The branch implementations and public plan validation remain separate obligations.", + )), + "Auths.Composition.Bounds.source_bounded_events" => Some(( + "The shipping inner evaluator emits at most 2048 node events for plans satisfying the explicit nonempty, 128-leaf and depth-16 structural premises.", + "Every represented plan whose independently computed view has no empty compound node, at most 128 leaves and depth at most 16, under exact total branch and counting-observer contracts. The theorem checks the actual source evaluator result. Public constructor/validation correspondence and callback/stack/full-verifier cost remain outside the claim; the shape premises are not replaced by a trusted validity flag.", + )), + _ => None, + }; + if let Some((claim_text, scope)) = plan { + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols: &[ + "auths_composition::evaluate_node", + "auths_composition::evaluate_members", + "auths_composition::observe_aggregate", + ], + scope, + residual_assumptions: PLAN_RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + const RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed declaration-name normalization, the pinned standard-library models, and the listed foundational axioms are trusted.", + "These statements cover child-outcome accumulation and finalization. Recursive traversal is separately refined under explicit callback contracts. Public plan validation, callback implementations, registry/stage composition, sealed result projection and the complete verifier remain outside these summary statements; this slice does not complete AP-SPEC-069 E2.", + ]; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Composition.Refinement.push_exact" => ( + "The shipping constant-space accumulator returns the exact independent natural-number update for each of the four child outcome variants.", + &["auths_composition::summary::push"], + "Every typed summary and child outcome whose two counters can each be incremented within usize; the postcondition fixes both counters and both minimum diagnostics.", + ), + "Auths.Composition.Refinement.all_exact" => ( + "The shipping conjunction finalizer returns exactly the independent denial-before-indeterminate decision.", + &["auths_composition::summary::all"], + "Every typed summary, including empty or inconsistent summaries. The separate Matches theorem establishes minimum-code meaning for a complete child sequence.", + ), + "Auths.Composition.Refinement.threshold_exact" => ( + "The shipping threshold finalizer returns exactly the independent count decision and selected diagnostic, including saturating addition.", + &[ + "auths_composition::summary::threshold", + "auths_composition::evaluate_threshold_counts", + ], + "Every u16 threshold and pair of usize counts with arbitrary diagnostic options, on either supported machine width. Zero and out-of-range thresholds are algebra inputs; plan validation rejects them separately.", + ), + "Auths.Composition.Refinement.threshold_authorized_exact" => ( + "The shipping threshold finalizer authorizes exactly when the supplied authorized-child count meets the threshold.", + &["auths_composition::summary::threshold"], + "Every u16 threshold and every typed summary; this is count classification rather than a proof of plan validation, child authenticity or branch selection.", + ), + "Auths.Composition.Refinement.source_fold_exact" => ( + "Every bounded finite sequence of actual shipping accumulator calls returns the exact independent folded summary.", + &["auths_composition::summary::push"], + "Every initial typed summary and child-outcome list for which each initial counter plus list length fits usize. This is the sequence of source updates; it does not prove the recursive evaluator supplied that exact sequence.", + ), + "Auths.Composition.Refinement.denial_precedes_lexical" => ( + "The shipping denial comparison returns precisely strict lexical order of the independent stable V1 denial-code bytes.", + &[ + "auths_model::{auths_model::DenialReason}::code_precedes", + "auths_model::{auths_model::DenialReason}::code_order", + ], + "Every pair of denial variants. The source rank and public string getter share one catalog; exhaustive native tests separately guard string parity, and the borrowed-string getter itself is outside this extraction.", + ), + "Auths.Composition.Refinement.requirement_precedes_lexical" => ( + "The shipping requirement comparison returns precisely strict lexical order of the independent stable V1 requirement-code bytes.", + &[ + "auths_model::{auths_model::Requirement}::code_precedes", + "auths_model::{auths_model::Requirement}::code_order", + ], + "Every pair of requirement variants. The source rank and public string getter share one catalog; exhaustive native tests separately guard string parity, and the borrowed-string getter itself is outside this extraction.", + ), + "Auths.Composition.Refinement.denial_order_exact" => ( + "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification.", + &["auths_model::{auths_model::DenialReason}::code_order"], + "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction.", + ), + "Auths.Composition.Refinement.denial_precedes_exact" => ( + "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification.", + &["auths_model::{auths_model::DenialReason}::code_precedes"], + "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction.", + ), + "Auths.Composition.Refinement.requirement_order_exact" => ( + "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification.", + &["auths_model::{auths_model::Requirement}::code_order"], + "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction.", + ), + "Auths.Composition.Refinement.requirement_precedes_exact" => ( + "The mechanically translated diagnostic helper returns exactly its independent finite-rank specification.", + &["auths_model::{auths_model::Requirement}::code_precedes"], + "Every variant or pair of variants in the stated stable V1 diagnostic carrier. Separate lexical-order theorems relate these ranks to the independent published-code byte table; the public borrowed-string getter itself remains outside this extraction.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn entry_deadline_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These theorems refine only the endpoint intersection and clock predicate for supplied typed bounds. The complete verifier's extraction of the temporal witness, installed gate projection, actual driver/I/O correspondence, monotonic clock and secret-lease enforcement remain outside these theorems. They do not complete AP-SPEC-069 E2, E3 or E4.", + ]; + const CHECK: &str = "auths_gateway_kernel::deadline::entry_time_allows"; + const MEET: &str = "auths_gateway_kernel::deadline::intersect_entry_bounds"; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Product.Refinement.EntryDeadline.translated_entry_time_refines_model" => ( + "The mechanically translated shipping entry-time predicate is total and exactly matches the independent lower-time and inclusive/exclusive endpoint semantics.", + &[CHECK], + "Every u64 evaluation time, current sample and upper endpoint, with either endpoint mode.", + ), + "Auths.Product.Refinement.EntryDeadline.translated_intersection_refines_model" => ( + "The mechanically translated shipping endpoint intersection returns precisely the model's minimum endpoint and preserves exclusion when equal bounds meet.", + &[MEET], + "Every pair of u64 upper endpoints and endpoint modes, without incrementing timestamps or overflowing.", + ), + "Auths.Product.Refinement.EntryDeadline.translated_clock_rollback_refuses" => ( + "The mechanically translated shipping entry-time predicate refuses every current sample before its evaluation time.", + &[CHECK], + "Every u64 evaluation time, earlier current sample and typed upper endpoint.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn collection_fence_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted.", + "These are exact scalar-decision refinements and a conditional model-history consequence. Store locking/transaction wiring, filesystem/database durability, state parsing, the actual store-to-model history bridge, and the complete counter-admission algorithm remain outside these theorems. Backend conformance supports the retained store contract; AP-SPEC-069 E4 is not complete.", + ]; + const OPEN: &str = "auths_stores::gateway_fence::gateway_window_open"; + const ADVANCE: &str = "auths_stores::gateway_fence::advance_gateway_collection"; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Product.Refinement.CollectionFence.translated_window_open_refines_model" => ( + "The mechanically translated shipping slot-eligibility leaf agrees exactly with the independent collection-cutoff predicate.", + &[OPEN], + "Every u64 expiry and optional u64 durable cutoff; no cutoff admits every expiry, and a present cutoff requires a strictly later expiry.", + ), + "Auths.Product.Refinement.CollectionFence.translated_advance_refines_model" => ( + "The mechanically translated shipping cutoff-advance leaf returns exactly the independent model's monotone maximum.", + &[ADVANCE], + "Every optional u64 previous cutoff and u64 requested cutoff, including older clock samples and the u64 boundary.", + ), + "Auths.Product.Refinement.CollectionFence.translated_closed_window_refuses" => ( + "The mechanically translated slot-eligibility leaf refuses an already collected expiry after every declared model history from that cutoff.", + &[OPEN], + "An arbitrary finite collection/admission model history whose final cutoff is the translated input, and an expiry no later than the prior cutoff. The actual backend-history bridge is not asserted.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn codec_refinement_metadata(declaration: &str) -> Option { + const RESIDUAL: &[&str] = &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. Slices have the translated platform length bound.", + "This claim covers only CBOR heads and unsigned argument bytes. Payloads, UTF-8 validation, protocol object schemas, constructors, complete-object canonical checks, allocation/work accounting, and the verifier are outside this theorem. It does not complete AP-SPEC-069 E1.", + ]; + const HEAD: &str = "auths_codec::cbor::read_head"; + const ENCODE: &str = "auths_codec::cbor::encode_head"; + const APPEND: &str = "auths_codec::cbor::append_tail"; + const TAIL: &str = "auths_codec::cbor::read_tail"; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Codec.Refinement.Encoder.append_tail_exact" => ( + "The mechanically translated shipping head-argument encoder appends exactly the independent big-endian digit sequence and terminates within its supplied capacity.", + &[APPEND], + "Every translated u64 value and initial byte vector, with width at most eight and initial length plus width within the platform vector bound.", + ), + "Auths.Codec.Refinement.Encoder.encode_head_refines" => ( + "The mechanically translated shipping head encoder is total and exactly follows the independent shortest definite-head grammar, refusing invalid major tags.", + &[ENCODE, APPEND], + "Every u8 major tag and u64 argument; successful bytes agree with the independent grammar and failure occurs only for tags above seven.", + ), + "Auths.Codec.Refinement.Encoder.encode_head_byte_bound" => ( + "Every successful mechanically translated shipping head encoding contains one through nine bytes.", + &[ENCODE, APPEND], + "Every u8 major tag and u64 argument. This bounds head output bytes, not the complete object's allocation/work or the physical allocator.", + ), + "Auths.Codec.Refinement.Encoder.encode_head_roundtrip" => ( + "Every valid mechanically translated shipping head encoding is accepted by the mechanically translated shipping reader, recovering its exact major/argument and preserving arbitrary following bytes.", + &[ENCODE, APPEND, HEAD, TAIL], + "Major tags below eight, every u64 argument, and every bounded input slice/cursor containing the encoded bytes followed by the declared tail. This is head-codec completeness, not whole-object completeness.", + ), + "Auths.Codec.Refinement.read_head_refines" => ( + "The mechanically translated shipping CBOR head reader is total and exactly agrees with the independent definite-head byte grammar on success and refusal; success advances one to nine bytes without exceeding the input.", + &[HEAD, TAIL], + "Every translated byte slice and platform cursor, including missing input, reserved/indefinite heads, non-minimal heads, and truncated arguments.", + ), + "Auths.Codec.Refinement.read_tail_bounded" => ( + "The mechanically translated shipping CBOR argument reader returns precisely the big-endian unsigned value when the bytes fit, or a typed error exactly when the input is too short, and returns the exact final cursor.", + &[TAIL], + "Every byte slice, cursor at or before its end, and argument width from zero through eight, with initial accumulator zero.", + ), + "Auths.Codec.Refinement.read_head_accepts_encoding" => ( + "The mechanically translated shipping head reader accepts every independently encoded valid head, recovers that head exactly, and preserves an arbitrary following tail.", + &[HEAD, TAIL], + "Every valid head (major below eight and argument below 2^64), tail, byte slice and cursor representing that independent encoding.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn approval_refinement_metadata(declaration: &str) -> Option { + const COMMON: &str = "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, the listed foundational axioms, and the theorem's explicit representation-validity premises (every compared principal fits the u32 UTF-8 byte bound) are trusted."; + const BOUNDARY: &str = "Approval signature verification, principal status, CBOR decoding, requirement identifiers, and the verifier's stage orchestration are outside this theorem."; + const RESIDUAL: &[&str] = &[COMMON, BOUNDARY]; + const APPROVER_VERDICT: &str = "auths_model::approval::approver_verdict"; + const COUNTS: &str = "auths_model::approval::approval_counts"; + const CONTAIN: &str = "auths_model::approval::principal_ids_contain"; + const SUBSET: &str = "auths_model::approval::principal_ids_subset"; + const COVERS: &str = "auths_model::approval::approval_requirement_covers"; + const RETAINED: &str = "auths_model::approval::approval_requirement_retained"; + const ATTENUATE: &str = "auths_model::approval::approval_requirements_attenuate"; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Refinement.Approval.translated_approver_verdict_refines_model" => ( + "The mechanically translated approver verdict returns exactly the model's approverVerdict over the abstracted outcomes.", + &[APPROVER_VERDICT], + "The terminating scan of per-approval outcomes for one approver: counted when some outcome is counted, pending when none is and some is pending, ignored otherwise.", + ), + "Auths.Refinement.Approval.translated_approval_counts_refines_model" => ( + "The mechanically translated distinct counting returns exactly the model's counted and pending approver counts, whose threshold decision is the model's decideCounts.", + &[COUNTS, APPROVER_VERDICT], + "The terminating loop over a requirement's listed approvers, each counted once, for every outcome list and every u16 threshold.", + ), + "Auths.Refinement.Approval.translated_principal_ids_contain_refines_model" => ( + "The mechanically translated principal-list membership returns exactly the model's list membership.", + &[CONTAIN], + "The terminating scan of a principal slice for one principal, compared by UTF-8 bytes bridged to String equality.", + ), + "Auths.Refinement.Approval.translated_principal_ids_subset_refines_model" => ( + "The mechanically translated principal-list inclusion returns exactly the model's list subset.", + &[SUBSET, CONTAIN], + "Every principal of the narrower slice occurring in the wider slice.", + ), + "Auths.Refinement.Approval.translated_approval_requirement_covers_refines_model" => ( + "The mechanically translated cover check returns exactly the model's covers: approvers a subset and a threshold no lower.", + &[COVERS, SUBSET, CONTAIN], + "One child and one parent approval requirement.", + ), + "Auths.Refinement.Approval.translated_approval_requirement_retained_refines_model" => ( + "The mechanically translated retention loop returns exactly the model's existence of a covering child requirement.", + &[RETAINED, COVERS], + "The terminating scan of a child requirement list for one parent requirement.", + ), + "Auths.Refinement.Approval.translated_approval_requirements_attenuate_refines_model" => ( + "The mechanically translated approval-requirement-v1 attenuation law returns exactly the model's requirementsAttenuate.", + &[ATTENUATE, RETAINED, COVERS, SUBSET], + "Every parent requirement covered by some child requirement, over requirement lists of any length.", + ), + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope, + residual_assumptions: RESIDUAL, + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn bounded_policy_link_refinement_metadata( + declaration: &str, +) -> Option { + const UNCONDITIONAL: &str = "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, the reviewed transparent external bridges, and the listed foundational axioms are trusted; the theorem has no premise."; + const BOUNDARY: &str = "Decoding the bounded-policy extension, computing the digest of the parent's extension bytes, and the verifier's stage orchestration are outside this theorem."; + const RESIDUAL: &[&str] = &[UNCONDITIONAL, BOUNDARY]; + const DIGEST_EQUAL: &str = "auths_model::bounded_policy::digest_equal"; + let (claim_text, rust_symbols, scope): (&str, &[&str], &str) = match declaration { + "Auths.Product.Refinement.BoundedPolicy.translated_digest_equal_refines_model" => ( + "The mechanically translated digest comparison returns exactly the equality of the digests' byte values.", + &[DIGEST_EQUAL], + "Every pair of 32-byte digests.", + ), + "Auths.Product.Refinement.BoundedPolicy.translated_bounded_policy_link_accepts_refines_model" => { + ( + "The mechanically translated parent-link check returns exactly the model's link rule: a kept extension links exactly its parent's extension digest, and an added one carries no link.", + &[ + "auths_model::bounded_policy::bounded_policy_link_accepts", + DIGEST_EQUAL, + ], + "Every optional child link and optional parent digest.", + ) } _ => return None, }; @@ -2227,8 +4567,468 @@ fn bounded_policy_link_refinement_metadata( }) } +fn connection_frame_refinement_metadata(declaration: &str) -> Option { + if declaration != "Auths.Product.ConnectionFrame.Refinement.connection_preimage_exact" { + return None; + } + Some(ProductionRefinementMetadata { + claim_text: "The actual connection-key builder returns precisely the registered domain, exact provider bytes, NUL separator and exact alias bytes within the shipping constructor bounds; no field or separator is omitted.", + rust_symbols: &["auths_gateway_kernel::identity::connection_record_preimage"], + scope: "All represented provider/alias byte buffers of at most 64 bytes each, including empty and binary inputs. The separate independent framing theorem earns field injectivity from NUL-free provider validation.", + residual_assumptions: &[ + "Lean's kernel, the pinned toolchain and foundational axioms are trusted. The actual SHA-256 primitive, String-to-byte mapping and complete runtime association remain separate; no global hash injectivity is assumed.", + "Native gateway parity checks compare the shipping hash caller against the frozen streaming preimage. Allocation failure remains outside the translated machine model; the proved builder bounds are below the portable usize limit.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + +fn profile_construction_refinement_metadata( + declaration: &str, +) -> Option { + if declaration.starts_with("Auths.Product.StringConstructors.Refinement.") { + let (claim_text, rust_symbols): (&str, &[&str]) = match declaration { + "Auths.Product.StringConstructors.Refinement.actual_provider_exact" => ( + "The actual ProviderKind String constructor returns exactly the independent complete lowercase provider language decision and typed error, preserving the supplied string on success.", + &["auths_connections::model::{auths_connections::model::ProviderKind}::parse"], + ), + "Auths.Product.StringConstructors.Refinement.provider_success_earns_exact_valid_payload" => { + ( + "Successful actual ProviderKind construction earns its complete UTF-8 byte grammar and exact input-payload preservation; no valid-input premise is assumed.", + &["auths_connections::model::{auths_connections::model::ProviderKind}::parse"], + ) + } + "Auths.Product.StringConstructors.Refinement.actual_alias_exact" => ( + "The actual ConnectionAlias String constructor returns exactly the independent complete lowercase alias language decision and typed error, preserving the supplied string on success.", + &["auths_connections::model::{auths_connections::model::ConnectionAlias}::parse"], + ), + "Auths.Product.StringConstructors.Refinement.alias_success_earns_exact_valid_payload" => { + ( + "Successful actual ConnectionAlias construction earns its complete UTF-8 byte grammar and exact input-payload preservation; no valid-input premise is assumed.", + &[ + "auths_connections::model::{auths_connections::model::ConnectionAlias}::parse", + ], + ) + } + "Auths.Product.StringConstructors.Refinement.actual_semantic_exact" => ( + "The actual SemanticId String constructor returns exactly the independent complete semantic identifier language decision and typed error, preserving the supplied string on success.", + &["auths_connections::model::{auths_connections::model::SemanticId}::parse"], + ), + "Auths.Product.StringConstructors.Refinement.semantic_success_earns_exact_valid_payload" => { + ( + "Successful actual SemanticId construction earns its complete UTF-8 byte grammar and exact input-payload preservation; no valid-input premise is assumed.", + &["auths_connections::model::{auths_connections::model::SemanticId}::parse"], + ) + } + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Actual generic constructors specialized to the standard owned-String identity conversion. Every String within the existing reviewed UTF-8 model's portable U32 byte-size bound is covered, including arbitrary malformed identifiers and all Unicode strings in that bound.", + residual_assumptions: &[ + "Lean's kernel, pinned toolchain, foundational axioms and existing reviewed String/UTF-8 standard interfaces are trusted. The String representation bound is an explicit input premise, not a validity or desired-result premise. Explicit bounds avoid the native-default proof in the upstream toStr helper.", + "Every Auths constructor and byte helper is transparently translated. Byte-helper reuse is by definitional equality with the already qualified owner, and std projections are direct aliases to reviewed models. Other Into implementations, larger modeled String carriers, complete protocol decoding, allocation failure and whole runtime caller composition remain separate.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + let claim_text = match declaration { + "Auths.Product.ProfileConstructor.Refinement.constructor_exact" => { + "The unchanged actual inherent profile constructor returns exactly InvalidProfile at version zero and otherwise constructs exactly the supplied semantic identifier and version. No result or nonzero-version premise is assumed." + } + "Auths.Product.ProfileConstructor.Refinement.source_success_preserves_fields" => { + "Every successful actual profile construction earns a positive version and preserves both exact supplied fields; successful construction is an output condition, not an input premise." + } + "Auths.Product.ProfileConstructor.Refinement.source_zero_version_refused" => { + "The actual profile constructor refuses version zero for every represented semantic identifier." + } + _ => return None, + }; + Some(ProductionRefinementMetadata { + claim_text, + rust_symbols: &[ + "auths_connections::model::{auths_connections::model::ConnectionProfile}::new", + ], + scope: "Every represented typed SemanticId and u16 version. The actual shipping method body is translated transparently through a non-shipping selector; no constructor algorithm is duplicated or replaced.", + residual_assumptions: &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted. The offline selector uses only checksum-identical shipping lock identities and locked compilation.", + "The string-to-SemanticId parser, full record codec, projection and runtime caller composition remain separate. This proves constructor field/version behavior, not validity of an arbitrary represented SemanticId string.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }) +} + fn connections_refinement_metadata(declaration: &str) -> Option { + if declaration.starts_with("Auths.Product.SemanticId.Refinement.") { + let (claim_text, rust_symbols): (&str, &[&str]) = match declaration { + "Auths.Product.SemanticId.Refinement.semantic_head_exact" => ( + "The actual semantic-identifier head classifier exactly accepts ASCII letters and digits for every byte.", + &["auths_connections::kernel::semantic_head_valid"], + ), + "Auths.Product.SemanticId.Refinement.semantic_tail_exact" => ( + "The actual semantic-identifier tail classifier exactly accepts ASCII letters/digits and the five registered punctuation bytes.", + &["auths_connections::kernel::semantic_tail_valid"], + ), + "Auths.Product.SemanticId.Refinement.semantic_valid_exact" => ( + "The complete actual identifier validator returns exactly the independent nonempty bounded initial-alphanumeric/full-tail language on every slice and maximum, without a validity premise.", + &["auths_connections::kernel::semantic_id_valid"], + ), + "Auths.Product.SemanticId.Refinement.source_earns_no_nul" => ( + "Successful actual semantic-identifier validation earns NUL absence throughout the complete byte buffer.", + &["auths_connections::kernel::semantic_id_valid"], + ), + "Auths.Product.SemanticId.Refinement.source_earns_ascii" => ( + "Successful actual semantic-identifier validation earns that every byte is ASCII.", + &["auths_connections::kernel::semantic_id_valid"], + ), + "Auths.Product.SemanticId.Refinement.source_earns_bounds" => ( + "Successful actual semantic-identifier validation earns a nonempty buffer within the supplied size bound.", + &["auths_connections::kernel::semantic_id_valid"], + ), + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Every represented byte buffer and usize maximum; helper claims cover every u8. The shipping SemanticId parser consumes this byte predicate with maximum 128.", + residual_assumptions: &[ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. All useful byte properties are earned from the source result.", + "String conversion and the complete typed constructor/record decoder remain separate. The cutover has frozen native grammar parity across all byte pairs and every byte mutation at lengths 127, 128 and 129; no hash assumption is used.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + if declaration.starts_with("Auths.Product.RecoveryGate.Refinement.") { + let (claim_text, rust_symbols): (&str, &[&str]) = match declaration { + "Auths.Product.RecoveryGate.Refinement.record_change_exact" => ( + "The actual rotation/authorization-replacement guard permits exactly a non-revoked record and a nondecreasing timestamp.", + &["auths_connections::kernel::record_change_allows"], + ), + "Auths.Product.RecoveryGate.Refinement.record_change_earns_terminal_and_time" => ( + "An accepted actual administrative record change earns non-revocation and monotone time.", + &["auths_connections::kernel::record_change_allows"], + ), + "Auths.Product.RecoveryGate.Refinement.recovery_exact" => ( + "The complete actual recovery-lease guard returns exactly the specified ordered typed failures or success for every state and generation pair, including raw zeros.", + &["auths_connections::kernel::recovery_lease"], + ), + "Auths.Product.RecoveryGate.Refinement.revoked_refuses_every_generation" => ( + "A revoked connection refuses every actual recovery-lease request before generation checks.", + &["auths_connections::kernel::recovery_lease"], + ), + "Auths.Product.RecoveryGate.Refinement.success_earns_generation_and_state" => ( + "Successful actual recovery authorization earns a non-revoked state and a positive requested generation no newer than the record.", + &["auths_connections::kernel::recovery_lease"], + ), + "Auths.Product.RecoveryGate.Refinement.binding_requirement_exact" => ( + "The complete actual recovery-binding classifier returns exactly the independently stated current/recorded/refused generation policy on every tuple.", + &["auths_connections::kernel::recovery_binding_requirement"], + ), + "Auths.Product.RecoveryGate.Refinement.current_requirement_earns_exact_generation" => ( + "Requiring the current commitment earns the exact current credential generation, its positivity and coverage by the operation generation.", + &["auths_connections::kernel::recovery_binding_requirement"], + ), + "Auths.Product.RecoveryGate.Refinement.recorded_requirement_earns_older_generation" => { + ( + "Selecting the authenticated recorded commitment earns a positive credential generation no newer than the operation, which strictly predates the current credential.", + &["auths_connections::kernel::recovery_binding_requirement"], + ) + } + "Auths.Product.RecoveryGate.Refinement.state_transition_exact" => ( + "The actual administrative state guard exactly permits changed state from a non-revoked record at a nondecreasing timestamp.", + &["auths_connections::kernel::state_transition_allows"], + ), + "Auths.Product.RecoveryGate.Refinement.state_transition_earns_terminal_and_time" => ( + "Successful actual state-transition validation earns terminal revocation, changed state and monotone time constraints.", + &["auths_connections::kernel::state_transition_allows"], + ), + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Every represented actual ConnectionState, u64 generation tuple and u64 timestamp pair. The typed record methods consume these guards; Native frozen full-record parity checks cover their projection and commitment dispatch.", + residual_assumptions: &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and the listed foundational axioms are trusted. No new external model is introduced.", + "The complete record decoder, NonZero.get/caller projection, authentication of the recorded operation, the existing constant-time commitment comparison, actual credential-store lease and runtime reload/write association remain separate. Current-versus-recorded selection proves policy, not possession or authenticity of the supplied commitment.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + if declaration.starts_with("Auths.Codec.Payload.") + || declaration.starts_with("Auths.Codec.Collection.") + || declaration.starts_with("Auths.Codec.Fields.") + { + let (claim_text, rust_symbols): (&str, &[&str]) = match declaration { + "Auths.Codec.Payload.payload_exact" => ( + "The actual payload reader returns exactly the grammar-selected contiguous bytes and cursor, including failed length conversion, addition overflow and truncated payloads.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload"], + ), + "Auths.Codec.Payload.bytes_exact" => ( + "The actual byte-string reader returns exactly the definite major-two payload and its source cursor/input behavior.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::bytes"], + ), + "Auths.Codec.Payload.str_exact" => ( + "The actual text reader returns exactly the definite major-three payload accepted by the explicit UTF-8 primitive contract, preserving cursor behavior on UTF-8 refusal.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::str"], + ), + "Auths.Codec.Payload.success_earns_span" => ( + "Actual payload acceptance earns the exact contiguous source span, requested length, final cursor and input bounds without a successful-parse premise.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::payload"], + ), + "Auths.Codec.Collection.collection_exact" => ( + "For every valid CBOR major tag, the actual collection reader exactly distinguishes malformed input, indefinite collection heads and definite lengths with exact cursor/input preservation.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::collection"], + ), + "Auths.Codec.Collection.map_exact" => ( + "The actual raw map-head reader refines the independent collection grammar, including its indefinite form and exact cursor/input behavior.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::map"], + ), + "Auths.Codec.Collection.array_exact" => ( + "The actual raw array-head reader refines the independent collection grammar, including its indefinite form and exact cursor/input behavior.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::array"], + ), + "Auths.Codec.Fields.key_exact" => ( + "The actual field-key reader returns exactly Malformed, NonCanonical or success according to the independently decoded bounded integer and expected key, with exact cursor/input behavior.", + &["auths_codec::decode::key"], + ), + "Auths.Codec.Fields.map_exact" => ( + "The actual protocol map guard accepts exactly a definite head with the required field count and otherwise returns Malformed with exact cursor/input behavior.", + &["auths_codec::decode::map"], + ), + "Auths.Codec.Fields.text_exact" => ( + "The actual protocol text helper returns exactly the decoded UTF-8 bytes or Malformed with exact cursor/input behavior.", + &["auths_codec::decode::text"], + ), + "Auths.Codec.Fields.null_exact" => ( + "The actual protocol null helper accepts exactly the CBOR null byte and maps primitive refusal to Malformed with exact cursor/input behavior.", + &["auths_codec::decode::null"], + ), + "Auths.Codec.Fields.is_null_exact" => ( + "The actual optional-field null query exactly refines the independent first-byte type query and maps missing input to Malformed.", + &["auths_codec::decode::is_null"], + ), + "Auths.Codec.Fields.array_exact" => ( + "The actual protocol array guard accepts exactly definite lengths within its supplied bound, rejects indefinite or malformed heads as Malformed, and rejects excessive lengths as LimitExceeded.", + &["auths_codec::decode::array"], + ), + "Auths.Codec.Fields.bounded_bytes_exact" => ( + "The actual bounded-byte helper returns an exact owned copy only within the supplied size and nonempty requirements, preserving Malformed versus LimitExceeded and exact cursor/input behavior.", + &["auths_codec::decode::bounded_bytes"], + ), + "Auths.Codec.Fields.digest_bytes_exact" => ( + "The actual digest-byte helper accepts exactly a definite 32-byte payload and preserves its exact bytes, cursor and Malformed refusals.", + &["auths_codec::decode::digest_bytes"], + ), + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Every represented input slice and arbitrary machine-word cursor, with exact typed success/refusal, returned bytes or length, cursor and preserved input. Collection's generic major-tag premise is explicitly less than eight and is discharged for the actual array/map callers. Payload availability alone determines the independent list model; native length-conversion or addition failure is proved unable to discard an available in-bounds payload. Accepted-span is an earned partial safety property, not a separate exact verdict theorem.", + residual_assumptions: &[ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing reviewed standard-library slice, checked-integer, UTF-8, cloning and array-copy contracts are trusted. No new external model, opaque Auths algorithm or native-evaluation axiom is introduced. The standard UTF-8 predicate is a named leaf contract; this does not prove the UTF-8 library implementation itself.", + "Raw collection readers accept indefinite heads and raw integer heads permit wider encodings. Protocol array/map guards reject indefinite forms; full-object canonical re-encoding, constructor-valid object closure, parser completeness, aggregate allocation/work bounds and byte-to-authority composition remain separate. Copying here proves exact values under the existing allocation model, not physical allocator availability or runtime I/O behavior.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + if let Some(leaf) = declaration.strip_prefix("Auths.Codec.Cursor.") { + let (claim_text, rust_symbols): (&str, &[&str]) = match leaf { + "new_exact" => ( + "The actual decoder constructor preserves the exact borrowed input and initializes its cursor to zero.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::new"], + ), + "at_exact" => ( + "The actual explicit-cursor constructor accepts exactly positions at most the input length and preserves both fields.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::at"], + ), + "position_exact" => ( + "The actual position accessor returns exactly the stored cursor.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::position"], + ), + "head_exact" => ( + "The actual typed-head decoder is total over every represented cursor and refines the independent byte grammar, exact decoded value, refusal cursor and preserved input.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::head"], + ), + "u64_exact" => ( + "The actual unsigned-word reader refines the independent major-zero grammar and exact cursor/input behavior, including malformed and wrong-major heads.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u64"], + ), + "u8_exact" => ( + "The actual u8 reader accepts exactly grammar-decoded words within 255 and preserves the consumed head cursor even when narrowing refuses.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u8"], + ), + "u16_exact" => ( + "The actual u16 reader accepts exactly grammar-decoded words within 65535 and preserves the consumed head cursor even when narrowing refuses.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::u16"], + ), + "null_exact" => ( + "The actual null reader accepts exactly the CBOR null byte, advances by one only on success and preserves the input.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::null"], + ), + "datatype_exact" => ( + "The actual first-byte query returns exactly the independent major/additional-tag classification for every byte; it does not establish availability or validity of a complete head or payload.", + &["auths_codec::cbor::{auths_codec::cbor::Decoder<'a>}::datatype"], + ), + "ensure_complete_exact" => ( + "The actual completion guard accepts exactly cursor equality with the explicitly supplied input length and otherwise returns Malformed; input identity is a separate caller obligation.", + &["auths_codec::decode::ensure_complete"], + ), + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Every represented byte slice, arbitrary machine-word cursor and requested major tag. Reserved/truncated/wrong-major input and narrowing failures are included; no successful parse, valid cursor, expected output or honest input is a premise. The datatype query is checked for all 256 first-byte values against a separate major/additional-tag interpretation.", + residual_assumptions: &[ + "Lean's kernel, pinned Rust/Charon/Aeneas/Lean toolchain, listed foundational axioms and existing exact standard-library Slice/Option/Result/checked-integer interfaces are trusted. No new external model, opaque Auths body or native-evaluation axiom is introduced.", + "The raw head reader intentionally permits wider integer encodings; complete canonical object acceptance remains the enclosing codec's responsibility. Peeking a type is not decoding a payload. ensure_complete compares the explicitly supplied length and does not prove that the caller supplied the decoder's own input. Full payload/UTF-8/collection/object codecs, constructor closure, allocation/work limits and byte-to-authority composition remain separate.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + if declaration.starts_with("Auths.Product.RecordShape.Refinement.") { + let (claim_text, rust_symbols): (&str, &[&str]) = match declaration { + "Auths.Product.RecordShape.Refinement.text_comparison" + | "Auths.Product.RecordShape.Refinement.text_order_exact" => ( + "The actual String comparison dictionary and complete strict-order scan refine String lexicographic order without a caller-supplied comparison or order-law premise.", + &["auths_connections::kernel::strictly_sorted_unique"], + ), + "Auths.Product.RecordShape.Refinement.profile_comparison" + | "Auths.Product.RecordShape.Refinement.profile_order_exact" => ( + "The actual derived profile comparison dictionary and complete strict-order scan refine lexicographic identifier-then-version order without a comparison or order-law premise.", + &[ + "auths_connections::kernel::strictly_sorted_unique", + "auths_connections::model::{impl core::cmp::Ord for auths_connections::model::ConnectionProfile}::cmp", + ], + ), + "Auths.Product.RecordShape.Refinement.workloads_exact" => ( + "The actual complete workload allowlist validator returns exactly nonempty bounded strict String ordering and printable-ASCII text validity on the represented UTF-8 carrier.", + &["auths_connections::kernel::workloads_valid"], + ), + "Auths.Product.RecordShape.Refinement.profiles_exact" => ( + "The actual complete profile allowlist validator returns exactly nonempty bounded strict identifier/version ordering, with no comparator premise.", + &["auths_connections::kernel::profiles_valid"], + ), + "Auths.Product.RecordShape.Refinement.record_shape_exact" + | "Auths.Product.RecordShape.Refinement.success_earns_all_invariants" => ( + "The composed validator called by ConnectionRecord::validate returns the exact workload/profile/timestamp verdict with native error precedence; success earns all displayed collection, text, duplicate-absence and temporal invariants.", + &["auths_connections::kernel::validate_record_shape"], + ), + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Every actual String/profile slice and actual record state/time tuple on the explicit portable String UTF-8 byte-size carrier. Empty, unsorted, duplicate, oversized, malformed text and contradictory timestamp inputs are included. No valid allowlist, comparator result, order law or desired validator result is assumed.", + residual_assumptions: &[ + "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain and listed foundational axioms are trusted. The five reviewed transparent std String interfaces implement exact equality, total/partial ordering, the inert Eq marker and UTF-8 byte projection. The explicit U32 carrier bound is the existing representation boundary, not a new product text limit.", + "The full ConnectionRecord field projection, descriptor/hash/generation assembly, canonical codec and caller/runtime/backend histories remain separate. Profile field validity belongs to the typed constructors; this allowlist validator earns collection validity and ordering, not validity of an arbitrary forged profile carrier. Native tests compare frozen complete validation and real decoder behavior, including the decoder's earlier collection-bound refusal precedence.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + if declaration.starts_with("Auths.Product.RecordTimes.Refinement.") { + let claim_text = match declaration { + "Auths.Product.RecordTimes.Refinement.record_times_exact" => { + "The complete actual durable-record time validator returns exactly the independent lifetime/revocation-shape predicate for every state, timestamp pair and optional revocation timestamp." + } + "Auths.Product.RecordTimes.Refinement.success_earns_order" => { + "Successful actual record time validation earns creation no later than update." + } + "Auths.Product.RecordTimes.Refinement.success_earns_revocation_shape" => { + "Successful actual record validation earns revocation timestamp presence exactly for revoked state and every present timestamp within the inclusive lifetime." + } + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols: &["auths_connections::kernel::record_times_valid"], + scope: "Every actual represented ConnectionState, two u64 timestamps and optional u64 revocation timestamp. The actual constructor/decoder validation consumes this predicate after unchanged allowlist checks.", + residual_assumptions: &[ + "Lean's kernel, pinned toolchain and permitted foundational axioms are trusted. No new external model, native axiom or expected-validity premise is introduced.", + "The complete record codec, all allowlist/resource checks, timestamp/caller projection and full runtime histories remain separate. Frozen full-record and actual canonical-decoder parity tests support the temporal validation cutover. These are integer/time-shape laws, not a proof of a physical clock.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } + if declaration.starts_with("Auths.Product.StrictOrder.Refinement.") { + let claim_text = match declaration { + "Auths.Product.StrictOrder.Refinement.strict_order_exact" => { + "The complete actual generic strict-order checker returns exactly the independent adjacent-chain scan for every slice under the displayed primitive comparator contract; empty/singleton behavior and every index are covered." + } + "Auths.Product.StrictOrder.Refinement.source_earns_no_duplicates" => { + "An accepted actual strict-order check earns no duplicates under the displayed primitive comparator meaning, transitivity and irreflexivity laws." + } + _ => return None, + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols: &["auths_connections::kernel::strictly_sorted_unique"], + scope: "Every represented slice and native Ord dictionary satisfying the displayed lower-level comparison contract. The no-duplicate consequence also requires the stated strict-order laws; no expected checker result or already-sorted input is assumed.", + residual_assumptions: &[ + "Lean's kernel, pinned toolchain, foundational axioms and displayed primitive comparator contract/laws are trusted. The entire Auths scan and index arithmetic are translated; no opaque iterator algorithm or new std model is introduced.", + "Closed String/profile comparator-instance correspondence, complete record bounds/text validity, actual caller projection and complete codec/runtime composition remain separate. Frozen native checks compare the two real comparators and full record/decoder behavior to the previous windows predicate.", + ], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } const UNCONDITIONAL: &str = "Lean's kernel, the pinned Rust/Charon/Aeneas/Lean toolchain, and the listed foundational axioms are trusted; the theorem has no premise."; + if declaration.starts_with("Auths.Product.ConnectionBytes.Refinement.") { + const BYTE_BOUNDARY: &str = "This proves the actual byte classifiers, not complete String constructors, the canonical record decoder or runtime caller composition. Native frozen byte-pair parity supports the production constructor cutover; string-to-byte projection, allocation and whole constructor validity remain separate. No hash or commitment assumption is needed for the byte properties."; + let (claim_text, rust_symbol) = match declaration { + "Auths.Product.ConnectionBytes.Refinement.lower_tail_exact" => ( + "The actual scalar token-tail classifier returns exactly the independent lowercase/digit/hyphen predicate for every u8.", + "auths_connections::kernel::lower_tail_valid", + ), + "Auths.Product.ConnectionBytes.Refinement.graphic_valid_exact" => ( + "The complete actual printable-ASCII validator returns exactly the independent nonempty length-bounded full-buffer predicate for every slice and maximum, without an expected validity premise.", + "auths_connections::kernel::ascii_graphic_valid", + ), + "Auths.Product.ConnectionBytes.Refinement.lower_valid_exact" => ( + "The complete actual lowercase token validator returns exactly the independent bounded first-letter and complete-tail language for every slice and maximum, without an expected validity premise.", + "auths_connections::kernel::lower_token_valid", + ), + "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_no_nul" => ( + "Every successful actual lowercase token validation earns that the entire buffer contains no NUL byte; NUL absence is not assumed.", + "auths_connections::kernel::lower_token_valid", + ), + "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_no_nul" => ( + "Every successful actual printable-ASCII validation earns that the entire buffer contains no NUL byte; NUL absence is not assumed.", + "auths_connections::kernel::ascii_graphic_valid", + ), + "Auths.Product.ConnectionBytes.Refinement.source_lower_earns_size_bound" => ( + "Every successful actual lowercase token validation earns a nonempty buffer within its supplied size bound.", + "auths_connections::kernel::lower_token_valid", + ), + "Auths.Product.ConnectionBytes.Refinement.source_graphic_earns_size_bound" => ( + "Every successful actual printable-ASCII validation earns a nonempty buffer within its supplied size bound.", + "auths_connections::kernel::ascii_graphic_valid", + ), + _ => return None, + }; + let rust_symbols: &[&str] = match rust_symbol { + "auths_connections::kernel::lower_tail_valid" => { + &["auths_connections::kernel::lower_tail_valid"] + } + "auths_connections::kernel::lower_token_valid" => { + &["auths_connections::kernel::lower_token_valid"] + } + "auths_connections::kernel::ascii_graphic_valid" => { + &["auths_connections::kernel::ascii_graphic_valid"] + } + _ => unreachable!("closed byte-classifier inventory"), + }; + return Some(ProductionRefinementMetadata { + claim_text, + rust_symbols, + scope: "Every represented byte buffer and usize maximum; the scalar helper covers every u8. Acceptance properties are conclusions of the source result, not input validity premises.", + residual_assumptions: &[UNCONDITIONAL, BYTE_BOUNDARY], + translation_evidence_kind: FormalEvidenceKind::MechanicalTranslation, + }); + } const BOUNDARY: &str = "The canonical record codec, the shared store's compare-and-swap, the local credential store's persistence, and the constant-time commitment comparison are outside this theorem; they are covered by the record round-trip and obsolete-state tests, the store conformance suite, and the cross-process connection tests on both stores. The reference commitment is assumed collision-resistant."; const RESIDUAL: &[&str] = &[UNCONDITIONAL, BOUNDARY]; const NEXT: &str = "auths_connections::kernel::next_generation"; @@ -2287,6 +5087,36 @@ fn bounded_policy_refinement_metadata(declaration: &str) -> Option ( + "The complete actual reservation guard returns exactly the independent ordered decision over all count frontiers, sum-slot frontiers and cumulative sums, including malformed vector shapes and checked-word overflow.", + &["auths_bounded_policy::kernel::reservation_admission"], + "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate.", + CHAIN_RESIDUAL, + ), + "Auths.Product.ReservationAdmission.Refinement.source_admission_earns_bounds" => ( + "Every actual Admit result earns all count and sum-slot strict bounds and every cumulative sum bound through complete pairwise relations; those bounds are not premises of the source theorem.", + &["auths_bounded_policy::kernel::reservation_admission"], + "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate.", + CHAIN_RESIDUAL, + ), + "Auths.Product.ReservationAdmission.Refinement.source_window_refusal_precedes_sum" => ( + "The actual reservation guard preserves window-exhaustion precedence whenever any count or sum-slot pair lacks room, regardless of every sum input.", + &["auths_bounded_policy::kernel::reservation_admission"], + "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate.", + CHAIN_RESIDUAL, + ), + "Auths.Product.ReservationAdmission.Refinement.source_admitted_has_complete_vectors" => ( + "Every actual Admit result earns all three frontier/capacity and total/capacity length equalities, so partial vector zips cannot create admission.", + &["auths_bounded_policy::kernel::reservation_admission"], + "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate.", + CHAIN_RESIDUAL, + ), + "Auths.Product.ReservationAdmission.Refinement.source_admitted_sums_do_not_overflow" => ( + "Every actual Admit result earns that every cumulative total plus the requested amount fits u64. This follows from complete sum-capacity checks and the represented capacity words, not an assumed no-overflow condition.", + &["auths_bounded_policy::kernel::reservation_admission"], + "Every six u64 slices and one u64 amount; window-refusal additionally states its explicit independent exhaustion condition. This decides admission only; storage insertion and ownership remain separate.", + CHAIN_RESIDUAL, + ), "Auths.Product.Refinement.translated_chain_counts_admit_refines_model" => ( "The mechanically translated count leaf returns exactly the model's count part of chain admission: every distinct counter of the fixed window below its capacity.", &["auths_bounded_policy::kernel::chain_counts_admit"], @@ -2851,6 +5681,7 @@ mod phase_ordering { kind: "theorem".to_owned(), statement: "True".to_owned(), axioms: Vec::new(), + statement_constants: Vec::new(), }, ) }) @@ -3431,11 +6262,16 @@ mod phase_ordering { kind: "theorem".to_owned(), statement: statement.to_owned(), axioms: Vec::new(), + statement_constants: vec!["Fixture.StrongBoundary".to_owned()], }], }; let strong = lean_statement_inventory_sha256(&audit("StrongBoundary input")); let weakened = lean_statement_inventory_sha256(&audit("True")); assert_ne!(strong, weakened); + let mut changed_implicit = audit("StrongBoundary input"); + changed_implicit.declarations[0].statement_constants = + vec!["Fixture.AlwaysAccept".to_owned()]; + assert_ne!(strong, lean_statement_inventory_sha256(&changed_implicit)); let source = include_str!("formal.rs"); let synchronizer = source diff --git a/xtask/src/formal_coverage.rs b/xtask/src/formal_coverage.rs index 4cc6881d0..57c6fb005 100644 --- a/xtask/src/formal_coverage.rs +++ b/xtask/src/formal_coverage.rs @@ -4,16 +4,21 @@ //! //! The scanner and the metrics are a port of study 006's reference scanner //! (`analysis/proof_coverage.py` in auths-research), with its definitions -//! unchanged: what a function is, when it is translated, refined directly, or +//! unchanged for historical fixtures: what a function is, when it is translated, refined directly, or //! in the refined closure (trait-instance records included), the two weights, //! and the five scopes. `reproduces_the_study_at_its_pinned_commit` holds the //! port to byte-identical output on the vendored inputs of the study's commit. +//! Live version 4 also inventories declared non-shipping extraction selectors +//! and fully translated imported bodies; historical inputs retain their scanner. +//! Compiled statement constants are used for theorem mentions and +//! explicit translator metadata for numbered loops. Dot notation and pretty +//! printing cannot hide or invent edges; loop wrappers retain their real kind. use crate::*; use std::cell::RefCell; use std::io::Read as _; -pub(crate) const TOOL_VERSION: &str = "1"; +pub(crate) const TOOL_VERSION: &str = "4"; pub(crate) const PIN: &str = "8bf2970c68ef01302a70b52861ecc256cf1bb06a"; const QUALIFICATION: &str = "formal/qualification/aeneas/qualification.toml"; pub(crate) const SCOPE_PATH: &str = "formal/coverage-scope-v1.toml"; @@ -38,6 +43,13 @@ pub(crate) trait Tree { fn list_files(&self, directory: &str) -> Result, String>; fn reads(&self) -> &RefCell>; + fn live_source_inventory(&self) -> bool { + false + } + fn relative_source_path(&self, path: &str) -> String { + path.to_owned() + } + fn read(&self, path: &str) -> Result { let bytes = self.read_bytes(path)?; self.reads() @@ -62,6 +74,17 @@ impl WorkTree { } impl Tree for WorkTree { + fn live_source_inventory(&self) -> bool { + true + } + fn relative_source_path(&self, path: &str) -> String { + Path::new(path) + .strip_prefix(&self.root) + .ok() + .and_then(Path::to_str) + .unwrap_or(path) + .replace('\\', "/") + } fn read_bytes(&self, path: &str) -> Result, String> { fs::read(self.root.join(path)).map_err(|error| format!("could not read {path}: {error}")) } @@ -429,6 +452,7 @@ pub(crate) struct RustFunction { pub(crate) qualified: String, pub(crate) begin_line: usize, pub(crate) end_line: usize, + pub(crate) signature_end_line: usize, pub(crate) code_lines: usize, pub(crate) in_macro: bool, } @@ -676,6 +700,7 @@ pub(crate) fn scan_rust(path: &str, source: &str) -> ScanResult { qualified: qualified(&stack, &name_token.text), begin_line: qualifier_start(&tokens, index), end_line: tokens[end].line, + signature_end_line: tokens[body].line, code_lines: 0, in_macro: in_macro(&stack), }); @@ -912,6 +937,8 @@ pub(crate) struct ScopeDefinition { pub(crate) every_file_listed: bool, #[serde(default)] pub(crate) components: Vec, + #[serde(default)] + pub(crate) extraction_selectors: BTreeMap, pub(crate) files: BTreeMap, } @@ -941,6 +968,18 @@ impl ScopeDefinition { )); } } + for (path, namespace) in &scope.extraction_selectors { + if !path.starts_with("formal/qualification/aeneas/entrypoints/") + || !path.ends_with(".rs") + || path.split('/').any(|part| part == "..") + || namespace.is_empty() + || scope.role(path) != "interface" + { + return Err(format!( + "extraction selector {path} must be declared non-shipping formal interface source" + )); + } + } Ok(scope) } @@ -963,6 +1002,7 @@ pub(crate) struct Translated { pub(crate) end_line: usize, pub(crate) kind: &'static str, pub(crate) funs_path: String, + pub(crate) declaration_span: bool, } #[derive(Deserialize)] @@ -974,10 +1014,73 @@ struct QualificationTranslations { struct QualificationTranslation { translation_json: String, local_functions: usize, + #[serde(default)] + required_symbols: Vec, } type Translations = (Vec, Vec<(String, String)>); +// These are compiler-created trait call shims for an anonymous closure, not +// handwritten `fn` declarations. Keep them in the Lean dependency graph; do +// not invent a separately scanned Rust function at the closure's inner span. +fn is_generated_closure_shim(rust_name: &str) -> bool { + let Some((owner, implementation)) = rust_name.split_once("::{impl core::ops::function::") + else { + return false; + }; + let Some((trait_name, receiver)) = implementation.split_once(" for ") else { + return false; + }; + let method = if trait_name.starts_with("FnMut<") { + "}::call_mut" + } else if trait_name.starts_with("FnOnce<") { + "}::call_once" + } else { + return false; + }; + let Some(closure) = receiver + .strip_prefix(&format!("{owner}::closure")) + .and_then(|name| name.strip_suffix(method)) + else { + return false; + }; + let ordinal = if let Some((ordinal, arguments)) = closure.split_once('<') { + if !arguments.ends_with('>') { + return false; + } + ordinal + } else { + closure + }; + ordinal.is_empty() + || ordinal + .strip_prefix('#') + .is_some_and(|index| !index.is_empty() && index.bytes().all(|b| b.is_ascii_digit())) +} + +// Aeneas numbers multiple loops (`_loop0`, `_loop1`); names alone do not +// identify their wrapper functions. Older fixture reports retain the fallback. +fn is_translated_loop(item: &Value, lean_name: &str) -> bool { + if item.get("loop").is_some_and(Value::is_object) { + return true; + } + let pieces: Vec<&str> = lean_name.rsplitn(3, '.').collect(); + let second_last = if pieces.len() >= 2 { pieces[1] } else { "" }; + second_last.contains("_loop") || lean_name.ends_with("_loop") +} + +fn has_translated_source_body(item: &Value, required_import: bool) -> bool { + item["is_local"].as_bool() == Some(true) + || (required_import + && item["is_opaque"].as_bool() == Some(false) + && item["lean_file"] + .as_str() + .is_some_and(|path| path.ends_with("/Funs.lean")) + && item["rust_name"] + .as_str() + .is_some_and(|name| name.starts_with("auths_"))) +} + fn load_translations(tree: &dyn Tree) -> Result { let qualification: QualificationTranslations = toml::from_str(&tree.read(QUALIFICATION)?) .map_err(|error| format!("invalid {QUALIFICATION}: {error}"))?; @@ -991,11 +1094,6 @@ fn load_translations(tree: &dyn Tree) -> Result { .ok_or_else(|| format!("{} names no crate", entry.translation_json))? .to_owned(); let funs_path = format!("{}/Funs.lean", parent_directory(&entry.translation_json)); - if let Some(existing) = funs_files.iter_mut().find(|(name, _)| *name == crate_name) { - existing.1.clone_from(&funs_path); - } else { - funs_files.push((crate_name.clone(), funs_path.clone())); - } let local: Vec<&Value> = document["functions"] .as_array() .ok_or_else(|| format!("{} lists no functions", entry.translation_json))? @@ -1009,7 +1107,47 @@ fn load_translations(tree: &dyn Tree) -> Result { local.len() )); } - for item in local { + let namespace = local + .first() + .and_then(|item| item["lean_name"].as_str()) + .and_then(|name| name.split('.').next()) + .filter(|name| !name.is_empty()) + .ok_or("translation has no local Lean namespace")?; + if local.iter().any(|item| { + item["lean_name"] + .as_str() + .and_then(|name| name.split('.').next()) + != Some(namespace) + }) { + return Err("one translation unit names inconsistent Lean namespaces".to_owned()); + } + // One Rust crate may have several independently qualified extraction + // units. Preserve every function file and its actual Lean namespace. + if !funs_files.iter().any(|(_, path)| *path == funs_path) { + funs_files.push((namespace.to_owned(), funs_path.clone())); + } + // Selection-only units expose actual inherent methods as transparent + // imported roots. Ordinary units keep their existing local inventory; + // delegated imports there are inventoried in their owning unit. + let selection_only = local.iter().all(|item| { + item["source"]["file"].as_str().is_some_and(|path| { + tree.relative_source_path(path) + .starts_with("formal/qualification/aeneas/entrypoints/") + }) + }); + let selected = document["functions"] + .as_array() + .ok_or("translation lists no functions")? + .iter() + .filter(|item| { + let required_import = tree.live_source_inventory() + && selection_only + && item["rust_name"].as_str().is_some_and(|name| { + entry.required_symbols.iter().any(|symbol| symbol == name) + }); + has_translated_source_body(item, required_import) + }); + for item in selected { let lean_name = item["lean_name"] .as_str() .ok_or("translation without lean_name")?; @@ -1017,18 +1155,19 @@ fn load_translations(tree: &dyn Tree) -> Result { .as_str() .ok_or("translation without rust_name")?; let source = &item["source"]; - let file = source["file"].as_str().ok_or("translation without file")?; + let reported_file = source["file"].as_str().ok_or("translation without file")?; + let file = tree.relative_source_path(reported_file); let begin_line = usize::try_from(source["begin_line"].as_u64().ok_or("no begin_line")?) .map_err(|error| error.to_string())?; let end_line = usize::try_from(source["end_line"].as_u64().ok_or("no end_line")?) .map_err(|error| error.to_string())?; - let pieces: Vec<&str> = lean_name.rsplitn(3, '.').collect(); - let second_last = if pieces.len() >= 2 { pieces[1] } else { "" }; - let kind = if second_last.contains("_loop") || lean_name.ends_with("_loop") { + let kind = if is_translated_loop(item, lean_name) { "loop" + } else if is_generated_closure_shim(rust_name) { + "closure-shim" } else if begin_line == end_line && tree - .read(file)? + .read(&file)? .lines() .nth(begin_line.saturating_sub(1)) .is_some_and(|line| line.contains("#[derive(")) @@ -1046,6 +1185,7 @@ fn load_translations(tree: &dyn Tree) -> Result { end_line, kind, funs_path: funs_path.clone(), + declaration_span: item["is_local"].as_bool() == Some(false), }); } } @@ -1063,15 +1203,15 @@ pub(crate) fn translated_functions(tree: &dyn Tree) -> Result, S /// Every translated Lean name (loop helpers included) mapped to its function's name. fn owner_of(translated: &[Translated]) -> BTreeMap { - let mut function_by_rust: BTreeMap<&str, &str> = BTreeMap::new(); + let mut function_by_rust: BTreeMap<(&str, &str), &str> = BTreeMap::new(); for item in translated.iter().filter(|item| item.kind != "loop") { - function_by_rust.insert(&item.rust_name, &item.lean_name); + function_by_rust.insert((&item.funs_path, &item.rust_name), &item.lean_name); } translated .iter() .filter_map(|item| { function_by_rust - .get(item.rust_name.as_str()) + .get(&(item.funs_path.as_str(), item.rust_name.as_str())) .map(|owner| (item.lean_name.clone(), (*owner).to_owned())) }) .collect() @@ -1106,12 +1246,12 @@ fn lean_call_graph( } } let known: BTreeSet = owners.keys().cloned().collect(); - let crates: BTreeSet<&str> = translated + let namespaces: BTreeSet<&str> = translated .iter() - .map(|item| item.crate_name.as_str()) + .filter_map(|item| item.lean_name.split('.').next()) .collect(); let mut edges: BTreeMap> = BTreeMap::new(); - for (crate_name, funs_path) in funs_files { + for (lean_namespace, funs_path) in funs_files { let text: Vec = tree.read(funs_path)?.chars().collect(); let docs = lean_doc_rust_names(&text); for (position, (start, name)) in docs.iter().enumerate() { @@ -1126,10 +1266,10 @@ fn lean_call_graph( let body = text_of(block, definition_end, block.len()); for identifier in lean_identifiers(&body) { let head = identifier.split('.').next().unwrap_or(""); - let candidate = if crates.contains(head) { + let candidate = if namespaces.contains(head) { identifier.clone() } else { - format!("{crate_name}.{identifier}") + format!("{lean_namespace}.{identifier}") }; for callee in resolve(&candidate, &known, instances) { let callee_owner = &owners[&callee]; @@ -1150,6 +1290,10 @@ fn lean_call_graph( pub(crate) struct AuditDeclaration { pub(crate) name: String, pub(crate) statement: String, + /// Canonical constants from Lean's compiled statement expression. Historic + /// study fixtures predate this field and retain their original scanner. + #[serde(default)] + pub(crate) statement_constants: Option>, } #[derive(Clone, Debug, Deserialize)] @@ -1166,19 +1310,29 @@ fn statement_mentions( ) -> Vec<(String, Vec)> { let owners = owner_of(translated); let known: BTreeSet = owners.keys().cloned().collect(); - let crates: BTreeSet<&str> = translated + let namespaces: BTreeSet<&str> = translated .iter() - .map(|item| item.crate_name.as_str()) + .filter_map(|item| item.lean_name.split('.').next()) .collect(); let mut mentions: Vec<(String, Vec)> = Vec::new(); for declaration in &audit.declarations { let mut found = BTreeSet::new(); - for identifier in lean_identifiers(&declaration.statement) { - let parts: Vec<&str> = identifier.split('.').collect(); - for offset in 0..parts.len() { - if crates.contains(parts[offset]) { - for name in resolve(&parts[offset..].join("."), &known, instances) { - found.insert(owners[&name].clone()); + if let Some(constants) = &declaration.statement_constants { + // Pretty printing may turn `Type.method value` into `value.method`. + // Only the compiled expression establishes the constant's identity. + for constant in constants { + for name in resolve(constant, &known, instances) { + found.insert(owners[&name].clone()); + } + } + } else { + for identifier in lean_identifiers(&declaration.statement) { + let parts: Vec<&str> = identifier.split('.').collect(); + for offset in 0..parts.len() { + if namespaces.contains(parts[offset]) { + for name in resolve(&parts[offset..].join("."), &known, instances) { + found.insert(owners[&name].clone()); + } } } } @@ -1331,6 +1485,13 @@ pub(crate) fn measure( files.insert(path, crate_path.clone()); } } + for (path, namespace) in &scope.extraction_selectors { + if files.contains_key(path) { + return Err(format!("selector {path} overlaps production source")); + } + file_order.push(path.clone()); + files.insert(path.clone(), format!("extraction-selector:{namespace}")); + } let mut scans = BTreeMap::new(); for path in &file_order { scans.insert(path.clone(), scan_rust(path, &tree.read(path)?)); @@ -1361,35 +1522,57 @@ pub(crate) fn measure( by_span.insert((function.file.clone(), function.begin_line), function); } let mut validation = Vec::new(); - let mut status = BTreeMap::new(); + let mut status: BTreeMap<(String, usize), Status> = BTreeMap::new(); for item in translated.iter().filter(|item| item.kind == "function") { let found = by_span.get(&(item.file.clone(), item.begin_line)); let outcome = match found { None => "not-found", - Some(function) if function.end_line != item.end_line => "end-line-differs", + Some(function) + if function.end_line != item.end_line + && !(item.declaration_span + && item.end_line == function.signature_end_line + && item.rust_name.rsplit("::").next() + == function.qualified.rsplit("::").next()) => + { + "end-line-differs" + } Some(_) => "matched", }; - validation.push(json!({ + let mut row = json!({ "rust_name": item.rust_name, "file": item.file, "charon_span": [item.begin_line, item.end_line], "scanner_span": found.map(|function| json!([function.begin_line, function.end_line])), "outcome": outcome, - })); + }); + if item.declaration_span { + row["span_kind"] = json!("imported-declaration; full Rust body supplied by scanner"); + } + validation.push(row); if let Some(function) = found { - status.insert( - (function.file.clone(), function.begin_line), - Status { - lean_name: item.lean_name.clone(), - refined_direct: direct.contains(&item.lean_name), - refined_closure: reached.contains(&item.lean_name), - theorems: mentions - .iter() - .find(|(name, _)| *name == item.lean_name) - .map(|(_, theorems)| theorems.clone()) - .unwrap_or_default(), - }, - ); + let key = (function.file.clone(), function.begin_line); + let incoming = Status { + lean_name: item.lean_name.clone(), + refined_direct: direct.contains(&item.lean_name), + refined_closure: reached.contains(&item.lean_name), + theorems: mentions + .iter() + .find(|(name, _)| *name == item.lean_name) + .map(|(_, theorems)| theorems.clone()) + .unwrap_or_default(), + }; + if let Some(previous) = status.get_mut(&key) { + if incoming.refined_direct && !previous.refined_direct { + previous.lean_name.clone_from(&incoming.lean_name); + } + previous.refined_direct |= incoming.refined_direct; + previous.refined_closure |= incoming.refined_closure; + previous.theorems.extend(incoming.theorems); + previous.theorems.sort(); + previous.theorems.dedup(); + } else { + status.insert(key, incoming); + } } } let audit_sha256 = hex::encode(Sha256::digest(audit_text.as_bytes())); @@ -2355,6 +2538,17 @@ pub(crate) fn publish(root: &Path) -> Result { let scope_text = tree.read(SCOPE_PATH)?; let scope = ScopeDefinition::parse(&scope_text)?; let audit_text = tree.read(AUDIT_PATH)?; + let compiled_audit: Audit = serde_json::from_str(&audit_text) + .map_err(|error| format!("invalid {AUDIT_PATH}: {error}"))?; + if compiled_audit + .declarations + .iter() + .any(|declaration| declaration.statement_constants.is_none()) + { + return Err(format!( + "{AUDIT_PATH} live coverage requires canonical compiled statement constants; regenerate the assurance audit" + )); + } let measurement = measure(&tree, scope, &audit_text)?; if !measurement.scope.every_file_listed { return Err(format!("{SCOPE_PATH} must give every scoped file a role")); @@ -3593,8 +3787,162 @@ pub(crate) fn formal_coverage(update: bool) -> Result<(), String> { #[cfg(test)] mod tests { + #[test] + fn explicit_loop_metadata_recognizes_numbered_wrappers_and_bodies() { + let metadata = serde_json::json!({"loop": {"id": 1, "pos": [1], "is_body": false}}); + assert!(super::is_translated_loop( + &metadata, + "sample.build_batch_loop0" + )); + assert!(super::is_translated_loop( + &metadata, + "sample.build_batch_loop1" + )); + assert!(super::is_translated_loop( + &metadata, + "sample.build_batch_loop1.body" + )); + assert!(!super::is_translated_loop( + &serde_json::json!({}), + "sample.build_batch" + )); + assert!(super::is_translated_loop( + &serde_json::json!({}), + "sample.old_loop" + )); + } + use super::*; + #[test] + fn transparent_auths_imports_are_source_bodies_only_in_live_inventory() { + let imported = json!({"is_local": false, "is_opaque": false, "rust_name": "auths_connections::profile::new", "lean_file": "generated/profile/Funs.lean"}); + assert!(has_translated_source_body(&imported, true)); + assert!(!has_translated_source_body(&imported, false)); + assert!(!has_translated_source_body( + &json!({"is_local": false, "is_opaque": true, "rust_name": "auths_connections::profile::new", "lean_file": "generated/profile/Funs.lean"}), + true + )); + assert!(!has_translated_source_body( + &json!({"is_local": false, "is_opaque": false, "rust_name": "core::word", "lean_file": "generated/profile/Funs.lean"}), + true + )); + assert!(!has_translated_source_body( + &json!({"is_local": false, "is_opaque": false, "rust_name": "auths_ports::Trait::method", "lean_file": "generated/profile/Types.lean"}), + true + )); + } + + #[test] + fn source_paths_are_normalized_and_selectors_cannot_hide_production() { + let tree = WorkTree::new(PathBuf::from("/reviewed")); + assert_eq!( + tree.relative_source_path("/reviewed/formal/entry.rs"), + "formal/entry.rs" + ); + assert_eq!( + tree.relative_source_path("core/src/lib.rs"), + "core/src/lib.rs" + ); + let base = "schema = \"auths-proof-coverage-scope/v1\"\nverifier_crate = \"core/test\"\ndecision_kernel_crates = []\ntranslated_crates = []\nexcluded_roles = [\"interface\"]\nnontrivial_code_lines = 4\nevery_file_listed = true\n"; + let selector = "formal/qualification/aeneas/entrypoints/profile.rs"; + let valid = format!( + "{base}[files]\n\"{selector}\" = \"interface\"\n[extraction_selectors]\n\"{selector}\" = \"auths_profile\"\n" + ); + assert!(ScopeDefinition::parse(&valid).is_ok()); + assert!( + ScopeDefinition::parse(&valid.replace(selector, "product/runtime/source.rs")).is_err() + ); + assert!( + ScopeDefinition::parse(&valid.replace("= \"interface\"", "= \"decision\"")).is_err() + ); + } + + #[test] + fn two_units_of_one_rust_crate_keep_both_lean_namespaces_and_function_files() { + let directory = tempfile::tempdir().expect("temporary input tree"); + let manifest = directory.path().join(QUALIFICATION); + fs::create_dir_all(manifest.parent().expect("manifest parent")) + .expect("manifest directory"); + fs::write(&manifest, "[[translations]]\ntranslation_json = \"native/translation.json\"\nlocal_functions = 1\n\n[[translations]]\ntranslation_json = \"codec/translation.json\"\nlocal_functions = 1\n") + .expect("two extraction units"); + for (unit, namespace, function) in [ + ("native", "AuthsNativeSha256", "raw_sha256"), + ("codec", "auths_codec", "signing_preimage"), + ] { + fs::create_dir_all(directory.path().join(unit)).expect("unit directory"); + let report = json!({"crate": "auths_codec", "functions": [{ + "rust_name": format!("auths_codec::hash::{function}"), + "lean_name": format!("{namespace}.hash.{function}"), + "is_local": true, "is_opaque": false, + "source": {"file": "source.rs", "begin_line": 1, "end_line": 2}, + }]}); + fs::write( + directory.path().join(unit).join("translation.json"), + report.to_string(), + ) + .expect("translation report"); + } + let tree = WorkTree::new(directory.path().to_owned()); + let (translated, files) = load_translations(&tree).expect("both qualified units"); + assert_eq!( + files, + vec![ + ( + "AuthsNativeSha256".to_owned(), + "native/Funs.lean".to_owned() + ), + ("auths_codec".to_owned(), "codec/Funs.lean".to_owned()), + ] + ); + let audit = Audit { declarations: vec![AuditDeclaration { + name: "both_statements".to_owned(), + statement: "AuthsNativeSha256.hash.raw_sha256 bytes = auths_codec.hash.signing_preimage bytes".to_owned(), + statement_constants: None, + }]}; + let mentions = statement_mentions(&audit, &translated, true); + assert_eq!(mentions.len(), 2); + for (_, claims) in mentions { + assert_eq!(claims, vec!["both_statements"]); + } + } + + #[test] + fn compiled_constants_recognize_dot_notation_without_accepting_printed_spoofs() { + let translated = vec![Translated { + rust_name: "auths_kernel::{Search}::probe".to_owned(), + lean_name: "auths_kernel.Search.probe".to_owned(), + crate_name: "auths_kernel".to_owned(), + file: "source.rs".to_owned(), + begin_line: 1, + end_line: 1, + kind: "function", + funs_path: "native/Funs.lean".to_owned(), + declaration_span: false, + }]; + let audit = Audit { + declarations: vec![ + AuditDeclaration { + name: "dot_notation".to_owned(), + statement: "state.probe = result".to_owned(), + statement_constants: Some(vec!["auths_kernel.Search.probe".to_owned()]), + }, + AuditDeclaration { + name: "printed_spoof".to_owned(), + statement: "auths_kernel.Search.probe = auths_kernel.Search.probe".to_owned(), + statement_constants: Some(Vec::new()), + }, + ], + }; + assert_eq!( + statement_mentions(&audit, &translated, true), + vec![( + "auths_kernel.Search.probe".to_owned(), + vec!["dot_notation".to_owned()] + )] + ); + } + fn pin_measurement() -> (Measurement, BTreeMap>) { let (tree, reference) = ArchiveTree::open( &root().join(PIN_FIXTURE), @@ -3662,6 +4010,7 @@ mod tests { qualified: "verify_branch".to_owned(), begin_line: 1, end_line: 2, + signature_end_line: 1, code_lines: 2, in_macro: false, }]; @@ -3673,3 +4022,51 @@ mod tests { assert!(resolve_function(&functions, &absent).is_err()); } } + +#[cfg(test)] +mod closure_shim_tests { + use super::is_generated_closure_shim; + + #[test] + fn closure_shims_do_not_hide_handwritten_functions_or_methods() { + assert!(is_generated_closure_shim( + "auths_composition::evaluate::{impl core::ops::function::FnMut<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_mut" + )); + assert!(is_generated_closure_shim( + "auths_composition::evaluate::{impl core::ops::function::FnOnce<(auths_composition::EvaluationEvent,), ()> for auths_composition::evaluate::closure}::call_once" + )); + assert!(is_generated_closure_shim( + "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(&'_ [u8; 32usize],), core::option::Option> for auths_signature_core::verify_ed25519::closure}::call_once" + )); + assert!(is_generated_closure_shim( + "auths_signature_core::verify_ed25519::{impl core::ops::function::FnOnce<(Key,), bool> for auths_signature_core::verify_ed25519::closure#1}::call_once" + )); + assert!(is_generated_closure_shim( + "auths_codec::hash::commitment_preimage::{impl core::ops::function::FnOnce<(usize,), core::option::Option> for auths_codec::hash::commitment_preimage::closure#1<'_0>}::call_once" + )); + // A closure's owner may itself be a handwritten trait method. Its + // `for` and `impl` segments must not be mistaken for the closure shim. + assert!(is_generated_closure_shim( + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::Ed25519Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}::call_once" + )); + assert!(is_generated_closure_shim( + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::{impl core::ops::function::FnOnce<(auths_signature_core::P256Error,), auths_ports::SignatureError> for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}::call_once" + )); + for function in [ + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify", + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify::closure}::call_once", + "auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::{impl core::ops::function::FnOnce for auths_signature::{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify::closure}::call_mut", + "auths_composition::evaluate", + "auths_composition::{auths_composition::EvaluationEvent}::outcome", + "auths_model::{impl core::ops::function::FnMut for auths_model::Handler}::call_mut", + "auths_model::closure::decide", + "auths_model::{impl core::ops::function::FnMut for auths_model::closure}::verify", + "auths_model::verify::{impl core::ops::function::FnOnce for auths_model::other::closure}::call_once", + "auths_model::verify::{impl core::ops::function::FnOnce for auths_model::verify::closure#invalid}::call_once", + "auths_model::verify::{impl core::ops::function::FnOnce for auths_model::verify::closureNamed}::call_once", + "auths_model::verify::{impl core::ops::function::FnOnce for auths_model::verify::closure#invalid}::call_once", + ] { + assert!(!is_generated_closure_shim(function), "{function}"); + } + } +} diff --git a/xtask/src/formal_qualification.rs b/xtask/src/formal_qualification.rs index 4acb600b5..7f56e272c 100644 --- a/xtask/src/formal_qualification.rs +++ b/xtask/src/formal_qualification.rs @@ -13,9 +13,201 @@ use std::{ const QUALIFICATION_PATH: &str = "formal/qualification/aeneas/qualification.toml"; const QUALIFICATION_SCHEMA: &str = "auths-proof-aeneas-qualification/v1"; const QUALIFICATION_BOUNDARY_CONTRACT_SHA256: &str = - "bd588f183a80542bc1f6f1990e0cae4aefa149f304693d37e535208266bbb553"; + "33fbd99ec34b7e232db2b65d19c55419a4ff5c82b1d7e371a0ed6bb35d96ea18"; const AENEAS_OUTPUT_MAPPINGS: &[(&str, &str)] = &[ + ( + "scope_codec-run/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + ), + ( + "scope_codec-run/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + ), + ( + "scope_codec-run/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean", + ), + ( + "scope_codec-run/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + ), + ( + "scope_codec-run/translation.json", + "formal/qualification/aeneas/generated/scope_codec/translation.json", + ), + ( + "status_selection-run/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + ), + ( + "status_selection-run/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + ), + ( + "status_selection-run/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + ), + ( + "status_selection-run/translation.json", + "formal/qualification/aeneas/generated/status_selection/translation.json", + ), + ( + "temporal_witness-run/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + ), + ( + "temporal_witness-run/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + ), + ( + "temporal_witness-run/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean", + ), + ( + "temporal_witness-run/translation.json", + "formal/qualification/aeneas/generated/temporal_witness/translation.json", + ), + ( + "suite_adapter-run/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + ), + ( + "suite_adapter-run/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean", + ), + ( + "suite_adapter-run/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + ), + ( + "suite_adapter-run/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + ), + ( + "suite_adapter-run/translation.json", + "formal/qualification/aeneas/generated/suite_adapter/translation.json", + ), + ( + "p256-run/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/Types.lean", + ), + ( + "p256-run/qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean", + ), + ( + "p256-run/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + ), + ( + "p256-run/qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean", + ), + ( + "p256-run/translation.json", + "formal/qualification/aeneas/generated/p256/translation.json", + ), + ( + "p256-run/name-normalization.json", + "formal/qualification/aeneas/generated/p256/name-normalization.json", + ), + ( + "sha256-run/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/Types.lean", + ), + ( + "sha256-run/qualification/aeneas/generated/sha256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean", + ), + ( + "sha256-run/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + ), + ( + "sha256-run/qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + ), + ( + "sha256-run/translation.json", + "formal/qualification/aeneas/generated/sha256/translation.json", + ), + ( + "sha256-run/foreign-name-normalization.json", + "formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json", + ), + ( + "signature-run/qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean", + ), + ( + "signature-run/qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean", + ), + ( + "signature-run/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + ), + ( + "signature-run/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + ), + ( + "signature-run/translation.json", + "formal/qualification/aeneas/generated/signature/translation.json", + ), + ( + "composition-run/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/Types.lean", + ), + ( + "composition-run/qualification/aeneas/generated/composition/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean", + ), + ( + "composition-run/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + ), + ( + "composition-run/qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean", + ), + ( + "composition-run/translation.json", + "formal/qualification/aeneas/generated/composition/translation.json", + ), + ( + "stores-run/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/stores/Types.lean", + ), + ( + "stores-run/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + ), + ( + "stores-run/translation.json", + "formal/qualification/aeneas/generated/stores/translation.json", + ), + ( + "codec-run/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/Types.lean", + ), + ( + "codec-run/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + ), + ( + "codec-run/qualification/aeneas/generated/codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean", + ), + ( + "codec-run/qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean", + ), + ( + "codec-run/translation.json", + "formal/qualification/aeneas/generated/codec/translation.json", + ), ( "model-run/qualification/aeneas/generated/model/Types.lean", "formal/qualification/aeneas/generated/model/Types.lean", @@ -96,6 +288,10 @@ const AENEAS_OUTPUT_MAPPINGS: &[(&str, &str)] = &[ "gateway-run/qualification/aeneas/generated/gateway/Funs.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", ), + ( + "gateway-run/qualification/aeneas/generated/gateway/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean", + ), ( "gateway-run/translation.json", "formal/qualification/aeneas/generated/gateway/translation.json", @@ -104,6 +300,10 @@ const AENEAS_OUTPUT_MAPPINGS: &[(&str, &str)] = &[ "connections-run/qualification/aeneas/generated/connections/Types.lean", "formal/qualification/aeneas/generated/connections/Types.lean", ), + ( + "connections-run/qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean", + ), ( "connections-run/qualification/aeneas/generated/connections/Funs.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", @@ -112,9 +312,45 @@ const AENEAS_OUTPUT_MAPPINGS: &[(&str, &str)] = &[ "connections-run/translation.json", "formal/qualification/aeneas/generated/connections/translation.json", ), + ( + "profile_construction-run/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + ), + ( + "profile_construction-run/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + ), + ( + "profile_construction-run/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + ), + ( + "profile_construction-run/translation.json", + "formal/qualification/aeneas/generated/profile_construction/translation.json", + ), ]; const REVIEWED_BRIDGE_ARTIFACTS: &[&str] = &[ + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", "formal/qualification/aeneas/generated/model/FunsExternal.lean", "formal/qualification/aeneas/generated/authority/TypesExternal.lean", "formal/qualification/aeneas/generated/authority/FunsExternal.lean", @@ -124,6 +360,71 @@ const REVIEWED_BRIDGE_ARTIFACTS: &[&str] = &[ /// Keep this ordered list aligned with the checked-in qualification manifest; /// synchronization and reviewed bridge destinations are checked against it. const GENERATED_ARTIFACTS: &[&str] = &[ + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + "formal/qualification/aeneas/generated/scope_codec/Types.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/Funs.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/scope_codec/translation.json", + "formal/qualification/aeneas/generated/status_selection/Types.lean", + "formal/qualification/aeneas/generated/status_selection/Funs.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + "formal/qualification/aeneas/generated/status_selection/translation.json", + "formal/qualification/aeneas/generated/temporal_witness/Types.lean", + "formal/qualification/aeneas/generated/temporal_witness/Funs.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + "formal/qualification/aeneas/generated/temporal_witness/translation.json", + "formal/qualification/aeneas/generated/suite_adapter/Types.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/Funs.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + "formal/qualification/aeneas/generated/suite_adapter/translation.json", + "formal/qualification/aeneas/generated/p256/Types.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + "formal/qualification/aeneas/generated/p256/Funs.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + "formal/qualification/aeneas/generated/p256/translation.json", + "formal/qualification/aeneas/generated/p256/name-normalization.json", + "formal/qualification/aeneas/generated/sha256/Types.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + "formal/qualification/aeneas/generated/sha256/Funs.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + "formal/qualification/aeneas/generated/sha256/translation.json", + "formal/qualification/aeneas/generated/sha256/foreign-name-normalization.json", + "formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + "formal/qualification/aeneas/generated/signature/Types.lean", + "formal/qualification/aeneas/generated/signature/Funs.lean", + "formal/qualification/aeneas/generated/signature/translation.json", + "formal/qualification/aeneas/generated/composition/Types.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + "formal/qualification/aeneas/generated/composition/Funs.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + "formal/qualification/aeneas/generated/composition/translation.json", + "formal/qualification/aeneas/generated/stores/Types.lean", + "formal/qualification/aeneas/generated/stores/Funs.lean", + "formal/qualification/aeneas/generated/stores/translation.json", + "formal/qualification/aeneas/generated/codec/Types.lean", + "formal/qualification/aeneas/generated/codec/Funs.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + "formal/qualification/aeneas/generated/codec/translation.json", "formal/qualification/aeneas/generated/model/Types.lean", "formal/qualification/aeneas/generated/model/Funs.lean", "formal/qualification/aeneas/generated/model/FunsExternal_Template.lean", @@ -147,13 +448,32 @@ const GENERATED_ARTIFACTS: &[&str] = &[ "formal/qualification/aeneas/generated/lifecycle/translation.json", "formal/qualification/aeneas/generated/gateway/Types.lean", "formal/qualification/aeneas/generated/gateway/Funs.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean", "formal/qualification/aeneas/generated/gateway/translation.json", "formal/qualification/aeneas/generated/connections/Types.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", "formal/qualification/aeneas/generated/connections/Funs.lean", "formal/qualification/aeneas/generated/connections/translation.json", + "formal/qualification/aeneas/generated/profile_construction/Types.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + "formal/qualification/aeneas/generated/profile_construction/Funs.lean", + "formal/qualification/aeneas/generated/profile_construction/translation.json", ]; const EXPECTED_CASE_MODULES: &[&str] = &[ + "qualification.aeneas.cases.ScopeCodec", + "qualification.aeneas.cases.StatusSelection", + "qualification.aeneas.cases.TemporalWitness", + "qualification.aeneas.cases.SuiteAdapters", + "qualification.aeneas.cases.P256", + "qualification.aeneas.cases.Sha256", + "qualification.aeneas.cases.Signature", + "qualification.aeneas.cases.Composition", + "qualification.aeneas.cases.Stores", + "qualification.aeneas.cases.Codec", "qualification.aeneas.cases.Model", "qualification.aeneas.cases.Algebra", "qualification.aeneas.cases.Authority", @@ -164,6 +484,67 @@ const EXPECTED_CASE_MODULES: &[&str] = &[ ]; const REQUIRED_AUTHORED_SOURCE_INPUTS: &[&str] = &[ + "product/runtime/auths-gateway-kernel/src/reservation_batch.rs", + "product/runtime/auths-gateway-kernel/src/slot_record.rs", + "product/runtime/auths-gateway-kernel/src/entry_authorization.rs", + "product/runtime/auths-gateway-kernel/src/reservation_retry.rs", + "product/runtime/auths-gateway-kernel/src/counter_aggregation.rs", + "product/runtime/auths-gateway-kernel/src/counter_preimages.rs", + "product/runtime/auths-gateway/src/bounds.rs", + "product/runtime/auths-gateway-kernel/src/frontier.rs", + "product/runtime/auths-gateway-kernel/src/identity.rs", + "product/runtime/auths-gateway/src/recipe.rs", + "product/runtime/auths-gateway/src/recipe/lower.rs", + "product/runtime/auths-gateway/src/recipe/strict_json.rs", + "product/runtime/auths-gateway/src/recipe/tests.rs", + "product/runtime/auths-gateway/src/store.rs", + "product/runtime/auths-gateway/src/connection.rs", + "product/runtime/auths-connections/src/kernel.rs", + "product/runtime/auths-connections/src/model.rs", + "core/crates/auths-model/src/principal_scheme_tests.rs", + "core/crates/auths-model/src/scope_constructor_tests.rs", + "core/crates/auths-codec/src/scope_decode_tests.rs", + "formal/qualification/aeneas/cases/ScopeCodec.lean", + "core/crates/auths-registries/Cargo.toml", + "core/crates/auths-registries/src/lib.rs", + "core/crates/auths-registries/src/status_selection_tests.rs", + "formal/qualification/aeneas/cases/StatusSelection.lean", + "core/crates/auths-verifier/Cargo.toml", + "core/crates/auths-verifier/src/lib.rs", + "core/crates/auths-verifier/src/temporal_tests.rs", + "formal/qualification/aeneas/cases/TemporalWitness.lean", + "core/fixtures/crypto/import_p256_wycheproof.py", + "core/fixtures/crypto/p256-sha256-v1.tsv", + "core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json", + "core/fixtures/crypto/README.md", + "core/crates/auths-signature/tests/p256_corpus.rs", + "bindings/independent/typescript/p256-corpus.test.ts", + "bindings/independent/go/auths/p256_corpus_test.go", + "bindings/independent/typescript/semantic-verifier.ts", + "xtask/src/checks.rs", + "core/crates/auths-signature/Cargo.toml", + "core/crates/auths-signature/src/lib.rs", + "core/crates/auths-ports/Cargo.toml", + "core/crates/auths-ports/src/lib.rs", + "formal/qualification/aeneas/cases/SuiteAdapters.lean", + "formal/Auths/Crypto/P256Primitives.lean", + "formal/qualification/aeneas/cases/P256.lean", + "core/crates/auths-signature-core/Cargo.toml", + "core/crates/auths-signature-core/src/lib.rs", + "formal/qualification/aeneas/cases/Signature.lean", + "core/crates/auths-composition/Cargo.toml", + "core/crates/auths-composition/src/lib.rs", + "core/crates/auths-composition/src/summary.rs", + "formal/Auths/Support/Discriminant.lean", + "formal/Auths/Support/PositiveVec.lean", + "formal/Auths/Support/UnitCallback.lean", + "formal/qualification/aeneas/cases/Composition.lean", + "core/crates/auths-codec/src/decode.rs", + "core/crates/auths-codec/src/encode.rs", + "core/crates/auths-codec/src/error.rs", + "core/crates/auths-codec/src/hash.rs", + "formal/qualification/aeneas/cases/Stores.lean", + "formal/qualification/aeneas/cases/Codec.lean", ".cargo/config.toml", "Cargo.toml", "Cargo.lock", @@ -177,9 +558,50 @@ const REQUIRED_AUTHORED_SOURCE_INPUTS: &[&str] = &[ "formal/qualification/aeneas/cases/Lifecycle.lean", "formal/qualification/aeneas/cases/Gateway.lean", "formal/qualification/aeneas/cases/Connections.lean", + "formal/qualification/aeneas/entrypoints/profile_construction.rs", ]; const EXPECTED_TRANSLATIONS: &[(&str, &str)] = &[ + ( + "auths_codec", + "formal/qualification/aeneas/generated/scope_codec/translation.json", + ), + ( + "auths_registries", + "formal/qualification/aeneas/generated/status_selection/translation.json", + ), + ( + "auths_verifier", + "formal/qualification/aeneas/generated/temporal_witness/translation.json", + ), + ( + "auths_signature", + "formal/qualification/aeneas/generated/suite_adapter/translation.json", + ), + ( + "auths_signature_core", + "formal/qualification/aeneas/generated/p256/translation.json", + ), + ( + "auths_codec", + "formal/qualification/aeneas/generated/sha256/translation.json", + ), + ( + "auths_signature_core", + "formal/qualification/aeneas/generated/signature/translation.json", + ), + ( + "auths_composition", + "formal/qualification/aeneas/generated/composition/translation.json", + ), + ( + "auths_stores", + "formal/qualification/aeneas/generated/stores/translation.json", + ), + ( + "auths_codec", + "formal/qualification/aeneas/generated/codec/translation.json", + ), ( "auths_model", "formal/qualification/aeneas/generated/model/translation.json", @@ -208,12 +630,35 @@ const EXPECTED_TRANSLATIONS: &[(&str, &str)] = &[ "auths_connections", "formal/qualification/aeneas/generated/connections/translation.json", ), + ( + "auths_profile_construction", + "formal/qualification/aeneas/generated/profile_construction/translation.json", + ), ]; const EXPECTED_TEMPLATE_AXIOMS: &[&str] = &[ + "formal/qualification/aeneas/generated/scope_codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/scope_codec/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/status_selection/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/p256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/sha256/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/signature/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/composition/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/TypesExternal_Template.lean", + "formal/qualification/aeneas/generated/codec/FunsExternal_Template.lean", "formal/qualification/aeneas/generated/model/FunsExternal_Template.lean", "formal/qualification/aeneas/generated/authority/TypesExternal_Template.lean", "formal/qualification/aeneas/generated/authority/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/gateway/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/profile_construction/FunsExternal_Template.lean", + "formal/qualification/aeneas/generated/connections/FunsExternal_Template.lean", ]; #[derive(Deserialize)] @@ -233,11 +678,159 @@ struct Qualification { source_files: Vec, generated_files: Vec, case_modules: Vec, + codegen_normalizations: Vec, tools: QualificationTools, external_models: Vec, warning_inventory: Vec, translations: Vec, template_axioms: Vec, + qualified_delegations: Vec, +} + +#[derive(Clone, PartialEq, Eq, Deserialize, serde::Serialize)] +#[serde(deny_unknown_fields)] +struct QualifiedDelegation { + importer_translation_json: String, + rust_symbol: String, + owner_translation_json: String, + owner_lean_declaration: String, + bridge_artifact: String, + bridge_lean_declaration: String, + delegation_theorem: String, +} + +fn expected_qualified_delegations() -> Vec { + vec![ + QualifiedDelegation { + importer_translation_json: + "formal/qualification/aeneas/generated/suite_adapter/translation.json".to_owned(), + rust_symbol: "auths_signature_core::verify_ed25519".to_owned(), + owner_translation_json: + "formal/qualification/aeneas/generated/signature/translation.json".to_owned(), + owner_lean_declaration: "auths_signature_core.verify_ed25519".to_owned(), + bridge_artifact: + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean".to_owned(), + bridge_lean_declaration: "AuthsSuiteAdapters.auths_signature_core.verify_ed25519" + .to_owned(), + delegation_theorem: "AuthsSuiteAdapters.ed25519_delegates".to_owned(), + }, + QualifiedDelegation { + importer_translation_json: + "formal/qualification/aeneas/generated/suite_adapter/translation.json".to_owned(), + rust_symbol: "auths_signature_core::verify_p256_sha256".to_owned(), + owner_translation_json: "formal/qualification/aeneas/generated/p256/translation.json" + .to_owned(), + owner_lean_declaration: "AuthsNativeP256.verify_p256_sha256".to_owned(), + bridge_artifact: + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean".to_owned(), + bridge_lean_declaration: "AuthsSuiteAdapters.auths_signature_core.verify_p256_sha256" + .to_owned(), + delegation_theorem: "AuthsSuiteAdapters.p256_delegates".to_owned(), + }, + ] +} + +fn delegation_endpoints_match( + imported: &TranslationFunction, + owned: &TranslationFunction, + link: &QualifiedDelegation, +) -> bool { + imported.rust_name == link.rust_symbol + && !imported.is_local + && imported.is_opaque + && imported.lean_name == link.bridge_lean_declaration + && owned.rust_name == link.rust_symbol + && owned.is_local + && !owned.is_opaque + && owned.lean_name == link.owner_lean_declaration +} + +fn delegation_statement_matches(declaration: &Value, link: &QualifiedDelegation) -> bool { + let Some(constants) = declaration["statement_constants"].as_array() else { + return false; + }; + declaration["name"] == link.delegation_theorem + && declaration["kind"] == "theorem" + && constants + .iter() + .any(|name| name.as_str() == Some(link.owner_lean_declaration.as_str())) + && constants + .iter() + .any(|name| name.as_str() == Some(link.bridge_lean_declaration.as_str())) + && declaration["axioms"].as_array().is_some_and(|axioms| { + axioms.iter().all(|axiom| { + matches!( + axiom.as_str(), + Some("propext" | "Classical.choice" | "Quot.sound") + ) + }) + }) +} + +fn validate_qualified_delegations( + root: &Path, + qualification: &Qualification, +) -> Result<(), String> { + let audit: Value = serde_json::from_slice( + &fs::read(root.join("formal/lean-assurance-audit-v1.json")) + .map_err(|error| error.to_string())?, + ) + .map_err(|error| error.to_string())?; + let declarations = audit["declarations"] + .as_array() + .ok_or("compiled delegation audit has no declarations")?; + for link in &qualification.qualified_delegations { + let load = |path: &str| -> Result { + if !qualification + .translations + .iter() + .any(|translation| translation.translation_json == path) + { + return Err(format!( + "qualified delegation references an unqualified unit {path}" + )); + } + serde_json::from_slice(&fs::read(root.join(path)).map_err(|error| error.to_string())?) + .map_err(|error| error.to_string()) + }; + let importer = load(&link.importer_translation_json)?; + let imported = importer + .functions + .iter() + .find(|function| function.rust_name == link.rust_symbol) + .ok_or("qualified delegation import is absent")?; + if imported.is_local + || !imported.is_opaque + || imported.lean_name != link.bridge_lean_declaration + { + return Err("qualified delegation import identity or boundary drifted".to_owned()); + } + let owner = load(&link.owner_translation_json)?; + let owned = owner + .functions + .iter() + .find(|function| function.rust_name == link.rust_symbol) + .ok_or("qualified delegation owner is absent")?; + if !delegation_endpoints_match(imported, owned, link) { + return Err( + "qualified delegation must resolve to the actual transparent local owner" + .to_owned(), + ); + } + if !REVIEWED_BRIDGE_ARTIFACTS.contains(&link.bridge_artifact.as_str()) { + return Err( + "qualified delegation bridge is not a reviewed compiled artifact".to_owned(), + ); + } + let declaration = declarations + .iter() + .find(|row| row["name"] == link.delegation_theorem) + .ok_or("qualified delegation theorem is absent from the compiled audit")?; + if !delegation_statement_matches(declaration, link) { + return Err("qualified delegation lacks both exact kernel constant references or exceeds the axiom policy".to_owned()); + } + } + Ok(()) } #[derive(Deserialize)] @@ -306,6 +899,7 @@ struct TranslationReport { #[derive(Deserialize)] struct TranslationFunction { rust_name: String, + lean_name: String, is_local: bool, is_opaque: bool, } @@ -546,15 +1140,47 @@ fn validate_manifest(root: &Path, qualification: &Qualification) -> Result<(), S .to_owned(), ); } - if qualification.case_modules.len() != 7 - || qualification.translations.len() != 7 - || qualification.external_models.len() != 4 + if qualification.qualified_delegations != expected_qualified_delegations() { + return Err("qualified source delegation inventory drifted".to_owned()); + } + if qualification.case_modules.len() != 17 + || qualification.translations.len() != 18 + || qualification.external_models.len() != 25 || qualification.warning_inventory.len() != 4 - || qualification.template_axioms.len() != 3 + || qualification.template_axioms.len() != 22 { return Err("Aeneas qualification inventory cardinality drifted".to_owned()); } + if qualification.codegen_normalizations + != [ + "scope-codec-qualified-discriminants-v1", + "scope-codec-recursive-loops-v1", + "composition-qualified-discriminants-v1", + "composition-positive-vector-v1", + "composition-recursive-loops-v1", + "signature-recursive-loops-v1", + "composition-unit-callback-return-v1", + "signature-qualified-discriminants-v1", + "signature-explicit-primitive-context-v1", + "sha256-monomorphic-foreign-names-v1", + "sha256-explicit-primitive-context-v1", + "p256-monomorphic-export-names-v1", + "p256-qualified-discriminants-v1", + "p256-explicit-primitive-context-v1", + "suite-qualified-discriminants-v1", + "suite-explicit-linked-primitive-context-v1", + "temporal-qualified-discriminants-v1", + "temporal-recursive-loops-v1", + "status-selection-qualified-discriminants-v1", + "status-selection-recursive-loops-v1", + "connection-construction-source-paths-v2", + "connections-qualified-discriminants-v1", + ] + { + return Err("Aeneas code generation normalization inventory drifted".to_owned()); + } + for path in [ qualification.adr.as_str(), qualification.source_closure.as_str(), @@ -709,6 +1335,8 @@ fn qualification_boundary_contract_sha256(qualification: &Qualification) -> Stri "translations": translations, "warning_inventory": warnings, "template_axioms": templates, + "codegen_normalizations": qualification.codegen_normalizations, + "qualified_delegations": qualification.qualified_delegations, })) .expect("in-memory qualification contract serializes"); hex::encode(Sha256::digest(bytes)) @@ -986,6 +1614,86 @@ fn synchronize_reviewed_bridges( update: bool, ) -> Result<(), String> { for (relative, expected) in [ + ( + "formal/qualification/aeneas/generated/connections/FunsExternal.lean", + render_connections_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/profile_construction/FunsExternal.lean", + render_profile_construction_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/standard/CheckedResult.lean", + render_checked_result_interfaces(), + ), + ( + "formal/qualification/aeneas/generated/gateway/FunsExternal.lean", + render_gateway_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/scope_codec/TypesExternal.lean", + render_scope_codec_types_external(), + ), + ( + "formal/qualification/aeneas/generated/scope_codec/FunsExternal.lean", + render_scope_codec_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/status_selection/FunsExternal.lean", + render_status_selection_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/temporal_witness/FunsExternal.lean", + render_temporal_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/suite_adapter/TypesExternal.lean", + render_suite_adapter_types_external(), + ), + ( + "formal/qualification/aeneas/generated/suite_adapter/FunsExternal.lean", + render_suite_adapter_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/p256/TypesExternal.lean", + render_p256_types_external(), + ), + ( + "formal/qualification/aeneas/generated/p256/FunsExternal.lean", + render_p256_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/sha256/TypesExternal.lean", + render_sha256_types_external(), + ), + ( + "formal/qualification/aeneas/generated/sha256/FunsExternal.lean", + render_sha256_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/signature/TypesExternal.lean", + render_signature_types_external(), + ), + ( + "formal/qualification/aeneas/generated/signature/FunsExternal.lean", + render_signature_functions_external(), + ), + ( + "formal/qualification/aeneas/generated/composition/TypesExternal.lean", + render_composition_types_external(), + ), + ( + "formal/qualification/aeneas/generated/composition/FunsExternal.lean", + render_composition_external(), + ), + ( + "formal/qualification/aeneas/generated/codec/TypesExternal.lean", + render_codec_types_external(), + ), + ( + "formal/qualification/aeneas/generated/codec/FunsExternal.lean", + render_codec_functions_external(), + ), ( "formal/qualification/aeneas/generated/model/FunsExternal.lean", render_model_external(), @@ -1016,97 +1724,618 @@ fn synchronize_reviewed_bridges( Ok(()) } -fn render_model_external() -> String { - "-- REVIEWED TRANSPARENT MODEL FOR AN AENEAS STANDARD-LIBRARY EXTERNAL.\n\ ---\n\ --- Rust string equality and ordering use Lean's exact String instances,\n\ --- `String::as_bytes` uses Aeneas' exact UTF-8 `Str` conversion, and fixed\n\ --- arrays are compared lexicographically through the translated element\n\ --- `Ord` instance. This file contains no authority semantics and no axiom.\n\ -import Aeneas\n\ -import qualification.aeneas.generated.model.Types\n\ -\n\ -open Aeneas Aeneas.Std Result ControlFlow Error\n\ -\n\ -set_option linter.dupNamespace false\n\ -set_option linter.hashCommand false\n\ -set_option linter.unusedVariables false\n\ -set_option maxHeartbeats 1000000\n\ -set_option maxRecDepth 2048\n\ -\n\ -private def compareLists {T : Type} (cmpOrdInst : core.cmp.Ord T) :\n\ - List T → List T → Result Ordering\n\ - | [], [] => ok .eq\n\ - | [], _ :: _ => ok .lt\n\ - | _ :: _, [] => ok .gt\n\ - | left :: leftTail, right :: rightTail => do\n\ - let ordering ← cmpOrdInst.cmp left right\n\ - match ordering with\n\ - | Ordering.eq => compareLists cmpOrdInst leftTail rightTail\n\ - | ordering => ok ordering\n\ -\n\ -@[rust_fun \"core::array::{core::cmp::Ord<[@T; @N]>}::cmp\"]\n\ -def Array.Insts.CoreCmpOrd.cmp\n\ - {T : Type} {N : Std.Usize} (cmpOrdInst : core.cmp.Ord T)\n\ - (left right : Array T N) : Result Ordering :=\n\ - compareLists cmpOrdInst left.val right.val\n\ -\n\ -@[rust_fun\n\ - \"alloc::string::{core::cmp::PartialEq}::eq\"]\n\ -def alloc.string.String.Insts.CoreCmpPartialEqString.eq\n\ - (left right : String) : Result Bool :=\n\ - ok (left == right)\n\ -\n\ -@[rust_fun \"alloc::string::{core::cmp::Ord}::cmp\"]\n\ -def alloc.string.String.Insts.CoreCmpOrd.cmp\n\ - (left right : String) : Result Ordering :=\n\ - ok (compare left right)\n\ -\n\ -@[rust_fun \"alloc::string::{alloc::string::String}::as_bytes\"]\n\ -def alloc.string.String.as_bytes (value : String) : Result (Slice Std.U8) :=\n\ - if h : value.toByteArray.size ≤ U32.max then\n\ - ok (Aeneas.Std.toStr value h)\n\ - else\n\ - fail .panic\n" - .to_owned() +fn render_checked_result_interfaces() -> String { + r##"-- Exact checked conversion and Result projection shared by translation units. +import Aeneas +open Aeneas Aeneas.Std Result + +def U64.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from (value : Std.Usize) := + core.num.tryFromUScalar .U64 value + +def core.result.Result.unwrap_or {T E : Type} (value : core.result.Result T E) (fallback : T) : + Result T := ok (match value with | .Ok value => value | .Err _ => fallback) +"## + .to_owned() } -fn render_authority_types_external() -> String { - "-- REVIEWED TYPE LINK FOR AENEAS-GENERATED PRODUCTION AUTHORITY CODE.\n\ ---\n\ --- All external authority carriers are the mechanically translated\n\ --- `auths-model` carriers. No opaque type or axiom is introduced here.\n\ -import qualification.aeneas.generated.model.Types\n" - .to_owned() +fn render_connections_functions_external() -> String { + r##"-- Reuse the reviewed exact String ordering/UTF-8 models; all Auths bodies remain translated. +import qualification.aeneas.generated.connections.Types +import qualification.aeneas.generated.model.FunsExternal +open Aeneas Aeneas.Std Result +namespace auths_connections +@[trait_default] +def core.cmp.PartialOrd.lt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right +abbrev alloc.string.String.Insts.CoreCmpPartialEqString.eq := + _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq +abbrev alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp := + _root_.alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp +abbrev alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq := + _root_.alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq +abbrev alloc.string.String.Insts.CoreCmpOrd.cmp := + _root_.alloc.string.String.Insts.CoreCmpOrd.cmp +abbrev alloc.string.String.as_bytes := _root_.alloc.string.String.as_bytes +end auths_connections +"##.to_owned() } -/// Renders the authority external bridge: transparent adapters plus imports. -/// -/// The authority translation emits its OWN copies of the algebra carriers, -/// `auths_authority.auths_algebra_kernel.RootLinkage` and -/// `...generated.AttenuationChecks`, distinct from the `_root_` types the -/// translated `auths_algebra_kernel` owns. Lean rejects passing one where the -/// other is expected. -/// -/// This file reboxes, field by field, and delegates. It restates NO Boolean -/// semantics: `root_preserved` and `attenuation_checks_accept` remain owned by -/// the mechanically translated algebra crate, and the adapters below only move -/// fields and call them. No axiom, cast, assumed equality, or reimplementation. -/// -/// The eleven attenuation assignments are generated from `dimensions`, i.e. -/// from `formal/algebra-contract-v1.toml`, so adding a twelfth dimension -/// regenerates this file rather than silently dropping the field. -/// -/// Emitted as explicit lines: Lean structure literals are layout-sensitive and -/// Rust string continuations strip leading whitespace. -fn render_authority_functions_external(dimensions: &[String]) -> String { - const LINKAGE_FIELDS: [&str; 4] = [ - "parent_root", - "parent_subject", - "parent_delegated", - "grant_issuer", - ]; - let mut lines: Vec = vec![ +fn render_profile_construction_functions_external() -> String { + r##"-- Reuse only the existing reviewed UTF-8/String projections; no Auths body is modeled. +import qualification.aeneas.generated.profile_construction.Types +import qualification.aeneas.generated.codec.FunsExternal +namespace auths_profile_construction +abbrev core.str.Str.as_bytes := _root_.core.str.Str.as_bytes +abbrev alloc.string.String.as_bytes := _root_.alloc.string.String.as_bytes +abbrev alloc.string.String.Insts.CoreOpsDerefDerefStr.deref := + _root_.alloc.string.String.Insts.CoreOpsDerefDerefStr.deref +end auths_profile_construction +"## + .to_owned() +} + +fn render_gateway_functions_external() -> String { + r##"-- Reuse the reviewed checked usize-to-u64 conversion and Result.unwrap_or models. +import qualification.aeneas.generated.gateway.Types +import qualification.aeneas.generated.standard.CheckedResult +"## + .to_owned() +} + +fn render_status_selection_functions_external() -> String { + r#"import qualification.aeneas.generated.status_selection.Types +import qualification.aeneas.generated.model.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsStatusSelection + +@[trait_default] +def core.cmp.PartialOrd.lt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right +@[trait_default] +def core.cmp.PartialOrd.gt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.gt.default implementation.partial_cmp left right +@[trait_default] +def core.cmp.Ord.max.default {Self : Type} + (implementation : Aeneas.Std.core.cmp.Ord Self) (left right : Self) : Result Self := + Aeneas.Std.core.cmp.Ord.max.default implementation.partialOrdInst.lt left right +abbrev alloc.string.String.Insts.CoreCmpPartialEqString.eq := + _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq +abbrev alloc.string.String.Insts.CoreCmpOrd.cmp := + _root_.alloc.string.String.Insts.CoreCmpOrd.cmp + +/-- Reviewed standard-library boundary: pinned Rust binary_search_by's exact + size/base transition and final comparison, including unsorted inputs. + Fuel is initial length + 1; exhausted/invalid indexing refuses explicitly. + This is not an Auths algorithm or an assumption of whitelist membership. -/ +def binarySearchLoop {T : Type} (order : Aeneas.Std.core.cmp.Ord T) + (values : List T) (target : T) : Nat → Nat → Nat → Result (core.result.Result Nat Nat) + | 0, _, _ => fail .panic + | fuel + 1, base, size => do + if size > 1 then + let half := size / 2 + let mid := base + half + match values[mid]? with + | none => fail .panic + | some value => + let comparison ← order.cmp value target + binarySearchLoop order values target fuel + (if comparison = .gt then base else mid) (size - half) + else + match values[base]? with + | none => fail .panic + | some value => + let comparison ← order.cmp value target + if comparison = .eq then ok (.Ok base) + else ok (.Err (base + if comparison = .lt then 1 else 0)) + +def core.slice.Slice.binary_search {T : Type} (order : Aeneas.Std.core.cmp.Ord T) + (values : Slice T) (target : T) : Result (core.result.Result Std.Usize Std.Usize) := do + if values.val.isEmpty then ok (.Err 0#usize) + else + let result ← binarySearchLoop order values.val target (values.val.length + 1) 0 values.val.length + match result with + | .Ok index => + let result ← UScalar.tryMk .Usize index + ok (.Ok result) + | .Err index => + let result ← UScalar.tryMk .Usize index + ok (.Err result) +theorem lt_default_delegates {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs) : + core.cmp.PartialOrd.lt.default implementation left right = + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right := rfl + +theorem gt_default_delegates {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs) : + core.cmp.PartialOrd.gt.default implementation left right = + Aeneas.Std.core.cmp.PartialOrd.gt.default implementation.partial_cmp left right := rfl + +theorem max_default_delegates {Self : Type} + (implementation : Aeneas.Std.core.cmp.Ord Self) (left right : Self) : + core.cmp.Ord.max.default implementation left right = + Aeneas.Std.core.cmp.Ord.max.default implementation.partialOrdInst.lt left right := rfl +end AuthsStatusSelection +"#.to_owned() +} + +fn render_temporal_functions_external() -> String { + r#"import qualification.aeneas.generated.temporal_witness.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsTemporalWitness +@[trait_default] +def core.cmp.PartialOrd.lt.default {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) + (left : Self) (right : Rhs) : Result Bool := + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right +abbrev core.option.Option.ok_or := @_root_.core.option.Option.ok_or +theorem lt_default_delegates {Self Rhs : Type} + (implementation : Aeneas.Std.core.cmp.PartialOrd Self Rhs) (left : Self) (right : Rhs) : + core.cmp.PartialOrd.lt.default implementation left right = + Aeneas.Std.core.cmp.PartialOrd.lt.default implementation.partial_cmp left right := rfl +end AuthsTemporalWitness +"# + .to_owned() +} + +fn render_suite_adapter_types_external() -> String { + r#"-- REVIEWED STRING CARRIER FOR THE UNINSPECTED PRIVATE SUITE-ID FIELD. +-- The verified methods never read it; constructor/registry validity is separate. +import Aeneas +namespace AuthsSuiteAdapters +abbrev auths_model.SignatureSuiteId := Aeneas.Std.Str +end AuthsSuiteAdapters +"# + .to_owned() +} + +fn render_suite_adapter_functions_external() -> String { + r#"-- EXACT DELEGATION TO QUALIFIED OWNING RUST UNITS, WITH EXHAUSTIVE ERROR REBOXING. +-- No Auths algorithm or crypto operation is assumed as an opaque function. +import qualification.aeneas.generated.suite_adapter.Types +import qualification.aeneas.generated.signature.Funs +import qualification.aeneas.generated.p256.Funs +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsSuiteAdapters + +abbrev core.result.Result.map_err := @_root_.core.result.Result.map_err + +def fromEdError : _root_.auths_signature_core.Ed25519Error → auths_signature_core.Ed25519Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def toEdError : auths_signature_core.Ed25519Error → _root_.auths_signature_core.Ed25519Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def fromP256Error : AuthsNativeP256.P256Error → auths_signature_core.P256Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def toP256Error : auths_signature_core.P256Error → AuthsNativeP256.P256Error + | .InvalidKey => .InvalidKey + | .InvalidSignatureEncoding => .InvalidSignatureEncoding + | .VerificationFailed => .VerificationFailed + +def edResult : Aeneas.Std.core.result.Result Unit _root_.auths_signature_core.Ed25519Error → + Aeneas.Std.core.result.Result Unit auths_signature_core.Ed25519Error + | .Ok value => .Ok value | .Err reason => .Err (fromEdError reason) + +def p256Result : AuthsNativeP256.core.qualified_p256_type_decls_0 → + Aeneas.Std.core.result.Result Unit auths_signature_core.P256Error + | .Ok value => .Ok value | .Err reason => .Err (fromP256Error reason) + +def auths_signature_core.verify_ed25519 [P : Auths.Crypto.Ed25519Primitives] + (key message signature : Slice Std.U8) : + Result (Aeneas.Std.core.result.Result Unit auths_signature_core.Ed25519Error) := do + let result ← _root_.auths_signature_core.verify_ed25519 (primitives := P) key message signature + ok (edResult result) + +def auths_signature_core.verify_p256_sha256 [P : Auths.Crypto.P256Primitives] + (key message signature : Slice Std.U8) : + Result (Aeneas.Std.core.result.Result Unit auths_signature_core.P256Error) := do + let result ← AuthsNativeP256.verify_p256_sha256 (primitive := P) key message signature + ok (p256Result result) + +-- Both conversions are isomorphisms on the complete error domains. +theorem ed_error_to_from (reason : _root_.auths_signature_core.Ed25519Error) : + toEdError (fromEdError reason) = reason := by cases reason <;> rfl + +theorem ed_error_from_to (reason : auths_signature_core.Ed25519Error) : + fromEdError (toEdError reason) = reason := by cases reason <;> rfl + +theorem p256_error_to_from (reason : AuthsNativeP256.P256Error) : + toP256Error (fromP256Error reason) = reason := by cases reason <;> rfl + +theorem p256_error_from_to (reason : auths_signature_core.P256Error) : + fromP256Error (toP256Error reason) = reason := by cases reason <;> rfl + +theorem ed25519_delegates [P : Auths.Crypto.Ed25519Primitives] + (key message signature : Slice Std.U8) : + auths_signature_core.verify_ed25519 (P := P) key message signature = + (do let result ← _root_.auths_signature_core.verify_ed25519 (primitives := P) key message signature + ok (edResult result)) := rfl + +theorem p256_delegates [P : Auths.Crypto.P256Primitives] + (key message signature : Slice Std.U8) : + auths_signature_core.verify_p256_sha256 (P := P) key message signature = + (do let result ← AuthsNativeP256.verify_p256_sha256 (primitive := P) key message signature + ok (p256Result result)) := rfl + +end AuthsSuiteAdapters +"#.to_owned() +} + +fn render_p256_types_external() -> String { + r#"-- REVIEWED EXPLICIT FOREIGN TYPES. NO GLOBAL INSTANCE OR AXIOM. +import Auths.Crypto.P256Primitives +namespace AuthsNativeP256 +abbrev ecdsa.qualified_p256_type_decls_4 [P : Auths.Crypto.P256Primitives] := P.Key +abbrev ecdsa.qualified_p256_type_decls_11 [P : Auths.Crypto.P256Primitives] := P.Signature +abbrev signature.error.Error [P : Auths.Crypto.P256Primitives] := P.Error +end AuthsNativeP256 +"# + .to_owned() +} + +fn render_p256_functions_external() -> String { + r#"-- REVIEWED TRANSPARENT STANDARD MATCHES AND EXPLICIT FOREIGN PROJECTIONS. +import qualification.aeneas.generated.p256.Types +open Aeneas Aeneas.Std Result +namespace AuthsNativeP256 +variable [P : Auths.Crypto.P256Primitives] + +def SharedSliceU8.Insts.CoreConvertTryIntoArrayU864.try_into (bytes : Slice Std.U8) : + Result core.qualified_p256_type_decls_9 := + if sized : bytes.val.length = 64 then + ok (.Ok ⟨bytes.val, by scalar_tac⟩) + else ok (.Err ()) + +def core.qualified_p256_fun_decls_27 (value : core.qualified_p256_type_decls_16) : Result Bool := + ok (match value with | .Ok _ => true | .Err _ => false) + +def core.qualified_p256_fun_decls_30 (value : core.qualified_p256_type_decls_17) : + Result core.qualified_p256_type_decls_13 := + ok (match value with | .Ok key => .Some key | .Err _ => .None) + +def core.qualified_p256_fun_decls_24 (value : core.qualified_p256_type_decls_14) : + Result core.qualified_p256_type_decls_12 := + ok (match value with | .Ok signature => .Some signature | .Err _ => .None) + + +def core.qualified_p256_type_decls_3.Insts.CoreOpsTry_traitTry.branch + (value : core.qualified_p256_type_decls_3) : Result core.qualified_p256_type_decls_6 := + ok (match value with | .Ok key => .Continue key | .Err reason => .Break (.Err reason)) + +def core.qualified_p256_type_decls_0.Insts.CoreOpsTry_traitFromResidualqualified_p256_type_decls_7.from_residual + (residual : core.qualified_p256_type_decls_7) : Result core.qualified_p256_type_decls_0 := + match residual with + | .Ok impossible => nomatch impossible + | .Err reason => ok (.Err reason) + +def core.qualified_p256_fun_decls_20 (bytes : Slice Std.U8) : Result Std.Usize := ok (Slice.len bytes) + +def ecdsa.qualified_p256_fun_decls_23 (bytes : Slice Std.U8) : + Result core.qualified_p256_type_decls_14 := do + let value ← P.parse bytes + ok (match value with | .Ok signature => .Ok signature | .Err reason => .Err reason) + +def ecdsa.qualified_p256_fun_decls_29 (bytes : Slice Std.U8) : + Result core.qualified_p256_type_decls_17 := do + let value ← P.decode bytes + ok (match value with | .Ok key => .Ok key | .Err reason => .Err reason) + +def ecdsa.qualified_p256_type_decls_4.Insts.SignatureVerifierVerifierqualified_p256_type_decls_11.verify + (key : ecdsa.qualified_p256_type_decls_4) (message : Slice Std.U8) + (signature : ecdsa.qualified_p256_type_decls_11) : Result core.qualified_p256_type_decls_16 := do + let value ← P.verify key message signature + ok (match value with | .Ok valueUnit => .Ok valueUnit | .Err reason => .Err reason) + +end AuthsNativeP256 +"#.to_owned() +} + +fn render_sha256_types_external() -> String { + r##"-- Explicit foreign output type, without a global instance or axiom. +import Auths.Crypto.Sha256Primitives +abbrev generic_array.qualified_sha256_type_decls_1 [P : Auths.Crypto.Sha256Primitives] := P.Output +"## + .to_owned() +} + +fn render_sha256_functions_external() -> String { + r##"-- Exact selected foreign calls are explicit implementation projections. +import qualification.aeneas.generated.sha256.Types +open Aeneas Aeneas.Std Result + +def generic_array.qualified_sha256_type_decls_1.Insts.CoreConvertIntoArrayU832.into + [P : Auths.Crypto.Sha256Primitives] (value : generic_array.qualified_sha256_type_decls_1) : + Result (Array Std.U8 32#usize) := P.intoBytes value + +def digest.qualified_sha256_type_decls_11.Insts.DigestDigestDigest.digest + [P : Auths.Crypto.Sha256Primitives] (value : Slice Std.U8) : + Result generic_array.qualified_sha256_type_decls_1 := P.digest value +"## + .to_owned() +} + +fn render_signature_types_external() -> String { + r##"-- REVIEWED FOREIGN TYPE INTERFACE. NO GLOBAL INSTANCE OR AXIOM. +import Auths.Crypto.NativePrimitives + +abbrev ed25519.Signature [P : Auths.Crypto.Ed25519Primitives] := P.Signature +abbrev ed25519_dalek.verifying.VerifyingKey [P : Auths.Crypto.Ed25519Primitives] := P.Key +abbrev signature.error.Error [P : Auths.Crypto.Ed25519Primitives] := P.Error +"## + .to_owned() +} + +fn render_signature_functions_external() -> String { + r##"-- REVIEWED TRANSPARENT STANDARD RESULT MODEL AND EXPLICIT FOREIGN INTERFACE. +import qualification.aeneas.generated.signature.Types +import qualification.aeneas.generated.codec.FunsExternal + +open Aeneas Aeneas.Std Result + +def core.result.Result.ok {T E : Type} (value : core.result.Result T E) : Result (Option T) := + Aeneas.Std.Result.ok (match value with | .Ok value => some value | .Err _ => none) + +def ed25519.Signature.from_bytes [P : Auths.Crypto.Ed25519Primitives] + (bytes : Array Std.U8 64#usize) : Result ed25519.Signature := P.signatureFromBytes bytes + +def ed25519_dalek.verifying.VerifyingKey.from_bytes [P : Auths.Crypto.Ed25519Primitives] + (bytes : Array Std.U8 32#usize) : + Result (core.result.Result ed25519_dalek.verifying.VerifyingKey signature.error.Error) := + P.decode bytes + +def ed25519_dalek.verifying.VerifyingKey.verify_strict [P : Auths.Crypto.Ed25519Primitives] + (key : ed25519_dalek.verifying.VerifyingKey) (message : Slice Std.U8) + (encodedSignature : ed25519.Signature) : Result (core.result.Result Unit signature.error.Error) := + P.verifyStrict key message encodedSignature +"##.to_owned() +} + +fn render_composition_types_external() -> String { + r##"-- REVIEWED: bounded ordered-set and consuming-iterator carriers. +-- Only Global allocation and the translated fixed-width ProofRef order are used. +import Aeneas +import Auths.Support.Discriminant +import Auths.Support.PositiveVec +open Aeneas Aeneas.Std +namespace alloc.collections.btree.set +structure BTreeSet (T A : Type) where + values : List T + bound : values.length ≤ Usize.max +structure IntoIter (T A : Type) where + values : List T + bound : values.length ≤ Usize.max +end alloc.collections.btree.set +"## + .to_owned() +} + +fn render_composition_external() -> String { + r##"-- REVIEWED: exact standard-container links and the pinned Rust Ord::max rule. +-- Ordered-set models are scoped to Global + copied ProofRef values and their +-- proved lawful order. They model set behavior, not Rust allocation or tree cost. +import qualification.aeneas.generated.composition.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result + +namespace auths_composition.alloc.vec + +def Vec.with_capacity (T : Type) (capacity : Std.Usize) : Vec T := + Vec.ofBase (Aeneas.Std.alloc.vec.Vec.with_capacity T capacity) + +def Vec.len {T : Type} (value : Vec T) : Std.Usize := + Aeneas.Std.alloc.vec.Vec.len value.toBase + +def Vec.push {T : Type} (value : Vec T) (element : T) : Result (Vec T) := do + let updated ← Aeneas.Std.alloc.vec.Vec.push value.toBase element + ok (Vec.ofBase updated) + +def Vec.is_empty {T : Type} (_A : Type) (value : Vec T) : Result Bool := + ok value.elements.toList.isEmpty + +end auths_composition.alloc.vec + +@[trait_default] def auths_composition.core.cmp.Ord.max.default {T : Type} + (order : Aeneas.Std.core.cmp.Ord T) (left right : T) : Result T := do + let greater ← order.partialOrdInst.lt right left + if greater then ok left else ok right + +def core.option.Option.Insts.CoreDefaultDefault.default (T : Type) : Result (Option T) := ok none + +namespace alloc.collections.btree.set + +def insertValues {T : Type} (order : core.cmp.Ord T) (value : T) : + List T → Result (Bool × List T) + | [] => ok (true, [value]) + | head :: tail => do + let comparison ← order.cmp value head + match comparison with + | .lt => ok (true, value :: head :: tail) + | .eq => ok (false, head :: tail) + | .gt => + let (added, remaining) ← insertValues order value tail + ok (added, head :: remaining) + +def BTreeSetTGlobal.new (T : Type) : Result (BTreeSet T Global) := + ok ⟨[], by simp⟩ + +def BTreeSet.insert {T A : Type} (_allocator : core.clone.Clone A) (order : core.cmp.Ord T) + (state : BTreeSet T A) (value : T) : Result (Bool × BTreeSet T A) := do + let (added, values) ← insertValues order value state.values + (if bound : values.length ≤ Usize.max then + ok (added, ⟨values, bound⟩) + else + fail .maximumSizeExceeded) + +def BTreeSet.len {T A : Type} (_allocator : core.clone.Clone A) + (state : BTreeSet T A) : Result Std.Usize := + ok (Usize.ofNatCore state.values.length (by have bound := state.bound; scalar_tac)) + +def BTreeSet.Insts.CoreIterTraitsCollectIntoIteratorTIntoIter.into_iter + {T A : Type} (_allocator : core.clone.Clone A) (state : BTreeSet T A) : + Result (IntoIter T A) := ok ⟨state.values, state.bound⟩ + +def IntoIter.Insts.CoreIterTraitsIteratorIterator.next + {T A : Type} (_allocator : core.clone.Clone A) (state : IntoIter T A) : + Result (Option T × IntoIter T A) := + match same : state.values with + | [] => ok (none, state) + | head :: tail => ok (some head, ⟨tail, by have bound := state.bound; rw [same] at bound; simp only [List.length_cons] at bound; omega⟩) + +end alloc.collections.btree.set +"##.to_owned() +} + +fn render_model_external() -> String { + r##"-- REVIEWED TRANSPARENT MODEL FOR AN AENEAS STANDARD-LIBRARY EXTERNAL. +-- +-- Rust string equality and ordering use Lean's exact String instances, +-- `String::as_bytes` uses Aeneas' exact UTF-8 `Str` conversion, and fixed +-- arrays are compared lexicographically through the translated element +-- `Ord` instance. This file contains no authority semantics and no axiom. +import Aeneas +import qualification.aeneas.generated.model.Types + +open Aeneas Aeneas.Std Result ControlFlow Error + +set_option linter.dupNamespace false +set_option linter.hashCommand false +set_option linter.unusedVariables false +set_option maxHeartbeats 1000000 +set_option maxRecDepth 2048 + +private def compareLists {T : Type} (cmpOrdInst : core.cmp.Ord T) : +List T → List T → Result Ordering +| [], [] => ok .eq +| [], _ :: _ => ok .lt +| _ :: _, [] => ok .gt +| left :: leftTail, right :: rightTail => do +let ordering ← cmpOrdInst.cmp left right +match ordering with +| Ordering.eq => compareLists cmpOrdInst leftTail rightTail +| ordering => ok ordering + +-- Public views expose the existing model for downstream proofs. Every +-- equation below reduces to the original private implementation. +def Array.Insts.CoreCmpOrd.compareValues {T : Type} (order : core.cmp.Ord T) + (left right : List T) : Result Ordering := compareLists order left right + +theorem Array.Insts.CoreCmpOrd.compareValues_nil_nil {T : Type} (order : core.cmp.Ord T) : + compareValues order [] [] = ok .eq := rfl + +theorem Array.Insts.CoreCmpOrd.compareValues_nil_cons {T : Type} (order : core.cmp.Ord T) + (head : T) (tail : List T) : compareValues order [] (head :: tail) = ok .lt := rfl + +theorem Array.Insts.CoreCmpOrd.compareValues_cons_nil {T : Type} (order : core.cmp.Ord T) + (head : T) (tail : List T) : compareValues order (head :: tail) [] = ok .gt := rfl + +theorem Array.Insts.CoreCmpOrd.compareValues_cons_cons {T : Type} (order : core.cmp.Ord T) + (left right : T) (leftTail rightTail : List T) : + compareValues order (left :: leftTail) (right :: rightTail) = + (do let ordering ← order.cmp left right + match ordering with + | .eq => compareValues order leftTail rightTail + | ordering => ok ordering) := rfl + +@[rust_fun "core::array::{core::cmp::Ord<[@T; @N]>}::cmp"] +def Array.Insts.CoreCmpOrd.cmp +{T : Type} {N : Std.Usize} (cmpOrdInst : core.cmp.Ord T) +(left right : Array T N) : Result Ordering := +compareLists cmpOrdInst left.val right.val + +@[rust_fun +"alloc::string::{core::cmp::PartialEq}::eq"] +def alloc.string.String.Insts.CoreCmpPartialEqString.eq +(left right : String) : Result Bool := +ok (left == right) + +@[rust_fun "alloc::string::{core::cmp::Ord}::cmp"] +def alloc.string.String.Insts.CoreCmpOrd.cmp +(left right : String) : Result Ordering := +ok (compare left right) + + +-- String implements a total order; PartialOrd returns that same comparison. +@[rust_fun "alloc::string::{core::cmp::PartialOrd}::partial_cmp"] +def alloc.string.String.Insts.CoreCmpPartialOrdString.partial_cmp + (left right : String) : Result (Option Ordering) := ok (some (compare left right)) + +-- Eq's marker method has no runtime observation or state change. +@[rust_fun "alloc::string::{core::cmp::Eq}::assert_fields_are_eq"] +def alloc.string.String.Insts.CoreCmpEq.assert_fields_are_eq (_ : String) : Result Unit := ok () + +@[rust_fun "alloc::string::{alloc::string::String}::as_bytes"] +def alloc.string.String.as_bytes (value : String) : Result (Slice Std.U8) := +if h : value.toByteArray.size ≤ U32.max then +ok (Aeneas.Std.toStr value h) +else +fail .panic + +@[rust_fun "core::str::{str}::len"] +def core.str.Str.len (value : Str) : Result Std.Usize := +ok (Slice.len value) + +@[rust_fun "core::str::{str}::is_empty"] +def core.str.Str.is_empty (value : Str) : Result Bool := +ok value.val.isEmpty + +@[rust_fun "core::str::{str}::as_bytes"] +def core.str.Str.as_bytes (value : Str) : Result (Slice Std.U8) := +ok value +"## + .to_owned() +} + +fn render_authority_types_external() -> String { + "-- REVIEWED TYPE LINK FOR AENEAS-GENERATED PRODUCTION AUTHORITY CODE.\n\ +--\n\ +-- All external authority carriers are the mechanically translated\n\ +-- `auths-model` carriers. No opaque type or axiom is introduced here.\n\ +import qualification.aeneas.generated.model.Types\n" + .to_owned() +} + +/// Renders the authority external bridge: transparent adapters plus imports. +/// +/// The authority translation emits its OWN copies of the algebra carriers, +/// `auths_authority.auths_algebra_kernel.RootLinkage` and +/// `...generated.AttenuationChecks`, distinct from the `_root_` types the +/// translated `auths_algebra_kernel` owns. Lean rejects passing one where the +/// other is expected. +/// +/// This file reboxes, field by field, and delegates. It restates NO Boolean +/// semantics: `root_preserved` and `attenuation_checks_accept` remain owned by +/// the mechanically translated algebra crate, and the adapters below only move +/// fields and call them. No axiom, cast, assumed equality, or reimplementation. +/// +/// The eleven attenuation assignments are generated from `dimensions`, i.e. +/// from `formal/algebra-contract-v1.toml`, so adding a twelfth dimension +/// regenerates this file rather than silently dropping the field. +/// +/// Emitted as explicit lines: Lean structure literals are layout-sensitive and +/// Rust string continuations strip leading whitespace. +fn render_authority_functions_external(dimensions: &[String]) -> String { + const LINKAGE_FIELDS: [&str; 4] = [ + "parent_root", + "parent_subject", + "parent_delegated", + "grant_issuer", + ]; + let mut lines: Vec = vec![ "-- REVIEWED TRANSPARENT ADAPTERS FOR AENEAS-GENERATED PRODUCTION AUTHORITY CODE.".into(), "--".into(), "-- The authority translation emits authority-local copies of the algebra".into(), @@ -1228,6 +2457,15 @@ fn render_authority_functions_external(dimensions: &[String]) -> String { output } +// The pinned generator starts declarations on a new line but may place a long +// name after the keyword on the following line. Both layouts must be counted +// and forbidden identically in compiled bridges. +fn is_lean_axiom_declaration(line: &str) -> bool { + line.trim_start() + .strip_prefix("axiom") + .is_some_and(|rest| rest.is_empty() || rest.starts_with(char::is_whitespace)) +} + fn validate_generated_inventory(root: &Path, qualification: &Qualification) -> Result<(), String> { for relative in &qualification.generated_files { let path = root.join(relative); @@ -1242,11 +2480,14 @@ fn validate_generated_inventory(root: &Path, qualification: &Qualification) -> R { let source = fs::read_to_string(&path) .map_err(|error| format!("could not read {}: {error}", path.display()))?; - for forbidden in ["axiom ", "sorry", "admit"] { - if source - .lines() - .any(|line| line.trim_start().starts_with(forbidden)) - { + for forbidden in ["axiom", "sorry", "admit"] { + if source.lines().any(|line| { + if forbidden == "axiom" { + is_lean_axiom_declaration(line) + } else { + line.trim_start().starts_with(forbidden) + } + }) { return Err(format!( "compiled qualification artifact contains forbidden `{forbidden}`: {relative}" )); @@ -1265,7 +2506,7 @@ fn validate_generated_inventory(root: &Path, qualification: &Qualification) -> R .map_err(|error| format!("could not read {}: {error}", inventory.artifact))?; let count = source .lines() - .filter(|line| line.trim_start().starts_with("axiom ")) + .filter(|line| is_lean_axiom_declaration(line)) .count(); if count != inventory.count { return Err(format!( @@ -1300,6 +2541,46 @@ fn validate_translation_reports(root: &Path, qualification: &Qualification) -> R expected.crate_name )); } + if matches!( + report.crate_name.as_str(), + "auths_codec" + | "auths_composition" + | "auths_signature_core" + | "auths_verifier" + | "auths_registries" + ) && report + .functions + .iter() + .any(|function| function.rust_name.starts_with("auths_") && function.is_opaque) + { + return Err( + "the codec/composition/signature/temporal/status closure must translate every Auths constructor and helper" + .to_owned(), + ); + } + if report.crate_name == "auths_signature" + && report.functions.iter().any(|function| { + function.rust_name.starts_with("auths_") + && function.is_opaque + && !qualification.qualified_delegations.iter().any(|link| { + link.importer_translation_json == expected.translation_json + && link.rust_symbol == function.rust_name + }) + }) + { + return Err( + "suite adapter contains an Auths import without an exact qualified owner" + .to_owned(), + ); + } + if report.crate_name == "auths_profile_construction" + && report + .functions + .iter() + .any(|function| function.rust_name.starts_with("auths_") && function.is_opaque) + { + return Err("profile construction selection must translate the actual Auths constructor and every helper body".to_owned()); + } let local = report .functions .iter() @@ -1351,6 +2632,7 @@ fn validate_translation_reports(root: &Path, qualification: &Qualification) -> R )); } } + validate_qualified_delegations(root, qualification)?; Ok(()) } @@ -1677,6 +2959,16 @@ fn build_qualification_cases(root: &Path, qualification: &Qualification) -> Resu } fn run_rust_qualification_cases(root: &Path) -> Result<(), String> { + run_checked( + "python3", + &[ + "core/fixtures/crypto/import_p256_wycheproof.py".to_owned(), + "core/fixtures/crypto/upstream/ecdsa_secp256r1_sha256_p1363_test.json".to_owned(), + "core/fixtures/crypto/p256-sha256-v1.tsv".to_owned(), + ], + root, + &[], + )?; run_checked( "cargo", &[ @@ -1684,12 +2976,45 @@ fn run_rust_qualification_cases(root: &Path) -> Result<(), String> { "-p".to_owned(), "auths-model".to_owned(), "-p".to_owned(), + "auths-codec".to_owned(), + "-p".to_owned(), + "auths-composition".to_owned(), + "-p".to_owned(), + "auths-signature-core".to_owned(), + "-p".to_owned(), + "auths-signature".to_owned(), + "-p".to_owned(), "auths-authority".to_owned(), "-p".to_owned(), "auths-author".to_owned(), ], root, &[], + )?; + run_checked( + "cargo", + &[ + "test".to_owned(), + "--locked".to_owned(), + "-p".to_owned(), + "auths-verifier".to_owned(), + "--lib".to_owned(), + "temporal_tests".to_owned(), + ], + root, + &[], + )?; + run_checked( + "cargo", + &[ + "test".to_owned(), + "--locked".to_owned(), + "-p".to_owned(), + "auths-registries".to_owned(), + "--lib".to_owned(), + ], + root, + &[], ) } @@ -1871,7 +3196,68 @@ fn reproduce( fs::create_dir_all(&llbc) .map_err(|error| format!("could not create {}: {error}", llbc.display()))?; + run_checked( + charon, + &charon_arguments( + "auths_signature_core::verify_ed25519,auths_signature_core::validate_ed25519_key,auths_signature_core::verify_p256_sha256_with", + &stable_llbc.join("auths_signature_core.llbc"), + "core/crates/auths-signature-core/Cargo.toml", + &[], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "auths_composition::evaluate,auths_composition::_::outcome", + &stable_llbc.join("auths_composition.llbc"), + "core/crates/auths-composition/Cargo.toml", + &[ + "--include", + "auths_model", + "--include", + "auths_algebra_kernel", + ], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "auths_codec::cbor::read_head,auths_codec::cbor::encode_head,auths_codec::decode::decode_canonical_action,auths_codec::hash::signing_preimage,auths_codec::hash::commitment_preimage,auths_codec::hash::identifier_preimage", + &stable_llbc.join("auths_codec.llbc"), + "core/crates/auths-codec/Cargo.toml", + &["--include", "auths_model"], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "auths_stores::gateway_fence::gateway_window_open,auths_stores::gateway_fence::advance_gateway_collection", + &stable_llbc.join("auths_stores.llbc"), + "product/stores/auths-stores/Cargo.toml", + &[], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "auths_codec::decode::status_trust", + &stable_llbc.join("auths_scope_codec.llbc"), + "core/crates/auths-codec/Cargo.toml", + &["--include", "auths_model"], + ), + root, + &[], + )?; let model_starts = [ + "auths_model::identifier::bounded_identifier_valid", "auths_model::inclusive_window_contains", "auths_model::validity_window_contains", "auths_model::permission_set_contains", @@ -1962,7 +3348,7 @@ fn reproduce( run_checked( charon, &charon_arguments( - "auths_bounded_policy::kernel::configuration_match_code,auths_bounded_policy::kernel::checked_add_u64,auths_bounded_policy::kernel::checked_sub_u64,auths_bounded_policy::kernel::checked_mul_u64,auths_bounded_policy::kernel::checked_div_u64,auths_bounded_policy::kernel::ceiling_count_code,auths_bounded_policy::kernel::ceiling_count_tightens,auths_bounded_policy::kernel::window_index,auths_bounded_policy::kernel::chain_counts_admit,auths_bounded_policy::kernel::chain_sums_admit,auths_bounded_policy::kernel::argument_policy_tightens", + "auths_bounded_policy::kernel::reservation_admission,auths_bounded_policy::kernel::configuration_match_code,auths_bounded_policy::kernel::checked_add_u64,auths_bounded_policy::kernel::checked_sub_u64,auths_bounded_policy::kernel::checked_mul_u64,auths_bounded_policy::kernel::checked_div_u64,auths_bounded_policy::kernel::ceiling_count_code,auths_bounded_policy::kernel::ceiling_count_tightens,auths_bounded_policy::kernel::window_index,auths_bounded_policy::kernel::chain_counts_admit,auths_bounded_policy::kernel::chain_sums_admit,auths_bounded_policy::kernel::argument_policy_tightens", &stable_llbc.join("auths_bounded_policy.llbc"), "product/policy/auths-bounded-policy/Cargo.toml", &[], @@ -1984,7 +3370,7 @@ fn reproduce( run_checked( charon, &charon_arguments( - "auths_gateway_kernel::recovery::recovery_capability,auths_gateway_kernel::construct::construct_write,auths_gateway_kernel::construct::construct_action_read,auths_gateway_kernel::construct::construct_credential_read,auths_gateway_kernel::order::start,auths_gateway_kernel::order::next_step,auths_gateway_kernel::transition::valid_transition,auths_gateway_kernel::ratio::relative_basis,auths_gateway_kernel::ratio::relative_ceiling_admits", + "auths_gateway_kernel::identity::connection_record_preimage,auths_gateway_kernel::entry_authorization::entry_allows,auths_gateway_kernel::counter_aggregation::linked_sum_contribution,auths_gateway_kernel::slot_record::validate_cumulative,auths_gateway_kernel::reservation_batch::build_batch,auths_gateway_kernel::reservation_retry::retry_target,auths_gateway_kernel::counter_aggregation::aggregate_sum,auths_gateway_kernel::counter_aggregation::aggregate,auths_gateway_kernel::counter_preimages::count_counter_preimage,auths_gateway_kernel::counter_preimages::sum_counter_preimage,auths_gateway_kernel::counter_preimages::count_slot_preimage,auths_gateway_kernel::counter_preimages::sum_slot_preimage,auths_gateway_kernel::frontier::_::new,auths_gateway_kernel::frontier::_::probe,auths_gateway_kernel::frontier::_::observe,auths_gateway_kernel::frontier::_::candidate,auths_gateway_kernel::deadline::entry_time_allows,auths_gateway_kernel::deadline::intersect_entry_bounds,auths_gateway_kernel::recovery::recovery_capability,auths_gateway_kernel::identity::valid_token,auths_gateway_kernel::identity::logical_operation_preimage,auths_gateway_kernel::construct::field_index,auths_gateway_kernel::construct::construct_write,auths_gateway_kernel::construct::construct_action_read,auths_gateway_kernel::construct::construct_credential_read,auths_gateway_kernel::order::start,auths_gateway_kernel::order::next_step,auths_gateway_kernel::transition::valid_transition,auths_gateway_kernel::ratio::relative_basis,auths_gateway_kernel::ratio::relative_ceiling_admits", &stable_llbc.join("auths_gateway_kernel.llbc"), "product/runtime/auths-gateway-kernel/Cargo.toml", &[], @@ -1995,7 +3381,7 @@ fn reproduce( run_checked( charon, &charon_arguments( - "auths_connections::kernel::next_generation,auths_connections::kernel::state_change,auths_connections::kernel::rotation,auths_connections::kernel::retained_generation,auths_connections::kernel::lease_generation", + "auths_connections::kernel::strictly_sorted_unique,auths_connections::kernel::record_times_valid,auths_connections::kernel::record_change_allows,auths_connections::kernel::recovery_lease,auths_connections::kernel::recovery_binding_requirement,auths_connections::kernel::state_transition_allows,auths_connections::kernel::semantic_id_valid,auths_connections::kernel::lower_token_valid,auths_connections::kernel::ascii_graphic_valid,auths_connections::kernel::next_generation,auths_connections::kernel::state_change,auths_connections::kernel::rotation,auths_connections::kernel::retained_generation,auths_connections::kernel::lease_generation,auths_connections::kernel::workloads_valid,auths_connections::kernel::profiles_valid,auths_connections::kernel::validate_record_shape", &stable_llbc.join("auths_connections.llbc"), "product/runtime/auths-connections/Cargo.toml", &[], @@ -2004,40 +3390,171 @@ fn reproduce( &[], )?; - for crate_name in [ - "auths_model", - "auths_algebra_kernel", - "auths_authority", - "auths_bounded_policy", - "auths_lifecycle", - "auths_gateway_kernel", - "auths_connections", - ] { - let snapshot = llbc.join(format!("{crate_name}.llbc")); - fs::copy(stable_llbc.join(format!("{crate_name}.llbc")), &snapshot).map_err(|error| { - format!("could not snapshot deterministic {crate_name} LLBC: {error}") - })?; - let arguments = ["pretty-print".to_owned(), snapshot.display().to_string()]; - let pretty = command_output(charon, &arguments, root, &[])?; - if !pretty.status.success() { - return Err(format_command_failure(&arguments, root, &pretty)); - } - fs::write( - llbc.join(format!("{crate_name}.llbc.pretty")), - pretty.stdout, - ) - .map_err(|error| format!("could not write canonical {crate_name} LLBC: {error}"))?; - } - - for (crate_name, subdir) in [ - ("auths_model", "model"), - ("auths_algebra_kernel", "algebra"), - ("auths_authority", "authority"), - ("auths_bounded_policy", "bounded_policy"), - ("auths_lifecycle", "lifecycle"), - ("auths_gateway_kernel", "gateway"), - ("auths_connections", "connections"), - ] { + run_checked( + charon, + &charon_arguments( + "auths_codec::hash::raw_sha256", + &stable_llbc.join("auths_codec_sha256.llbc"), + "core/crates/auths-codec/Cargo.toml", + &[ + "--monomorphize", + "--include", + "auths_model", + "--opaque", + "sha2", + "--opaque", + "digest", + "--opaque", + "crypto_common", + "--opaque", + "typenum", + ], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "auths_signature_core::verify_p256_sha256,auths_signature_core::validate_p256_key", + &stable_llbc.join("auths_signature_core_p256.llbc"), + "core/crates/auths-signature-core/Cargo.toml", + &[ + "--monomorphize", + "--opaque", + "p256", + "--opaque", + "ecdsa", + "--opaque", + "elliptic_curve", + "--opaque", + "primeorder", + "--opaque", + "crypto_bigint", + "--opaque", + "signature", + ], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "{impl auths_ports::SignatureSuite for auths_signature::Ed25519Suite}::verify,{impl auths_ports::SignatureSuite for auths_signature::P256Sha256Suite}::verify", + &stable_llbc.join("auths_signature.llbc"), + "core/crates/auths-signature/Cargo.toml", + &["--include", "auths_ports"], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "auths_verifier::assurance_horizon,auths_verifier::status_horizon,auths_verifier::status_decision", + &stable_llbc.join("auths_verifier.llbc"), + "core/crates/auths-verifier/Cargo.toml", + &["--include", "auths_model", "--include", "auths_ports"], + ), + root, + &[], + )?; + run_checked( + charon, + &charon_arguments( + "{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::principal,{impl auths_ports::StatusMethod for auths_registries::ExactStatusMethod}::grant", + &stable_llbc.join("auths_registries.llbc"), + "core/crates/auths-registries/Cargo.toml", + &["--include", "auths_model", "--include", "auths_ports"], + ), + root, + &[], + )?; + let profile_manifest = profile_selection_manifest(root, stable_llbc)?; + let mut profile_arguments = charon_arguments( + "auths_profile_construction::construct,auths_profile_construction::parse_provider,auths_profile_construction::parse_alias,auths_profile_construction::parse_semantic", + &stable_llbc.join("auths_profile_construction.llbc"), + &profile_manifest.display().to_string(), + &["--include", "auths_connections"], + ); + profile_arguments.push("--locked".to_owned()); + run_checked(charon, &profile_arguments, root, &[])?; + let profile_llbc = stable_llbc.join("auths_profile_construction.llbc"); + let mut profile_document: Value = + serde_json::from_slice(&fs::read(&profile_llbc).map_err(|error| error.to_string())?) + .map_err(|error| error.to_string())?; + normalize_profile_source_paths(&mut profile_document, root)?; + write_pretty_json(&profile_llbc, &profile_document)?; + normalize_p256_llbc_names( + &stable_llbc.join("auths_signature_core_p256.llbc"), + output, + charon, + root, + )?; + normalize_sha256_llbc_names( + &stable_llbc.join("auths_codec_sha256.llbc"), + output, + charon, + root, + )?; + + for crate_name in [ + "auths_scope_codec", + "auths_registries", + "auths_verifier", + "auths_signature", + "auths_signature_core_p256", + "auths_codec_sha256", + "auths_signature_core", + "auths_composition", + "auths_stores", + "auths_codec", + "auths_model", + "auths_algebra_kernel", + "auths_authority", + "auths_bounded_policy", + "auths_lifecycle", + "auths_gateway_kernel", + "auths_connections", + "auths_profile_construction", + ] { + let snapshot = llbc.join(format!("{crate_name}.llbc")); + fs::copy(stable_llbc.join(format!("{crate_name}.llbc")), &snapshot).map_err(|error| { + format!("could not snapshot deterministic {crate_name} LLBC: {error}") + })?; + let arguments = ["pretty-print".to_owned(), snapshot.display().to_string()]; + let pretty = command_output(charon, &arguments, root, &[])?; + if !pretty.status.success() { + return Err(format_command_failure(&arguments, root, &pretty)); + } + fs::write( + llbc.join(format!("{crate_name}.llbc.pretty")), + pretty.stdout, + ) + .map_err(|error| format!("could not write canonical {crate_name} LLBC: {error}"))?; + } + + for (crate_name, subdir) in [ + ("auths_scope_codec", "scope_codec"), + ("auths_registries", "status_selection"), + ("auths_verifier", "temporal_witness"), + ("auths_signature", "suite_adapter"), + ("auths_signature_core_p256", "p256"), + ("auths_codec_sha256", "sha256"), + ("auths_signature_core", "signature"), + ("auths_composition", "composition"), + ("auths_stores", "stores"), + ("auths_codec", "codec"), + ("auths_model", "model"), + ("auths_algebra_kernel", "algebra"), + ("auths_authority", "authority"), + ("auths_bounded_policy", "bounded_policy"), + ("auths_lifecycle", "lifecycle"), + ("auths_gateway_kernel", "gateway"), + ("auths_connections", "connections"), + ("auths_profile_construction", "profile_construction"), + ] { let destination = output.join(format!("{subdir}-run")); fs::create_dir_all(&destination).map_err(|error| { format!( @@ -2045,27 +3562,80 @@ fn reproduce( destination.display() ) })?; - run_checked( - aeneas, - &[ - "-backend".to_owned(), - "lean".to_owned(), - "-split-files".to_owned(), - "-emit-json".to_owned(), - "-warnings-as-errors".to_owned(), - "-subdir".to_owned(), - format!("qualification/aeneas/generated/{subdir}"), - "-dest".to_owned(), - destination.display().to_string(), - llbc.join(format!("{crate_name}.llbc")) - .display() - .to_string(), - ], - root, - &[], - )?; + let mut aeneas_arguments = vec![ + "-backend".to_owned(), + "lean".to_owned(), + "-split-files".to_owned(), + "-emit-json".to_owned(), + "-warnings-as-errors".to_owned(), + "-subdir".to_owned(), + format!("qualification/aeneas/generated/{subdir}"), + "-dest".to_owned(), + destination.display().to_string(), + llbc.join(format!("{crate_name}.llbc")) + .display() + .to_string(), + ]; + if matches!( + crate_name, + "auths_scope_codec" + | "auths_composition" + | "auths_signature_core" + | "auths_signature_core_p256" + | "auths_verifier" + | "auths_registries" + ) { + aeneas_arguments.insert(0, "-loops-to-rec".to_owned()); + } + if subdir == "scope_codec" { + aeneas_arguments.splice( + 0..0, + ["-namespace".to_owned(), "AuthsScopeCodec".to_owned()], + ); + } + if subdir == "status_selection" { + aeneas_arguments.splice( + 0..0, + ["-namespace".to_owned(), "AuthsStatusSelection".to_owned()], + ); + } + if subdir == "temporal_witness" { + aeneas_arguments.splice( + 0..0, + ["-namespace".to_owned(), "AuthsTemporalWitness".to_owned()], + ); + } + if subdir == "suite_adapter" { + aeneas_arguments.splice( + 0..0, + ["-namespace".to_owned(), "AuthsSuiteAdapters".to_owned()], + ); + } + if subdir == "p256" { + aeneas_arguments.splice( + 0..0, + ["-namespace".to_owned(), "AuthsNativeP256".to_owned()], + ); + } + if subdir == "sha256" { + aeneas_arguments.splice( + 0..0, + ["-namespace".to_owned(), "AuthsNativeSha256".to_owned()], + ); + } + run_checked(aeneas, &aeneas_arguments, root, &[])?; } for crate_name in [ + "auths_scope_codec", + "auths_registries", + "auths_verifier", + "auths_signature", + "auths_signature_core_p256", + "auths_codec_sha256", + "auths_signature_core", + "auths_composition", + "auths_stores", + "auths_codec", "auths_model", "auths_algebra_kernel", "auths_authority", @@ -2073,10 +3643,823 @@ fn reproduce( "auths_lifecycle", "auths_gateway_kernel", "auths_connections", + "auths_profile_construction", ] { fs::remove_file(llbc.join(format!("{crate_name}.llbc"))) .map_err(|error| format!("could not remove raw nondeterministic LLBC: {error}"))?; } + normalize_composition_discriminants(output)?; + normalize_signature_discriminants(output)?; + normalize_signature_primitive_context(output)?; + normalize_sha256_primitive_context(output)?; + normalize_p256_context(output)?; + normalize_suite_adapter_context(output)?; + normalize_temporal_context(output)?; + normalize_scope_codec_context(output)?; + normalize_status_selection_context(output)?; + normalize_connections_context(output)?; + Ok(()) +} + +// Preserve every translated Rust function body and constructor. The support +// modules qualify instances and give an isomorphic bounded Vec. A single trait +// dictionary field restores its erased unit output with a proved Result +// isomorphism; the callback implementation itself is not rewritten. +fn normalize_composition_discriminants(output: &Path) -> Result<(), String> { + let path = output.join("composition-run/qualification/aeneas/generated/composition/Types.lean"); + let source = fs::read_to_string(&path) + .map_err(|error| format!("could not read composition types: {error}"))?; + if source.matches("discriminant isize").count() != 8 + || source.matches("import Aeneas\n").count() != 1 + || source.contains("qualified_discriminant") + { + return Err("composition discriminant normalization input drifted".to_owned()); + } + let normalized = source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\nimport Auths.Support.PositiveVec\n", + ) + .replace("discriminant isize", "qualified_discriminant isize"); + fs::write(path, normalized) + .map_err(|error| format!("could not write composition types: {error}"))?; + let functions = + output.join("composition-run/qualification/aeneas/generated/composition/Funs.lean"); + let source = fs::read_to_string(&functions) + .map_err(|error| format!("could not read composition functions: {error}"))?; + let normalized = normalize_unit_observer_dictionary(&source)?; + fs::write(functions, normalized) + .map_err(|error| format!("could not write composition dictionary bridge: {error}")) +} + +fn normalize_unit_observer_dictionary(source: &str) -> Result { + const ORIGINAL: &str = " call_mut :=\n evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut\n coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst\n}"; + const ADAPTED: &str = " call_mut := fun state event => Auths.Support.UnitCallback.restore (\n evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut\n coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst state event)\n}"; + if source.matches(ORIGINAL).count() != 1 || source.matches("import Aeneas\n").count() != 1 { + return Err("composition unit-observer dictionary input drifted".to_owned()); + } + Ok(source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.UnitCallback\n", + ) + .replace(ORIGINAL, ADAPTED)) +} + +// Two signature-error enums share discriminant values with other extracted +// modules. Qualify only the generated instance names; preserve all types and +// translated Rust function bodies. +fn normalize_signature_discriminants(output: &Path) -> Result<(), String> { + let path = output.join("signature-run/qualification/aeneas/generated/signature/Types.lean"); + let source = fs::read_to_string(&path) + .map_err(|error| format!("could not read signature types: {error}"))?; + if source.matches("discriminant isize").count() != 2 + || source.matches("import Aeneas\n").count() != 1 + || source.contains("qualified_discriminant") + { + return Err("signature discriminant normalization input drifted".to_owned()); + } + let normalized = source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize"); + fs::write(path, normalized).map_err(|error| format!("could not write signature types: {error}")) +} + +// Generalize only the explicit foreign implementation parameter. Lean threads +// this section variable through exactly the declarations using those foreign +// types/calls. No generated Rust function body is changed and no instance exists. +// The pinned OCaml name-pattern emitter cannot print `Instantiated` name +// elements. These are foreign declaration identities only: preserve every +// Auths name, body, signature, layout, source span and call/type ID. +fn p256_export_names(mut document: Value) -> Result<(Value, Value), String> { + let original = document.clone(); + let mut substitutions = BTreeMap::::new(); + let mut selected = Vec::new(); + let mut identities = BTreeSet::new(); + let mut ledger = Vec::new(); + for group in [ + "type_decls", + "fun_decls", + "global_decls", + "trait_decls", + "trait_impls", + ] { + let rows = document["translated"][group] + .as_array() + .ok_or_else(|| format!("P-256 LLBC omits {group}"))?; + for (index, row) in rows.iter().enumerate().filter(|(_, row)| !row.is_null()) { + let name = row["item_meta"]["name"] + .as_array() + .ok_or("P-256 declaration has no name")?; + if !name.iter().any(|part| part.get("Instantiated").is_some()) { + continue; + } + let id = row["def_id"] + .as_u64() + .ok_or("P-256 declaration has no id")?; + let root = name + .first() + .and_then(|part| part["Ident"][0].as_str()) + .ok_or("P-256 name has no crate root")?; + let expected_root = match (group, id) { + ("type_decls", 4 | 11) => "ecdsa", + ("type_decls", 0 | 3 | 6 | 7 | 9 | 12 | 13 | 14 | 16 | 17) => "core", + ("fun_decls", 2 | 4) => "auths_signature_core", + ("fun_decls", 14 | 18 | 23 | 26 | 29) => "ecdsa", + ("fun_decls", 5 | 6 | 7 | 13 | 15 | 17 | 20 | 22 | 24 | 27 | 30 | 31 | 32 | 33) => { + "core" + } + _ => "", + }; + if root != expected_root || !identities.insert((group, id)) { + return Err( + "P-256 export-name inventory contains an unreviewed identity".to_owned(), + ); + } + let renamed = if root == "auths_signature_core" { + let base = if id == 2 { + "verify_p256_sha256_with" + } else { + "decode_p256_key_with" + }; + if row["item_meta"]["is_local"] != true + || name.len() != 3 + || name[1] != json!({"Ident": [base, 0]}) + || name[2].get("Instantiated").is_none() + { + return Err( + "P-256 normalization would change an unreviewed Auths source name" + .to_owned(), + ); + } + Value::Array(name[..2].to_vec()) + } else { + if row["item_meta"]["is_local"] != false { + return Err("P-256 foreign alias names a local declaration".to_owned()); + } + json!([{"Ident": [root, 0]}, {"Ident": [format!("qualified_p256_{group}_{id}"), 0]}]) + }; + let key = serde_json::to_string(&row["item_meta"]["name"]) + .map_err(|error| error.to_string())?; + if substitutions.insert(key, renamed.clone()).is_some() { + return Err("P-256 foreign declaration names are not unique".to_owned()); + } + selected.push((group, index, renamed.clone())); + ledger.push(json!({ + "declaration_group": group, "declaration_id": id, + "original_name": row["item_meta"]["name"], + "normalized_name": renamed, "source_span": row["item_meta"]["span"], + })); + } + } + if selected.len() != 33 { + return Err("P-256 foreign monomorphized name inventory drifted".to_owned()); + } + fn rewrite(value: &mut Value, substitutions: &BTreeMap) -> Result<(), String> { + if value + .as_array() + .and_then(|array| array.first()) + .is_some_and(|first| first.get("Ident").is_some()) + { + let key = serde_json::to_string(value).map_err(|error| error.to_string())?; + if let Some(replacement) = substitutions.get(&key) { + value.clone_from(replacement); + return Ok(()); + } + } + match value { + Value::Array(values) => { + for value in values { + rewrite(value, substitutions)?; + } + } + Value::Object(values) => { + for value in values.values_mut() { + rewrite(value, substitutions)?; + } + } + _ => (), + } + Ok(()) + } + rewrite(&mut document, &substitutions)?; + let mut expected = original.clone(); + for (group, index, name) in selected { + expected["translated"][group][index]["item_meta"]["name"] = name; + } + // Charon stores copies of declaration names in three metadata caches. + for cache in ["item_names", "assoc_item_names", "short_names"] { + expected["translated"][cache] = document["translated"][cache].clone(); + } + if expected != document { + return Err("P-256 name normalization changed non-name declaration data".to_owned()); + } + Ok(( + document, + json!({ + "schema": "auths-proof-foreign-name-normalization/v1", + "declarations": ledger, + "preserved": ["Auths base source names", "all function bodies", "signatures", "generics", "layouts", "source spans", "call and type IDs"], + }), + )) +} + +fn sha256_foreign_names(mut document: Value) -> Result<(Value, Value), String> { + let original = document.clone(); + let mut substitutions = BTreeMap::::new(); + let mut selected = Vec::new(); + let mut identities = BTreeSet::new(); + let mut ledger = Vec::new(); + for group in [ + "type_decls", + "fun_decls", + "global_decls", + "trait_decls", + "trait_impls", + ] { + let rows = document["translated"][group] + .as_array() + .ok_or_else(|| format!("SHA-256 LLBC omits {group}"))?; + for (index, row) in rows.iter().enumerate().filter(|(_, row)| !row.is_null()) { + let name = row["item_meta"]["name"] + .as_array() + .ok_or("SHA-256 declaration has no name")?; + if !name.iter().any(|part| part.get("Instantiated").is_some()) { + continue; + } + let id = row["def_id"] + .as_u64() + .ok_or("SHA-256 declaration has no id")?; + let allowed = match group { + "type_decls" => [1, 2, 3, 4, 5, 6, 7, 11, 12].contains(&id), + "fun_decls" => [1, 2].contains(&id), + _ => false, + }; + let root = name + .first() + .and_then(|part| part["Ident"][0].as_str()) + .ok_or("SHA-256 name has no crate root")?; + let expected_root = match (group, id) { + ("type_decls", 1) => "generic_array", + ("type_decls", 2..=7) => "typenum", + ("type_decls", 11 | 12) | ("fun_decls", 1) => "digest", + ("fun_decls", 2) => "core", + _ => "", + }; + if !allowed + || root != expected_root + || row["item_meta"]["is_local"] != false + || root.starts_with("auths_") + || !identities.insert((group, id)) + { + return Err( + "SHA-256 name normalization would touch an unreviewed or Auths declaration" + .to_owned(), + ); + } + let renamed = json!([ + {"Ident": [root, 0]}, + {"Ident": [format!("qualified_sha256_{group}_{id}"), 0]}, + ]); + let key = serde_json::to_string(&row["item_meta"]["name"]) + .map_err(|error| error.to_string())?; + if substitutions.insert(key, renamed.clone()).is_some() { + return Err("SHA-256 foreign declaration names are not unique".to_owned()); + } + selected.push((group, index, renamed.clone())); + ledger.push(json!({ + "declaration_group": group, "declaration_id": id, + "original_name": row["item_meta"]["name"], + "normalized_name": renamed, "source_span": row["item_meta"]["span"], + })); + } + } + if selected.len() != 11 { + return Err("SHA-256 foreign monomorphized name inventory drifted".to_owned()); + } + fn rewrite(value: &mut Value, substitutions: &BTreeMap) -> Result<(), String> { + if value + .as_array() + .and_then(|array| array.first()) + .is_some_and(|first| first.get("Ident").is_some()) + { + let key = serde_json::to_string(value).map_err(|error| error.to_string())?; + if let Some(replacement) = substitutions.get(&key) { + value.clone_from(replacement); + return Ok(()); + } + } + match value { + Value::Array(values) => { + for value in values { + rewrite(value, substitutions)?; + } + } + Value::Object(values) => { + for value in values.values_mut() { + rewrite(value, substitutions)?; + } + } + _ => (), + } + Ok(()) + } + rewrite(&mut document, &substitutions)?; + let mut expected = original.clone(); + for (group, index, name) in selected { + expected["translated"][group][index]["item_meta"]["name"] = name; + } + // Charon stores copies of declaration names in three metadata caches. + for cache in ["item_names", "assoc_item_names", "short_names"] { + expected["translated"][cache] = document["translated"][cache].clone(); + } + if expected != document { + return Err("SHA-256 name normalization changed non-name declaration data".to_owned()); + } + Ok(( + document, + json!({ + "schema": "auths-proof-foreign-name-normalization/v1", + "declarations": ledger, + "preserved": ["Auths names", "all function bodies", "signatures", "generics", "layouts", "source spans", "call and type IDs"], + }), + )) +} + +fn normalize_p256_llbc_names( + path: &Path, + output: &Path, + charon: &Path, + root: &Path, +) -> Result<(), String> { + let source = fs::read(path).map_err(|error| format!("could not read P-256 LLBC: {error}"))?; + let document = + serde_json::from_slice(&source).map_err(|error| format!("invalid P-256 LLBC: {error}"))?; + let path_text = path.display().to_string(); + let arguments = ["pretty-print", path_text.as_str()]; + let original = run_output(charon, &arguments, root, &[])?; + let (document, mut ledger) = p256_export_names(document)?; + write_pretty_json(path, &document)?; + let normalized = run_output(charon, &arguments, root, &[])?; + // Charon's short-name cache has nondeterministic map iteration order and + // hash-cons references. Use its pinned canonical printer, as the existing + // two-run LLBC gate does. The full JSON preservation check above still + // compares every body/type field and permits only reviewed name changes. + ledger["canonicalization"] = json!("pinned-charon-pretty-print-v1"); + ledger["original_canonical_llbc_sha256"] = + json!(hex::encode(Sha256::digest(original.as_bytes()))); + ledger["normalized_canonical_llbc_sha256"] = + json!(hex::encode(Sha256::digest(normalized.as_bytes()))); + fs::create_dir_all(output.join("p256-run")) + .map_err(|error| format!("could not create P-256 output directory: {error}"))?; + write_pretty_json(&output.join("p256-run/name-normalization.json"), &ledger) +} + +fn normalize_sha256_llbc_names( + path: &Path, + output: &Path, + charon: &Path, + root: &Path, +) -> Result<(), String> { + let source = fs::read(path).map_err(|error| format!("could not read SHA-256 LLBC: {error}"))?; + let document = serde_json::from_slice(&source) + .map_err(|error| format!("invalid SHA-256 LLBC: {error}"))?; + let path_text = path.display().to_string(); + let arguments = ["pretty-print", path_text.as_str()]; + let original = run_output(charon, &arguments, root, &[])?; + let (document, mut ledger) = sha256_foreign_names(document)?; + write_pretty_json(path, &document)?; + let normalized = run_output(charon, &arguments, root, &[])?; + // Charon's short-name cache has nondeterministic map iteration order and + // hash-cons references. Use its pinned canonical printer, as the existing + // two-run LLBC gate does. The full JSON preservation check above still + // compares every body/type field and permits only reviewed name changes. + ledger["canonicalization"] = json!("pinned-charon-pretty-print-v1"); + ledger["original_canonical_llbc_sha256"] = + json!(hex::encode(Sha256::digest(original.as_bytes()))); + ledger["normalized_canonical_llbc_sha256"] = + json!(hex::encode(Sha256::digest(normalized.as_bytes()))); + fs::create_dir_all(output.join("sha256-run")) + .map_err(|error| format!("could not create SHA-256 output directory: {error}"))?; + write_pretty_json( + &output.join("sha256-run/foreign-name-normalization.json"), + &ledger, + ) +} + +fn normalize_scope_codec_context(output: &Path) -> Result<(), String> { + let path = output.join("scope_codec-run/qualification/aeneas/generated/scope_codec/Types.lean"); + let source = fs::read_to_string(&path).map_err(|error| error.to_string())?; + fs::write(path, scope_codec_type_context(&source)?).map_err(|error| error.to_string()) +} +fn scope_codec_type_context(source: &str) -> Result { + if source.matches("namespace AuthsScopeCodec\n").count() != 1 + || source.matches("import Aeneas\n").count() != 1 + || source.contains("qualified_discriminant") + || source.matches("@[discriminant isize").count() != 4 + { + return Err("scope-codec type context input drifted".to_owned()); + } + Ok(source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize")) +} +#[cfg(test)] +mod scope_codec_context_tests { + use super::scope_codec_type_context; + #[test] + fn context_preserves_bodies_and_rejects_missing_repeated_or_changed_input() { + let reviewed = + include_str!("../../formal/qualification/aeneas/generated/scope_codec/Types.lean"); + let raw = reviewed + .replace("import Auths.Support.Discriminant\n", "") + .replace("qualified_discriminant isize", "discriminant isize"); + assert_eq!( + scope_codec_type_context(&raw).expect("reviewed context"), + reviewed + ); + assert!(scope_codec_type_context(reviewed).is_err()); + assert!(scope_codec_type_context(&raw.replace("namespace AuthsScopeCodec\n", "")).is_err()); + assert!( + scope_codec_type_context(&raw.replacen( + "@[discriminant isize", + "@[rust_discriminant isize", + 1 + )) + .is_err() + ); + } +} + +fn normalize_connections_context(output: &Path) -> Result<(), String> { + let path = output.join("connections-run/qualification/aeneas/generated/connections/Types.lean"); + let source = fs::read_to_string(&path).map_err(|error| error.to_string())?; + fs::write(path, connections_type_context(&source)?).map_err(|error| error.to_string()) +} +fn connections_type_context(source: &str) -> Result { + if source.matches("namespace auths_connections\n").count() != 1 + || source.matches("import Aeneas\n").count() != 1 + || source.contains("qualified_discriminant") + || source.matches("@[discriminant isize").count() != 3 + { + return Err("connections type context input drifted".to_owned()); + } + Ok(source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize")) +} +#[cfg(test)] +mod connections_context_tests { + use super::connections_type_context; + #[test] + fn context_preserves_enum_bodies_and_rejects_inventory_drift() { + let reviewed = + include_str!("../../formal/qualification/aeneas/generated/connections/Types.lean"); + let raw = reviewed + .replace("import Auths.Support.Discriminant\n", "") + .replace("qualified_discriminant isize", "discriminant isize"); + assert_eq!(connections_type_context(&raw).unwrap(), reviewed); + assert!(connections_type_context(reviewed).is_err()); + assert!( + connections_type_context(&raw.replace("namespace auths_connections\n", "")).is_err() + ); + assert!( + connections_type_context(&raw.replacen("@[discriminant isize", "@[other isize", 1)) + .is_err() + ); + } +} + +fn normalize_status_selection_context(output: &Path) -> Result<(), String> { + let path = output + .join("status_selection-run/qualification/aeneas/generated/status_selection/Types.lean"); + let source = fs::read_to_string(&path).map_err(|error| error.to_string())?; + fs::write(path, status_selection_type_context(&source)?).map_err(|error| error.to_string()) +} +fn status_selection_type_context(source: &str) -> Result { + if source.matches("namespace AuthsStatusSelection\n").count() != 1 + || source.matches("import Aeneas\n").count() != 1 + || source.contains("qualified_discriminant") + || source.matches("@[discriminant isize").count() != 7 + { + return Err("status-selection type context input drifted".to_owned()); + } + Ok(source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize")) +} +#[cfg(test)] +mod status_selection_context_tests { + use super::status_selection_type_context; + #[test] + fn context_preserves_bodies_and_rejects_missing_repeated_or_changed_input() { + let reviewed = + include_str!("../../formal/qualification/aeneas/generated/status_selection/Types.lean"); + let raw = reviewed + .replace("import Auths.Support.Discriminant\n", "") + .replace("qualified_discriminant isize", "discriminant isize"); + assert_eq!( + status_selection_type_context(&raw).expect("reviewed context"), + reviewed + ); + assert!(status_selection_type_context(reviewed).is_err()); + assert!( + status_selection_type_context(&raw.replace("namespace AuthsStatusSelection\n", "")) + .is_err() + ); + assert!( + status_selection_type_context(&raw.replacen( + "@[discriminant isize", + "@[rust_discriminant isize", + 1 + )) + .is_err() + ); + } +} + +fn normalize_temporal_context(output: &Path) -> Result<(), String> { + let path = output + .join("temporal_witness-run/qualification/aeneas/generated/temporal_witness/Types.lean"); + let source = fs::read_to_string(&path).map_err(|error| error.to_string())?; + fs::write(path, temporal_type_context(&source)?).map_err(|error| error.to_string()) +} +fn temporal_type_context(source: &str) -> Result { + if source.matches("namespace AuthsTemporalWitness\n").count() != 1 + || source.matches("import Aeneas\n").count() != 1 + || source.contains("qualified_discriminant") + || source.matches("@[discriminant isize").count() != 10 + { + return Err("temporal type context input drifted".to_owned()); + } + Ok(source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize")) +} + +#[cfg(test)] +mod temporal_context_tests { + use super::temporal_type_context; + + #[test] + fn context_preserves_the_exact_type_bodies_and_rejects_drift() { + let reviewed = + include_str!("../../formal/qualification/aeneas/generated/temporal_witness/Types.lean"); + let raw = reviewed + .replace("import Auths.Support.Discriminant\n", "") + .replace("qualified_discriminant isize", "discriminant isize"); + assert_eq!(temporal_type_context(&raw).unwrap(), reviewed); + assert!(temporal_type_context(reviewed).is_err()); + assert!(temporal_type_context(&format!("{raw}{raw}")).is_err()); + assert!( + temporal_type_context(&raw.replacen("@[discriminant isize", "@[other isize", 1)) + .is_err() + ); + assert!( + temporal_type_context(&raw.replace("namespace AuthsTemporalWitness\n", "")).is_err() + ); + } +} + +fn normalize_suite_adapter_context(output: &Path) -> Result<(), String> { + let directory = output.join("suite_adapter-run/qualification/aeneas/generated/suite_adapter"); + for file in ["Types.lean", "Funs.lean"] { + let path = directory.join(file); + let source = fs::read_to_string(&path).map_err(|error| error.to_string())?; + fs::write(path, suite_adapter_context(&source, file == "Types.lean")?) + .map_err(|error| error.to_string())?; + } + Ok(()) +} +fn suite_adapter_context(source: &str, types: bool) -> Result { + if source.matches("namespace AuthsSuiteAdapters\n").count() != 1 + || source.contains("variable [edPrimitive") + || source.contains("variable [p256Primitive") + || source.contains("qualified_discriminant") + { + return Err("suite adapter context input drifted".to_owned()); + } + if types { + if source.matches("import Aeneas\n").count() != 1 { + return Err("suite adapter type import drifted".to_owned()); + } + Ok(source + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize")) + } else { + if source.matches("noncomputable section\n").count() != 1 { + return Err("suite adapter section drifted".to_owned()); + } + Ok(source.replace("noncomputable section\n", "noncomputable section\n\nvariable [edPrimitive : Auths.Crypto.Ed25519Primitives]\nvariable [p256Primitive : Auths.Crypto.P256Primitives]\n")) + } +} + +fn normalize_p256_context(output: &Path) -> Result<(), String> { + let directory = output.join("p256-run/qualification/aeneas/generated/p256"); + for file in ["Types.lean", "Funs.lean"] { + let path = directory.join(file); + let source = fs::read_to_string(&path).map_err(|error| error.to_string())?; + fs::write(path, p256_context(&source, file == "Types.lean")?) + .map_err(|error| error.to_string())?; + } + Ok(()) +} + +fn p256_context(source: &str, types: bool) -> Result { + let marker = if types { + "namespace AuthsNativeP256\n" + } else { + "noncomputable section\n" + }; + if source.matches(marker).count() != 1 + || source.contains("variable [primitive") + || !source.contains("namespace AuthsNativeP256\n") + || source.contains("qualified_discriminant") + { + return Err("P-256 explicit primitive context input drifted".to_owned()); + } + let generalized = source.replace( + marker, + &format!("{marker}\nvariable [primitive : Auths.Crypto.P256Primitives]\n"), + ); + if !types { + return Ok(generalized); + } + if generalized.matches("import Aeneas\n").count() != 1 { + return Err("P-256 type import input drifted".to_owned()); + } + Ok(generalized + .replace( + "import Aeneas\n", + "import Aeneas\nimport Auths.Support.Discriminant\n", + ) + .replace("discriminant isize", "qualified_discriminant isize")) +} + +fn normalize_sha256_primitive_context(output: &Path) -> Result<(), String> { + let path = output.join("sha256-run/qualification/aeneas/generated/sha256/Funs.lean"); + let source = fs::read_to_string(&path) + .map_err(|error| format!("could not read SHA-256 functions: {error}"))?; + fs::write(path, sha256_primitive_context(&source)?) + .map_err(|error| format!("could not write SHA-256 functions: {error}")) +} + +fn sha256_primitive_context(source: &str) -> Result { + let marker = "noncomputable section\n"; + if source.matches(marker).count() != 1 + || source.matches("namespace AuthsNativeSha256\n").count() != 1 + || source.contains("Auths.Crypto.Sha256Primitives") + { + return Err("SHA-256 explicit primitive context input drifted".to_owned()); + } + Ok(source.replace( + marker, + "noncomputable section\n\nvariable [primitive : Auths.Crypto.Sha256Primitives]\n", + )) +} + +fn normalize_signature_primitive_context(output: &Path) -> Result<(), String> { + let path = output.join("signature-run/qualification/aeneas/generated/signature/Funs.lean"); + let source = fs::read_to_string(&path) + .map_err(|error| format!("could not read signature functions: {error}"))?; + fs::write(path, signature_primitive_context(&source)?) + .map_err(|error| format!("could not write signature functions: {error}")) +} + +fn signature_primitive_context(source: &str) -> Result { + let marker = "noncomputable section\n"; + if source.matches(marker).count() != 1 + || source.matches("namespace auths_signature_core\n").count() != 1 + || source.contains("Auths.Crypto.Ed25519Primitives") + { + return Err("signature explicit primitive context input drifted".to_owned()); + } + Ok(source.replace( + marker, + "noncomputable section\n\nvariable [primitives : Auths.Crypto.Ed25519Primitives]\n", + )) +} + +/// A selector crate keeps method extraction outside production APIs. Its +/// dependencies must remain a checksum-identical subset of the shipping lock. +fn profile_selection_manifest(root: &Path, stable_llbc: &Path) -> Result { + let directory = stable_llbc.join("profile-selection"); + fs::create_dir_all(&directory) + .map_err(|e| format!("could not create profile selector: {e}"))?; + let source = root.join("formal/qualification/aeneas/entrypoints/profile_construction.rs"); + let dependency = root.join("product/runtime/auths-connections"); + let manifest = directory.join("Cargo.toml"); + let contents = format!( + "[package]\nname = \"auths-profile-construction\"\nversion = \"0.0.0\"\nedition = \"2024\"\npublish = false\n[lib]\npath = {}\n[dependencies]\nauths-connections = {{ path = {} }}\n[workspace]\nresolver = \"3\"\n", + toml::Value::String(source.display().to_string()), + toml::Value::String(dependency.display().to_string()), + ); + fs::write(&manifest, contents).map_err(|e| format!("could not write profile selector: {e}"))?; + fs::copy(root.join("Cargo.lock"), directory.join("Cargo.lock")) + .map_err(|e| format!("could not pin profile selector dependencies: {e}"))?; + run_checked( + "cargo", + &[ + "metadata".to_owned(), + "--offline".to_owned(), + "--format-version".to_owned(), + "1".to_owned(), + "--manifest-path".to_owned(), + manifest.display().to_string(), + ], + root, + &[], + )?; + let original = fs::read_to_string(root.join("Cargo.lock")).map_err(|e| e.to_string())?; + let selected = fs::read_to_string(directory.join("Cargo.lock")).map_err(|e| e.to_string())?; + validate_profile_selection_lock(&original, &selected)?; + Ok(manifest) +} + +/// Charon resolves a temporary manifest's source and dependency paths to +/// absolute paths. Only its file-name metadata is made repository relative; +/// function bodies, spans, options and embedded source bytes stay untouched. +fn normalize_profile_source_paths(document: &mut Value, root: &Path) -> Result<(), String> { + let files = document["translated"]["files"] + .as_array_mut() + .ok_or("profile LLBC omits source file metadata")?; + let mut count = 0; + for file in files { + let Some(name) = file["name"]["Local"].as_str() else { + continue; + }; + if let Ok(relative) = Path::new(name).strip_prefix(root) { + let relative = relative.to_str().ok_or("non-UTF8 profile source path")?; + file["name"]["Local"] = json!(relative); + count += 1; + } + } + if count != 4 { + return Err(format!( + "profile selection source inventory drifted: {count} files" + )); + } + Ok(()) +} + +fn validate_profile_selection_lock(original: &str, selected: &str) -> Result<(), String> { + fn packages(source: &str) -> Result, String> { + let document: toml::Value = + toml::from_str(source).map_err(|e| format!("invalid selector lock: {e}"))?; + document + .get("package") + .and_then(toml::Value::as_array) + .cloned() + .ok_or_else(|| "selector lock has no package inventory".to_owned()) + } + fn identity(mut package: toml::Value) -> toml::Value { + if let Some(table) = package.as_table_mut() { + table.remove("dependencies"); + } + package + } + let pinned: Vec<_> = packages(original)?.into_iter().map(identity).collect(); + let mut selectors = 0; + for package in packages(selected)? { + if package.get("name").and_then(toml::Value::as_str) == Some("auths-profile-construction") { + if package.get("version").and_then(toml::Value::as_str) != Some("0.0.0") + || package.get("source").is_some() + || package.get("checksum").is_some() + || package.get("dependencies") + != Some(&toml::Value::Array(vec![toml::Value::String( + "auths-connections".to_owned(), + )])) + { + return Err("profile selector is not the reviewed local selection crate".to_owned()); + } + selectors += 1; + } else if !pinned.contains(&identity(package)) { + return Err( + "profile selector changed a shipping dependency identity or checksum".to_owned(), + ); + } + } + if selectors != 1 { + return Err("profile selection lock must contain exactly one selector".to_owned()); + } Ok(()) } @@ -2141,19 +4524,11 @@ fn synchronize_aeneas_output(root: &Path, reproduced: &Path, update: bool) -> Re } fn canonicalize_aeneas_versions(reproduced: &Path, expected_commit: &str) -> Result<(), String> { - let expected_short = expected_commit; - for component in [ - "model", - "algebra", - "authority", - "bounded_policy", - "lifecycle", - "gateway", - "connections", - ] { - let path = reproduced - .join(format!("{component}-run")) - .join("translation.json"); + for &(source, _) in AENEAS_OUTPUT_MAPPINGS + .iter() + .filter(|(source, _)| source.ends_with("translation.json")) + { + let path = reproduced.join(source); let mut report: Value = serde_json::from_slice( &fs::read(&path) .map_err(|error| format!("could not read {}: {error}", path.display()))?, @@ -2170,12 +4545,12 @@ fn canonicalize_aeneas_versions(reproduced: &Path, expected_commit: &str) -> Res path.display() ) })?; - if !aeneas_version_matches(actual, expected_short) { + if !aeneas_version_matches(actual, expected_commit) { return Err(format!( - "Aeneas translation identity drifted for {component}: expected {expected_short}, found {actual}" + "Aeneas translation identity drifted for {source}: expected {expected_commit}, found {actual}" )); } - report["aeneas_version"] = Value::String(expected_short.to_owned()); + report["aeneas_version"] = Value::String(expected_commit.to_owned()); write_pretty_json(&path, &report)?; } Ok(()) @@ -2409,6 +4784,184 @@ fn format_command_failure(arguments: &[String], directory: &Path, output: &Outpu ) } +fn render_codec_types_external() -> String { + r##"import Aeneas +open Aeneas Aeneas.Std +def core.str.error.Utf8Error : Type := Unit +"## + .to_owned() +} + +fn render_codec_functions_external() -> String { + r##"-- REVIEWED TRANSPARENT STANDARD-LIBRARY MODELS; NO AUTHS ALGORITHM IS OPAQUE. +import qualification.aeneas.generated.codec.Types +import qualification.aeneas.generated.standard.CheckedResult +import qualification.aeneas.generated.model.FunsExternal +open Aeneas Aeneas.Std Result +set_option linter.unusedVariables false + +-- UTF-8 error payload is unobserved; all failures map to Malformed. +def Auths.Codec.StdModel.bytes (bytes : Str) : ByteArray := + (bytes.val.map (fun byte => UInt8.ofNat byte.val)).toByteArray + +def Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from (value : Std.U64) := + core.num.tryFromUScalar .Usize value + +def U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from (value : Std.U64) := + core.num.tryFromUScalar .U8 value + +def U16.Insts.CoreConvertTryFromU64TryFromIntError.try_from (value : Std.U64) := + core.num.tryFromUScalar .U16 value + +def U16.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from (value : Std.Usize) := + core.num.tryFromUScalar .U16 value + +def core.option.Option.Some {T : Type} (value : T) : Result (Option T) := ok (some value) +def core.option.Option.as_ref {T : Type} (value : Option T) : Result (Option T) := ok value + +def core.option.Option.ok_or {T E : Type} (value : Option T) (error : E) : + Result (core.result.Result T E) := + ok (match value with | some x => .Ok x | none => .Err error) + +def core.option.Option.Insts.CoreCmpPartialEqOption.eq {T : Type} + (eqInst : core.cmp.PartialEq T T) (left right : Option T) : Result Bool := + match left, right with + | none, none => ok true + | some left, some right => eqInst.eq left right + | _, _ => ok false + +def core.result.Result.map {T E U F : Type} + (function : core.ops.function.FnOnce F T U) + (value : core.result.Result T E) (callback : F) : Result (core.result.Result U E) := do + match value with + | .Ok value => + let output ← function.call_once callback value + ok (.Ok output) + | .Err error => ok (.Err error) + +def core.result.Result.map_err {T E F O : Type} + (function : core.ops.function.FnOnce O E F) + (value : core.result.Result T E) (callback : O) : Result (core.result.Result T F) := do + match value with + | .Ok value => ok (.Ok value) + | .Err error => + let output ← function.call_once callback error + ok (.Err output) + +def core.str.converts.from_utf8 (bytes : Slice Std.U8) : + Result (core.result.Result Str core.str.error.Utf8Error) := + ok (if (Auths.Codec.StdModel.bytes bytes).IsValidUTF8 then .Ok bytes else .Err ()) + +def alloc.string.String.Insts.CoreOpsDerefDerefStr.deref (value : String) : Result Str := + if bounded : value.toByteArray.size ≤ U32.max then ok (toStr value bounded) else fail .panic + +def alloc.string.String.Insts.CoreConvertFromShared0Str.from (value : Str) : Result String := + match String.fromUTF8? (Auths.Codec.StdModel.bytes value) with + | some value => ok value + | none => fail .panic + +def alloc.vec.Vec.as_slice {T : Type} (A : Type) (value : alloc.vec.Vec T) : Result (Slice T) := + ok (alloc.vec.Vec.deref value) + +def alloc.vec.Vec.is_empty {T : Type} (A : Type) (value : alloc.vec.Vec T) : Result Bool := + ok value.val.isEmpty + +-- The action call uses a stateless Unit closure for the digest key; the +-- scope constructor reuses this model with a stateless identity key. +-- This sorting model is sound only after proving purity and total-order laws +-- for that concrete callback; it is not an arbitrary FnMut Rust algorithm model. +private def insertKey {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item : T) : + (items : List T) → Result {output : List T // output.length = items.length + 1} + | [] => ok ⟨[item], rfl⟩ + | first :: rest => do + let (left, _) ← key.call_mut callback item + let (right, _) ← key.call_mut callback first + let comparison ← order.cmp left right + if comparison = .gt then + let inserted ← insertKey key order callback item rest + ok ⟨first :: inserted.val, by simp [inserted.property]⟩ + else ok ⟨item :: first :: rest, rfl⟩ + +private def sortKey {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) : + (items : List T) → Result {output : List T // output.length = items.length} + | [] => ok ⟨[], rfl⟩ + | first :: rest => do + let sorted ← sortKey key order callback rest + let inserted ← insertKey key order callback first sorted.val + ok ⟨inserted.val, by simp [inserted.property, sorted.property]⟩ + +def alloc.slice.Slice.sort_by_key {T K F : Type} + (key : core.ops.function.FnMut F T K) (order : core.cmp.Ord K) + (input : Slice T) (callback : F) : Result (Slice T) := do + let output ← sortKey key order callback input.val + ok ⟨output.val, by rw [output.property]; exact input.property⟩ + +-- A fallible pointer-sized signed conversion, exactly as Rust TryFrom specifies. +def Isize.Insts.CoreConvertTryFromUsizeTryFromIntError.try_from (value : Std.Usize) : + Result (core.result.Result Std.Isize core.num.error.TryFromIntError) := + ok (match IScalar.tryMkOpt .Isize value.val with + | some signed => .Ok signed + | none => .Err ()) + +def core.option.Option.and_then {T U F : Type} + (callback : core.ops.function.FnOnce F T (Option U)) (value : Option T) (function : F) : + Result (Option U) := + match value with + | none => ok none + | some value => callback.call_once function value + +-- Public equations expose the existing reviewed key-sort model without +-- duplicating or changing its algorithm. Downstream ordinary sorting uses +-- only the stateless identity key and earns its comparison laws separately. +namespace Auths.Codec.StdModel + +def insertKeyValues {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item : T) (items : List T) := + insertKey key order callback item items + +theorem insertKeyValues_nil {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item : T) : + insertKeyValues key order callback item [] = ok ⟨[item], rfl⟩ := rfl + +theorem insertKeyValues_cons {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (item first : T) (rest : List T) : + insertKeyValues key order callback item (first :: rest) = + (do let (left, _) ← key.call_mut callback item + let (right, _) ← key.call_mut callback first + let comparison ← order.cmp left right + if comparison = .gt then + let inserted ← insertKeyValues key order callback item rest + ok ⟨first :: inserted.val, by simp [inserted.property]⟩ + else ok ⟨item :: first :: rest, rfl⟩) := rfl + +def sortKeyValues {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (items : List T) := + sortKey key order callback items + +theorem sortKeyValues_nil {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) : + sortKeyValues key order callback [] = ok ⟨[], rfl⟩ := rfl + +theorem sortKeyValues_cons {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (callback : F) (first : T) (rest : List T) : + sortKeyValues key order callback (first :: rest) = + (do let sorted ← sortKeyValues key order callback rest + let inserted ← insertKeyValues key order callback first sorted.val + ok ⟨inserted.val, by simp [inserted.property, sorted.property]⟩) := rfl + +theorem sort_by_key_values {T K F : Type} (key : core.ops.function.FnMut F T K) + (order : core.cmp.Ord K) (input : Slice T) (callback : F) : + _root_.alloc.slice.Slice.sort_by_key key order input callback = + (do let output ← sortKeyValues key order callback input.val + ok ⟨output.val, by rw [output.property]; exact input.property⟩) := rfl + +end Auths.Codec.StdModel +"## + .to_owned() +} + #[cfg(test)] mod tests { use super::*; @@ -2749,6 +5302,61 @@ def character := 's' fs::remove_file(path).expect("remove owned evidence fixture"); } + #[test] + fn axiom_inventory_covers_split_names_and_compiled_bridge_refusal() { + for source in [ + "axiom imported : Type", + "axiom\n imported : Type", + " axiom\timported : Type", + ] { + assert_eq!( + source + .lines() + .filter(|line| is_lean_axiom_declaration(line)) + .count(), + 1 + ); + } + for line in [ + "-- axiom imported : Type", + "def axiomName := true", + "axiomatic_identifier", + ] { + assert!(!is_lean_axiom_declaration(line)); + } + let repository = Path::new(env!("CARGO_MANIFEST_DIR")) + .parent() + .expect("workspace root"); + let mut qualification = load_qualification(repository).expect("current inventory"); + let directory = tempfile::tempdir().expect("owned gate fixture"); + qualification.generated_files = vec!["FunsExternal.lean".to_owned()]; + qualification.template_axioms.clear(); + fs::write( + directory.path().join("FunsExternal.lean"), + "axiom\n unchecked : Type\n", + ) + .expect("split declaration fixture"); + let error = validate_generated_inventory(directory.path(), &qualification) + .expect_err("a split-name axiom must also be refused in compiled bridges"); + assert!(error.contains("forbidden `axiom`")); + + qualification.generated_files = vec!["FunsExternal_Template.lean".to_owned()]; + qualification.template_axioms.push(TemplateAxiomInventory { + artifact: "FunsExternal_Template.lean".to_owned(), + count: 1, + compiled: false, + }); + fs::write( + directory.path().join("FunsExternal_Template.lean"), + "axiom\n imported : Type\n", + ) + .expect("uncompiled template fixture"); + validate_generated_inventory(directory.path(), &qualification) + .expect("exact template count"); + qualification.template_axioms[0].count = 0; + assert!(validate_generated_inventory(directory.path(), &qualification).is_err()); + } + #[test] fn generated_artifact_inventory_rejects_omission_and_substitution() { let exact = GENERATED_ARTIFACTS @@ -2807,6 +5415,37 @@ def character := 's' ); } + #[test] + fn every_mapped_translation_report_uses_the_full_pinned_commit() { + let directory = tempfile::tempdir().expect("owned translation fixture"); + let commit = "3a8586facab25b31bdb1e1f5f45acd60d1cc5ff0"; + let reports = AENEAS_OUTPUT_MAPPINGS + .iter() + .filter(|(source, _)| source.ends_with("translation.json")) + .map(|(source, _)| directory.path().join(source)) + .collect::>(); + assert_eq!(reports.len(), EXPECTED_TRANSLATIONS.len()); + for (index, path) in reports.iter().enumerate() { + fs::create_dir_all(path.parent().expect("report parent")).expect("fixture directory"); + let abbreviation = &commit[..if index % 2 == 0 { 7 } else { 8 }]; + write_pretty_json( + path, + &json!({"aeneas_version": abbreviation, "sentinel": 17}), + ) + .expect("fixture report"); + } + canonicalize_aeneas_versions(directory.path(), commit).expect("all report identities"); + for path in &reports { + let report: Value = serde_json::from_slice(&fs::read(path).expect("report bytes")) + .expect("report JSON"); + assert_eq!(report["aeneas_version"], commit); + assert_eq!(report["sentinel"], 17); + } + write_pretty_json(&reports[0], &json!({"aeneas_version": "0000000"})) + .expect("wrong identity"); + assert!(canonicalize_aeneas_versions(directory.path(), commit).is_err()); + } + #[test] fn reviewed_translation_boundary_contract_is_exact() { let repository = Path::new(env!("CARGO_MANIFEST_DIR")) @@ -2819,3 +5458,445 @@ def character := 's' ); } } + +#[cfg(test)] +mod unit_observer_dictionary_tests { + use super::normalize_unit_observer_dictionary; + + #[test] + fn unit_adapter_is_single_site_and_preserves_the_callback_body() { + let callback = + "def native_callback (state : Unit) (_event : Unit) : Result Unit := ok state\n"; + let field = " call_mut :=\n evaluate.closure.Insts.CoreOpsFunctionFnMutTupleEvaluationEventTuple.call_mut\n coreopsfunctionFnMutT0TupleProofRefBranchOutcomeInst\n}"; + let source = format!("import Aeneas\n{callback}{field}"); + let adapted = normalize_unit_observer_dictionary(&source).expect("reviewed dictionary"); + assert!(adapted.contains(callback)); + assert_eq!( + adapted + .matches("Auths.Support.UnitCallback.restore") + .count(), + 1 + ); + assert!(normalize_unit_observer_dictionary(callback).is_err()); + assert!(normalize_unit_observer_dictionary(&format!("{source}\n{field}")).is_err()); + assert!(normalize_unit_observer_dictionary(&adapted).is_err()); + } +} + +#[cfg(test)] +mod signature_primitive_context_tests { + use super::signature_primitive_context; + + #[test] + fn explicit_primitive_parameter_preserves_every_generated_body() { + let marker = "noncomputable section\n"; + let parameter = "\nvariable [primitives : Auths.Crypto.Ed25519Primitives]\n"; + let body = "namespace auths_signature_core\ndef wrapper (bytes : Slice Std.U8) := do\n let key ← foreign_decode bytes\n concrete_guard_and_verify key bytes\nend auths_signature_core\n"; + let source = format!("import Aeneas\n{marker}{body}"); + let generalized = signature_primitive_context(&source).expect("one explicit interface"); + assert_eq!(generalized.replace(parameter, ""), source); + assert!(signature_primitive_context(&generalized).is_err()); + assert!(signature_primitive_context(body).is_err()); + assert!(signature_primitive_context(&format!("{source}{marker}")).is_err()); + assert!(signature_primitive_context(&format!("{source}{body}")).is_err()); + } +} + +#[cfg(test)] +mod sha256_foreign_name_tests { + use super::{sha256_foreign_names, sha256_primitive_context}; + use serde_json::{Value, json}; + + fn declaration(id: u64, root: &str, local: bool) -> Value { + json!({ + "def_id": id, + "item_meta": {"name": [ + {"Ident": [root, 0]}, {"Ident": [format!("item_{id}"), 0]}, + {"Instantiated": {"closed": true}}, + ], "is_local": local, "span": {"file": "source.rs", "line": id}}, + "body": {"calls": [1, 2], "guard": "retained"}, + "signature": {"inputs": ["bytes"], "output": "fixed32"}, + "generics": [], "layout": {"size": 32}, + }) + } + + fn fixture() -> Value { + let mut types = vec![Value::Null; 15]; + for id in [1_u64, 2, 3, 4, 5, 6, 7, 11, 12] { + let root = if id == 1 { + "generic_array" + } else if id <= 7 { + "typenum" + } else { + "digest" + }; + types[usize::try_from(id).expect("small fixture id")] = declaration(id, root, false); + } + let mut local = declaration(0, "auths_codec", true); + local["item_meta"]["name"] = + json!([{"Ident": ["auths_codec", 0]}, {"Ident": ["raw_sha256", 0]}]); + json!({"translated": { + "type_decls": types, + "fun_decls": [local, declaration(1, "digest", false), declaration(2, "core", false)], + "global_decls": [], "trait_decls": [], "trait_impls": [], + "item_names": [], "assoc_item_names": [], "short_names": [], + "target_information": {"pointer_bytes": 8}, + }}) + } + + #[test] + fn foreign_aliases_preserve_bodies_types_layouts_and_auths_identity() { + let original = fixture(); + let (renamed, ledger) = + sha256_foreign_names(original.clone()).expect("reviewed name inventory"); + assert_eq!(ledger["declarations"].as_array().expect("ledger").len(), 11); + assert_eq!( + original["translated"]["fun_decls"][0], + renamed["translated"]["fun_decls"][0] + ); + for (old, new) in original["translated"]["fun_decls"] + .as_array() + .expect("functions") + .iter() + .zip( + renamed["translated"]["fun_decls"] + .as_array() + .expect("functions"), + ) + { + for field in ["body", "signature", "generics", "layout", "def_id"] { + assert_eq!(old[field], new[field]); + } + } + assert!(sha256_foreign_names(renamed).is_err()); + } + + #[test] + fn names_in_executable_data_or_unreviewed_declarations_are_refused() { + let mut body_name = fixture(); + body_name["translated"]["fun_decls"][0]["body"] = + body_name["translated"]["type_decls"][1]["item_meta"]["name"].clone(); + assert!(sha256_foreign_names(body_name).is_err()); + let mut auths = fixture(); + auths["translated"]["type_decls"][1]["item_meta"]["name"][0] = + json!({"Ident": ["auths_model", 0]}); + assert!(sha256_foreign_names(auths).is_err()); + let mut missing = fixture(); + missing["translated"]["type_decls"][1] = Value::Null; + assert!(sha256_foreign_names(missing).is_err()); + let mut extra = fixture(); + extra["translated"]["global_decls"] = json!([declaration(99, "sha2", false)]); + assert!(sha256_foreign_names(extra).is_err()); + } + + #[test] + fn explicit_hash_parameter_changes_no_generated_body() { + let source = "noncomputable section\nnamespace AuthsNativeSha256\ndef wrapper := selected_digest\nend AuthsNativeSha256\n"; + let parameter = "\nvariable [primitive : Auths.Crypto.Sha256Primitives]\n"; + let generalized = sha256_primitive_context(source).expect("one interface"); + assert_eq!(generalized.replace(parameter, ""), source); + assert!(sha256_primitive_context(&generalized).is_err()); + assert!(sha256_primitive_context(&format!("{source}{source}")).is_err()); + assert!(sha256_primitive_context("def wrapper := selected_digest").is_err()); + } +} + +#[cfg(test)] +mod p256_export_name_tests { + use super::{p256_context, p256_export_names}; + use serde_json::{Value, json}; + + fn row(id: u64, root: &str) -> Value { + let local = root == "auths_signature_core"; + let base = if local { + if id == 2 { + "verify_p256_sha256_with".to_owned() + } else { + "decode_p256_key_with".to_owned() + } + } else { + format!("foreign_{id}") + }; + json!({"def_id": id, "item_meta": { + "name": [{"Ident": [root, 0]}, {"Ident": [base, 0]}, {"Instantiated": {"closed": true}}], + "is_local": local, "span": {"source": "exact.rs", "line": id}}, + "body": {"guard": "preserved", "call_ids": [3, 7]}, + "signature": {"input": "bytes", "output": "retained"}, + "generics": [], "layout": {"size": 64}}) + } + + fn fixture() -> Value { + let mut types = vec![Value::Null; 18]; + for id in [0_u64, 3, 4, 6, 7, 9, 11, 12, 13, 14, 16, 17] { + types[usize::try_from(id).expect("fixture id")] = row( + id, + if [4, 11].contains(&id) { + "ecdsa" + } else { + "core" + }, + ); + } + let mut functions = vec![Value::Null; 34]; + for id in [ + 2_u64, 4, 5, 6, 7, 13, 14, 15, 17, 18, 20, 22, 23, 24, 26, 27, 29, 30, 31, 32, 33, + ] { + let root = if [2, 4].contains(&id) { + "auths_signature_core" + } else if [14, 18, 23, 26, 29].contains(&id) { + "ecdsa" + } else { + "core" + }; + let mut function = row(id, root); + if root != "auths_signature_core" { + function["item_meta"]["name"][1] = json!({"Ident": [format!("function_{id}"), 0]}); + } + functions[usize::try_from(id).expect("fixture id")] = function; + } + json!({"translated": {"type_decls": types, "fun_decls": functions, + "global_decls": [], "trait_decls": [], "trait_impls": [], + "item_names": [], "assoc_item_names": [], "short_names": [], + "target_information": {"pointer_bytes": 8}}}) + } + + #[test] + fn exact_export_adaptation_preserves_all_executable_fields() { + let original = fixture(); + let (normalized, ledger) = p256_export_names(original.clone()).expect("closed inventory"); + assert_eq!(ledger["declarations"].as_array().expect("ledger").len(), 33); + for group in ["type_decls", "fun_decls"] { + for (old, new) in original["translated"][group] + .as_array() + .expect("rows") + .iter() + .zip(normalized["translated"][group].as_array().expect("rows")) + { + if old.is_null() { + assert!(new.is_null()); + continue; + } + let mut expected = old.clone(); + expected["item_meta"]["name"] = new["item_meta"]["name"].clone(); + assert_eq!(expected, *new); + } + } + for id in [2, 4] { + assert_eq!( + normalized["translated"]["fun_decls"][id]["item_meta"]["name"] + .as_array() + .expect("base name") + .len(), + 2 + ); + } + assert!(p256_export_names(normalized).is_err()); + } + + #[test] + fn unreviewed_auths_paths_missing_identities_and_body_names_fail_closed() { + let mut auths = fixture(); + auths["translated"]["fun_decls"][2]["item_meta"]["name"][1] = + json!({"Ident": ["another_algorithm", 0]}); + assert!(p256_export_names(auths).is_err()); + let mut local_foreign = fixture(); + local_foreign["translated"]["type_decls"][4]["item_meta"]["is_local"] = json!(true); + assert!(p256_export_names(local_foreign).is_err()); + let mut missing = fixture(); + missing["translated"]["type_decls"][4] = Value::Null; + assert!(p256_export_names(missing).is_err()); + let mut body = fixture(); + body["translated"]["fun_decls"][2]["body"] = + body["translated"]["type_decls"][4]["item_meta"]["name"].clone(); + assert!(p256_export_names(body).is_err()); + let mut extra = fixture(); + extra["translated"]["global_decls"] = json!([row(99, "core")]); + assert!(p256_export_names(extra).is_err()); + } + + #[test] + fn primitive_context_preserves_every_generated_body_and_rejects_repetition() { + let functions = "noncomputable section\nnamespace AuthsNativeP256\ndef source := actual_calls_and_guards\nend AuthsNativeP256\n"; + let parameter = "\nvariable [primitive : Auths.Crypto.P256Primitives]\n"; + let normalized = p256_context(functions, false).expect("function context"); + assert_eq!(normalized.replace(parameter, ""), functions); + assert!(p256_context(&normalized, false).is_err()); + assert!(p256_context(&format!("{functions}{functions}"), false).is_err()); + assert!(p256_context("def source := alternate", false).is_err()); + let types = "import Aeneas\nnamespace AuthsNativeP256\n@[discriminant isize]\ninductive Closed where | one\nend AuthsNativeP256\n"; + let normalized = p256_context(types, true).expect("type context"); + assert_eq!( + normalized + .replace(parameter, "") + .replace("import Auths.Support.Discriminant\n", "") + .replace("qualified_discriminant", "discriminant"), + types + ); + assert!(p256_context(&normalized, true).is_err()); + } +} + +#[cfg(test)] +mod qualified_delegation_tests { + use super::{ + TranslationFunction, delegation_endpoints_match, delegation_statement_matches, + expected_qualified_delegations, suite_adapter_context, + }; + use serde_json::json; + + #[test] + fn printed_owner_name_cannot_replace_the_actual_kernel_reference() { + let link = expected_qualified_delegations().remove(0); + let mut declaration = json!({"name": link.delegation_theorem, "kind": "theorem", + "statement": format!("{} = {}", link.bridge_lean_declaration, link.owner_lean_declaration), + "statement_constants": [link.bridge_lean_declaration], "axioms": ["propext"]}); + assert!(!delegation_statement_matches(&declaration, &link)); + declaration["statement_constants"] = + json!([link.bridge_lean_declaration, link.owner_lean_declaration]); + assert!(delegation_statement_matches(&declaration, &link)); + declaration["axioms"] = json!(["propext", "sorryAx"]); + assert!(!delegation_statement_matches(&declaration, &link)); + declaration["axioms"] = json!([]); + declaration["kind"] = json!("axiom"); + assert!(!delegation_statement_matches(&declaration, &link)); + } + + #[test] + fn an_opaque_foreign_or_wrong_owner_cannot_close_the_import() { + let link = expected_qualified_delegations().remove(0); + let imported = TranslationFunction { + rust_name: link.rust_symbol.clone(), + lean_name: link.bridge_lean_declaration.clone(), + is_local: false, + is_opaque: true, + }; + let mut owned = TranslationFunction { + rust_name: link.rust_symbol.clone(), + lean_name: link.owner_lean_declaration.clone(), + is_local: true, + is_opaque: false, + }; + assert!(delegation_endpoints_match(&imported, &owned, &link)); + owned.is_opaque = true; + assert!(!delegation_endpoints_match(&imported, &owned, &link)); + owned.is_opaque = false; + owned.is_local = false; + assert!(!delegation_endpoints_match(&imported, &owned, &link)); + owned.is_local = true; + owned.rust_name = "auths_signature_core::another_verifier".to_owned(); + assert!(!delegation_endpoints_match(&imported, &owned, &link)); + owned.rust_name.clone_from(&link.rust_symbol); + owned.lean_name = "Unqualified.always_accept".to_owned(); + assert!(!delegation_endpoints_match(&imported, &owned, &link)); + } + + #[test] + fn context_does_not_change_any_generated_adapter_body() { + let source = "noncomputable section\nnamespace AuthsSuiteAdapters\ndef adapter := actual_fields_and_callback\nend AuthsSuiteAdapters\n"; + let parameter = "\nvariable [edPrimitive : Auths.Crypto.Ed25519Primitives]\nvariable [p256Primitive : Auths.Crypto.P256Primitives]\n"; + let normalized = suite_adapter_context(source, false).expect("one context"); + assert_eq!(normalized.replace(parameter, ""), source); + assert!(suite_adapter_context(&normalized, false).is_err()); + assert!(suite_adapter_context(&format!("{source}{source}"), false).is_err()); + assert!(suite_adapter_context("def unreviewed := alternate", false).is_err()); + } +} + +fn render_scope_codec_types_external() -> String { + r##"import qualification.aeneas.generated.codec.TypesExternal +"## + .to_owned() +} + +fn render_scope_codec_functions_external() -> String { + r##"import qualification.aeneas.generated.scope_codec.Types +import qualification.aeneas.generated.codec.FunsExternal +open Aeneas Aeneas.Std Result +namespace AuthsScopeCodec +abbrev Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from := _root_.Usize.Insts.CoreConvertTryFromU64TryFromIntError.try_from +abbrev U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from := _root_.U8.Insts.CoreConvertTryFromU64TryFromIntError.try_from +abbrev core.option.Option.Some := @_root_.core.option.Option.Some +abbrev core.option.Option.ok_or := @_root_.core.option.Option.ok_or +abbrev core.option.Option.Insts.CoreCmpPartialEqOption.eq := @_root_.core.option.Option.Insts.CoreCmpPartialEqOption.eq +abbrev core.result.Result.map := @_root_.core.result.Result.map +abbrev core.result.Result.map_err := @_root_.core.result.Result.map_err +abbrev core.str.converts.from_utf8 := _root_.core.str.converts.from_utf8 +abbrev core.str.Str.len := _root_.core.str.Str.len +abbrev core.str.Str.is_empty := _root_.core.str.Str.is_empty +abbrev core.str.Str.as_bytes := _root_.core.str.Str.as_bytes +abbrev alloc.string.String.Insts.CoreCmpPartialEqString.eq := _root_.alloc.string.String.Insts.CoreCmpPartialEqString.eq +abbrev alloc.string.String.Insts.CoreCmpOrd.cmp := _root_.alloc.string.String.Insts.CoreCmpOrd.cmp +abbrev alloc.string.String.Insts.CoreConvertFromShared0Str.from := _root_.alloc.string.String.Insts.CoreConvertFromShared0Str.from +abbrev alloc.vec.Vec.is_empty := @_root_.alloc.vec.Vec.is_empty + +def identityKey {T : Type} : core.ops.function.FnMut Unit T T := { + FnOnceInst := { call_once := fun _ value => ok value } + call_mut := fun _ value => ok (value, ()) +} + +/-- Ordinary sorting delegates to the previously reviewed stable key-sort + model using a pure, stateless identity key. String comparison laws and + totality are earned separately for the actual native Ord dictionary. -/ +def alloc.slice.Slice.sort {T : Type} (order : core.cmp.Ord T) (values : Slice T) : Result (Slice T) := + _root_.alloc.slice.Slice.sort_by_key identityKey order values () + +def core.ops.range.RangeInclusive.contains {Idx U : Type} + (_indexOrder : core.cmp.PartialOrd Idx Idx) (lowerOrder : core.cmp.PartialOrd Idx U) + (upperOrder : core.cmp.PartialOrd U Idx) (range : core.ops.range.RangeInclusive Idx) (item : U) : Result Bool := do + let lower ← lowerOrder.le range.start item + if lower then upperOrder.le item range.end else ok false +abbrev core.result.Result.unwrap_or := @_root_.core.result.Result.unwrap_or +end AuthsScopeCodec +"##.to_owned() +} + +#[cfg(test)] +mod profile_selection_lock_tests { + use super::{normalize_profile_source_paths, validate_profile_selection_lock}; + use serde_json::json; + use std::path::Path; + + #[test] + fn source_path_normalization_only_changes_file_names() { + let mut original = json!({"translated": { + "files": [ + {"name": {"Local": "/reviewed/formal/selector.rs"}, "contents": "/reviewed/literal"}, + {"name": {"Local": "/reviewed/product/model.rs"}}, + {"name": {"Local": "/reviewed/product/lib.rs"}}, + {"name": {"Local": "/reviewed/product/kernel.rs"}}, + {"name": {"Local": "/rustc/core.rs"}} + ], "fun_decls": [{"body": "/reviewed/literal"}], "options": {"unchanged": true} + }}); + let mut expected = original.clone(); + for (index, relative) in [ + "formal/selector.rs", + "product/model.rs", + "product/lib.rs", + "product/kernel.rs", + ] + .iter() + .enumerate() + { + expected["translated"]["files"][index]["name"]["Local"] = json!(relative); + } + normalize_profile_source_paths(&mut original, Path::new("/reviewed")).unwrap(); + assert_eq!(original, expected); + assert!(normalize_profile_source_paths(&mut original, Path::new("/reviewed")).is_err()); + } + const PINNED: &str = "[[package]]\nname = \"dep\"\nversion = \"1.0.0\"\nsource = \"registry+test\"\nchecksum = \"aaa\"\n"; + const SELECTOR: &str = "[[package]]\nname = \"auths-profile-construction\"\nversion = \"0.0.0\"\ndependencies = [\"auths-connections\"]\n"; + #[test] + fn selection_accepts_only_pinned_dependency_identities_and_checksums() { + let valid = format!("{PINNED}{SELECTOR}"); + assert!(validate_profile_selection_lock(PINNED, &valid).is_ok()); + for mutation in [ + valid.replace("1.0.0", "2.0.0"), + valid.replace("aaa", "bbb"), + valid.replace("auths-connections", "unreviewed"), + ] { + assert!(validate_profile_selection_lock(PINNED, &mutation).is_err()); + } + assert!(validate_profile_selection_lock(PINNED, PINNED).is_err()); + assert!(validate_profile_selection_lock(PINNED, &format!("{valid}{SELECTOR}")).is_err()); + } +} diff --git a/xtask/src/kani_harness.rs b/xtask/src/kani_harness.rs index dc6ed7f08..97eec73ce 100644 --- a/xtask/src/kani_harness.rs +++ b/xtask/src/kani_harness.rs @@ -31,12 +31,14 @@ struct Lexed { tokens: Vec, lines: Vec, closing: Vec>, + strings: BTreeMap, } fn lex(source: &str) -> Result { let characters: Vec = source.chars().collect(); let mut tokens = Vec::new(); let mut lines = Vec::new(); + let mut strings = BTreeMap::new(); let mut line = 1; let mut index = 0; while let Some(&character) = characters.get(index) { @@ -60,6 +62,7 @@ fn lex(source: &str) -> Result { index = skip_block_comment(&characters, index, &mut line)?; continue; } + let mut string_value = None; let token = if character.is_alphabetic() || character == '_' { let start = index; while characters @@ -93,7 +96,9 @@ fn lex(source: &str) -> Result { } Token::Literal } else if character == '"' { + let start = index + 1; index = skip_quoted(&characters, index, &mut line)?; + string_value = Some(characters[start..index - 1].iter().collect()); Token::Literal } else if character == '\'' { if characters.get(index + 1) == Some(&'\\') { @@ -116,6 +121,9 @@ fn lex(source: &str) -> Result { index += 1; Token::Punct(character) }; + if let Some(value) = string_value { + strings.insert(tokens.len(), value); + } tokens.push(token); lines.push(start_line); } @@ -124,6 +132,7 @@ fn lex(source: &str) -> Result { tokens, lines, closing, + strings, }) } @@ -273,7 +282,12 @@ struct FileItems { helpers: BTreeMap>>, /// File modules declared under a test or Kani configuration, as inline /// module paths ending in the declared name. - excluded_modules: Vec>, + excluded_modules: Vec, +} + +struct ExcludedModule { + module: Vec, + relative_path: Option, } #[derive(Clone)] @@ -546,15 +560,47 @@ impl Scanner<'_> { module.push(name.clone()); if self.punct(keyword + 2, ';') { if excluded { - if attributes.iter().any(|range| { - matches!(self.attribute(range).first(), Some(Token::Ident(first)) if first == "path") - }) { - return Err(format!( - "test or Kani module {name} at line {} uses #[path], which this lint cannot resolve", - self.line(keyword) - )); + let mut relative_path = None; + for range in attributes { + let attribute = self.attribute(range); + if matches!(attribute.first(), Some(Token::Ident(first)) if first == "cfg_attr") + && attribute + .iter() + .any(|token| matches!(token, Token::Ident(name) if name == "path")) + { + return Err( + "conditional test/Kani module paths are not supported".to_owned() + ); + } + if !matches!(attribute.first(), Some(Token::Ident(first)) if first == "path") { + continue; + } + let [Token::Ident(_), Token::Punct('='), Token::Literal] = attribute else { + return Err( + "test/Kani module path must be one plain relative string literal" + .to_owned(), + ); + }; + let value = self.lexed.strings.get(&(range.start + 2)).ok_or_else(|| { + "test/Kani module path must use a plain quoted string".to_owned() + })?; + let path = Path::new(value); + if relative_path.is_some() + || value.is_empty() + || value.contains(['\\', '\0']) + || path.extension().is_none_or(|extension| extension != "rs") + || path + .components() + .any(|part| !matches!(part, std::path::Component::Normal(_))) + { + return Err("test/Kani module path must name one unescaped relative Rust source without parent traversal".to_owned()); + } + relative_path = Some(path.to_path_buf()); } - self.items.excluded_modules.push(module); + self.items.excluded_modules.push(ExcludedModule { + module, + relative_path, + }); } else { self.items.namespaces.insert(name); } @@ -743,16 +789,45 @@ fn scan_sources(source_root: &Path, sources: Vec<(PathBuf, String)>) -> Result Result { "product/fixtures/v1/lifecycle/registry.toml".to_owned(), "product/runtime/auths-lifecycle/src".to_owned(), "product/stores/auths-stores/src/lifecycle.rs".to_owned(), - "product/stores/auths-stores/migrations/postgres_lifecycle_v6.sql".to_owned(), + "product/stores/auths-stores/migrations/postgres_lifecycle_v7.sql".to_owned(), "product/stores/auths-stores/tests/postgres_lifecycle.rs".to_owned(), "product/stores/auths-stores/tests/postgres_tls".to_owned(), ], @@ -942,6 +942,7 @@ fn frozen_byte_inventories() -> Result, String> { "core/fixtures/v1/manifest.json".to_owned(), "core/formal-vectors/v1/manifest.json".to_owned(), "core/fixtures/identity/v1/vectors.json".to_owned(), + "core/fixtures/crypto".to_owned(), "bindings/wasm/auths-proof-wasm/identity-abi-v1.json".to_owned(), "formal/assurance-manifest-v1.toml".to_owned(), "formal/qualification/aeneas/generated".to_owned(),